FSCA and SARB Issue Joint Communication on Cloud Computing

Posted 12 August 2025 Written by Acts Online
Category Financial Services Regulation

Brought to you by SA Accounting Academy: In terms of the Financial Sector Regulation Act, No. 9 of 2017, the Financial Sector Conduct Authority (FSCA) and the South African Reserve Bank (SARB) have issued Joint Communication 2 of 2025 regarding cloud computing and the offshoring of data.

The publication outlines the governance role of financial institutions in managing risks associated with cloud services and signals the authorities’ intention to introduce formal regulatory requirements. The communication elaborates on recommended best practices for cloud adoption, risk mitigation, and the way forward for regulatory oversight.

The provisions of this Joint Communication are applicable to financial institutions as defined in the Financial Sector Regulation Act, No. 9 of 2017, with the following exceptions:

  • Lloyd’s; and
  • Branches of foreign reinsurers.

The guidance emphasizes that while cloud computing offers operational efficiencies, it introduces specific risks related to data sovereignty, security, and systemic concentration that must be managed through robust internal controls and board-level oversight.

Click here to download the Joint Communication 2 of 2025: Cloud computing and offshoring of data.

What this means for you, your business, or your clients

  • For yourself: Review the best practice guidelines to ensure your professional advice regarding IT governance and data offshoring remains aligned with the FSCA and SARB’s current supervisory expectations.
  • For your business: Conduct a gap analysis of your firm’s cloud service level agreements (SLAs) and data residency policies against the standards set out in Joint Communication 2 of 2025 to prepare for future mandatory regulations.
  • For your clients: Advise financial institution clients to update their risk management frameworks and governance structures to specifically address the offshoring of data and the concentration risks associated with third-party cloud providers.

Originally published at https://accountingacademy.co.za/news/read/fsca-cloud-computing-and-offshoring-of-data

The views expressed herein are those of the author and do not necessarily reflect those of Acts Online. Acts Online accepts no responsibility for the accuracy, completeness or fairness of the article, nor does the information contained herein constitute advice, legal or otherwise.