Protection of Personal Information Act (POPIA)
Effective July 2021; administered by the Information Regulator; largely GDPR-aligned
Information Regulator (South Africa)
Sub-Saharan Africa · GDP rank #32
ZA · ZAR @ 0.0607/USD
South Africa is Sub-Saharan Africa's most bank-anchored payments market — five banks (Standard, Absa, FirstRand/FNB, Nedbank, Capitec) control >90% of retail accounts and a mature card-acceptance stack coexists with an unusually durable cash economy. SARB's PayShap instant rail, live since March 2023, is the first genuine challenge to card dominance since the 1990s; SARB's 50% acquisition of BankservAfrica (rebranded PayInc) and the Payments Ecosystem Modernisation Programme are restructuring the rulebook in public. Capitec overtook Standard Bank by retail customer count in October 2025.
Tab 06
Headline fraud totals and typology splits, the rollout of EMV chip, tokenisation, 3DS and biometrics, and the controlling data-protection and payments statutes.
Card-not-present fraud is dominant; SABRIC coordinates industry fraud data. APP fraud is rising with PayShap adoption; SARB considering a mandatory reimbursement regime similar to the UK PSR.
Reported payment fraud · 2024
Card-not-present share
3DS adoption on CNP
Trend lines
Where a full typology breakdown is not published, the authorities typically disclose year-on-year growth in specific scam categories. Authorised push-payment (APP) scams and account-takeover fraud are the canonical “wallet era” concerns in most markets.
Controlling regulation
Effective July 2021; administered by the Information Regulator; largely GDPR-aligned
Information Regulator (South Africa)
Enhanced in response to FATF grey-listing 2023; beneficial-ownership registry tightened; continued grey-list remediation 2025-26
Financial Intelligence Centre (FIC)
Primary cybercrime statute; operative sections commenced December 2021
Parliament of South Africa