Lock the
Doors
October is Cybersecurity Awareness Month in South Africa, and spring is giving way to the busy run toward year-end. This edition is about protecting what you have built and proving that you govern it well.
Welcome to the October edition of The Business of Advice. October is Cybersecurity Awareness Month in South Africa, and spring is giving way to the busy run toward year-end. This edition is about protecting what you have built and proving that you govern it well. We open where the calendar points us, at cybersecurity, with thirty days to test whether your defences would really hold.
From there we turn to the heart of the new conduct regime: why, under the Conduct of Financial Institutions Bill, accountability sits with the person at the top and cannot be delegated away. Along the way we introduce AI tokens on the platform and, at the Innovators Pulse Check, we celebrate three subscribers who have each won a one-on-one coaching session.
FSP Business 4.0 brings together decades of advice, compliance, practice management and technology experience to help South African advice businesses build, govern and grow with confidence. Whether you are hardening your cyber defences or sharpening how you govern, we are here to walk the journey with you.
Behind FSP Business 4.0
Thirty Days to Lock the Doors
October is Cybersecurity Awareness Month in South Africa. It is the right moment to find out how exposed your advice business really is.
Your client files are the prize
Digital banking crime cost South Africans R2.4 billion in 2025, up from about R1.9 billion the year before[1]. Banking apps drove more than 70 percent of those losses[1]. Most incidents exploit human error rather than weak technology and deepfake audio and video are expected to become common fraud tools[5].
Now look at what sits on your server. Identity documents. Tax records. Bank statements. Investment mandates. Beneficiary nominations. Few small businesses hold so much about so many families. That makes you a target whether you have three staff or thirty.
What South African law already expects
Section 11 of the General Code of Conduct requires every provider to use appropriate technological systems to limit the risk of client loss through theft and fraud[6]. That covers every category and every size.
Joint Standard 2 of 2024 came into force on 1 June 2025[3][4]. It binds discretionary and administrative providers directly and is the benchmark for everyone else[3]. Paragraph 8.3.1 requires multi-factor authentication for internet access to sensitive information. Paragraph 7.2.7 requires annual awareness training for all users. Paragraphs 7.4.1 and 7.5.1 require tested backups and a tested incident response plan. Paragraph 3.4 lets you scale this to your size and risk[3]. Proportionate never means absent.
Section 19 of the Protection of Personal Information Act requires reasonable security safeguards. Section 22 requires you to notify the Information Regulator and affected clients as soon as reasonably possible after a compromise[7]. Since April 2025 that report goes through the Regulator’s eServices Portal[8]. The Conduct of Financial Institutions Bill will add outcomes-based duties to prevent foreseeable customer harm[9].
In 2021 ransomware encrypted every information system at the Department of Justice and Constitutional Development after antivirus licences lapsed. In July 2023 the Information Regulator issued its first administrative fine, R5 million, when the department ignored an enforcement notice[2].
In July 2025 the Australian Securities and Investments Commission sued the licensee Fortnum Private Wealth. It alleges an attack on one representative put more than 9,000 clients’ data on the dark web and that no minimum cyber training was required[10].
What happens when controls lapse
Neither case needed a clever hacker. Lapsed licences. Missing training. Nobody checking. If you appoint representatives, the Fortnum matter should sound uncomfortably familiar.
Take the assessment
The FSP Business 4.0 Cybersecurity Readiness Assessment asks fifteen questions built on the Joint Standard, the General Code of Conduct and the Protection of Personal Information Act. It is benchmarked against the United States National Institute of Standards and Technology framework[11] and the Australian Signals Directorate Essential Eight[12]. Each answer is scored from 1 to 10 and weighted to the risk behind it, and the detailed report sets out action steps matched to your score, so you know what to fix first.
Fifteen questions, scored and weighted to risk, with a detailed report that tells you what to fix first.
- Switch on multi-factor authentication for email, cloud storage and every product provider platform[3].
- Agree a call-back rule. No banking detail change or payment instruction goes ahead without a call to the number already on file.
- Restore one client file from backup this week. If you cannot do it, you do not have a backup[3].
- Run a thirty-minute team session on phishing emails and deepfake voice calls, and keep the attendance record[3].
- Confirm your Information Officer is registered and knows how to report a compromise through the eServices Portal[8].
You Cannot Delegate Your Way Out of COFI
If you own or run a financial services provider, the Conduct of Financial Institutions Bill is about you. It is not mainly about your compliance officer or your key individual. It is about the person at the top.
The Bill was introduced in Parliament on 17 April 2026[13]. It is not law yet and few expect it to pass before Christmas[14]. Do not read that delay as breathing space. The duties it builds on already apply today under the Financial Advisory and Intermediary Services Act, the fit and proper rules and the General Code of Conduct.
What the Bill says about you
The draft makes the governing body accountable for compliance with the Act, at section 18(1) of the 2020 draft[15]. It makes that body ultimately responsible for the firm’s culture and its governance arrangements. It then requires the firm to check that those arrangements actually work, at section 19(1)[15]. In most advice businesses the governing body is the owner. Often it is only the owner.
You can hand the work to others. You cannot hand them the accountability. Your compliance officer reports to you and your information technology provider works for you. When something goes wrong, the question will be what you decided and what you did when you found out.
The cost of looking away
Enforcement is already busy. In the year to March 2026 the regulator imposed penalties of R2.89 billion on 76 people and firms. It debarred 68 individuals, and firms debarred a further 1,792 of their own people[16]. In July the regulator penalised an investment firm and its chief executive R2.5 million because an employee had stolen from clients. The firm had found and reported the fraud itself and is disputing the penalty[17]. There is no hiding behind the business or behind your staff. Anti-money laundering fines alone can reach R10 million for an individual[18].
- Name your governing body in writing and sign a charter that says what it decides.
- Sign your own fit and proper declaration and ask someone else to review it.
- Declare your conflicts, including your shareholding and your provider relationships.
- Approve every policy on your register by resolution after you have read it.
- Decide what you will see every quarter. Complaints, advice quality, conduct risk and money belong on one page.
- Put dates in the diary for monthly, quarterly and annual reviews and minute every one.
Now is the time
A transition period of about three years is expected once the Act is passed[19]. Owners who start now will reach relicensing with a record. Owners who wait will arrive with good intentions and nothing to show. A minute is the only proof that you governed. A policy you never read counts against you.
Three Concerns Decision-Makers Raised
At our mid-programme Pulse workshop the questions that came up most often were not about the law itself but about keeping up with the work of preparing for it. Three concerns dominated the room, and each has a practical answer.
Too much information
Be guided by the results of your COFI Readiness Assessment. Where you have already scored well in an area, you do not need to work through the action items for that area; you can skip it and come back when you have time. As Anton says, do the big rocks first, the big rocks being the essential, fundamental building blocks where you did not score well. Not all areas are equally important. Make sure that you understand the difference between essential, good to have and nice to have policies and procedures in your FSP. There is unfortunately no shortcut, but you can filter.
How much of this actually applies to me?
This is where proportionality matters, which we covered in full in last month’s September edition. The practical next step is to complete the Proportionality Assessment: it reads your practice by size, client base, product complexity and distribution model and shows how much of the framework genuinely applies to you. A smaller, simpler practice is not expected to carry the architecture of a large group. The assessment turns the vague worry of “is all of this really for me?” into a clear, evidenced answer you can act on. Anton will provide specific guidelines in the months to come.
Getting the governing body in the room
The practice manager can drive the work, but the accountability and the sign-off cannot be delegated. Complete the readiness assessment collaboratively, with the governing body present, rather than as a solo practice-manager exercise. That is where the debate happens, shared understanding is built and the decisions are actually made.
- Let your COFI Readiness Assessment results guide you, and tackle the big rocks first.
- Complete the Proportionality Assessment to see how much of the framework applies to you.
- Bring the governing body into the room and complete the readiness assessment together.
Introducing AI Tokens
FSP Business 4.0 is introducing AI tokens. Every subscriber receives 50,000 free tokens to use on AI-generated reports and analysis, and once those are used you can buy a token pack and carry on. Here is what a token is, and why we are using them.
What is a token?
AI models do not read whole sentences the way people do. Before the AI can work with your information, it breaks the text into small pieces called tokens. A token can be a whole word, part of a word, a number or a punctuation mark[20]. Take the sentence “The client needs retirement advice.” The AI might split it into seven tokens: The, client, needs, retire, ment, advice and the full stop.
Common words are usually one token, while longer or unusual words are broken into several. As a rough guide, one token is about four characters of English text, so one hundred tokens is roughly seventy-five words[20]. The AI also produces its answer one token at a time, so the report you receive is made of tokens too.
Why tokens matter
Tokens are how the AI industry measures work. Every question, set of assessment answers or document the AI reads is counted as input tokens, and every report it writes is counted as output tokens. AI providers charge by the number of tokens processed, so a long, detailed analysis costs more to produce than a short summary[20][22]. In other words, every AI report generated in FSP Business 4.0 has a real, measurable cost behind it.
Why we are using tokens
We want to give every practice access to AI-powered reports and analysis without building that cost into everyone’s subscription. Tokens let us do that fairly.
You pay for what you use. Practices that use AI lightly are not paying for heavy users.
Your subscription stays focused. It covers the platform, assessments, templates and learning, while AI is pay-as-you-use.
You stay in control. You can see your balance at any time and decide when to top up.
How it works
Your 50,000 free tokens are loaded to your balance. Each AI report or analysis draws tokens from that balance, depending on how much the AI reads and writes. When your balance reaches zero, AI reports pause until you top up. Token packs start at R149 for 200,000 tokens, payment is made securely through Paystack and paid tokens never expire[21]. To get the most from your tokens, ask specific questions, share only the information the AI needs and avoid regenerating the same report. You can check your balance or top up from the AI Token Top Up page in your dashboard. The illustration below shows the full journey, from your free allowance to topping up.
- Ask specific questions.
- Share only the information the AI needs.
- Avoid regenerating the same report.
- Starter200,000 tokensR149
- Standard500,000 tokensR299
- Practice800,000 tokensR399
- Pro1,200,000 tokensR499
Congratulations to Our Three Coaching Winners
We are delighted to announce the three subscribers drawn at our latest Innovators Pulse Check. Each one wins a dedicated one-on-one coaching session with the FSP Business 4.0 team, focused entirely on their practice. Congratulations to:
The session is coaching on the business, not advice on individual client files. Not a winner this time? Every subscriber who joins the next Pulse Check goes into the draw again.
Pillar 3 (Client Engagement, Part 2) Goes Live on 14 October
The FSP Business 4.0 Workshop Programme for Innovators runs through to May 2027, each session building on the last. With Pillar 3 on Client Engagement (Part 1) now complete, the next session, Pillar 3: Operations, Client Engagement (Part 2), takes place on 14 October 2026. It turns the client-engagement habits of the last session into the operational backbone of a business that runs well without depending on any one person. Note too that Pillar 5’s follow-up on Succession Planning and Practice Continuity is already on the calendar for April 2027.
All sessions online · 09:00–10:00 SAST · Link sent before each workshop.
Lock the Doors,
Protect What You Have Built
Cyber defences, governance you can prove and a business that runs well without depending on any one person. Secure your seat now, or take the Cybersecurity Readiness Assessment and find out what to fix first.
Sources & Further Reading
- South African Banking Risk Information Centre (2026) Annual Crime Statistics 2025. Johannesburg: South African Banking Risk Information Centre. Available at: https://www.sabric.co.za/wp-content/uploads/2026/08/SABRIC-Annual-Crime-Statistics-Report-2025.pdf (Accessed: 29 September 2026).
- TechCentral (2023) ‘Info Regulator nails justice department over cyberattack’, TechCentral, 4 July. Available at: https://techcentral.co.za/info-regulator-nails-justice-department-over-cyberattack/227868/ (Accessed: 29 September 2026).
- Financial Sector Conduct Authority and Prudential Authority (2024) Joint Standard 2 of 2024: Cybersecurity and Cyber Resilience Requirements for Financial Institutions. Pretoria: Financial Sector Conduct Authority and Prudential Authority.
- Michalsons (2026) ‘Joint Standard on Cybersecurity and Cyber Resilience Requirements’, Michalsons. Available at: https://www.michalsons.com/blog/cybersecurity-and-cyber-resilience-requirements-joint-standard/60149 (Accessed: 29 September 2026).
- ITWeb (2025) ‘SA sees uptick in AI-based fraud schemes’, ITWeb, August. Available at: https://www.itweb.co.za/article/sa-sees-uptick-in-ai-based-fraud-schemes/lwrKx73YbDmqmg1o (Accessed: 29 September 2026).
- Financial Services Board (2003) General Code of Conduct for Authorised Financial Services Providers and Representatives, Board Notice 80 of 2003. Pretoria: Financial Services Board.
- Republic of South Africa (2013) Protection of Personal Information Act 4 of 2013. Pretoria: Government Printer.
- Covington and Burling (2025) ‘South Africa introduces mandatory e-Portal reporting for data breaches’, Inside Privacy, April. Available at: https://www.insideprivacy.com/data-security/data-breaches/south-africa-introduces-mandatory-e-portal-reporting-for-data-breaches/ (Accessed: 29 September 2026).
- National Treasury (2023) Conduct of Financial Institutions Bill, revised draft. Pretoria: National Treasury.
- Australian Securities and Investments Commission (2025) 25-143MR ASIC sues Fortnum Private Wealth for allegedly failing to adequately manage cybersecurity risks. Sydney: Australian Securities and Investments Commission. Available at: https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2025-releases/25-143mr-asic-sues-fortnum-private-wealth/ (Accessed: 29 September 2026).
- National Institute of Standards and Technology (2024) The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29. Gaithersburg: United States Department of Commerce. Available at: https://doi.org/10.6028/NIST.CSWP.29 (Accessed: 29 September 2026).
- Australian Signals Directorate (2023) Essential Eight Maturity Model. Canberra: Australian Cyber Security Centre. Available at: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight (Accessed: 29 September 2026).
- National Treasury (2026) Conduct of Financial Institutions Bill, 2026, introduced in the National Assembly on 17 April 2026, Government Gazette Notice 7376 of 2026. Pretoria: National Treasury.
- FAnews (2026) ‘Waiting for the “set” call on this COFI scrum’, FAnews, 7 September. Available at: https://www.fanews.co.za/article/compliance-regulatory/2/general/1082/waiting-for-the-set-call-on-this-cofi-scrum/44647 (Accessed: 29 September 2026).
- National Treasury (2020) Conduct of Financial Institutions Bill, second draft published for public comment, 8 October 2020. Pretoria: National Treasury.
- Financial Sector Conduct Authority (2026) Regulatory Actions Report: 1 April 2025 to 31 March 2026. Pretoria: Financial Sector Conduct Authority.
- Moodley, N. (2026) ‘FSCA confirms 80 Eight uncovered and reported 2021 fraud after firm challenges R2.5m penalty’, Daily Maverick, 24 July. Available at: https://www.dailymaverick.co.za/article/2026-07-24-fsca-confirms-80-eight-uncovered-and-reported-2021-fraud-after-firm-challenges-r25m-penalty/ (Accessed: 29 September 2026).
- Financial Intelligence Centre (no date) Supervision and enforcement. Pretoria: Financial Intelligence Centre. Available at: https://www.fic.gov.za/compliance/supervision-and-enforcement/ (Accessed: 29 September 2026).
- Webber Wentzel (2025) ‘The COFI Bill: what financial institutions need to know’, Webber Wentzel Insights, 14 August. Johannesburg: Webber Wentzel.
- OpenAI (2026) What are tokens and how to count them? OpenAI Help Center. Available at: https://help.openai.com/en/articles/4936856-what-are-tokens-and-how-to-count-them (Accessed: 29 September 2026).
- FSP Business 4.0 (2026) Top Up AI Tokens. Available at: https://www.fsp40.com/4point0/AiTopup.aspx (Accessed: 29 September 2026).
- Google Cloud (2026) Generative AI glossary. Google Cloud Documentation. Available at: https://cloud.google.com/vertex-ai/generative-ai/docs/learn/glossary (Accessed: 29 September 2026).