1 AN ASSESSMENT OF THE ADEQUACY OF SOUTH AFRICAN FINTECH REGULATION: COMPARATIVE ANALYSIS AND PROPOSALS FOR REFORM by Syed Mohammad Naeem Akhtar, student number:1836955 Submitted in partial fulfilment of the requirements for the degree of Master of Laws by Coursework and Research Report at the University of the Witwatersrand, Johannesburg Date: 13/10/2023 2 DECLARATION I, 1836955, declare that this Research Report is my own unaided work. It is submitted in partial fulfillment of the requirements for the degree of Master of Laws (by Coursework and Research Report) at the University of the Witwatersrand, Johannesburg. It has not been submitted before for any degree or examination in this or any other university. I have submitted my final Research Report through TurnItIn and have attached the report to my submission. Word Count: 10 496 words. 3 ABSTRACT The past few years have been characterised by unprecedented developments in financial technology (fintech) including rapid innovation in mobile payment systems, peer-to-peer lending, virtual currencies and blockchain technology. A sizeable portion of innovative fintech has arisen outside of the traditional financial and banking system largely driven by venture capital-backed fintech start-ups. This disruption and evolution in banking and financial services caused by fintech innovation has heightened the need for new policies and rules regarding the regulation of fintech to be both thorough and forward thinking. This is because the effective regulation of fintech is crucial to innovation and the future success and stability of the financial services industry as a whole. This paper assesses the adequacy South Africa’s current regulatory framework in relation to fintech, with a primary focus on the emergence of specific fintech in South Africa such as payment systems, lending and cryptocurrencies and their respective regulatory frameworks. A review of the risks posed by fintech usage and inadequate regulation is carried out – of which cybercrime and data privacy were identified as emerging risks. This is followed by an analysis of the strengths and challenges of South Africa’s regulatory framework which indicates that South Africa boasts a robust and well-regulated financial sector. The focus is then turned to a comparative analysis of foreign jurisdictions, particularly Australia, Nigeria, and Kenya with the aim of identifying measures that could be adopted to further strengthen fintech regulation. The paper ends off with a list of proposed recommendations to be adopted to improve South Africa’s fintech regulation, including inter alia the adoption of open banking and the creation of a harmonised system of regulation in the region. 4 TABLE OF CONTENTS I. INTRODUCTION.................................................................................................. 6 a. Fintech in South Africa – Payment Systems and Lending ................................................ 6 b. Fintech in South Africa – Mobile Money ......................................................................... 8 c. Fintech in South Africa – Crypto-assets………………………………………………...9 II. RISKS AND CHALLENGES POSED BY THE EMERGENCE OF FINTECH ....................................................................................................................... 10 a. Cybercrime risks ............................................................................................................ 10 b. Stability risk……………………………………………………………………….…...12 c. Privacy risks…………………………………………………………………………...13 III. THE REGULATORY FRAMEWORK FOR FINTECH IN SOUTH AFRICA…………………………………………………………………………13 a. Key regulatory players in South Africa………………………………………………14 b. Fintech regulation - Crypto-assets………………………………………………...…15 c. Fintech regulation- Payment services………………………………………………...17 d. Fintech regulation – Lending…………………………………………………………19 IV. STRENGTHS AND CHALLENGES IN SOUTH AFRICA’S REGULATORY ENVIRONMENT …………………………………………………………..…..21 a. Challenges – Regulatory fragmentation……………………………………………...21 b. Strengths – Consumer Protection, Data Privacy and Security………………………..22 V. WHAT CAN BE LEARNT FROM OTHER JURISDICTIONS?..................24 a. Australia……………………………………………………………………………...24 b. Nigeria………………………………………………………………………………..26 c. Kenya………………………………………………………………………………...27 VI. RECOMMENDATIONS FOR REFORM………………………………… ...28 a. Use of incentive programs to facilitate innovation…………………………………..28 b. Use of open banking………………………………………………………………….29 c. Encourage financial literacy…………………………………………………………29 5 d. Harmonisation of regulatory frameworks…………………………………………..30 VII. CONCLUSION ………………………………………………………………30 VIII. BIBLIOGRAPHY ……………………………………………………………32 6 I. INTRODUCTION Financial Technology (Fintech) refers to the application of computer programs or related technology for the provision of banking and financial services.1 Desmangles suggests that the driving force behind the rise of fintech globally has been to disrupt the modus operandi of traditional banks by improving the delivery of banking products and services through the use of algorithm banking, cryptocurrencies and mobile payment solutions among others.2 The global financial crisis of 2008 resulted in an increasing mistrust in the traditional banking sector, with large numbers of consumers preferring more personalised and interactive solutions as opposed to the mass banking approach used traditionally. Combined with this, the growing demand for financial services by people who previously had no access to the banking sector set the stage for the rapid rise in fintech innovation post 2014 – which has increasingly attracted the attention of financial market regulators.3 The regulatory bodies in South Africa have traditionally opted for a ‘wait and see’ approach, choosing to assess and understand the risks associated with fintech use rather than stifling fintech innovation through excessive regulation. However, with the rapid increase in popularity of fintech systems it has become increasingly evident that a more hands-on approach to the regulation of fintech is required, especially in the context of highly sophisticated cybercrime that is pervasive in the global financial sectors of this age. a. Fintech in South Africa – payment systems and lending South Africa has been identified as a hotbed for fintech innovation in Africa, with the Global Fintech Index City ranking South Africa as the top African country on the world’s fintech start- up ecosystem map in 2020.4 It is one of the few countries in Africa with a relatively large, banked population as well as some of the highest numbers for mobile phone penetration on the continent.5 Having a robust banking and financial services sector – albeit one that has been slow in adapting to rapid advancement – creates an ideal environment for the fintech industry to take root. Combined with the ease of access to services provided for by smartphones, fintech 1 Sofia Anyfantaki ‘The evolution of financial technology’ (2016) Economic Bulletin at 47. 2 Desmangles, L. et al. ‘Global Retail Banking 2018: The Power of Personalization’ (2018) available at https://www.bcg.com/publications/2018/global-retail-banking-2018-power-personalization accessed on 5 June 2023. 3 Sofia Anyfantaki, op cit note 1. 4 The Global Fintech Index 2020 available at https://findexable.com/wp- content/uploads/2019/12/Findexable_Global-Fintech-Rankings-2020exSFA.pdf accessed on 5 June 2023. 5 Ashlin Perumall ‘The evolving fintech regulatory landscape in South Africa’ The Banker 15 September 2022, available at https://www.thebanker.com/The-evolving-regulatory-landscape-in-South-African-fintech- 1663227850 accessed on 7 June 2023. 7 has established itself as a mainstream service in the country.6 This has allowed fintech to exert significant influence over service sectors such as the payment systems industry by ensuring simplicity, interoperability and the supply of value-added services all in one platform.7 To elaborate on this, fintech payment system platforms incorporate simplicity and ease into transactions by allowing customers to pay with a single tap. Further, such platforms are not restricted to a single type of payment method which makes the interoperability of information technology systems a significant selling point for such fintech. Naturally, traditional banks have become aware of how such technologies may compromise their role in the competitive payments landscape, and so there has been an increase in collaboration between banks and non- bank players that have introduced payment platforms and applications to enable money transfers.8 Examples of dominant fintech platforms in this sector include PayGate and Yoco which respectively offer leading payment services to enterprise companies worldwide and to small businesses in South Africa. The rapid-paced evolution of fintech has also allowed it to gain a foothold in peer-to-peer (P2P) consumer and business lending by filling the gaps in traditional lending models that arose as a result of lower risk appetite among retail banks post the global financial crisis.9 Such lending fintech platforms utilise alternative methods of assessing the creditworthiness of potential customers for example through files of sales history from eBay as compared to traditional methods used by commercial and retail banks that could inadvertently exclude a large number of the population from accessing such lending services.10 Not surprisingly, such lending platforms have boomed in popularity and thus present stiff competition to traditional financial institutions. However, they also create opportunities for cooperation and synergies as has been seen through increased collaboration between major mobile network providers and commercial banks in South Africa with the aim of extending the provision of services to the low-income and unbanked consumer. JUMO is a prime example of a fintech company encouraging financial inclusion, as it allows the unbanked to take out loans among other financial services easily using their mobile phones.11 6 Ibid. 7 Sofia Anyfantaki, Op cit note 1 at 51. 8 Coetzee, J. ‘Risk aversion and the Adoption of Fintech by South African Banks’ (2019) 14 African Journal of Business and Economic research at 134. 9 Sofia Anyfantaki, op cit note 1at 52. 10 Sofia Anyfantaki, op cit note 1 at53. 11 Ayileka Ayomide & Fagbolade Oluromade ‘Regulating Africa’s Fintech Space: Promoting Innovation or Stifling Growth?’ available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3939790 accessed on 7 June 2023. 8 b. Fintech in South Africa – Mobile Money Linked to payment systems, is the rise in mobile money as a fintech innovation that has significantly contributed to financial inclusion, which can be defined as ensuring access to financial products and services affordably and in a fair and transparent manner.12 Mobile money essentially enables the storage of monetary value on a mobile phone to effect payments, purchases, and transfers.13 The ease of accessing all these services from a mobile phone without the restraints of infrastructure and high operating costs that have traditionally kept financial services away from the unbanked has resulted in a significant boom in the use of such fintech particularly in less developed areas.14 It is worth noting however, that in the South African context, mobile money platforms such as M-Pesa, albeit their significant advantages, have not kicked off as successfully as their counterparts in Kenya and Tanzania. There are two prevailing reasons for this, firstly, in South Africa mobile money payments are constrained through regulation stipulating that e-money can only be issued by a bank, coupled with this, the definition of a deposit15 further limits the ability of independent service providers to offer mobile payments without a partnership with a bank.16 The second reason for the ‘failure’ of mobile money in South Africa is linked to the relatively large banked population that South Africa already boasts in comparison to Kenya and other countries in which mobile money services have flourished. It has been noted that mobile money platforms tend to be more successful in regions where infrastructural hinderances and barriers to access are more prevalent.17 In South Africa, the competitors in the formal sector for the service that mobile money provides are already well established and benefit from significant market shares and convenience, further there is easier access to ATMs and retail branch networks in South Africa that have somewhat hindered the growth of mobile money as a fintech service.18 Regardless of 12 Financial inclusion is sometimes also simply defined as providing access to financial services for all. See FATF Guidance: Anti-Money Laundering and Terrorist Financing Measures and Financial Inclusion (2013) para 17. 13 Claire Alexandre & Lynn Chang Eisenhart ‘Mobile Money as an Engine of Financial Inclusion and Lynchpin of Financial Integrity’ (2013) 8 WJLTA at 287. 14 Kersop, M & Du Toit, SF ‘Anti-Money Laundering Regulations and the Effective use of Mobile Money in South Africa – Part 1’ (2015) 18(5) PELJ at 1606. 15 Deposit, as defined by s1(1) of the Banks Act, is money paid by one person to another person subject to an agreement that provides for the repayment in whole or part by the person having received money from the other person, with or without premiums, on demand and with or without the payment of interest. Deposit taking has generally been relegated as the business of a bank. 16 FinMark Trust – Research Report on Mobile Money in South Africa, September 2017 available at https://finmark.org.za/system/documents/files/000/000/267/original/Final-Report-on-Mobile-Money-in-South- Africa.pdf?1603094540 accessed on 10 July 2023. 17 Kersop M op cit note 14. 18 FinMark Trust op cit note 16 at 2. 9 how mobile money fintech was received in South Africa, it remains a pervasive fintech service that is affected by the current regulation of fintech in South Africa as will be discussed in later sections. c. Fintech in South Africa – Crypto-assets For the purposes of this research paper, the final form of fintech that will be discussed is cryptocurrencies or crypto-assets. Cryptocurrencies are essentially a decentralised and convertible virtual currency that is protected by cryptography.19 They function as mediums of exchange for goods and services and represent a store of inherent value. By virtue of cryptocurrencies being decentralised and purely digital, there is no bank or central government responsible for its administration – as such, cryptocurrencies are not recognised as legal tender in any jurisdiction.20 Cryptocurrencies as fintech essentially connect a user to financial markets and enable the trading of different cryptocurrencies using blockchain or distributed ledger technology, effectively removing the need for trusted financial intermediaries such as traditional banks.21 The Intergovernmental Fintech Working Group (IFWG) maintains a position that crypto assets are highly volatile and inherently risky owing to their decentralised and disintermediated value proposition.22 Despite this, crypto assets in the South African landscape enjoy a growing community of blockchain developers and entrepreneurs, it is estimated that over 5.8 million people in South Africa, which is approximately 9.4% of the population, currently own crypto currency or crypto-assets.23 Additionally, there are several start-ups operating in the space. Examples of South African-based cryptocurrency exchanges include iCE3X, Altcoin Trader and Valr, all of which allow users to buy and sell cryptocurrencies using the rand and other cryptocurrencies.24 In contrast to how traditional players in the financial services sector collaborated with and adopted fintech related to other payments systems and lending platforms, the adoption of blockchain powered technologies by traditional banks and other players has 19 Deon Erasmus & Susan Bowden ‘A critical analysis of South African Anti-Money Laundering Legislation with regard to cryptocurrency’ (2020) 41 Obiter at 310. 20 FATF http://www.fatf-gafi.org/media/fatf/documents/reports/Virtual-currency-key-definitions-and-potential- aml-cft-risks.pdf at 26. 21 Deon Erasmus op cit note 19 at 313. 22 IFWG Crypto Assets Regulatory Working Group, FAQs available at https://www.treasury.gov.za/comm_media/press/2021/IFWG_CAR%20WG_Crypto%20assets%20FAQs_Final. pdf accessed on 10 July 2023 at 4. 23 Triple A – Global Cryptocurrency Ownership Data, 2023 available at: https://triple-a.io/crypto-ownership- data/ accessed on 9 July 2023. 24 Emi Lacapra ‘An overview of the Cryptocurrency Regulations in South Africa’ available at: https://cointelegraph.com/learn/cryptocurrency-regulations-in-south-africa accessed on 10 July 2023. 10 been relatively slow. However, it should be noted that the SARB is currently exploring central bank digital currencies25 in an effort to introduce international efficiencies into the domestic financial services industry.26 Having discussed the prevalent forms of emerging fintech in the South African financial services sector, the next section will focus on the potential risks and challenges that these financial technologies raise, thereafter a discussion will follow on what the current South African regulatory framework is in relation to the above-mentioned financial technology. II. RISKS AND CHALLENGES POSED BY THE EMERGENCE OF FINTECH Undoubtedly one of the greatest contributions to society by fintech has been the rapid increase of financial inclusion, through which many small business and low-income individuals have gained access to financial services broadly.27 The growth in digital financial technology has not only reshaped financial processes globally, but it has also exposed users and systems to new risks related to crime, competitiveness, privacy, and financial stability.28 a. Cybercrime risks Duran and Griffin suggest that the latest and possibly largest risk emerging from the current boom in fintech is that of cyber-attacks and cyber-related crime.29 Related to this is the ease with which cryptocurrencies can be used to circumvent regulations around money laundering and terrorist financing.30 The reason for this is that cryptocurrencies enjoy a high degree of anonymity. Cryptocurrency users can only be identified using their public key, however there is no other personal information that is made available, and as such, criminals can easily use this to circumvent the ‘know-your-customer’ policy which requires regulators to have updated accounts of verified personal information in order to curb money laundering and terrorist 25 Central bank digital currencies are defined as a form of money that is denominated in fiat currency in an electronic form and which is a liability on the central bank’s balance sheet similar to cash and central bank deposits. See further SARB: Frequently Asked Questions on central bank digital currencies available at https://www.resbank.co.za/content/dam/sarb/what-we-do/banknotes-and-coin/CBDC%20FAQ%27s.pdf . 26 SARB: FAQs on central bank digital currencies available at https://www.resbank.co.za/content/dam/sarb/what-we-do/banknotes-and-coin/CBDC%20FAQ%27s.pdf accessed on 10 July 2023 at 2. 27 Vincenzo Bavoso ‘The Promise and Perils of Alternative Market-Based Finance: The Case of P2P Lending in the UK (2020) 21 Journal of Banking Regulation at 395. 28 Marc Hollanders ‘Fintech and Financial Inclusion: Opportunities and Challenges’ (2020) 14 Journal of Payments Strategy and Systems at 323. 29 Randall Duran & Paul Griffin ‘Smart Contracts: Will Fintech Be the Catalyst for the next Global Financial Crisis?’ (2019) 29(1) Journal of Financial Regulation and Compliance at 112. 30 Eray Arda Akartuna, Shane D. Johnson & Amy Thronton ‘Preventing the Money Laundering and Terrorist Financing Risks of Emerging Technologies: An International Policy Delphi Study.’ (2022) 179 Technological Forecasting and Social Change. 11 financing.31 In addition to this, because cryptocurrencies are transferred directly to a recipient without the need for intermediary monitoring and identification, the stages of money laundering (placement, layering and integration) can be merged into each other with ease using electronic channels.32 Traditional anti-money laundering mechanisms depend on the monitoring of intermediaries and the following of the money trail, however, with cryptocurrencies doing away with intermediaries as well as transactional recordkeeping33, the traditional approach becomes impossible to apply, thus enhancing the ease by which criminals may launder money across jurisdictions. Linked to this is the instantaneous and irreversible transfer of cryptocurrencies across national borders that can be carried out without any government knowledge or interference – owing to such fintech being decentralised.34 The risk that this poses is that even if an illegal transaction is detected, it is basically impossible to stop such a transfer or recover the illegal proceeds once the transaction has been recorded on the blockchain. Aside from money laundering risks, cryptocurrencies also pose risks to end-users. The irreversible nature of these transactions owing to a lack of a central processing point means that if one user transfers cryptocurrency to another user incorrectly, there is no recourse to reclaim that accidental transfer unless the recipient wallet owner decides to refund the money, which leaves users at the mercy of unscrupulous individuals.35 This risk was emphasised by the Intergovernmental Fintech Working Group in its 2020 position paper on crypto assets in which it was outlined that there is no regulatory protection that would compensate the owner or user of a cryptocurrency for any loss that may be suffered.36 Further, crypto-assets are subject to high volatility which exposes users to additional risk and problems when it comes to performance in terms of a contract because the value of the crypto-asset can gain and lose value very quickly.37 31 Deon Erasmus op cit note 19 at 313. 32 Jason de Mink ‘Dangers inherent in Bitcoin and other cryptocurrencies’ (2018) 33 DeRebus. 33 Cryptocurrencies utilise the blockchain as a public ledger which makes the previous transactions available to all users, however such transactions are computer coded and linked to the public key – which has no personal information linked to it that may be used to potentially identify users that engage in illicit activities. This makes it difficult to link transactions to users unless the users explicitly cooperate with regulators. 34 Deon Erasmus op cit note 19 at 313. 35 NH Hamukuaya ‘The Development of Cryptocurrencies as a Payment Method in South Africa’ (2021) 24(1) PELJ at 14. 36 IFWG Position Paper on Crypto-Assets 2021 available at https://www.treasury.gov.za/comm_media/press/2021/IFWG_CAR%20WG_Position%20paper%20on%20crypt o%20assets_Final.pdf accessed on 17 July 2023. 37 NH Hamukuaya op cit note 35. 12 b. Stability risks Although crypto-assets form a large segment of the risks that are posed by fintech, there are several other types of risks faced by consumers of financial technology. Examples of these include fintech platform unreliability or vulnerability combined with operator fraud or misconduct. This can come about as a result of the complexity and opaqueness of fintech business models which have been rapidly developed and not tested appropriately, leaving unaware consumers at a heightened risk of fraud or misconduct by operators. An example of this was the rapid growth in the Chinese peer-to-peer lending market in the 2010s that was followed by major platform collapses and incidences of operator misconduct and fraud that resulted in consumers having to bear significant financial losses.38 In addition to this, fintech platforms that are premised on alternative finance and lending open up consumers to the risk of being victims of unscrupulous lending practices such as predatory lending practices for example charging excessive processing fees or not revealing the complete terms and conditions combined with aggressive collection practices.39 The challenge with such unscrupulous platforms is the reputational risks that carry on to the whole peer-to-peer lending sector, which can turn potential customers away owing to all lenders being painted with the same brush. Aside from the unscrupulous practices of lenders, the increasing prevalence of short-term loans that are provided by micro-credit providing platforms utilising mass marketing techniques with inadequate credit assessments has resulted in significant lending to borrowers with little regard for the capacity of these borrowers to repay such loans.40 As a natural consequence, lenders are suffering from financial losses and borrowers are increasingly being caught in debt traps. In this way, the opportunities for financial inclusion that fintech provides can be easily overshadowed by the financial stress placed on individuals who may be forced to cut back on necessities in order to repay the digital microloan. 38 Boeddu, Gian Luciano et al ‘Consumer Risks in Fintech: New Manifestations of Consumer Risks and Emerging Regulatory Approaches’ Policy Research Paper available at http://documents.worldbank.org/curated/en/515771621921739154/Consumer-Risks-in-Fintech-New- Manifestations-of-Consumer-Risks-and-Emerging-Regulatory-Approaches-Policy-Research-Paper accessed on 15 July 2023, at 12. 39 Centre for Financial Inclusion – Fintech Lending Risk Barometer 2022-2023 available at https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2023/01/Fintech-Lending-Risk- Barometer-2022-2023_1.12.pdf accessed on 15 August 2023, at 13. 40 Boeddu op cit note 38 at 51. 13 c. Privacy risks The rise in fintech has also raised several concerns around data privacy owing to the highly data-driven nature of fintech platforms. Risks include poor visibility on data ownership and compliance.41 To elaborate on this, when fintech platforms are carrying out product development or market research, they often approach data brokers or data analytics companies who sell consumer’s personal data. As a result, personal information is always subject to data mining, purchasing and analytics regardless of whether there is an existing or potential relationship between the consumers whose data is being used and the fintech platform that is mining or buying such data.42 Often consumers are blindsided by data collection companies and have no say in what data is being collected and to whom it is being sold. This presents significant challenges as sensitive personal information may be easily sold across markets in the absence of strict regulation around the use of personal information. As can be evidenced by the discussion above, fintech presents a number of opportunities such as ease of transacting and overall simplicity for consumers as well as financial inclusion for the unbanked. However, it can be argued that they present just as many risks and threats to the security of not only individual consumers but to the financial sector as a whole. As a result, it is prudent that financial regulators take note of the risks and implement appropriate regulation that protects both consumers of financial technology and financial institutions as well. The next section focuses on the regulatory framework of fintech in South Africa and how this framework is implemented to combat the identified risks. III. THE REGULATORY FRAMEWORK FOR FINTECH IN SOUTH AFRICA The boom in fintech development and usage has been noted by regulators as one that requires a risk-based approach in terms of regulation. This approach emphasises the importance of focusing on identifying the risks associated with the use of fintech, for example the risk-based approach utilised by the Financial Action task Force (FATF) focuses on identifying money laundering risks and risks of terrorist financing associated with payment systems such as cryptocurrencies, one such risk being the high degree of anonymity of cryptocurrencies.43 While this risk-based approach is commendable as it encompasses a proactive assessment that allows for a balanced integration of human judgement and modern technology to come up with appropriate risk management measures, it bears emphasising that the regulatory regime in 41 Fintech Lending Risk Barometer op cit note 39 at 14. 42 Boeddu op cit note 38 at 39. 43 Deon Erasmus op cit note 19 at 317. 14 South Africa has for too long utilised a wait and see approach which is not effective enough in curbing the potential risks that unregulated fintech use may present. Admittedly the traditional financial sector regulation in South Africa is sturdy, however it is increasingly becoming important to update such regulation to keep abreast with the rapid innovation in the fintech sector in order to enhance consumer protection. Below is an outline of the regulatory environment and key players in South Africa. a. Key regulatory players in South Africa Five key regulatory authorities regulate the South African financial services sector. These are the South African Reserve bank (SARB); the Prudential Authority (PA); the Financial Sector Conduct Authority (FSCA); the Financial Intelligence Centre (FIC) and finally the National Credit Regulator (NCR). I will briefly lay out their primary responsibilities in maintaining the financial sector, before focusing on the regulation of fintech in South Africa with a specific focus on crypto-assets, fintech payment systems and peer-to-peer lending – as these are the three sectors that I have identified as having the most fintech influence. The SARB is the main regulator of banking and payment services in South Africa. Its primary duty is to ensure the maintenance of price stability while pursuing sustainable and balanced economic growth in the country.44 Its mandate has been extended through its prudential authority function to include the regulation of prudential requirements for all financial services institutions in South Africa.45 The Financial Sector Regulation Act (FSRA)46 gave effect to important changes in the regulation of the financial sector, by establishing both the Prudential Authority and the FSCA. The Prudential Authority operates as a juristic person within the administration of the SARB, and it is primarily responsible for regulating banks, insurers, and financial conglomerates. On the other hand, the FSCA is external to the SARB and carries out the market conduct regulator functions of overseeing financial services providers, insurers, fund-management and asset-management entities and investment schemes, among others.47 The NCR is responsible for the regulation of credit providers, credit bureaus and debt collectors, specifically where consumers are natural persons or entities that fall below certain annual turnover thresholds. Finally, the FIC, established by the Financial Intelligence 44 Section 224 of the Constitution of the Republic of South Africa, 1996. 45 Geral, D. Kern, K. Tibane, B. and Janks, J ‘Fintech in South Africa: Overview’ 2023, available at: https://practiceguides.chambers.com/practice-guides/comparison/768/10626/17027-17029-17043-17047-17052- 17055-17058-17068-17073-17077-17080-17083-17093 accessed on 10 August 2023. 46 Act no 9 of 2017. 47 Geral, D. et al op cit note 45. 15 Centre Act (FICA) concerns itself with the regulation of anti-money laundering and client verification requirements by designated institutions. When it comes to the regulation of fintech, these primary financial industry policymakers have utilised a coordinated approach through the creation of a consortium of the country’s regulators – the Intergovernmental Fintech Working Group (IFWG). The IFWG mainly focuses of the regulation of crypto assets as well as anti-money laundering and South African exchange control.48 It advises on the drafting of fintech regulations through its published position papers and participatory discussions with the public in order to settle on policies. Interestingly, these position papers and guidance notes appear to be the only settled policy on the regulation of crypto-assets. At present there has been no hard legislation promulgated in South Africa in respect of crypto-assets specifically, instead, the regulatory approach seeks to encompass fintech within the existing legislative framework. In its attempts to encourage financial service innovation while ensuring that regulators keep pace with such innovation, the IFWG has implemented an Innovation Hub which comprises of an innovation accelerator, a regulatory guidance unit, as well as a regulatory sandbox.49 This initiative offers a secure environment for the testing of new market ready fintech against regulation. The purpose is not to test the financial technology itself, but rather to assess how the technology fits into current regulation and how regulation should be adapted to keep up with the rapid changes in technology that are necessary to improve efficiency in the financial services sector.50 b. Fintech regulation - Crypto-assets It should be noted however, that the regulatory stance in South Africa is progressing from one of observance without regulation towards a more formalised and collaborative approach, focusing on the specific regulation of crypto-asset services and their service providers.51 In 2019, the Crypto-Asset Regulatory Working Group was established to investigate all aspects of crypto-assets in order to develop a cohesive government response. A number of recommendations were put forward by this group including the adoption of a framework to monitor cross-border financial flows of crypto-assets, combined with the implementation of Anti-Money Laundering and Know-your-Customer frameworks, as well as the aligning of 48 Ashlin Perumall op cit note 5. 49 Op cit note 11. 50 IFWG FAQs available at: https://www.ifwg.co.za/IFWG%20Documents/Regulatory_Sandbox_FAQs.pdf accessed on 5 June 2023. 51 Geral, D et al, op cit note 45. 16 financial sector laws to include crypto assets.52 It is in line with these recommendations that the Prudential Authority in 2022 issued guidance notes highlighting the need for a risk-based approach to managing the risks posed by crypto-assets. The first concrete action towards the regulation of crypto-assets was the declaration by the FSCA that crypto assets fall under the definition of ‘financial products’ in terms of the Financial Advisory and Intermediary Services Act, effectively broadening the regulatory net to accommodate for the licensing of providers of financial services in relation to crypto- assets.53 As a result, financial services providers who seek to offer crypto services to their clients will now be required to submit their FSP licence applications by the 30th of November 2023.54 Further, the FIC Act definition of an ‘accountable institution’ was extended to include persons carrying on the following businesses: exchanging crypto-assets; offering to administer or safekeep crypto-assets; conducting transactions to transfer crypto-assets from one account to another; as well as providing financial services related to the sale of a crypto-asset.55 As a result of this, persons dealing in crypto-assets will need to comply with additional governance, risk-management, and compliance requirements specifically in relation to client verification (KYC), anti-money laundering and the combatting of terrorist financing. This is a positive step towards the more efficient regulation of crypto-assets in South Africa, allowing for a better oversight of money laundering, terrorist financing and tax evasion activities that may be taking place using crypto-assets. In addition to this, the complete enactment and implementation of the Conduct of Financial Institutions (CoFI) Bill is anticipated within the coming years, as consultation phases and formal proposals are currently under way. The legislative underpinnings of this Bill revolve around promoting financial inclusion, competition and transformation, as well as promoting the innovation and development of innovative technologies, processes and practices.56 It is on these underpinned core objectives that the development of fintech regulation may be anchored.57 The CoFI Bill will consolidate the conduct standards of financial institutions, and it aims to protect the interests of financial customers as well as to promote fair, transparent and 52 PwC Global Crypto Regulation Report 2023 available at: https://www.pwc.com/gx/en/new- ventures/cryptocurrency-assets/pwc-global-crypto-regulation-report-2023.pdf accessed on 23 August 2023, at 60. 53 Financial Advisory and Intermediary Services Act 37 of 2002, section 1(h). 54 FAIS Notice 90 of 2022. 55 Schedule 1 of the Financial Intelligence Centre Act 38 of 2001, Section 22. 56 Conduct of Financial Institutions Bill, clause 3. 57 Sheshree Govender ‘A fintech take on the Conduct of the Financial Institutions Bill’ (2019) Without Prejudice available at https://0-hdl-handle-net.innopac.wits.ac.za/10520/EJC-14635602cc accessed on 20 July 2023. 17 efficient financial markets.58 Among the anticipated provisions are ones relating to open banking and the licencing of crypto-asset service providers (CASPs) and crypto-asset trading platforms (CATPs). As per the proposed provisions of the CoFI Bill, the subject of the reformed regulatory regime will be the actual activities related to providing financial products and services as defined by the Bill, and the type of fintech that should be subject to regulation are technologies applied to financial services with the potential to disrupt current business models, applications or products.59 Additionally, it is expected that the way that established financial institutions and emerging technology providers are likely to collaborate, will change as the rules in this regard become formalised and clearer.60 c. Fintech regulation- Payment services In relation to payment services fintech, the regulation of this sector is slightly more concrete than that of crypto-assets. In terms of the SARB Act, the Reserve Bank has the mandate to conduct, monitor and regulate the payments sector in South Africa.61 In terms of the National Payment Systems Act, the SARB has delegated to the Payments Association of South Africa (PASA), the governing function of payment systems.62 As such, PASA is the body responsible for managing and regulating its members’ – both banks and non-banks – participation in the payment system.63 PASA’s oversight covers the full payment process, from payer to beneficiary, as well as the systems and processes applied to effect payments. To regulate payment systems efficiently, non-bank providers of payment services – i.e., the fintech platforms that enable payment services – are obliged to register with PASA either as a system operator or as a third-party payment provider.64 This registration is crucial for non-bank players in order to ensure that they are formally authorised to participate in the payment system. However, the involvement of non-banks in the payment system is limited by the NPS Act, for example, they may be authorised to provide the technology and technical infrastructure for payments, but the issuance of cash and e-money is restricted to registered South African 58 Sibahle Malinga ‘New financial laws to shake up SA’s fintech sector’ 25 March 2022, available at https://www.itweb.co.za/content/KzQenMjVQeOMZd2r accessed on 17 June 2023. 59 SARB – Regulatory Strategy of the Financial Sector Conduct Authority: October 2018 to September 2021, 2018. 60 Geral, D et al op cit note 45. 61 South African Reserve Bank Act 90 of 1989, Section 10(1)(c). 62 National Payment Systems Act 78 of 1998, Section 3(1). 63 SARB – Oversight of the South African National Payment System, available at: https://www.resbank.co.za/content/dam/sarb/what-we-do/payments-and-settlements/regulation- oversight/Oversight.pdf accessed on 15 July 2023, at 6. 64 National Payment Systems Act 78 of 1998, Section 4(2). 18 Banks.65 As such, non-bank players are required to form partnerships with banks in order to carry out certain functions such as money transfers for domestic remittances, the issuance of e- money,66 as well as for third-parties performing card acquiring services.67 It is worth noting that criticisms have been levelled against the NPS Act for hindering access and competition in the national payments system, and thus stifling innovation.68 These criticisms stem from the regulatory requirement for non-banks that allow them to clear payments in their own name but require them to be sponsored by banks to carry out the settlement of the same transactions. The SARB has taken note of these criticisms and through the NPS Act review and SARB’s Vision 2025 document, it has recognised the need to integrate non-banks into the payment system. SARB’s Vision 2025 document lays out a number of goals, of which two goals are relevant to fintech platforms – the goal of promoting competition and innovation, in which banks and non-banks will compete for the full range of payment services across the entire payment value chain under the same legal and regulatory framework, as well as the goal of ensuring interoperability to prevent unnecessary fragmentation in payment systems which drive up costs.69 As a result, the NPS Act Review contains certain recommendations to revamp the payments system in South Africa while ensuring its stability. Of importance to fintech platforms is Recommendation 13 which speaks to allowing the provision of retail payment services regardless of whether the service provider is a bank or non-bank. Further, such entities will be subject to a risk-based regulatory, supervisory and oversight framework rather than being forced to fit into the business of a bank as defined in the Banks Act.70 Recommendation 13 goes on further to provide for the inclusion of non-bank players in the clearing and settlement activities provided risk-reduction measures and collateral 65Deloitte – The Expanding role of non-bank players in the South African National Payment System, available at https://www2.deloitte.com/content/dam/Deloitte/za/Documents/financial-services/za-Non-bank-expansion-in- South-Africa-updated.pdf accessed on 15 July 2023, at 6. 66 As per the SARB’s E-Money paper published in 2009, the issuance of e-money is restricted to registered South African Banks to reduce potential risks in the national payment system. Fintech firms seeking to issue e- money are required to partner with a registered bank or earn authorisation as a bank in terms of the Banks Act. This has been identified as one of the factors that have limited the use of e-money and related services in South Africa. 67 Deloitte op cit note 65 at 6. 68 International Monetary Fund, ‘South Africa Financial System Stability Assessment’, IMF Country Report No. 14/340, December 2014, available at https://www.imf.org/external/pubs/ft/scr/2014/cr14340.pdf accessed on 15 July 2023. 69 SARB – The National Payment System Framework and Strategy Vision 2025 available at: https://www.resbank.co.za/content/dam/sarb/what-we-do/payments-and-settlements/Vision%202025%20- %20Action%20Plan.pdf accessed on 15 July 2023. 70 SARB – Review of the National Payment System Act 78 of 1998, Policy paper 2018. Recommendation 13. 19 or prefunding requirements are met by such entities.71 A potential result of the successful implementation of this recommendation will be that fintech platforms that provide payment services may have increased opportunities to provide e-money, mobile money and remittance services without the requirement of partnering with a bank.72 However, to enable this successfully, SARB will need to develop adequate legislative and regulatory frameworks around mobile money that are not currently in place, as well as ensuring that a risk-reduction framework is aligned with prudential requirements and regulatory reporting to ensure that the inclusion of non-banks in the clearing and settlement system does not result in financial instability owing to the risks of including such entities.73 It remains to be seen exactly how these changes will be effected through legislative amendments, but the proposed reforms are undoubtedly a step in the right direction to ensure adequate regulation of fintech platforms in the payment systems sector. d. Fintech regulation – Lending With respect to peer-to-peer lending through fintech, there is no specific regulation dealing with this in South Africa, however P2P lending and such related activities do trigger regulatory requirements under the more general financial services frameworks such as the National Credit Act, the Banks Act, or the National Payment Systems Act. South Africa utilises an activities-based approach to the regulation of lending. The National Credit Act (NCA) is the main legislative framework covering lending and related practices in South Africa, and it provides for the establishment of the National Credit Regulator (NCR) to oversee all credit and lending activities that have an effect in South Africa.74 The NCA is heavily consumer-based and is considered to be the gold-standard in Africa owing to its provisions being broad enough to regulate all lending activities whether they are enabled through financial technology platforms or through traditional lending institutions.75 All lenders whose credit agreements fall within the ambit of the NCA are required to formally register as credit providers with the NCR.76 Once registered, they are subject to extensive market conduct rules and obligations to combat over-indebtedness as well as compliance with the affordability 71 SARB – Review of the National Payment System Act 78 of 1998, Policy paper 2018. Recommendation 13.2. 72 Deloitte op cit note 65 at 11. 73 Deloitte op cit note 65 at 15. 74, National Credit Act 34 of 2005, Section 12. 75 Geral, D. et al op cit note 45. 76 NCA, supra note 74, section 40. 20 assessment regulations based on the non-discretionary validation of consumers’ gross income.77 Prior to the promulgation of the affordability assessment regulations in 2015, each credit provider was granted leeway to determine their own affordability assessment based on general principles in relation to reckless lending.78 Unsurprisingly, this led to inconsistent application of the assessment processes and standards.79 The NCR sought to maintain uniformity and ensure that only those borrowers who are in a stable enough financial position to repay their loans were granted such, thus the implementation of the new affordability assessment regulations. Further, the credit agreement volume and value-thresholds that previously applied to credit providers were removed to ensure that all credit-providers are required to comply with the new assessment regulations without any room for credit providers to fly under the NCR’s radar and undermine legislative provisions.80 This serves to ensure that the risks of reckless lending and over-lending are appropriately contained to avoid any systemic risk to the financial sector. It has been noted that the risks associated with fintech lending in South Africa do not stem from a lack of proper and adequate regulation but rather because of the business practices of emerging platforms that may seek to ‘cut through the red tape’ in attempts to grant their consumers a speedier service while cutting corners around rules that have been put in place to protect consumers.81 As such, the regulatory framework surrounding lending is robust, what remains to be seen is how regulators ensure that upcoming fintech platforms adhere to such regulations. Owing to the broad coverage over lending activities that the NCA enjoys, there has been no indication by regulators that any targeted legislation will be implemented in future in relation to the peer-to-peer lending activities carried out specifically by fintech platforms. Having discussed South Africa’s present and proposed regulations in relation to the identified fintech, the following section entails a brief overview of the strengths and challenges in South Africa’s regulatory environment, taking into consideration the risks identified in the preceding section. 77 NCA, supra note 74, section 48; Regulation 23A National Credit Regulations 2006. 78 NCA, supra note 74, section 82. 79 Kawadza, H. ‘Remarks on lending reforms ushered in by regulation 23A of the Affordability assessment Regulations’ (2017) De Jure 167. 80 KPMG report 2015 – The New Affordability Assessment Regulations available at: https://assets.kpmg.com/content/dam/kpmg/pdf/2016/05/National-Credit-Factsheet-May%202015.pdf accessed on 4 July 2023. 81 Fintech in Africa, Unpacking Risk and Regulation Conference Summary, available at https://bowmanslaw.com/wp-content/uploads/2017/10/Fintech-In-Africa-Conference-Summary.pdf accessed on 17 June 2023, at 13. 21 IV. STRENGTHS AND CHALLENGES IN SOUTH AFRICA’S REGULATORY ENVIRONMENT In relation to Fintech, South African regulators’ key imperative has been to balance effective regulation while encouraging innovation. Focusing too strictly on one over the other could result in either innovation being stifled, or an endless barrage of harm to end consumers. South African regulators’ support of innovation in fintech is evident through the establishment of the IFWG which aims to support the growing role of fintech in the South African Financial sector.82 In order to explore how regulators can be proactive in the assessment of risks and opportunities, the IFWG has introduced initiatives such as the Regulatory Guidance Unit, the Innovation Accelerator as well as the Regulatory Sandbox as detailed in the preceding section of this paper.83 This forward looking approach of proactively engaging with emerging fintech platforms is undoubtedly laudable as it ensures that regulators do not lag behind the rapid speed at which fintech innovation is occurring but rather work hand-in-hand to promote innovation that is regulatory complaint. a. Challenges – Regulatory fragmentation A challenge that regulators and innovators historically faced was the fragmentation of the regulatory landscape in such a way that innovators would encounter issues in accessing the many regulatory bodies available and in obtaining timely advice from the relevant authorities, however the creation of the IFWG as a one-stop shop has mitigated this issue.84 Further, the proposed ‘Conduct of Financial Institutions Bill’ is an attempt to consolidate the numerous legislations relating to market conduct into a single, comprehensive piece of legislation, thus ensuring that regulators and innovators alike will find all the information they need in one place.85 Despite this, a challenge that remains for fintech firms is that the existing legislative frameworks only apply to fintech products and services to the extent that such products fall within the ambit of the specific legislation.86 Thus, innovative fintech that does not easily fall under the defined scope of the regulatory structure, or one that encompasses several differing legislative frameworks may experience difficulties in ascertaining the regulatory jurisdiction 82 BFA Global – Fintech Regulation in South Africa 2021 available at https://bfaglobal.com/wp- content/uploads/2021/08/0.-Fintech-Regulation-in-South-Africa-28-June-2021.pdf accessed on 6 July 2023 at 18. 83 IFWG – ‘About Us’, available at https://www.ifwg.co.za/Pages/About-Us.aspx accessed on 6 July 2023. 84 BFA Global op cit note 82 at 19. 85 Ibid at 18. 86 Ibid at 19. 22 that it falls under. This can and has caused significant regulatory uncertainty for new emerging financial technologies. Linked to this is the burdensome compliance costs that come with ensuring that new products are compliant with several regulations.87 Often start-ups have limited resources and the requirement to align with specific and numerous regulatory provisions that they may not even be aware of can be a burden that results in the stifling of innovation. As highlighted in the previous section, current legislation does not allow fintech platforms (i.e., non-banks) to issue e-money, nor does it allow then to integrate payment systems directly onto their platforms which has significantly impacted such platforms from successfully operating in the payments sphere. This, however, is a challenge that can be overcome by the successful implementation of Recommendation 13 of the National Payments Systems Act Review which seeks to extend the services that authorised non-banks can provide to consumers. b. Strengths – Consumer Protection, Data Privacy and Security. Despite the challenges, there are a number of strengths that the regulatory environment in South Africa enjoys. Bearing in mind the risks articulated in section II in relation to data privacy and consumer protection, it is worth noting that the South African regulatory framework surrounding data protection is quite robust. The overarching provision is found in the Constitution of the Republic of South Africa, which guarantees every citizen the right to have their privacy protected as well as to not have the privacy of their communications infringed.88 This encompasses the right to protection against the unlawful collection and dissemination of personal information.89 The enactment of the Protection of Personal Information Act (POPIA) further entrenched protections around the processing of personal information by private and public bodies, who are required to meet certain minimum requirements in relation to accountability, openness and the implementation of security safeguards in order to process individuals’ personal information.90 With regard to the risk of data being unscrupulously sold to offshore companies, the POPI Act regulates this further by requiring that the transfer of personal information to a third party offshore is dependent on certain conditions including the consent of the data subject, the third-party ought to be subject to laws that offer similar protection to POPIA and that the transfer is necessary for the performance of a contract between the responsible party and the 87 Ibid at 19. 88 Constitution of the Republic of South Africa 1996, section 14. 89 Protection of Personal Information Act 4 of 2013, preamble. 90 Protection of Personal Information Act 4 of 2013, chapter 3. 23 data subject.91 This effectively mitigates the risks of having unauthorised data being sold to fintech developers who want to use such data for consumer profiling. It can be argued that this in turn stifles innovation because platform developers may not be able to easily ascertain the needs of consumers, however it must be emphasised that innovation at the cost of consumer protection goes against the balance that the regulatory bodies are trying to maintain, and so, cannot be encouraged. Aside from the above-mentioned general provisions of POPIA, South African regulation also has sectoral provisions around data protection such as the Code of Banking Practice in which banks have agreed to treat all the personal information of their customers as private and confidential.92 Further, the National Credit Act also requires all persons who receive, compile and retain customers personal information to keep such information confidential.93 Seeing as these provisions can be extended to fintech platforms, the South African regulatory framework appears to be on track to mitigating any risks that may arise from the data intensive nature of fintech. A final aspect in which regulators have taken appropriate steps in the right direction is that of ensuring cybersecurity. In 2012 the policy framework for national cybersecurity was adopted, following which the Cybersecurity Hub was established as a decision-making body responsible for the identification of cybersecurity threats and the effective combatting of identified threats to create a cyber environment in which all South African residents can safely communicate, socialise, and transact in confidence.94 In 2021 the Cybercrime Act was passed as the overarching legal framework governing cybersecurity. This Act listed the unlawful access and unlawful interception of data as cybercrime offences, as well as the unlawful interference with data programs, cyber fraud, and cyber extortion.95 The disclosure of harmful data messages was further criminalised. In terms of regulation, financial institutions and other service providers (including fintech platforms) are obliged to retain any evidence in connection to a cybercrime offence and to report such offences within 72 hours of becoming aware of the offence.96 Linked to the issue of cybercrime, is the incidence of high-profile cryptocurrency investment scams that have had occurred in south Africa97 which has led to regulators 91 Ibid section 72. 92 Code of Banking Practice, section 6.1. 93 National Credit Act supra note 74 section 68. 94 Department of Communications and Digital Technologies – Cybersecurity Hub Project available at https://www.dcdt.gov.za/cybersecurity-hub-project.html accessed on 8 July 2023. 95 Cybercrimes Act 19 of 2020, chapter 2, part I. 96 Ibid section 54. 97 The biggest crypto scam globally in 2020 was perpetrated in South Africa by Mirror Trading International through which victims of a Ponzi Scheme was swindled out of US$588 million in Bitcoin. In 2021 South 24 effectively banning investment through collective investment schemes in crypto-assets and derivative products as well as a ban on investment by pension funds coupled with an effective ban on the processing of credit card payments for the purchase of crypto-asset payments from offshore.98 These bans are considered ‘effective’ because the measures outlined are informal at present, but may serve as a holding position pending formal regulation. Having assessed some of the strengths and challenges of the South African Regulatory environment, the next section outlines valuable lessons to be learnt from the regulatory regimes of other jurisdictions. V. WHAT CAN BE LEARNT FROM OTHER JURISDICTIONS? Globally, fintech development has been guided by principles rather than hard-and-fast rules. This not only ensures that parameters are kept certain, but also grants sufficient flexibility to incorporate new innovations while ensuring that risks are understood and mitigated in the most efficient ways. In this section certain aspects of fintech regulations from differing jurisdictions will be analysed to determine whether there is anything that South African regulators can adopt and improve on to create a more encompassing regulatory environment for fintech innovation. a. Australia Australian fintech regulatory environment is strikingly similar to the South African one, broadly this framework includes licensing for financial services and consumer credit agreements as well as registration obligations for financial corporations, coupled with extensive privacy, anti-money laundering and the combatting of terrorist financing requirements.99 In order to carry on a financial service business or put out a financial product into the market in Australia, an application for an Australian financial service license is required in terms of the Corporations Act 2001.100 ‘Financial service’ and ‘financial product’ are broadly defined to include any investment or wealth management business, advisory business (including robo-advice) payment service, trading and crowdfunding platform – all of Africans were once again the subject of global headlines following the theft of US$3.6 billion from investors by a company called Africrypt. For more, see Chelin, R. ‘Africa: New playground for crypto scams and money laundering’ Institute for Security Studies, available at: https://issafrica.org/iss-today/africa-new-playground-for- crypto-scams-and-money-laundering accessed on 8 July 2023. 98 Geral, D. et al op cit note 45. 99 International Comparative Legal Guide – Fintech 2023, Chapter 2: Australia available at: https://cdn.bfldr.com/FM3YDCO2/at/g7m48n23b7m73q7mx9hkcrpj/International_Comparative_Legal_Guide_ -_Fintech_Australia2023.pdf accessed on 8 July 2023 at 9. 100 Corporations Act 2001, section 911A. 25 which will trigger the licensing requirement.101 Similarly, an Australian Credit licence will be required for engaging in consumer credit activities such as peer-to-peer lending.102 Other relevant regulatory frameworks include the Banking Act which regulates entities undertaking the business of a bank and requires such entities to be registered and authorised by the Australian Prudential Regulation Authority as deposit taking institutions.103 Australian fintech platforms are also obliged to enrol with the Australian Transaction Reports and Analysis Centre (AUSTRAC) and comply with customer due diligence and reporting requirements in terms of the Anti-Money Laundering and Counter-Terrorism Financing Act.104 A salient feature of the regulatory environment in Australia is the special incentive scheme for investment in fintech businesses. This incentive scheme constitutes of two prongs: incentives for investors, and incentives for fintech developers. With regard to investors, incentives are granted for investment in fintech start-ups with low income and expenses, also known as Early-Stage Innovation Companies (ESICs).105 Essentially, this incentive program rewards investments of less than 30% of the equity in an ESIC with a 20% non-refundable tax- offset as well as a 10-year tax exemption on any capital gains arising on the disposal on the investment. The 20% tax offset is capped at AUD 200,000 per investor in each income year, and the tax exemption is on the condition that such investments are held for at least one year but not more than 10 years.106 With respect to fintech developers, the Research and Development (R&D) Tax Incentive program applies to fintech entities that have incurred expenditure on certain software R&D. The incentives granted to small businesses (those with an aggregated turnover of under AUD 20 million) include a refundable offset of 18.5% above the claimant’s corporate tax rate, which currently sits at 25%. Essentially providing a total 43.5% refundable tax offset. For businesses that have an aggregate turnover greater than or equal to AUD 20 million, a non-refundable tax offset of their corporate tax rate combined with an incremental premium of either 8.5% or 16.5% is granted. The incremental premium is dependent on the R&D intensity of the firm in question, i.e., the proportion of the claimants eligible R&D expenditure as a percentage of total business expenditure.107 101 ICLG, op cit note 99. 102 Ibid. 103 Banking Act 1959 (Cth), section 9. 104 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 105 ICLG, op cit note 99 p 9. 106 Ibid. 107 Ibid. 26 This feature of the Australian regulatory environment is one that South African regulators should consider adopting as it effectively encourages collaboration and innovation in fintech – which will in turn benefit consumers – while helping to mitigate the compliance costs that emerging fintech platforms have been shown to struggle with owing to a lack of adequate resources at their disposal. b. Nigeria Moving away from Australia, and looking closer to home, the Nigerian Regulatory environment also has some note-worthy features that South African regulators can learn from. One such feature is the adoption of Open Banking in Nigeria and the issuance of a regulatory framework for this adoption.108 Open Banking is a banking practice that allows consumer banking, transaction and other related financial data to be accessed by third-party financial service providers through the use of application programming interfaces (APIs).109 Open banking reduces compliance and verification time by eliminating the need for manual document presentation and centralising the exchange of required information on an independent platform, it also facilitates a more competitive and transparent financial market in which service providers can analyse consumers data to streamline services and offer solutions that are best suited to the individual consumer.110 As per Nigeria’s regulations, the open exchange of data through APIs is categorised in four ways: (i) product information and service touchpoints, (ii) market insight transactions, (iii) personal information and financial transactions, and (iv) profile, analytics and scoring transactions. Further, there is a tier system with varying registration requirements and operational capacities depending on the risk management maturity level of the participants.111 While the SARB has taken note of the rise of open banking globally and accordingly published a consultation paper on open banking activities in the national payment system and issued policy proposals,112 there has been no further action to adopt this innovative practice that has the potential to revolutionise the financial services sector in South Africa. South Africa already has a robust legal framework and stringent compliance requirements coupled with 108 As per Circular PSM/DIR/PUB/CIR/02/001, dated February 17, 2021. 109 Investopedia – Open Banking: Definition, how it works, and Risks 2022, available at https://www.investopedia.com/terms/o/open-banking.asp accessed on 9 July 2023. 110 Ibid. 111 Regulatory Framework for Open Banking in Nigeria, sections 4.1 and 5.2. 112 SARB – Consultation paper on open-banking activities in the national payment system, 2020, available at https://www.resbank.co.za/content/dam/sarb/what-we-do/payments-and-settlements/regulation- oversight/Consultation%20Paper%20on%20open%20banking.pdf accessed on 18 July 2023. 27 adequate technological infrastructure that make it well-suited for the adoption of open banking. As such, it is recommended that South African regulators take a leaf from the books of jurisdictions that have surpassed it in terms of regulatory advancement and work towards the implementation of Open Banking. c. Kenya A final lesson can be learnt by analysing the reasons for the boom in fintech use in countries like Kenya. Although South Africa boasts similar levels of mobile phone penetration among the population as Kenya does, there has been a stark difference in how successful fintech programs based on mobile money have been in the two regions. In Kenya, the telecommunications giant Safaricom spearheaded its money transfer service, M-Pesa in 2007 to function as a mobile bank without the need for an internet connection.113 This innovative fintech was adopted at an almost alarming rate in Kenya owing to the conducive environment provided by regulatory authorities. As a result, financial inclusion boomed from approximately 26% in 2006 to over 83% presently.114 In South Africa however, when MTN attempted to provide a similar service, it encountered several problems. One of the reasons being that South African consumers already enjoyed relatively high levels of financial inclusion and access to financial services.115 Further, the regulatory environment in South Africa was not as conducive to the adoption of this fintech. This can be attributed to the restrictive approach towards the issuance of e-money and mobile money services that can be provided by non-banks in terms of South African Legislation. These limitations forced mobile operators to partner with banks in order to provide the payment services which further constrained innovation and prevented competition that could have challenged established players in the field.116 In addition to this, the limited access to the national payment system owing to restrictions around clearing and settlement of payments meant that the transactional capability of mobile operators was constrained. It is understood that these restrictions were put in place to manage illegal activities such as fraud and money laundering, however the focus in South Africa was placed on regulating the institution or the issuer of e-money. This presents challenges as there are a vast number of ways in which e-money institutions can exploit opportunities in the mobile money space and 113 Chitavi, M. Cohen, L. and Hagist, S. ‘Kenya is becoming a Global Hub of Fintech Innovation’ (2021) Harvard Business Review. 114 Ibid. 115 FinMark op cit note 16. 116 FinMark op cit note 16 at 21. 28 having a regulatory framework that forces firms to fit in a one-size-fits-all regime places an excessive burden on these institutions, effectively stifling innovation.117 In the South African context, bearing in mind the objectives of countering illegal activities while encouraging financial inclusion, regulators would be better suited to regulating mobile money as it stands as a service or product using narrow activity-based licences, instead of placing all their focus on the institution that offers the service. This would allow for non-bank institutions and platforms to innovate freely within the boundary of regulatory safety while focusing on the outcome which is financial inclusion, rather than being bogged down by regulations that limit the service to certain institutions. As such, the above comparison between the success rates of two similar fintech offerings in the two countries demonstrates the need to have a reactive and adaptive regulatory environment that does not place excessive limitations on innovation. Albeit the restrictions that were imposed were in place to protect consumers and the financial sector, there lies an important lesson to be learnt regarding flexibility and the need to shift focus from the regulation of institutions to the regulation of activities, services, and products while maintaining consumer protection. VI. RECOMMENDATIONS FOR REFORM As has been demonstrated above, while South Africa does have a robust and forward-looking regulatory framework around fintech, there is always room to learn from other jurisdictions and improve on the current framework. a. Use of incentive programs to facilitate innovation The adoption of incentive programs to encourage investment and innovation in the fintech sector will not only boost the rate of innovation but will also enable fintech start-ups to compete more efficiently in financial markets as the high costs in relation to research and development as well as the costs incurred in ensuring regulatory compliance will no longer be as constraining a factor for smaller firms. Although it can be argued that the indiscriminate offering of incentives may result in a boom in innovation that is more ‘quantity over quality’, to counter this, it is recommended that the tax-incentive design that is implemented in South Africa should be based on qualifying criteria to promote the quality of investment and innovation rather than just the quantity. An example could be the use of performance related tax relief or incentives 117 Ibid, p55. 29 around innovative designs that are adapted to suit the local context of consumers perfectly. In this way, regulators can ensure that the results of incentive programs are actually translated into consumer benefits and an overall attainment of value for money. b. Use of open banking One way to ensure that innovative designs in fintech suit consumer needs perfectly, is the adoption of open banking using APIs. This will ensure that third-party service providers and innovators will have secure access to customers financial information and transacting preferences in order tailor the products to perfectly suit the needs of the customer. The proper implementation of open banking with the right regulatory framework is likely to result in greater service offerings and competition in the financial market combined with an improvement in customer convenience and transparency on the types of products that are on offer by financial institutions. To ensure the safety and mitigate any risks that may arise from the use of open banking, it is recommended that regulation be implemented that includes third party providers under the same regulations that banks are subject to. This can potentially curb the reputational risks to banks that arise from the misuse of customers data. Further, any regulations that are to be implemented in relation to the adoption of open banking should be premised on the consumer’s consent, as well as data security requirements and data privacy expectations to ensure that third party service providers carry out their activities in a controlled environment. c. Encourage financial literacy An additional recommendation to ensure the overall safety of the financial sector would be the extension of financial literacy programs to consumers. In 2021 South Africa had a formal financial inclusion rate of 81% of the adult population.118 However in the same year a study conducted by the Organisation for Economic Co-operation and Development (OECD) showed that only 42% of the adult population is financially literate. This presents a number of challenges to regulators as the low financial literacy levels translates to poor financial decision making and a lack of financial security as customers may not be as aware of the risks involved in the activities that they partake in. A comprehensive outreach and education program would significantly improve financial literacy in the population which will not only improve how the 118 FSCA – Financial Sector Outlook Study 2022, available at: https://www.fsca.co.za/Documents/FSCA%20Financial%20Sector%20Outlook%20Study%202022.pdf accessed on 15 July 2023. 30 average South African manages their finances, but it will also have a sector-wide positive impact on financial stability. Further, education around the common types of scams and fraud that consumers may fall victim to will enable consumers to make smarter and more informed financial choices, thus reducing the incidences of financial crime and fraud, which have rocked the South African financial sector in recent years. d. Harmonisation of regulatory frameworks Africa remains a conducive environment for the growth of innovative fintech, as such, regulators across the continent only stand to benefit from a harmonised system of fintech regulation. To enable this, a joint African fintech task force similar to the IFWG but with a wider continental reach could be established. The aim of such a task force would be to develop policies surrounding data outsourcing and offshoring, cloud services, transparency and the reduction of barriers to fintech growth and expansion. The harmonisation of existing regulations will make it easier for fintech developers in the region to expand their markets and access greater foreign direct investment. Further, seeing as Africa boasts a multi-billion-dollar payments industry, a harmonised fintech payments system creates even greater potential for joint economic development in the continent. To aid this, the African Continental Free Trade Area (AfCFTA) would be an ideal platform to facilitate such regulatory harmonisation and thus ensure that fintech regulation is up to standard, regardless of the originating country. This enables consumers both in South Africa and Africa as a whole have access to a wider range of fintech of whose regulatory compliance they can be assured of. VII. CONCLUSION This Research Paper began by analysing the emergence of fintech in South Africa, it was noted that the adoption of fintech has been particularly prevalent in the payments systems sector as well as in the peer-to-peer lending sector. Further, the popularity of cryptocurrency has surged in recent years. The rapid emergence of fintech, however, presents a number of risks to both consumers and the financial sector itself. Some of the identified risks were the prevalence of use of crypto-assets for money laundering and terrorist financing, as well as the risks around data protection which is a significant risk factor owing to the data-intensive models of fintech platforms and service providers. Having identified the risks that plague the fintech sector, this paper went on to analyse the current regulatory regime in South Africa and noted that regulation generally appears to be robust and forward looking and in support of innovation. It is worth noting that presently there is no specific legislation targeted at fintech, rather emerging fintech 31 platforms are required to fit into existing legislative frameworks, which presents challenges that may stifle innovation. However, there are reforms on the horizon, such as the much- awaited implementation of the COFI Bill, as well as recommendations to integrate non-banks into the payment systems network. The focus of this paper was then shifted to the regulatory regimes of other jurisdictions, such as Australia, Nigeria, and Kenya to identify salient features of these regimes that the South African regime could learn from and adopt. Having identified such features, the paper ended off with recommendations for reform, which include, inter alia the adoption of open banking systems and the use of incentive programs by regulators to encourage meaningful innovation in fintech. 32 BIBLIOGRAPHY Legislation Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Constitution of the Republic of South Africa, 1996. Conduct of Financial Institutions Bill, 2020. Cybercrimes Act 19 of 2020. Financial Advisory and Intermediary Services Act 37 of 2002. Financial Intelligence Centre Act 38 of 2001. National Credit Act 34 of 2005. National Credit Regulations, 2006. National Payment Systems Act 78 of 1998. Protection of Personal Information Act 4 of 2013. South African Reserve Bank Act 90 of 1989. Foreign Legislation Australia – Corporations Act 2001, section 911A. Australia – Banking Act 1959 (Cth). Journal Articles Claire Alexandre & Lynn Chang Eisenhart ‘Mobile Money as an Engine of Financial Inclusion and Lynchpin of Financial Integrity’ (2013) 8 WJLTA. Coetzee, J. ‘Risk aversion and the Adoption of Fintech by South African Banks’ (2019) 14 African Journal of Business and Economic Research. Deon Erasmus & Susan Bowden ‘A critical analysis of South African Anti-Money Laundering Legislation with regard to cryptocurrency’ (2020) 41 Obiter. 33 Eray Arda Akartuna, Shane D. Johnson & Amy Thronton ‘Preventing the Money Laundering and Terrorist Financing Risks of Emerging Technologies: An International Policy Delphi Study.’ (2022) 179 Technological Forecasting and Social Change. Jason de Mink ‘Dangers inherent in Bitcoin and other cryptocurrencies’ (2018) 33 DeRebus. Kawadza, H. ‘Remarks on lending reforms ushered in by regulation 23A of the Affordability assessment Regulations’ (2017) De Jure. Kersop, M & Du Toit, SF ‘Anti-Money Laundering Regulations and the Effective use of Mobile Money in South Africa – Part 1’ (2015) 18(5) PELJ. Marc Hollanders ‘Fintech and Financial Inclusion: Opportunities and Challenges’ (2020) 14 Journal of Payments Strategy and Systems. NH Hamukuaya ‘The Development of Cryptocurrencies as a Payment Method in South Africa’ (2021) 24(1) PELJ. Randall Duran & Paul Griffin ‘Smart Contracts: Will Fintech Be the Catalyst for the next Global Financial Crisis?’ (2019) 29(1) Journal of Financial Regulation and Compliance. Sheshree Govender ‘A fintech take on the Conduct of the Financial Institutions Bill’ (2019) Without Prejudice. Sofia Anyfantaki ‘The evolution of financial technology’ (2016) Economic Bulletin. Vincenzo Bavoso ‘The Promise and Perils of Alternative Market-Based Finance: The Case of P2P Lending in the UK (2020) 21 Journal of Banking Regulation. Research Papers Boeddu, Gian Luciano et al ‘Consumer Risks in Fintech: New Manifestations of Consumer Risks and Emerging Regulatory Approaches’ Policy Research Paper available at http://documents.worldbank.org/curated/en/515771621921739154/Consumer-Risks- in-Fintech-New-Manifestations-of-Consumer-Risks-and-Emerging-Regulatory- Approaches-Policy-Research-Paper accessed on 15 July 2023 34 Ayileka Ayomide & Fagbolade Oluromade ‘Regulating Africa’s Fintech Space: Promoting Innovation or Stifling Growth?’ available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3939790 accessed on 7 June 2023. FinMark Trust – Research Report on Mobile Money in South Africa, September 2017 available at https://finmark.org.za/system/documents/files/000/000/267/original/Final- Report-on-Mobile-Money-in-South-Africa.pdf?1603094540 accessed on 10 July 2023. Policy Documents Code of Banking Practice. Intergovernmental Fintech Working Group Position Paper on Crypto-Assets. Financial Action Task Force Guidance: Anti-Money Laundering and Terrorist Financing Measures and Financial Inclusion (2013). Financial Advisory and Intermediary Services Notice 90 of 2022. Regulatory Framework for Open Banking in Nigeria. South African Reserve Bank – Regulatory Strategy of the Financial Sector Conduct Authority: October 2018 to September 2021. South African Reserve Bank – Review of the National Payment System Act 78 of 1998, Policy paper 2018. South African Reserve Bank – The National Payment System Framework and Strategy Vision 2025. Internet Sources Ashlin Perumall ‘The evolving fintech regulatory landscape in South Africa’ The Banker 15 September 2022, available at https://www.thebanker.com/The-evolving- regulatory-landscape-in-South-African-fintech-1663227850 accessed on 7 June 2023. BFA Global – Fintech Regulation in South Africa 2021 available at https://bfaglobal.com/wp-content/uploads/2021/08/0.-Fintech-Regulation-in-South- Africa-28-June-2021.pdf accessed on 6 July 2023. 35 Centre for Financial Inclusion – Fintech Lending Risk Barometer 2022-2023 available at https://content.centerforfinancialinclusion.org/wp- content/uploads/sites/2/2023/01/Fintech-Lending-Risk-Barometer-2022- 2023_1.12.pdf accessed on 15 August 2023. Chelin, R. ‘Africa: New playground for crypto scams and money laundering’ Institute for Security Studies available at https://issafrica.org/iss-today/africa-new-playground- for-crypto-scams-and-money-laundering accessed on 9 July 2023. Chitavi, M. Cohen, L. and Hagist, S. ‘Kenya is becoming a Global Hub of Fintech Innovation’ (2021) Harvard Business Review available at https://hbr.org/2021/02/kenya-is-becoming-a-global-hub-of-fintech-innovation accessed on 7 July 2023. Deloitte – The Expanding role of non-bank players in the South African National Payment System, available at https://www2.deloitte.com/content/dam/Deloitte/za/Documents/financial-services/za- Non-bank-expansion-in-South-Africa-updated.pdf accessed on 15 July 2023. Department of Communications and Digital Technologies – Cybersecurity Hub Project available at https://www.dcdt.gov.za/cybersecurity-hub-project.html accessed on 8 July 2023. Desmangles, L. et al. ‘Global Retail Banking 2018: The Power of Personalization’ (2018) available at https://www.bcg.com/publications/2018/global-retail-banking- 2018-power-personalization accessed on 5 June 2023. Emi Lacapra ‘An overview of the Cryptocurrency Regulations in South Africa’ available at: https://cointelegraph.com/learn/cryptocurrency-regulations-in-south- africa accessed on 10 July 2023. Fintech in Africa, Unpacking Risk and Regulation Conference Summary, available at https://bowmanslaw.com/wp-content/uploads/2017/10/Fintech-In-Africa-Conference- Summary.pdf accessed on 17 June 2023. 36 FSCA – Financial Sector Outlook Study 2022, available at: https://www.fsca.co.za/Documents/FSCA%20Financial%20Sector%20Outlook%20St udy%202022.pdf accessed on 15 July 2023. Financial Action Task Force – Virtual Currencies Key Definitions and potential Risks, available at: http://www.fatf-gafi.org/media/fatf/documents/reports/Virtual-currency- key-definitions-and-potential-aml-cft-risks.pdf. Geral, D. Kern, K. Tibane, B. and Janks, J ‘Fintech in South Africa: Overview’ 2023, available at: https://practiceguides.chambers.com/practice- guides/comparison/768/10626/17027-17029-17043-17047-17052-17055-17058- 17068-17073-17077-17080-17083-17093 accessed on 10 August 2023. Intergovernmental Fintech Working Group, FAQs available at: https://www.ifwg.co.za/IFWG%20Documents/Regulatory_Sandbox_FAQs.pdf accessed on 5 June 2023. IFWG Crypto Assets Regulatory Working Group, FAQs available at https://www.treasury.gov.za/comm_media/press/2021/IFWG_CAR%20WG_Crypto %20assets%20FAQs_Final.pdf accessed on 10 July 2023. IFWG – ‘About Us’, available at https://www.ifwg.co.za/Pages/About-Us.aspx accessed on 6 July 2023. International Comparative Legal Guide – Fintech 2023, Chapter 2: Australia available at: https://cdn.bfldr.com/FM3YDCO2/at/g7m48n23b7m73q7mx9hkcrpj/International_C omparative_Legal_Guide_-_Fintech_Australia2023.pdf accessed on 8 July 2023. International Monetary Fund, ‘South Africa Financial System Stability Assessment’, IMF Country Report No. 14/340, December 2014, available at https://www.imf.org/external/pubs/ft/scr/2014/cr14340.pdf accessed on 15 July 2023. Investopedia – Open Banking: Definition, how it works, and Risks 2022, available at https://www.investopedia.com/terms/o/open-banking.asp accessed on 9 July 2023. 37 KPMG report 2015 – The New Affordability Assessment Regulations available at: https://assets.kpmg.com/content/dam/kpmg/pdf/2016/05/National-Credit-Factsheet- May%202015.pdf accessed on 4 July 2023. PwC Global Crypto Regulation Report 2023 available at: https://www.pwc.com/gx/en/new-ventures/cryptocurrency-assets/pwc-global-crypto- regulation-report-2023.pdf accessed on 23 August 2023. SARB – Consultation paper on open-banking activities in the national payment system, 2020, available at https://www.resbank.co.za/content/dam/sarb/what-we-do/payments- and-settlements/regulation- oversight/Consultation%20Paper%20on%20open%20banking.pdf accessed on 18 July 2023. SARB – Frequently Asked Questions on central bank digital currencies available at https://www.resbank.co.za/content/dam/sarb/what-we-do/banknotes-and- coin/CBDC%20FAQ%27s.pdf. SARB – Oversight of the South African National Payment System, available at: https://www.resbank.co.za/content/dam/sarb/what-we-do/payments-and- settlements/regulation-oversight/Oversight.pdf accessed on 15 July 2023. Sibahle Malinga ‘New financial laws to shake up SA’s fintech sector’ 25 March 2022, available at https://www.itweb.co.za/content/KzQenMjVQeOMZd2r accessed on 17 June 2023. The Global Fintech Index 2020 available at https://findexable.com/wp- content/uploads/2019/12/Findexable_Global-Fintech-Rankings-2020exSFA.pdf accessed on 5 June 2023. Triple A – Global Cryptocurrency Ownership Data, 2023 available at: https://triple- a.io/crypto-ownership-data/ accessed on 9 July 2023.