JOINT COMMUNICATION 5 OF 2026 AND JOINT NOTICE 2 OF 2026 - TRUSTEE'S RESPONSIBILITY FOR REPORTING MATERIAL IT AND CYBER INCIDENTS

Effective 1 September 2026, retirement funds are required to report material IT and cyber incidents to the Financial Sector Conduct Authority (FSCA) using the prescribed reporting template submitted through the FSCA Joint Standards Submission Portal.

A Structured Three-Stage Reporting Process

Trustees must ensure that their incident management and governance frameworks can support a three-stage reporting process for material incidents:

A critical point for trustees is that the 24-hour reporting period begins when the incident is classified as material, not when it is first detected. The requirement is measured in actual hours rather than business hours, making rapid decision-making essential.

Funds should therefore have established escalation procedures that enable key stakeholders, including the principal officer, trustees, administrators, IT and cybersecurity service providers, legal advisers, and communications teams, to assess incidents promptly and determine whether they are material.

Material Incidents Extend Beyond Technical Cyber Attacks

he reporting obligation is not limited to technology failures or malicious cyberattacks. A cyber incident may include breaches of security policies, procedures, or acceptable-use requirements, regardless of whether an external attack occurred.

For example, the unauthorised disclosure of member information by an employee could constitute a cyber incident even where no system has been compromised. In such circumstances, the retirement fund must assess whether the incident is material and therefore reportable.

Assessing Materiality

The determination of materiality remains principles-based and must be considered in the context of the fund’s size, complexity, operational environment, and risk profile.

Axiomatic’s advice is that trustees should consider whether the incident has had, or is likely to have, a severe and widespread impact on:

Fund operations
Services provided to members and beneficiaries
The confidentiality, integrity, or availability of member data
Contribution processing
Benefit calculations and payments
Third-party service providers and dependencies
The broader financial system or economy

Importantly, trustees should not delay reporting while waiting for complete information. A reasonable assessment should be made based on the facts available at the time, with further information provided as investigations progress.

Trustees Remain Ultimately Accountable

Although many retirement funds rely extensively on administrators and external service providers for operational processing, technology infrastructure, and cybersecurity controls, regulatory accountability remains with the board of trustees.

A service provider’s notification to another regulator does not satisfy the fund’s reporting obligations to the FSCA. Consequently, funds should ensure that their agreements with administrators and other service providers clearly require them to:

Identify, contain, and escalate relevant incidents without delay
Provide sufficient information to support the fund's materiality assessment
Preserve relevant evidence
Cooperate fully with investigations
Assist with regulatory reporting and member communications where required.

Managing Incomplete Information

he FSCA recognises that complete information may not be available immediately following an incident. Where the prescribed template allows an “unknown” response, funds should provide the most accurate information available, submit the initial notification on a best-efforts basis, and supplement or correct the information during later reporting stages.

Trustees should also note that reporting to the FSCA does not eliminate any separate notification obligations that may arise under the Protection of Personal Information Act (POPIA) or other applicable legislation. Each regulatory framework must be considered independently.

Axiomatic's Key Takeaway

The new reporting requirements place significant emphasis on governance, preparedness, and timely decision-making. Retirement funds should review their incident response frameworks, reporting procedures, and service provider agreements to ensure they can identify, assess, and report material IT and cyber incidents within the prescribed timelines. Effective preparation before an incident occurs will be critical to meeting regulatory expectations and protecting members’ interests.

Not Sure Your Fund's Reporting Framework Is Ready?

Talk to Axiomatic about reviewing your incident response plan, governance structures, and service provider agreements before the FSCA comes knocking.

Services

Payroll

Benefits

Reward

JOINT COMMUNICATION 5 OF 2026 AND JOINT NOTICE 2 OF 2026 - TRUSTEE'S RESPONSIBILITY FOR REPORTING MATERIAL IT AND CYBER INCIDENTS

A Structured Three-Stage Reporting Process

Material Incidents Extend Beyond Technical Cyber Attacks

Assessing Materiality

Trustees Remain Ultimately Accountable

Managing Incomplete Information

Axiomatic's Key Takeaway

Not Sure Your Fund's Reporting Framework Is Ready?

Services

Need Any Consultations

Quick Links

Corporate Governance

Our Location

Subscribe Our Newsletter

COOKIE POLICY

Welcome to our website.

1. Introduction

2. What Are Cookies

3. How We Use Cookies

4. Your Cookie Choices

5. Third-Party Cookies

6. Updates to This Policy

7. Contact Us