First National Bank (FNB) has been fined R1m by the Information Regulator after an assessment found shortcomings in its handling of repeated security incidents and its safeguards against unauthorised access to personal information on its digital home loan application platform.
The regulator issued an Enforcement Notice and an Infringement Notice against the bank following an assessment under the Protection of Personal Information Act (PoPIA).
The findings included weaknesses in identifying, classifying and responding to repeated security incidents, as well as deficiencies in the technical and organisational measures used to protect personal information.
The regulator announced the fine on 26 October 2026.
Security incidents and exposed customer information
The assessment followed a security compromise notification submitted by FNB under section 22 of PoPIA, after media reports concerning the exposure of customer information and unlawful access to personal information through the bank’s digital home loan application platform.
The exposed information included customers’ account numbers.
According to the regulator, the assessment identified repeated security incidents that constituted interference with the confidentiality of personal information. The findings raised concerns about whether the bank’s security measures adequately protected information against unlawful access and other forms of unauthorised processing.
The assessment also identified weaknesses in FNB’s implementation of the security safeguards required by section 19 of PoPIA and in its governance frameworks for retaining personal information.
Regulator finds contravention of PoPIA
The regulator found that FNB had committed an offence under section 105 of PoPIA. This finding related to the unlawful processing of customers’ account information through the bank’s failure to comply with the security safeguards prescribed by section 19.
It further found that FNB reasonably ought to have known that a contravention could occur and that it was likely to cause substantial damage or distress to affected individuals, but failed to take reasonable steps to prevent it.
The R1m administrative fine follows the regulator’s findings on these security and governance shortcomings.
The regulator called on public and private bodies to review their compliance programmes, strengthen information-security safeguards, ensure that Information Officers fulfil their statutory responsibilities and respond promptly to regulatory directives.
The enforcement action underscores the requirements imposed on organisations by PoPIA to protect personal information through appropriate security measures and effective organisational governance.
