{
  "type": "NewsArticle",
  "url": "https://sonomos.ai/newsroom/south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform/",
  "slug": "south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform",
  "title": "South Africa's Information Regulator fines FNB R1 million over exposed home loan application data",
  "summary": "The Information Regulator says First National Bank failed to meet POPIA's security safeguards after customer information, including account numbers, was exposed through its digital home loan platform.",
  "section": "Regulation",
  "category": "regulation",
  "format": "news",
  "tags": [
    "POPIA",
    "South Africa",
    "banking",
    "security safeguards"
  ],
  "published_at": "2026-10-28T13:30:00.000Z",
  "updated_at": "2026-10-28T13:30:00.000Z",
  "word_count": 532,
  "publisher": {
    "name": "Sonomos Newsroom",
    "url": "https://sonomos.ai/newsroom/",
    "standards": "https://sonomos.ai/newsroom/standards/",
    "organization": {
      "name": "Sonomos",
      "url": "https://sonomos.ai/"
    }
  },
  "follows_up": null,
  "followed_by": [],
  "sources": [
    {
      "number": 1,
      "title": "Information Regulator fines Central Johannesburg TVET College and First National Bank for POPIA contravention",
      "publisher": "Information Regulator of South Africa",
      "url": "https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf",
      "published": "2026-10-26",
      "accessed": "2026-10-28"
    },
    {
      "number": 2,
      "title": "FNB fine: regulator hits bank with R1-million Popia penalty",
      "publisher": "TechCentral",
      "url": "https://techcentral.co.za/fnb-fine-information-regulator-popia/287711",
      "published": "2026-10-27",
      "accessed": "2026-10-28"
    },
    {
      "number": 3,
      "title": "Information Regulator fines FNB R1 million over POPIA violations",
      "publisher": "SABC News",
      "url": "https://www.sabcnews.com/sabcnews/information-regulator-fines-fnb-r1m-over-popia-violations/",
      "published": "2026-10-27",
      "accessed": "2026-10-28"
    }
  ],
  "verification": {
    "method": "automated-source-check",
    "checked_at": "2026-10-28T13:28:00.000Z",
    "description": "https://sonomos.ai/newsroom/standards/",
    "claims": [
      {
        "claim": "The Regulator imposed an administrative fine of R1 million on FNB after finding an offence under section 105 of POPIA.",
        "source": 1,
        "source_url": "https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf"
      },
      {
        "claim": "The assessment followed a section 22 security compromise notification by FNB after media reports of exposed customer information on its digital home loan platform.",
        "source": 1,
        "source_url": "https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf"
      },
      {
        "claim": "The Regulator also fined Central Johannesburg TVET College R500,000 for failing to comply with an enforcement notice.",
        "source": 1,
        "source_url": "https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf"
      },
      {
        "claim": "TechCentral reports FNB has 90 days to report compliance and 30 days to appeal the enforcement notice.",
        "source": 2,
        "source_url": "https://techcentral.co.za/fnb-fine-information-regulator-popia/287711"
      }
    ]
  },
  "corrections": [],
  "body_markdown": "South Africa's Information Regulator has fined First National Bank (FNB) R1 million under the Protection of Personal Information Act (POPIA), saying the bank failed to keep customer information secure on its digital home loan application platform. In [its media statement dated 26 October 2026](https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf), the Regulator said it issued both an Enforcement Notice and an Infringement Notice against the bank.\n\n## What the Regulator found\n\nAccording to the statement, the Regulator's compliance assessment began after FNB submitted a security compromise notification under section 22 of POPIA, following media reports about the exposure of customer information and unlawful access to personal information through the platform. The exposed information included data subjects' account numbers.\n\nThe assessment, the Regulator said, found \"significant shortcomings\" in how FNB identified, classified and responded to repeated security incidents, which it described as interference with the confidentiality of personal information. It also identified deficiencies in FNB's implementation of the security safeguards required by section 19 of POPIA and weaknesses in its governance of how long personal information is retained.\n\nThe Regulator found that FNB committed an offence under section 105 of POPIA through unlawful processing of account information, arising from its failure to comply with section 19. It said FNB reasonably ought to have known of the risk, that the contravention was likely to cause substantial damage or distress to affected individuals, and that the bank failed to take reasonable steps to prevent it.\n\n## Further details reported\n\n[TechCentral reported](https://techcentral.co.za/fnb-fine-information-regulator-popia/287711) additional findings from the enforcement notice, which it said is dated 21 October 2026. It reported that the Regulator ordered FNB to amend its privacy notice because reliance on grounds such as \"legitimate interest\" is not a valid basis for further processing under POPIA, and to review how it collects personal information from newspapers. TechCentral also reported that FNB has 90 days to report evidence of compliance and 30 days to appeal. It said it had asked FNB for comment and, at publication, reported no response. These details come from TechCentral's account of the notice rather than from the Regulator's media statement.\n\n## A second fine the same day\n\nThe same statement covers Central Johannesburg TVET College, which the Regulator fined R500,000. It said the college failed to comply with an enforcement notice issued on 22 May 2026 after three individuals complained that their personal information was shared with third parties without legal justification. The Regulator cited, among other things, a failure to report the data breach in the prescribed manner and the lack of a compliance framework.\n\n[SABC News reported](https://www.sabcnews.com/sabcnews/information-regulator-fines-fnb-r1m-over-popia-violations/) that the Regulator's acting senior manager for POPIA, Hangi Mbedzi, said the penalties reflect the seriousness of the breaches and the risk to affected people. SABC attributed to her the criteria the Regulator considers under section 109 when setting fines: the nature of the personal information, the number of data subjects affected and the likelihood of distress or damage.\n\n## What is unresolved\n\nThe Regulator's statement does not say how many people were affected. FNB's response and whether it will appeal were not available in the sources reviewed. The Regulator's statement also calls on public and private bodies to review their compliance programmes, strengthen information-security safeguards and respond promptly to regulatory directives.",
  "links": {
    "html": "https://sonomos.ai/newsroom/south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform/",
    "markdown": "https://sonomos.ai/newsroom/south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform/index.md",
    "json": "https://sonomos.ai/newsroom/south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform/index.json",
    "image": "https://sonomos.ai/og/newsroom/south-africa-regulator-fines-fnb-r1-million-popia-home-loan-platform.png"
  }
}