South Africa’s Financial Sector Conduct Authority has set out a three-year regulatory calendar running to March 2029 that will touch nearly every operational layer of the country’s fintech sector — where data can be stored, how cloud vendors are governed, what open finance will eventually require, and how payment services are licensed. None of these rules exist yet in final form. Most are still in technical drafting. But the FSCA’s 2026 Regulation Plan is specific enough about sequencing to allow firms to plan against it, rather than wait for finished text.
What follows is a timeline of the workstreams most relevant to fintechs, drawn from the regulator’s own scheduling.
2026/27 (April 2026 — March 2027): technical work, first drafts, one hard deadline
The financial year now underway is dominated by drafting rather than publication. The Joint Standard on Cloud Computing and Offshoring of Data — the instrument that will eventually govern where fintechs can host infrastructure and how offshore vendor relationships are supervised — is in technical work throughout this period, developed jointly by the FSCA and Prudential Authority. No public draft is expected until the following financial year.
The Joint Standard on Outsourcing, covering third-party service provision more broadly, follows the same pattern: continued technical work in 2026/27, with a version for public consultation expected only once that work concludes. The Joint Standard on Governance, which the FSCA describes as underpinning the entire regulatory architecture, remains in technical refinement during this period, with a second round of public consultation anticipated later in the three-year cycle.
Open finance has no scheduled instrument at all in this window. Work continues under National Treasury’s Intergovernmental Fintech Working Group on a policy position — covering use-case prioritisation, API standardisation and cost-benefit analysis — but the FSCA has not committed to a date for any resulting legislative or regulatory intervention.
Payment services regulation moves incrementally: a concept framework, developed during 2025/26, is due to become a draft for public consultation during 2026/27, contingent on the FSCA first resolving sequencing questions with the Reserve Bank’s National Payment System Department, whose own payment authorisation framework overlaps with the FSCA’s conduct standard.
The one fixed date in the entire plan falls in this period. The Johannesburg Interbank Average Rate, JIBAR, is scheduled for cessation on 31 December 2026, to be replaced by the South African Rand Overnight Index Average, ZARONIA. Unlike the fintech-specific workstreams above, this transition affects any institution — fintech lender, payments provider, or otherwise — holding JIBAR-referenced loans, derivatives or floating-rate instruments. A Conduct Standard for Benchmarks was published for consultation in March 2026, and National Treasury has proposed “safe harbour” amendments to the Financial Sector Regulation Act to manage legacy contracts that cannot easily be repapered before the deadline.
2027/28 (April 2027 — March 2028): the consultation year
This is the period in which most fintech-relevant drafts are expected to reach public view. The Cloud Computing and Data Offshoring standard is scheduled for its first round of public consultation in 2027/28 — the earliest point at which fintechs will see actual proposed text on data residency and offshore vendor governance, roughly two years after the workstream was first formalised. The Outsourcing standard follows a comparable track, with public consultation expected in the same window, and a second round already anticipated before finalisation.
The Governance standard, having completed a first round of public consultation earlier in the cycle, is expected to undergo a second round during 2027/28, alongside continued engagement with the Prudential Authority on points of overlap between the two regulators’ mandates.
The alternative investment funds framework — a genuinely new licensing category for vehicles not previously regulated as such — is also scheduled to reach public consultation in this window, having spent 2026/27 in technical work and informal consultation.
Beneficial ownership requirements, driven in part by South Africa’s efforts to address Financial Action Task Force findings from its mutual evaluation, are expected to move from technical work into public consultation and eventual submission to Parliament during this period, though the FSCA notes the exact timeline still requires confirmation with the Prudential Authority.
2028/29 (April 2028 — March 2029): finalisation, where it happens at all
By the final year of the plan, a handful of workstreams are expected to reach Parliament or final publication: the beneficial ownership standard, the outsourcing standard following its second consultation round, and elements of the payment services conduct standard, assuming the earlier sequencing issues with the Reserve Bank are resolved on schedule. Several others — cloud computing and data offshoring among them — are not shown reaching finalisation within the three-year window at all; the FSCA’s own timeline extends only to a second round of public consultation for that standard by early 2028, with no submission-to-Parliament date yet indicated.
Open finance remains absent from the finalisation column throughout the entire three-year plan. No instrument, draft or otherwise, is scheduled to reach public consultation before March 2029 on current information. Any open finance rule affecting fintechs during this plan period will need to be added to the FSCA’s schedule after the fact, once National Treasury’s policy position is settled.
The dependency running underneath all of it
Nearly every fintech-relevant workstream above sits downstream of the Conduct of Financial Institutions Bill, approved by Cabinet in March 2026 and gazetted for introduction to the National Assembly in April. The FSCA has been explicit that its themed frameworks — including those covering data governance, nominees and custody, and disclosure — are being developed in anticipation of COFI, with public consultation timing “at this stage uncertain” pending the bill’s progress through Parliament, a process outside the regulator’s control. A slower-than-expected passage through Parliament would push back not only COFI-linked frameworks directly, but plausibly the joint standards on cloud computing, outsourcing and governance as well, given the FSCA’s stated intention to sequence related reforms together rather than release them piecemeal.
What the timeline does and does not tell fintechs
The FSCA’s plan gives South African fintechs an unusually specific advance view of what is coming and roughly when: cloud and data offshoring rules by 2027/28 at the earliest, outsourcing requirements on a similar track, open finance rules with no committed date at all, and one hard deadline — JIBAR’s cessation — that has nothing to do with fintech policy specifically but affects any firm with floating-rate exposure regardless.
What it does not offer is certainty. The regulator states plainly that the projects and timelines in its own annexure are “a broad estimate, not fixed, and subject to change,” dependent on external factors including the pace of COFI’s passage through Parliament. For a sector often criticised for treating regulation as something to react to after the fact, that qualification is itself the most useful piece of information in the document: the rules are coming, the sequence is reasonably clear, but the exact dates are the regulator’s best guess rather than a fixed commitment.
A narrow but genuine window
None of this amounts to a guarantee that submitting comments during a consultation period will materially change a final standard. Regulatory consultation in South Africa, as elsewhere, tends to reward organised, well-resourced participants over individual firms, and the FSCA’s stated priority — sequencing reform to manage cumulative burden on the sector — is itself a signal that it is listening to aggregate industry feedback about pace, if not necessarily to granular technical suggestions from any single company.
What the 2026 Regulation Plan does establish, on its own terms, is that the shaping period for cloud and data offshoring rules, outsourcing requirements, governance standards and open finance policy is still open, in most cases for another one to two years before a public draft even exists. Fintechs that treat this period as worth the resourcing cost are, at minimum, better positioned to anticipate the eventual rules than those that wait for a published standard to react to. Whether that translates into influence over the substance of the rules is a separate question the FSCA’s own document does not answer, and one the industry itself will only be able to assess once the current round of drafting reaches Parliament.