South Africa’s financial sector cautiously advances AI adoption amid regulatory and ethical challenges

South Africa’s financial regulators have published the country’s first comprehensive report on artificial intelligence (AI) adoption across the financial sector, providing an important snapshot of early trends, investment intentions, associated risks, and emerging regulatory needs. Released jointly by the Financial Sector Conduct Authority (FSCA) and the Prudential Authority (PA) after a voluntary survey conducted between October and December 2024, the report gathered insights from about 2,100 institutions ranging from banks and insurers to pension funds, payment providers, lenders, fintechs, and investment firms.

Of these respondents, 220 , roughly 10.6 percent , confirmed current AI usage, underscoring that penetration of AI into South Africa’s financial sector is still in its early stages but growing. The report primarily focuses on banking, insurance, and investment sectors, which collectively hold the largest asset shares within the financial system.

Banks are leading the way in AI adoption, with over half of banking respondents reporting some form of deployed AI system. Payment providers are nearly as active, with 50 percent adoption, while retirement funds, insurers, and lenders lag significantly behind, with adoption levels around 14 percent, 8 percent, and 8 percent respectively. When it comes to investment, the report reveals a stark contrast: nearly 45 percent of banks using AI expect to invest more than R30 million in AI technologies during 2024, whereas most insurers and investment providers anticipate much smaller allocations, often less than R1 million, indicative of a more experimental or cautious approach.

Currently, AI use is largely focused on operational efficiencies and risk mitigation. Institutions predominantly use AI for tasks such as document analysis, workflow automation, decision-support mechanisms, and fraud detection. Particularly noteworthy is the application of AI in credit scoring and underwriting among banks, lenders, and payment firms. The report further highlights future plans to expand AI capabilities into real-time fraud detection, cybersecurity analytics, and enhanced surveillance to combat money laundering and terrorism financing. Insurers aim to grow AI deployment in underwriting and claims processing, while retirement funds and asset managers are exploring portfolio optimisation and more sophisticated risk modelling.

Generative AI (GenAI) is still in a nascent phase, with current uses limited primarily to internal functions such as drafting documents, summarising reports, and generating presentations. Some firms have begun deploying GenAI for marketing communications and client interactions, with future plans pointing towards customer-facing chatbots, automated service channels, enhanced report generation, and more extensive workflow automation.

However, significant challenges persist. The report identifies data privacy and protection , particularly compliance with South Africa’s Protection of Personal Information Act (POPIA) , as the foremost risk. Other prominent concerns include cybersecurity vulnerabilities, model biases, poor data quality, and the risk of consumer harm from opaque or inaccurate AI outputs. Generative AI introduces additional complexities, notably around misinformation, intellectual property concerns, and the responsible use of large language models.

Barriers to wider AI adoption are multifaceted. Regulatory uncertainty, scarce talent, limited internal expertise, difficulties in achieving transparency, and legacy IT infrastructure issues all restrict institutions’ ability to scale AI solutions effectively and responsibly. The report also highlights governance gaps: many firms still rely on traditional risk management frameworks without dedicated AI oversight, lacking clear accountability mechanisms, human monitoring, model validation processes, or continuous performance reviews. Tools designed to improve “explainability,” such as SHAP and LIME, have been identified as valuable but not yet widely adopted.

The current regulatory framework in South Africa does not include AI-specific legislation. Instead, AI-enabled automated financial advice is regulated under existing laws such as POPIA and the Financial Advisory and Intermediary Services Act (FAIS). POPIA places restrictions on fully automated decisions that have legal or significant effects, mandating conditions such as explicit consent or legal authorisation and requiring channels for individual review or human intervention. FAIS similarly demands human oversight and controls for automated advice providers, with general codes of conduct applying to digital advisory tools including robo-advisers. The introduction of the Conduct of Financial Institutions Bill is anticipated to strengthen supervision of digital innovations and bolster consumer protections further.

The release of this report marks an important step towards shaping a clearer regulatory and supervisory landscape for AI in South Africa’s financial sector. Both the FSCA and PA indicated that it will serve as the foundation for a forthcoming discussion paper and sustained engagement with stakeholders.

These regulatory efforts come amidst a broader digital transformation in the financial sector. South Africa’s 2024/25 Prudential Authority Annual Report notes that large banks are increasingly adopting digital innovations including AI, robotics, and smart devices to enhance customer experience and operational efficiency, while simultaneously reinforcing cybersecurity through AI-powered defences and predictive analytics.

Nevertheless, wider AI adoption across South African business sectors remains challenged by skills shortages and security concerns, as highlighted by a Dell Technologies study showing that 100 percent of South African businesses surveyed lack sufficient AI expertise, with 76 percent worried about exposing sensitive data through third-party AI systems. Contrastingly, smaller businesses demonstrate notable enthusiasm for AI: an ASUS report reveals that 77 percent of small-to-medium business (SMB) leaders are ready to adopt AI immediately, with many already reporting productivity and decision-making improvements as well as better talent retention.

Critical to responsible AI advancement in South Africa is adherence to privacy and ethics frameworks, strongly shaped by POPIA regulations. Research by Zoho underscores that South African organisations are distinguished among emerging markets for their emphasis on ethical AI use and data privacy, with the majority implementing privacy audits, third-party risk assessments, and formal AI use policies.

Overall, South Africa’s financial regulators and institutions are cautiously advancing their AI journeys, seeking to balance innovation with consumer protection, data privacy, and ethical governance. The regulatory landscape is evolving, with ongoing dialogue anticipated to help guide effective, secure, and responsible AI adoption that supports a digitally transformed and resilient financial sector.