The fine was announced around 26–27 October 2026. FNB has 30 days to pay it or elect to be tried in court on the alleged offence
The main trigger was a 2022 security compromise. On 21 February 2022, FNB confirmed that the personal information of 88 data subjects (home-loan applicants) was exposed to 696 unauthorised individuals through its banking app/home-loan platform. Some individual account holders had been incorrectly classified as employees, which gave them access to others’ details. Exposed data included full names, identity numbers, contact details, physical addresses, income/salary information, and (in nine cases) account numbers.
The Regulator found that FNB failed to address the vulnerability properly even after two customers reported it, treating the incidents as isolated rather than a broader compromise. It also identified broader compliance shortcomings, including:
- Weaknesses in security safeguards (section 19 of POPIA).
- Unlawful processing of account numbers, which amounts to an offence under section 105.
- Problematic collection of personal information from sources such as newspapers (not regarded as a “public record” under the Act in the circumstances).
- Indefinite retention of certain records without a clear legal basis.
- Deficiencies in the privacy policy/notices.
The Regulator described FNB’s handling of the matter as inadequate and noted that the bank reasonably ought to have known of the risk of substantial damage or distress to affected individuals but failed to take reasonable preventive steps.
Related action
At the same time, the Regulator fined Central Johannesburg TVET College R500,000 for separate POPIA non-compliance (failure to comply with an earlier enforcement notice).
This is one of the more notable enforcement actions against a major South African bank under POPIA and underscores the Regulator’s focus on both specific security failures and ongoing governance of personal information (collection, retention, and safeguards).
