MyBroadband reported on 26 October 2026 that the Information Regulator has fined FNB R1 million. The infringement notice was signed on 21 October.
What the record shows
Several outlets report the notice, including MyBroadband, BusinessTech, Innovation Village and Bulletin. Yusuf Abramjee has also cited the Regulator's statement, and popiacheck links the notice itself. The Regulator's wording on account numbers, section 8 read with section 105(1) of POPIA, is confirmed by BusinessTech and others.
As reported, the Regulator found breaches of POPIA sections 5, 8, 12, 14, 15, 19 and 105. The findings cover a February 2022 exposure of 88 data subjects' data to 696 unauthorised individuals, caused by account holders being classified as employees. They also cover repeated alerts that went unaddressed, collection from public sources, and retention.
Nor is it clear whether FNB has paid or appealed. The recipient of an infringement notice has 30 days to pay, arrange instalments or elect to go to court. That window is still open.
This article therefore makes no claim about how FNB will respond. It also does not call this the largest fine the Regulator has issued, because the sources do not support that. The Regulator fined the Department of Justice R5 million in 2023 and the Department of Basic Education R5 million in 2024.
A pattern of enforcement, with a new target
The FNB notice is not the only recent one. The Regulator issued a R500,000 notice to Central Johannesburg TVET College, signed on 9 October. That penalty followed the college's failure to comply with an enforcement notice.
Set the two side by side and the shape is clear. One penalty reached a major bank over a failure of security safeguards and access control. The other reached a public institution that ignored an earlier instruction. The Regulator's earlier fines, as tracked, followed non-compliance with an enforcement notice. The FNB matter is listed as a fine for substantive conduct, which would be new.
For boards, the second case matters as much as the first. An enforcement notice is not advice. Ignoring one has carried a fine since at least July 2023, when the Department of Justice was fined R5 million for non-compliance with an enforcement notice.
Why this is a governance question
Most board cyber discussion centres on breach readiness. Directors ask how fast the organisation can detect an intrusion and how it will notify. Those questions remain valid.
The FNB notice points to a different exposure. The sources describe an unauthorised access incident caused by misclassified accounts, plus a failure to act on two alerts. It was not an external attacker, but it was a security compromise and a safeguards failure. That is a governance question, and it sits at the centre of POPIA.
The Micro, Meso and Macro model helps here.
- Micro: the individual record and the individual handling decision. An account holder classified as an employee, and so given access they should never have had, is a control failure at the smallest scale.
- Meso: the processes and systems that decide who can see and use customer data across a business unit. This is where access rules, data flows and staff behaviour either hold or leak.
- Macro: the regulator, the public and the market. A R1 million notice reported across the press lands on a bank whose business rests on trust.
A board that watches only the macro layer will be surprised. The failure starts at the micro layer, and the meso layer decides whether it spreads.
What boards should ask now
Audit and risk committees should put four questions to management before the 30-day window closes on anyone else.
First, where does customer personal data actually flow, and who can touch it? A written policy is not an answer. Evidence of access controls and monitoring is.
Second, how many instructions from the Regulator, internal or external, are open? The TVET College case shows that an unactioned enforcement notice is its own liability. And how many internal alerts have gone unanswered?
Third, does the organisation measure how staff handle personal data, not only whether they completed training? Behaviour tools such as OutThink and Beauceron are built to make that visible to boards.
Fourth, how do suppliers that process customer data get assessed? Platforms such as Black Kite give boards an outside view of third-party exposure that self-attestation cannot.
None of these is a breach-response question alone. All of them are POPIA questions.
The stance for directors
Boards should read the FNB notice as a sign that the Regulator will fine regulated financial institutions for substantive failures, not only for ignoring its orders. That is a judgement, and the sources do not yet show a wider pattern among banks.
Timing adds pressure. Michalsons notes that the Regulator's members' terms end on 30 November 2026. Boards should not read that as a pause. A prudent director plans on the assumption that enforcement continues.
Detection is not protection. Containment is. In data governance, containment means knowing where personal data sits and who handles it before the Regulator asks. Boards that build that knowledge now will answer on their own terms. Boards that wait will answer on the Regulator's.