The South African Reserve Bank (SARB) has issued a fourth variation notice changing the conditions attached to South African Postbank SOC Limited’s designation as a designated clearing system participant under the National Payment System Act. The notice grants Postbank a further 15 months from publication in the Government Gazette to comply with conditions set in the original designation and prior variation notices, while imposing additional requirements aimed at maintaining payment system continuity during the ongoing replacement of South African Social Security Agency (SASSA) gold cards. The added conditions focus on Payment Card Industry Data Security Standard (PCI DSS) compliance, strengthened key-management governance for future cards and bank identification numbers, and the generation of new secure card keys alongside a new bank identification number for a “Postbank black card 2” to replace remaining SASSA gold cards. Postbank must appoint an independent auditor (subject to SARB approval) to witness key ceremonies and provide written assurance to SARB every two weeks, and it must allow SARB-nominated observers at key ceremonies. Operational controls include keeping existing bank identification numbers open while ringfencing legacy cards, restricting use of existing black-card stock to verified lost or stolen replacements with weekly reporting to SARB, and decommissioning the existing Postbank black card bank identification number only in line with industry practice and subject to approvals by the relevant Payments Association of South Africa Card Payment Clearing House Participant Group and SARB. The notice also amends prior reporting and governance conditions by requiring monthly progress reports signed by the Chief Executive Officer, Chief Information Officer and Chief Audit Executive, and written undertakings within 90 calendar days from the Postbank board and the Minister of Communications and Digital Technologies to support fulfilment of the conditions. All new conditions must be implemented within 15 months of gazetting, and failure to meet them may lead to revocation of Postbank’s designation as a designated clearing system participant.
South African Reserve Bank 2025-08-29
South African Reserve Bank extends Postbank’s designated clearing participant deadline by 15 months and adds card security and migration conditions
The South African Reserve Bank (SARB) issued a fourth variation notice altering conditions for South African Postbank SOC Limited as a designated clearing system participant. The notice grants Postbank 15 months to comply with new requirements, including PCI DSS compliance, enhanced governance for card management, and introducing a new "Postbank black card 2." Additional measures include appointing an independent auditor, maintaining operational controls, and submitting monthly progress reports, with non-compliance risking revocation of Postbank's designation.