The IRCC oversees the discharge of regulatory compliance responsibilities. The Committee monitors, assesses, researches and reports on the regulatory environment in which the Group operates. The IRCC reports to the Audit, Risk, and Compliance Committee (ARCC).
The process of compliance management encompasses:
The risk of non-compliance is being managed through:
The regulatory environment changes constantly. We proactively contribute to and manage our regulatory environment by taking care of the interests of all our stakeholders and clients.
The Board is satisfied that the Company has complied with all relevant provisions of the Companies Act of South Africa and the JSE Listings Requirements and has operated in conformity with the Company's MOI during the year.
The information alongside summarises the status of the top two pieces of legislation within the Group:
POPIA gives effect to section 14 of the Constitution, which provides that everyone has the right to privacy. The Act promotes the protection of personal information processed by public and private bodies and seeks to balance the right to privacy against other rights such as access to information.
The following POPIA initiatives have been implemented to ensure compliance at 31 May 2022:
Two information requests were received from the Information Regulator during the first three months of the financial year. The information was duly supplied to the Regulator and no further correspondence was received thereon.
BLT operations rely heavily on technology platforms to facilitate service delivery, which increases the risk of cybercrime. It is therefore of critical importance to maintain the integrity and stability of key IT systems to protect stakeholder interests against increasingly sophisticated targeted attempts at digitally assisted fraud, which is one of the main objectives of the Cybersecurity and Cybercrimes Bill, 2021.
Examples of data messages deemed harmful by the new law include those which incite violence or damage to property; threaten persons with violence or damage to property, and those which contain an intimate image. Other offences include cyber fraud, forgery, extortion and theft of incorporeal property.
The unlawful and intentional access of a computer system or computer data storage medium is also considered an offence, along with the unlawful interception of, or interference with data.
Cybersecurity threats remain a critical ongoing risk and form a significant part of our technology investments. Stringent standards for information and infrastructure security controls have been reviewed and reinforced over the year. We proactively assess our vulnerabilities and risk of exposure on an ongoing basis while driving cyber risk prevention, assessment, and education programmes to maintain vigilance. We are embedding security as a core component within platform delivery via governed development mechanisms and implemented detection capabilities and response processes in our environment.
The focus was on the suite of the NIST Cybersecurity Framework controls in line with our approved strategy. The following have been accomplished along the NIST suite of controls:
