Year
Logo

UNLIMITED

POTENTIAL

Material risks and opportunities

“The main purpose of risk management is to position the organisation to understand adequately and respond to potential risks and opportunities that could materially impact the execution of our strategy and our ability to create value.”

Blu Label’s primary risks and opportunities are identified within the context of our strategy to proactively respond to ever-changing internal and external operating environments. In pursuing our goals toward creating, preserving and realising value for our stakeholders, we are strengthening the link between our strategy and the Group’s risks and opportunities by applying our Enterprise-wide Risk Management (“ERM”) process within the context of key business requisites.

Our ERM process ensures the adequacy, appropriateness and effectiveness of our responses, mitigating potential significant negative business impacts to deliver on our business targets.

01INCREASED THREAT OF CYBERCRIME

DESCRIPTION

Since most of the Group’s inventory is of a virtual nature, defence against cybercrime will remain a top priority. Cyber-attacks can lead to reputational damage, business disruption and ultimately financial loss.

The Group is dependent on the systems and platforms that enable its products and services and support the management of its merchant base. Blu Label’s technology spend has increased in recent years in support of its importance to both organic and inorganic growth, while simultaneously improving system availability and resilience as the volumes of both the number and types of transactions increase.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Blu Label places significant focus on the security of all systems, both production and enterprise to pre-emptively detect, prevent and manage security threats and recover expediently in the event of a cybersecurity breach.
  • Independent third parties continually conduct periodic vulnerability scans and penetration tests to ensure that Blu Label’s systems are secure and new threats are actively monitored and appropriately addressed through our 24/7 security operations centre.
  • A Security Operations Centre (“SOC”) has been set up and is now fully operational. The SOC provides real-time threat detection and analysis of our environment and assists in countering cybercrime risks. The optimisation of the SOC is also currently ongoing. Furthermore, the SOC is being used for threat intelligence and is assisting in developing and rolling out assurance programmes that incorporate internal and external reviews of our data storage practices.
  • Our National Institute of Standards and Technology (“NIST”) Cybersecurity Framework is structured or aligned to the three lines of defence model. This allows for a dynamic approach focusing on assembling and arranging capabilities that allow for quicker response and optimising our cybersecurity initiatives. Our maturity scores are independently assessed by internal audit for factual accuracy.
  • We have appointed the appropriate skills set to manage our IT security. To bolster our cyber security, we have outsourced the entire function to a capable, highly skilled and adequately resourced service provider.
  • Maintain cyber-resilience arrangements, including incident response procedures, backup and recovery capabilities, tabletop exercises and executive-level reporting on cyber posture.
  • An advanced cloud-native platform has been implemented to counter malware threats.
  • A data loss prevention tool has been implemented, which provides real-time visibility, threat protection and data security for cloud services and websites.
  • All Blu Label staff members are mandated to participate in an ongoing cybersecurity awareness training programme, as part of cybersecurity culture and posture.
  • Cyber-insurance cover is in place to protect the Group in the event of a breach.
  • Blu Label has achieved full certification on ISO 27001:2022 for its main trading platform/system.
  • Maintain ISO 27001:2022 certification for the main trading platform/system and use the ISMS as a continuous improvement mechanism for information security governance, control monitoring and management review. Achieving this certification demonstrates our commitment to maintaining stringent standards for information security. It represents a resounding endorsement for digital security in the highly competitive telecoms and fintech industries in which we participate.
02ECONOMIC AND GEOPOLITICAL OUTLOOK

DESCRIPTION

Unfavourable economic conditions and heightened inflation are negatively impacting on consumer disposable income and/or consumer spend ability resulting in reduced trade performance. Consumers are forced to prioritise their buying habits based on needs, leaving less or no disposable income to buy discretionary products.

The South African consumer environment remains constrained and geopolitical developments in the Middle East have added further pressure and volatility through higher oil and fuel prices. These heightened geopolitical tensions, shifts in global trade alliances and volatility in commodity prices could create uncertainty for investment flows and currency stability. The balance between risk and opportunity will be influenced by the outcome of local political stability, policy direction and the country’s ability to maintain investor confidence amid a shifting global landscape.

Regulatory pressures have seen certain of our material redemption partners seeking to protect their margins and as such have commenced implementing rate cuts in the commissions we earn.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • The Group continues assessing the potential impact of these geopolitical risks on our value chain.
03POTENTIAL THEFT OF E-TOKENS, UNETHICAL BEHAVIOUR AND FRAUD

DESCRIPTION

Due to the nature of its digital inventory, the Group is vulnerable to fraudulent activities. Blu Label maintains zero tolerance for fraud and irregularities. All incidents are investigated, irrespective of the size or value.

The ongoing rollout of new products/solutions increases our exposure to potential fraud-related activities.

E-tokens are a form of electronic cash utilised for secure transactions. The Group relies on the high-volume, low-margin distribution and sale of these e-tokens of value. Therefore, Blu Label must protect its virtual stock from theft and cybercrime.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Continue to strengthen operational, technology and security controls over digital inventory, voucher PINs and related value-bearing products.
  • Fraud and ethics are discussed at Board level by both the Social, Ethics and Transformation Committee (“SETC”) and the Audit, Risk and Compliance Committee (“ARCC”).
  • Our ethics hotline, hosted by Deloitte, remains available for anonymous reporting of any instances or suspicions of fraud.
  • Staff are mandated to participate in digital programmes that enhance awareness relating to fraud and ethics. A code of conduct, disciplinary and fraud policies are in place.
  • Maintain and mature the Fraud Management Framework to ensure consistent prevention, detection, response and reporting of fraud risks across the Group.
  • The confidentiality, integrity and availability of virtual stock is managed through role-based access control, secure transfer of supplier/customer files and encryption with hardware security modules.
  • The internal audit function performs independent assurance on these controls’ design adequacy and effectiveness.
  • A robust set of automated internal controls assists in timeous detection and prevents the theft of voucher pins and related digital products.
  • Insurance cover is in place to protect the Group in case of a breach.
04CUSTOMER AND REVENUE CONCENTRATION

DESCRIPTION

Certain prominent financial institutions and retailers rely on Blu Label to process their substantial transaction volumes. A lapse in the Group’s service delivery to these stakeholders could negatively impact its profitability and/or reputation.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Blu Label maintains long-standing relationships with these parties and has an impressive track record of service delivery.
  • Mature failover and business continuity mechanisms provide a high degree of certainty that we maintain uptime beyond 99%, even as transaction volumes continue to grow.
  • As part of our operational resilience framework and practices, we actively monitor and enhance our business continuity and disaster recovery plan (“DRP”).
  • Blu Label developed fraud monitoring systems as well as transaction failure monitoring tools, so that we can respond immediately should we experience a material drop in service delivery beyond what our failover systems catch.
05MARGIN COMPRESSION IN PREPAID PRODUCTS

DESCRIPTION

The prepaid airtime and data market in South Africa — led by Vodacom, MTN, Telkom Mobile and Cell C — continues to face margin compression. The environment is highly competitive, with all major networks targeting the same consumer segment. To retain market share, networks offer increased value to consumers (more data and airtime for the same or lower spend), leading to lower adequate margins.

The entry and growth of Mobile Virtual Network Operators (“MVNO”) has further intensified competition, while ongoing economic pressure is reflected in declining recharge trends across the sector.

In addition, the prepaid electricity market also continues to face margin compression and increased competition.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Long-term agreements with network operators are in place to secure revenue continuity.
  • The Group diversifies into adjacent product categories to reduce reliance on high volume, low-margin lines.
  • Continued engagement with suppliers to preserve margin where possible.
  • Ongoing product diversification and innovation to offset structural margin pressure.
06INEFFECTIVE GOVERNANCE OF EMERGING TECHNOLOGIES

DESCRIPTION

Our gradual progress in implementing AI technologies, aimed at driving efficiencies and improving business performance, is underpinned by a strong commitment to responsible data use. This includes carefully considering AI’s ethical implications and ensuring data is used responsibly and ethically.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Maintain the Group AI governance framework, AI Governance Policy, AI Strategy Guideline and AI Acceptable Use Policy to guide responsible adoption and use of emerging technologies.
  • We maintain a central AI and emerging technology use-case repository to support visibility, ownership, risk assessment, approval status and ongoing monitoring.
  • Implement robust data governance policies, a set of rules and procedures for managing data, which comply with privacy regulations in line with the Protection of Personal Information Act, 2013 (“POPIA”).
  • Apply security-by-design and privacy-by-design controls to AI and emerging technology solutions, including access control, logging, monitoring and data protection requirements.
  • Implement security measures which include data protection, continuous monitoring and detection of threats.
  • Monitor evolving regulatory, legal and ethical expectations relating to AI and emerging technologies and update governance artefacts as required.
  • Provide awareness and targeted guidance to business and technology teams to encourage innovation while maintaining responsible, secure and compliant use.
07CELL C CONTINUES TO BE A MATERIAL INVESTMENT FOR THE GROUP

DESCRIPTION

Cell C remains a material investment for the Group and its performance, strategic execution and ability to deliver sustainable value remain important to Blu Label’s overall investment case.

STRATEGIC RESPONSE AND MITIGATING MEASURES

Blu Label is represented on the Cell C Board of Directors, providing appropriate oversight of the business’s performance, strategy and key decisions. The Group continues to support Cell C’s progress as an independent, capital-light telecommunications business while closely monitoring the investment.

08MATURITY OF BUSINESS CONTINUITY/DISASTER RECOVERY MANAGEMENT

DESCRIPTION

Business continuity management plans (“BCM”) and Disaster recovery management plans (“DRM”) ensure that the business is prepared for severe interruptions and that business processes continue with minimum downtime during cases of emergency or disaster.

If the BCM are misinterpreted or not correctly in place, the potential breakdown of critical business processes could harm the Group’s profitability and reputation.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Blu Label’s BCM steering committee meets bi-annually to ensure the Group is prepared to counter any risk.
  • We refresh our business impact analyses, critical process mapping and recovery requirements for material subsidiaries, platforms and technology services annually.
  • We are currently reviewing the effectiveness of our BCM system to ensure that we manage our continuity risks effectively.
  • Business continuity simulation testing was performed in certain material subsidiaries during FY26 which validated the effectiveness of our recovery strategies and ensured team readiness.
  • We have engaged with an external service provider to review the content of our BCP and they will be tested during 2027 via practical scenario tests.
  • Use independent review (internal audit) and assurance outcomes to strengthen BCM/DR design, test coverage and evidence quality.
09CHANGING EMPLOYMENT EQUITY LEGISLATION

DESCRIPTION

The new employment equity (“EE”) regulations in South Africa, particularly the introduction of sectoral targets for designated groups, pose a risk of potential penalties for employers who fail to meet these targets. Designated employers, which include the Group, must align their EE plans with these sectoral targets.

Failure to meet these targets, without justifiable reasons, can result in penalties and potential legal action.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • A focused EE plan (2025–2030) has been implemented and is in alignment with the revised Ministerial Information and Communication Technology (“ICT”) sector targets.
  • Quarterly tracking of progress across occupational levels in the Group.
  • Executive dashboards have been produced and monitored indicating EE targets and performance.
  • EE Forum functioning across divisions documenting progress and challenges to assist the Group in achieving its diversity goals, which the Social and Ethics Committee oversees.
  • Bursary, learnership and internship pipelines targeting designated groups to assist in meeting sector targets.
10FINANCIAL AND DIGITAL INCLUSION

DESCRIPTION

A significant portion of South Africa’s population is underserved in terms of its ability to access formal financial services. Following the substantial increase in access to cellular phones and data, Blu Label can offer consumers and informal businesses access to low-cost digital means of e-commerce transactions.

The rapid expansion of mobile phone and data penetration presents an opportunity for Blu Label to play a significant role in facilitating digital inclusion. Our low‑cost, accessible e-commerce and financial transaction platforms enable consumers and informal businesses to participate more efficiently in the digital economy, reducing cash dependency, expanding market reach and enhancing transactional convenience.

STRATEGIC RESPONSE AND MITIGATING MEASURES

  • Creating financial inclusion for communities through our innovative products and services that digitally connect consumers to anywhere-anytime products and services that would ordinarily be out of reach to many consumers.
  • Increase connectivity to drive economic participation within underserved communities.