FNB fined R1 million after 696 customers viewed 88 home-loan files

Sophie Lindqvist

South Africa’s Information Regulator imposed a R1-million fine on First National Bank through an enforcement notice dated 21 October; SABC News reported the announcement on 27 October after the FNB app let 696 customers view 88 other people’s home-loan applications.

The fine related to an offence under section 105 of the Protection of Personal Information Act (POPIA), which deals with mishandling bank account numbers. Nine of the 88 people had account numbers exposed. The regulator’s finding covered both the app’s technical failure and the bank’s handling of two customer reports.

Some account holders had been incorrectly classified as FNB employees. That classification gave them access to a list of names and ID numbers belonging to people with home-loan applications in progress. Clicking a name opened the full file. It showed contact details, a physical address, income and salary information and, in some cases, an account number.

Why did the regulator intervene after two customer reports?

On 30 March 2022, one customer alerted FNB that they could see other customers’ loan applications. A second customer reported the same issue on 3 May 2022.

After each alert, FNB removed the individual’s access, treated the matter as isolated and did not report it to the regulator. The regulator became involved only after a complaint reached it in September 2022.

Information Regulator chair Pansy Tlakula’s notice states: “FNB did not address this vulnerability to the confidentiality of personal information even after two alerts by two parties who were mindful of the fact that they should not have been able to have access to such personal information.”

The regulator said FNB left the vulnerability unaddressed despite both alerts. It called the handling “lackadaisical” and questioned how much longer the information would have remained exposed had it not intervened.

What risks did the regulator identify?

The regulator said the exposed data created risks of identity theft, mobile-number swapping fraud and attempts to bypass banks’ know-your-customer (KYC) checks. A breached file could contain enough personal and financial detail to support each scheme.

The risk increased when criminals combined the FNB data with credit-bureau information from earlier Experian and TransUnion breaches already circulating online. Together, the records could function like a fuller identity dossier, giving criminals additional material with which to target victims.

What did the order require about newspaper collection?

The order also rejected FNB’s stated basis for collecting personal information from newspapers. The bank relied on a POPIA provision it could not lawfully justify for that collection.

Much of the collection supported screening for politically exposed persons (PEPs), meaning people in prominent public positions subject to closer anti-money-laundering vetting. The regulator said a newspaper is not a “public record” as defined in the Act.

FNB must document whether another legal ground permits the collection. If none does, it must stop collecting that information.

What else did FNB have to change?

FNB’s records-retention schedule also permitted indefinite storage of personal information, including cancelled employee tax certificates and registers of securities, without a stated legal basis.

FNB must appoint a records management company to destroy those records. It must also give the regulator a certificate of destruction.

The regulator further ordered FNB to amend its privacy notice. It found that FNB used grounds such as “legitimate interest” when sharing customer information, although those grounds were not valid exceptions allowing further processing under POPIA. The notice also failed to state all customers’ rights under the Act.

What deadlines and responses remain?

FNB must report back with evidence of compliance within 90 days. It has 30 days to appeal the enforcement notice.

The 27 October announcement also included a separate R500,000 fine against Central Johannesburg TVET College.

Hangi Mbedzi, the regulator’s acting senior manager for POPIA, told SABC News that the fines reflected the seriousness of the breaches and the risk to affected people.

TechCentral had asked FNB for comment, including whether it intended to appeal. The bank had not stated its intention when the report was published.

What does the order mean for practitioners?

For practitioners, the notice makes app access and complaint handling part of a broader governance review. Banks should test user classifications, escalate repeat alerts, assess breach-reporting duties, document lawful bases for collection and retention, and align privacy notices with POPIA. FNB must also evidence each ordered change within 90 days, while the 30-day appeal period remains open.