The Banking Association of South Africa - Code of Banking Practice

22.2 Safeguarding against digital banking risks

Digital banking makes real-time banking services and transacting more easily accessible and available. However, there are certain precautions that must be taken to protect you and your bank, and your bank accounts against fraudsters who can try to get unauthorised access to Digital banking profiles.

Take note

Always be vigilant about the origination of emails. Rather call the institution who sent the email to confirm to be certain. An email being sent to you to confirm banking details for a deposit you are about to make, may have been intercepted by a fraudster or scammer and the details changed to a fraudulent account in favour of the fraudster.

What you must do

You must:

familiarise yourself with the safety guidance that we send to you from time to time or as provided on our website or banking app to protect yourself;
be aware and careful when making payments to beneficiaries and, where possible, always try to verify beneficiary bank account details to avoid email compromise scams;
review your statements and reconcile your accounts regularly so that you can identify any suspicious transactions and report them to us;
if your bank makes it available, make sure that you subscribe to receive transaction notifications from us, such as SMSs, to alert you to unauthorised activity on your account;
change your temporary password to a password of your choice known only to you;
never reveal your access credentials to anyone, and especially not to one of our staff members, as these can be used to access your accounts and electronic banking profile;
change your login details on your accounts immediately if you believe that someone may know your access credentials;
not use the web browser facility to store your password online to avoid having to enter it each time you transact using internet banking;
type in our internet banking website address when logging in and not click on a link, making sure that the website is ours and not a fraudulent site, and check the site security certificate for the internet banking website each time before you do your banking;
not use computer terminals to which members of the public generally have access to.

Take note

if you have to use a public computer, make sure to log out after you finish banking;
install and enable adequate antivirus and security software on the device you use to access our mobile application and on the computer you use to access internet banking;
not leave your computer or other devices unattended when you are logged into your internet banking site;
remember to use the screen lock on your computer or other devices;
be aware of scams, such as vishing and phishing, which may include avoiding clicking on any suspicious links sent by email, SMS or other medium;
treat emails, SMSs, or calls you receive with caution;
take care when entering account information and the amount when doing your banking so that when you make payments you transfer the correct amount to the correct account;
change your access credentials if you believe or know that someone has compromised or had sight of them;
regularly change your passwords and ensure that you use a strong password that is not obvious or common and cannot be guessed easily; and
follow our advice.

What we will do

We:

will take reasonable measures to make sure that our digital banking services and related technology are secure, and we will regularly review and update them to make sure that they are secure;
will provide you with regularly updated information on how to access digital banking services, including:
details about your username, selection of appropriate passwords and the availability of additional authentication or security options, and
how to maintain your security;
can, if you fail to change your temporary password immediately, construe this as negligence on your part;
will provide you with the applicable terms and conditions relating to the use of digital banking services, including any fees and charges;
will tell you about the transaction limits that apply to our digital banking services, which we can change from time to time;
will tell you what procedures you must follow to report unauthorised access to your information, accounts or disputed transactions using your digital banking service;
will provide you with effective and convenient means to notify us of security incidents and with easily accessible contact points to report such activity as soon as you are aware of it;
will make sure that transactions through our digital banking services can be traced;
will never ask you to reveal any account details, PIN or access credentials in a letter, email, SMS or telephone call or through messaging services, such as WhatsApp;
cannot reverse any duplicate or erroneous payments you make to other accounts without the specific consent of those accountholders; and
provide you with assistance and guidance on how to stay safe online on our websites or other digital banking services.

22.3 Safeguarding personal information provided to third parties

What you must do

You must inform us if any:

personal information we hold must be updated;
and
information that we have received from third parties is incorrect.

What we will do

We will:

update our records accordingly when you tell us about any changes to your personal information or to the information of your business;
update our records accordingly and engage with the relevant third parties to inform them that the information must be updated;
request any third party obtaining your personal information to maintain adequate security measures; and
only transfer personal information overseas or to another jurisdiction in line with applicable laws.

Term	Explanation
Demand guarantee (or on-demand guarantee)	An undertaking (promise) that someone (or an entity), called the guarantor, gives the beneficiary of the guarantee that the guarantor will satisfy (pay) on demand the agreed amount of money (which often relates to the debts of another, called the principal debtor). Take note A demand guarantee is a primary obligation and is not dependent on the existence of any other debt or agreement. Any disputes between the parties about the underlying debt or agreement do not impact this obligation – the guarantee must be paid on demand.
Device	A tablet, cellphone and wearable or similar technology.
Device credentials	Includes but is not limited to: a password, passcode, unlock pattern and login details used as a method of accessing a device or authorising a transaction through a device.
Digital banking	Cellphone banking, internet banking and a banking app or other digital means.
Direct marketing	Us approaching you in person or by mail or by electronic communication, including email, SMS, and automatic calling machines, for the direct or indirect purpose of promoting or offering to supply, in the ordinary course of business, any goods or services to you; or requesting you to make a donation of any kind for any reason. Take note An automatic calling machine makes automated calls without human intervention.
Dormant account	An account on which you have initiated no activity for a period that we have established in advance and in accordance with the rules relating to the specific type of account.

Term	Explanation
Access credentials	The way you access your digital banking services, including your access code, password, or other unique means of personal identification.
Agent	A third party, either a company or a person, that your bank appoints to render a service. This can include third-party debt collection agencies that collect debts on behalf of your bank.
Applicable laws	Any laws in force from time to time; and any applicable industry code, guidance, policy, or standard enforceable by law; or any order that is set out by a regulator.
ATM (automated teller machine)	A machine that you use to withdraw cash and to access other banking services, including balance enquiries and prepaid purchases.
Banking app	An application on your device that allows you to transfer money from one of your accounts to another, pay bills, see statements and perform other transactions.
Basic banking services	The opening, operation, and maintenance of transactional accounts.

Term	Explanation
Vulnerable customer	A natural person, who because of personal circumstances, is especially susceptible to harm, particularly when a bank does not act with appropriate levels of care. Take note Where parts of this Code apply only to vulnerable customers and the term ‘you’ is used, it means vulnerable customers in that part. Vulnerable customers can include customers who: have a physical disability; have psychological problems and/or mental health problems; have a debilitating illness; have limited financial literacy; experience changed or changing financial circumstances; experience adverse life events; are susceptible because of: their age (the youth, due to a lack of experience, or the elderly, in other words people of 65 and older), language barriers, loss (such as of a job, a family member through death, because of divorce or an illness), or geographical location (which can lead to customers not being able to access certain banking products and services); and is at a higher risk of experiencing unfair treatment because of » a limited ability to maintain or develop their wellbeing, difficulty in obtaining or understanding information, or being unable to access, choose or buy suitable products (and services).
We, our, us	Your bank
Written	Something in writing, including electronic representations of information, such as an SMS or email, that is stored, sent, or received by electronic means.

Term	Explanation
Loyalty programme	Any arrangement or scheme where a supplier of goods or services or a similar entity offers or grants any loyalty credit or award in connection with a transaction or agreement to you. Take note Your bank will apply the principles in this Code to a loyalty programme where you are a: natural person. OR juristic person; partnership or trust; and your asset value or annual turnover is less than R2 million. AND Where the Consumer Protection Act 68 of 2008 applies.
Money laundering (ML)	Any activity that has or is likely to have the effect of concealing or disguising the nature, source, location, disposition, or movement of the proceeds of unlawful activities, or any interest that anyone has in such proceeds.
Natural person	An individual and sole proprietor. Take note Where parts of this Code apply only to a natural person and the pronoun ‘you’ is used, it means a natural person in that part.
NCA	The National Credit Act, 34 of 2005, that aims to regulate the business of credit providers and places a variety of obligations on credit providers (mainly aimed at protecting credit consumers), including the prevention of reckless lending practices and measures to enhance disclosure of information to credit consumers.

Term	Explanation
POPIA	The Protection of Personal Information Act, 4 of 2013, that aims to promote the protection of personal information processed by public and private bodies; introduce certain conditions so as to establish minimum requirements for the processing of personal information; provide for the establishment of an Information Regulator to exercise certain powers and to perform certain duties and functions in terms of this Act and the Promotion of Access to Information Act, 2000; provide for the issuing of codes of conduct; provide for the rights of persons regarding unsolicited electronic communications and automated decision making; regulate the flow of personal information across the borders of the Republic; and provide for matters connected therewith.
Proliferation financing (PF)	Any act of providing funds or financial services that are used, in whole or in part, for the manufacture, acquisition, possession, development, export, trans-shipment, brokering, transport, transfer, stockpiling, or use of nuclear, chemical or biological weapons and their means of delivery and related materials in contravention of national laws or, where applicable, international obligations.
Promotional competition	A competition or game that we conduct for the purpose of promoting our products and/or services and where we distribute prizes to participating winners. Take note Your bank will apply the principles in this Code to a promotional competition where you are a: natural person; OR juristic person; trust or partnership, your asset value or annual turnover is less than R2 million. AND Where the Consumer Protection Act 68 of 2008 applies.

Term	Explanation
NCA credit agreement	A credit agreement as defined in the NCA with a customer to which the NCA applies. Take note Your bank will apply the NCA to a credit agreement concluded with you if you are a: natural person; or trust with one or two trustees (and the trustees are not juristic persons); or stokvel.
Password	A string of characters that allows you to access various services (such as digital banking, your device, or your email account) and that is also used for identification. Take note If there is any occasion that you are given a temporary password, you must change this to your own unique password.
Person	A natural and a juristic person. Take note Where parts of this Code apply only to persons and the pronoun ‘you’ is used, it means persons in that part.
Personal customer	Natural persons or sole proprietor who maintain an account or who receive other services from a bank. Take note Where parts of this Code apply only to personal customers and the pronoun ‘you’ is used, it means personal customers in that part.

Term	Explanation
Fixed interest rate	An interest rate that remains unchanged and not affected by market rate fluctuations for the specified period of the loan or credit agreement or other product.
Integrity	To be accurate, consistent, and reliable.
Interest	The amount we charge you in respect of the amount you owe us; or the amount we pay you in respect of for example, your savings or investment account, usually expressed as a percentage with reference to a period, such as per annum.
Internet banking	An internet-based system that is provided by us and allows you to transfer money between your accounts, pay bills, see statements, and perform other transactions.
Juristic person	Includes a trust, partnership, association, body of persons, body corporate, company or close corporation or similar entities with legal rights and duties either incorporated in or outside the Republic of South Africa, which has legal personality or enjoys a similar status in terms of which it may enter into contractual relations and legal proceedings. Take note Where parts of this Code apply only to juristic persons and the pronoun ‘you’ is used it means juristic persons in that part.
Loyalty credit or award	Any benefit or a right to goods, services, or other benefits (including points, credits, tokens, devices or other intangible or tangible things that can accrue to you) that you can accumulate and entitles you to certain goods, services or benefits that are part of a loyalty programme.

Term	Explanation
Promotional offer	An offer we make you of a prize, a reward, gift, free goods or services, a price reduction or other benefit, such as a voucher entitling you to a price reduction or other benefit. Take note Your bank will apply the principles in this Code to a promotional offer where you are a: natural person; OR juristic persons; trust or partnership; your asset value or annual turnover is less than R2 million. AND Where the Consumer Protection Act 68 of 2008 applies.
Reasonable	Justifiable and comparable to the service provided.
Sanctions	Restrictions on activities that relate to particular countries, goods and services, or persons and entities. Take note South Africa implements the targeted financial sanctions (TFS) that originate from the United Nations Security Council resolutions under Chapter VII of the Charter of the United Nations (UNSCR). For these sanctions to be given effect FICA requires accountable institutions to freeze property and transactions pursuant to financial sanctions imposed in the UNSCR.
Security	Items of value, such as a mortgage bond registered over a property, share certificates and life policies, which represent assets used as support for a loan or other credit facilities. Take note If you do not repay the loan for which you have provided security, we have the right to dispose of the security.

Term	Explanation
Personal information	Information relating to an identifiable, living, natural person and, where it is applicable, an identifiable, existing juristic person, including, but not limited to: information relating to the race, gender, sex, pregnancy, marital status, national, ethnic, or social origin, and colour, sexual orientation, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language, and birth of the person; information relating to the education or the medical, financial, criminal or employment history of the person; any identifying number, symbol, email address, physical address, telephone number, location information, online identifier, or other particular assignment to the person; the biometric information of the person; the personal opinions, views, or preferences of the person; correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the content of the original correspondence; the views or opinions of another individual about the person; and the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.
Phishing	The fraudulent practice of sending emails or other messages claiming to be from reputable companies to make individuals reveal personal information, such as passwords and credit card numbers.
PIN (personal identification number)	A number that is provided to you or that you choose on a strictly confidential basis, such as a card PIN that will enable you to draw cash and access other services from an ATM or point-of-sale device and that can also be used as an authentication mechanism.

Term	Explanation
Credit agreement	A legal contract in terms of which we lend you a certain amount of money for a specified period or finance movable goods and that outlines the terms and conditions associated with the contract, including your periodic repayments of the loan plus interest or, in the event of a lease, the monthly rental. The NCA does not apply to your credit agreement with your bank if: you are a juristic person (subject to the below principles regarding trusts); or you are a trust with three or more trustees; or you are a trust with one or two trustees, but the trustees are juristic persons; or you are a partnership; and your asset value or annual turnover is R1 million or more.
Customer	A personal customer and an SMME. Take note Where parts of this Code only apply to a customer of a bank and the pronoun ‘you’ is used, it means customer in that part.
Debit order	A mandate, being a written, verbal, or electronic authority that you give to a service provider, allowing a service provider to debit your bank account.
Deposit	Putting money into an account, thereby increasing the credit balance, or reducing any debit balance.

Term	Explanation
Cardholder	A customer who has a card, or a secondary cardholder linked to the account of the customer.
Charges [or fee(s)]	An amount or amounts that we can charge in respect of a transaction, product, an account, or a service that we offer.
Conduct Standard for Banks, 3 of 2020	The standard that applies to banks in relation to our provision of financial products and financial services. The aim of the standard is to make sure that we treat you as our customer fairly in accordance with six treatingcustomers- fairly outcomes, namely: Outcome 1 – Fair treatment is central to the culture of banks; Outcome 2 – Products and services in the retail market that are sold and marketed are designed according to the needs of the customers identified and targeted accordingly; Outcome 3 – Customers are provided with clear information and kept appropriately informed before, during and after point of sale; Outcome 4 – Advice is suitable and according to the customer’s circumstances; Outcome 5 – Service is of an acceptable standard and products perform as customers have been led to expect; and Outcome 6 – Customers do not face unreasonable after-sale barriers when they want to change a product, switch providers, submit a claim or make a complaint.
Contact details	Details that you have provided us with to contact you, such as your address, email, telephone, and cellphone information. Take note We require your address to send you communications and notices, including legal notices.

Term	Explanation
Suretyship	An undertaking (promise) by a person called the surety, that the surety as coprincipal (joint) debtor will pay the debts of another, called the principal debtor, if the principal debtor fails to pay or does not perform some other legal obligation in a contract. Take note A suretyship is dependent on the existence of any other debt or agreement.
Terrorist financing (TF)	Any activity that has, or is likely to have, the effect of concealing or disguising the nature, source, location, disposition or movement of funds for the purposes of financing any act of terrorist and related activities, as defined in regulations and/or any property in possession or under the control of a bank that is associated with specified entities (terrorists or terrorist organisations).
Transaction account	An account into which you can pay money or into which people can pay money to you and from which you can pay third parties.
Unique means of personal identification	A selection of memorable facts and information of a private and personal nature that you choose and of which only you know the sequence. Take note You can use the selection of facts and information for identification and for verifying identification when accessing accounts.
Username	A sequence of characters used by a person to access a computer, network, or other digital banking services, such as internet banking.
Verification	The process of confirming the accuracy or validity of information provided by you, by comparing it against information contained in documents or electronic databases created by reliable and independent third-party sources.
Vishing	The fraudulent practice of making phone calls or leaving voice messages claiming to be from reputable companies to make individuals reveal personal information, such as bank details and credit card numbers.

Term	Explanation
Electronic wallet	An electronic or digital container in which you can securely store value or add a card (typically including technologies to interface with point-of-sale devices, such as QR code scanners, near-field communications, and other wireless communication technologies), thereby providing a secure means of transacting and transferring value between you and businesses.
Email compromise	A type of cybercrime where the fraudster or scammer uses email to trick someone into sending money or divulging confidential information.
Exchange rate	The current market price at which one currency can be exchanged for another.
Fee(s) (or charges)	An amount or amounts that we can charge in respect of a transaction, a product, an account, or a service that we offer.
FICA	The Financial Intelligence Centre Act, No 38 of 2001 (FICA) (as amended). Take note This legal framework exists to help identify the proceeds of unlawful activities and to combat activities related to money laundering, terrorist funding and tax evasion.
Financial difficulties	Any circumstances that can have an adverse effect on your financial ability to fulfil contractual obligations in terms of agreements you entered into.
Financial education	The method by which customers: improve their understanding of financial products, concepts, and risks through acquiring information, and develop the skills and confidence to become more aware of financial risks and opportunities, allowing them to: make informed choices, know where to go for assistance, and take other effective actions to improve their financial wellbeing.

Term	Explanation
Beneficial owner	A defined natural person who independently or together with another person ultimately owns or exercises effective control over a juristic person and ultimately owns or exercises effective control over a juristic person customer, thereby applying a transparent principle through multiple layers of corporate ownership. Take note This definition provides for a singular, natural person beneficial owner, unless the ownership, interest or control is held or exercised jointly in a material manner, in which case all joint holders will collectively be deemed to be the beneficial owner(s). In the case of trusts the definition specifically includes all founders, settlors, donors, trustees, protectors, and named beneficiaries. In the case of partnerships this specifically includes all partners.
Bundled	Selling goods or services together as a required package, but: they have been packaged together for your benefit and convenience, including any savings in charges for you or we sell the bundled products or services separately and there is individual prices for those products or services. Your bank will apply the principles in this Code to bundled goods or services where you are a: natural person; OR juristic person; partnership or trust; and your asset value or annual turnover is less than R2 million; AND Where the Consumer Protection Act 68 of 2008 applies.
Business day	Any day other than an official South African public holiday, Saturday, or Sunday.
Card	Any card (physical plastic or virtual card issued to you) or card information that allows you to pay for goods and services and, where applicable, for performing functions at an ATM or point-of-sale device.

Term	Explanation
Setoff	Our using available funds in one of your accounts for settling a debt or part of a debt in one of your other accounts. Take note “Setoff’ is the noun or name of the activity and “set off’ is the verb that describes the action.
Site security certificate	A validation and encryption tool that shows that a website is secure, and that data is encrypted for your security. Take note You can see the site security certificate when you click on the closed padlock in the status bar of your browser window.
SMME (small, medium and microenterprise)	A juristic persons whose turnover for the past financial year was up to and including R10 million. Take note Where parts of this Code apply only to SMMEs and the pronoun ‘you’ is used, it means SMMEs in that part.
Social engineering	The use of fear or pressure or other psychological methods to obtain personal and confidential information from you, such as by tricking you to disclose information you would not usually disclose or by getting you to install malware on your computer for fraudulent purposes.
Stop order	An instruction that you give us to pay an amount to a nominated beneficiary regularly.

Protecting your account

22.2 Safeguarding against digital banking risks

Take note

What you must do

Take note

What we will do

22.3 Safeguarding personal information provided to third parties

What you must do

What we will do