By Bongani Hini
Anyone I’ve spoken to lately has a complaint about it. The 7am robocalls. The relentless stream of phishing SMSes. The spammy emails offering dubious funeral or car insurance deals. It’s no wonder so many South Africans feel vulnerable and unsure who has access to their data, or worse, who is selling it.
We like to think our personal information is protected. South Africa’s Protection of Personal Information Act (POPIA), which came into effect in 2020, gives individuals ownership over their data. But the reality is starkly different. Despite the legislation, enforcement remains weak, and consequences for data breaches or misuse are rare. If data truly belongs to the individual, as the POPIA insists, then South Africans have every right to ask why they still feel like they’re being mined for profit by businesses that face little accountability.
This situation becomes even more critical when we bring open finance into the picture. Open finance is a system where consumers can give permission for different financial institutions, not just banks but also insurers, investment platforms, and others, to share their data with trusted third parties. The goal is to help consumers access better financial products, save money, or manage their finances more easily. If done right, it can open up the financial system to more innovation and more personalised services, giving people greater control over their financial lives.
South Africa, facing staggering inequality, low levels of financial inclusion, and a legacy of mistrust in institutions, could stand to benefit enormously from a well-regulated open finance framework. Done right, it could help close the inequality gap, improve access to affordable credit, and even shift the power balance back to the consumer. But done poorly, it risks further exploiting the very people it’s supposed to help, especially when basic privacy protections still aren’t properly enforced.
Globally, there are lessons to learn. In the European Union, the move toward open finance is guided by progressive regulation, most notably the Revised Payment Services Directive (PSD2). Its primary purpose is to enhance consumer protection, foster innovation, and improve competition in the payments sector. PSD2 requires banks to provide regulated third-party providers with access to customer account data, but only with the customer’s explicit consent. This shift gave rise to a new generation of fintech innovation, built on the principle that consumers, not institutions, should control their financial information.
Germany, in particular, has become a cautionary example in how tight regulation can sometimes slow down innovation. German AI firms, such as Heidelberg-based Aleph Alpha, have warned that the EU’s new AI Act, although well-intentioned, may overcorrect and make it difficult for European startups to compete globally, especially against less-restricted American or Chinese counterparts.
On the flip side, China’s fintech explosion has shown what can happen when innovation vastly outpaces regulation. Mobile payment platforms like Alipay and WeChat Pay transformed the Chinese economy, but at the cost of massive data collection and blurred consent boundaries. In recent years, China has introduced stricter oversight of its technology and financial sectors, including rules around algorithmic accountability and data governance. However, the country still lacks a dedicated open finance framework, and many of its efforts are still unfolding. The Chinese experience is a reminder that waiting too long to regulate can lead to consumer harm, followed by heavy-handed responses that may limit future innovation.
The United States is now trying to strike a middle ground. In 2024, the Consumer Financial Protection Bureau (CFPB) finalised rules that compel banks to give consumers control over their own financial data. It’s an approach that prioritises individual rights without stifling innovation, and it is a model that’s worth watching closely.
South Africa doesn’t need to copy any single system. But it does need to find its own balance: strong enough regulation to protect consumers, but agile enough to support local fintech innovation. The Financial Sector Conduct Authority (FSCA) has flagged open finance as a strategic focus, and there’s increasing collaboration between regulators and the private sector. Yet legislation specific to open finance is still missing, and for now, many data-sharing practices remain unclear and unregulated.
This conversation also cannot be separated from the country’s developmental priorities. South Africa has one of the youngest populations in the world, and many of its socio-economic challenges, from unemployment to financial exclusion, are deeply interlinked. Open finance, if steered correctly, could become a powerful lever for development. It could enable access to tools that help young people build credit histories, access low-cost financial services, launch small businesses, or simply gain better control over their financial lives. But this will require more than just regulatory frameworks. It demands real investment in infrastructure, digital literacy, and capacity-building so that innovation does not only benefit the few, but lifts the many.
We are at a critical point. South Africa has the chance to design a model that protects people, encourages innovation, and builds trust. But it must begin with a cultural and institutional shift where consumer rights are treated not as afterthoughts, but as the foundation of a healthy financial system. Until we start enforcing our existing laws and calling out the shady data practices that still go unpunished, it will be difficult to convince the average South African that they truly own their financial data.
The potential is there. But the question remains - do we have the political will, regulatory muscle, and the industry leadership to get it right?