Why the CoFI Bill Matters Now

South Africa's financial sector is heading into one of its biggest regulatory overhauls in decades. The Conduct of Financial Institutions Bill (CoFI) is a fundamental reset of how banks are expected to behave, govern themselves, and treat customers.
 

The CoFI Bill South Africa forms a key component of the country's Twin Peaks regulatory reform and will primarily focus on strengthening market conduct regulation across the entire financial services sector. 
 

Following two rounds of public commentary, CoFI is expected to be tabled in Parliament in the first quarter of 2026. Promulgation is anticipated in 2026, with a transitional period of approximately three years to follow.
 

That transition period sounds generous, but it is not. The institutions that start preparing now will have a measurable compliance advantage over those that wait for the final text.
 

What Is the CoFI Bill?

The Conduct of Financial Institutions Bill (CoFI) is a landmark piece of legislation designed to unify South Africa's fragmented financial sector laws under a single, principles-based conduct framework.
 

South Africa currently regulates financial conduct through a patchwork of sector-specific laws. The CoFI Bill changes that. It will consolidate and replace various industry-specific conduct laws, including the Financial Advisory and Intermediary Services Act, the Collective Investment Schemes Control Act, the Short-term Insurance Act, the Long-term Insurance Act, the Credit Rating Services Act, the Financial Institutions (Protection of Funds) Act, and the Friendly Societies Act. 
 

It also brings a significant shift in regulatory philosophy. Rather than prescribing exact rules for every scenario, the CoFI Bill South Africa moves toward conduct-based regulation. Financial institutions are expected to demonstrate that their decisions and processes consistently deliver fair outcomes for customers.
 

The Financial Sector Conduct Authority (FSCA) is the primary regulator responsible for implementing and supervising compliance with CoFI. The FSCA Commissioner has emphasised that readiness for CoFI is an industry-wide responsibility, not solely the FSCA's. Financial institutions and banks must proactively align their business models, governance frameworks, and compliance strategies with CoFI's principles and expectations. 

In short: the FSCA will not carry institutions across the line. That work belongs to each institution.

Key Objectives of the CoFI Bill

Understanding what the CoFI Bill is trying to achieve helps institutions prioritise where to focus first. The Bill is built around four core objectives:
 

- Fair customer outcomes

Every product, service, and interaction must be designed and delivered with the customer's best interest as the measurable standard. It will be assessed and enforced.
 

- Market integrity and transparency

The CoFI Bill South Africa requires institutions to be honest and clear in how they communicate, price products, and disclose risks. Opacity is no longer a defensible position.
 

- Strengthened consumer protection

The CoFI Bill reflects a deep understanding of both consumer protection and market realities. The FSCA has been deliberate in recognising the strain that constant regulatory changes place on institutions. CoFI is designed to give a single, flexible framework that aligns with international best practice and responds to modern risks.
 

- Risk-based supervision

The FSCA will not apply the same level of scrutiny to every institution equally. Higher-risk institutions and products will attract more intensive oversight. This makes internal risk controls and conduct monitoring critical infrastructure, not optional extras.

As Lizl Budhram, Head of Advice at Old Mutual Personal Finance, put it, "South Africa's regulatory framework has reached a point of maturity. It's time to consolidate, simplify, and lead with purpose. CoFI gives us the clarity, cohesion, and confidence to do just that.”

What the CoFI Bill Means for Banks in South Africa

This is where the CoFI Bill South Africa becomes most relevant for banks and financial institutions operating day to day.
 

1. Increased accountability for conduct

Under the Conduct of Financial Institutions Bill (CoFI), banks cannot delegate accountability for poor customer outcomes to product complexity or market conditions. Boards and senior management will be expected to demonstrate active oversight of conduct risk, not just sign off on compliance policies.
 

2. Stronger governance and internal controls

Institutions will need to ensure that key persons and representatives satisfy fit and proper requirements, maintain sound corporate governance standards, and implement appropriate remuneration and conflict of interest policies. Governance gaps that regulators previously tolerated will receive direct scrutiny under CoFI.
 

3. Product design and customer fairness

Banks will need to demonstrate that financial products are designed for the customers they are sold to, not just technically compliant. This includes reviewing existing product lines to assess whether they genuinely serve customer needs at every stage of the product lifecycle.
 

4. Enhanced disclosure and reporting obligations

Financial institutions must meet all reporting, record-keeping, and audit requirements under CoFI at all times. This means updating disclosure frameworks so that customers receive clear, relevant, and timely information before making any financial decision.
 

5. Alignment with Treating Customers Fairly (TCF)

The CoFI Bill formally embeds the TCF framework into law. What was previously a principles-based expectation becomes a legal obligation. Fair customer treatment practices must be strengthened in line with the Treating Customers Fairly (TCF) principles across every customer-facing function in the institution.

Compliance Requirements and Operational Impact of the CoFI Bill

Knowing what CoFI requires is one thing. Building the operational capacity to meet those requirements consistently is another. Here is what banks need to put in place:
 

- Updated compliance frameworks: Existing frameworks built around the old sector-specific laws will need to be reviewed and restructured. Financial institutions are advised to begin mapping their current activities to prepare for the activity-based licensing model and to develop compliance frameworks aligned with this approach.
 

- Risk and conduct monitoring: CoFI's risk-based supervision model means institutions need live visibility into conduct risk across all business lines. This requires moving beyond periodic reviews toward continuous monitoring of how products are sold, how complaints are handled, and how customer outcomes are tracked.
 

- Data and reporting requirements: The CoFI Bill South Africa demands accurate, timely, and structured data. Reporting frameworks may need to be updated, while transformation policies and related structures should be developed or enhanced. Institutions relying on manual reporting processes will struggle to meet these requirements at scale.
 

- Staff training and internal policies: Conduct-based regulation requires staff at every level to understand not just the rules but also the intent behind them. Training programmes need to move beyond tick-box completion toward embedding conduct principles into day-to-day decision-making.
 

- Integration with AML and KYC processes: The CoFI Bill does not operate in isolation. Its customer fairness and due diligence obligations intersect directly with existing AML, KYC, and FICA requirements. Institutions that treat these as separate workstreams will create compliance gaps. The smarter approach is integration: a single customer view that supports both conduct and financial crime obligations simultaneously.
 

Also Read: How can Banks in South Africa Ensure Compliance with AML Regulation

How Banks in South Africa Can Prepare for the CoFI Bill

The three-year transitional period following promulgation is not a grace period. It is the window institutions have to demonstrate that they are genuinely building toward compliance, not scrambling at the deadline.

Here are the practical steps banks in South Africa should be taking now:
 

• Conduct a gap assessment: Map current governance structures, product lines, disclosure practices, and compliance frameworks against CoFI Bill South Africa requirements. Identify where the gaps are before the regulator does.
• Upgrade compliance systems: Automated and technology-driven systems and processes should be reviewed to confirm that they remain fit for purpose under the new regulatory expectations. Systems designed for the old regulatory environment may not meet CoFI's conduct monitoring, reporting, and audit trail requirements.
• Automate monitoring and reporting: Manual processes cannot scale to meet the continuous monitoring expectations of the CoFI Bill. Automated compliance tools that track conduct indicators, flag anomalies, and generate structured reports give institutions the visibility and speed regulators will expect.
• Strengthen customer due diligence: CoFI's customer fairness obligations require institutions to genuinely know their customers, not just verify their identities. Enhanced CDD processes that capture customer needs, risk profiles, and product suitability assessments will become baseline expectations, not differentiators.
• Use RegTech solutions: Early preparation will ensure agility and competitiveness once the new regime takes effect. RegTech platforms that integrate conduct monitoring, KYC, AML, and reporting into a single operational layer give banks the infrastructure to meet CoFI Bill South Africa requirements without building parallel compliance systems from scratch.
   

Youverify's compliance platform supports banks in building exactly this kind of integrated infrastructure, combining automated identity verification, transaction monitoring, customer risk profiling, and audit-ready reporting in one place. As CoFI's obligations take effect, that connected approach will matter more than any individual compliance tool.

Conclusion

The CoFI Bill South Africa is a major shift in how banks are expected to operate, govern themselves, and prove compliance. As shown throughout this article , success under CoFI will depend on strong oversight, continuous monitoring, and the ability to demonstrate fair customer outcomes in real time.
 

Trying to meet these requirements with disconnected systems or manual processes will slow institutions down and create gaps. The reality is that compliance, customer due diligence, and conduct monitoring now need to work together as one system, not separate functions.
 

Youverify helps banks achieve this by bringing identity verification, transaction monitoring, customer risk profiling, and reporting into a single platform. With the right infrastructure in place, banks can stay compliant, reduce operational pressure, and move into the CoFI era with confidence.

 Speak to our compliance experts to see how this works for your financial institution.