FSCA Unveils OMNI-Risk Return: A New Era For Risk

Supervision in South Africa

The Financial Sector Conduct Authority ("FSCA") published the draft OMNI-Risk Return and an Explanatory Guide on 30 September 2025, kicking off a two-month consultation period until 30 November 2025. The OMNI-Risk Return is set to become the foundational data source for the FSCA's new automated, harmonised supervisory risk model, which will be embedded within its Integrated Regulatory Solution ("IRS") supervisory technology ("SupTech") platform.

This development is significant for the financial sector and replaces fragmented, licence-by-licence assessments with a single, comparable risk profile for each financial institution. By introducing standardised indicators and automation, the FSCA aims to reduce inconsistency, manual effort and delays in supervision. The streamlined and harmonised data collection process is designed to minimise duplication and clarify reporting obligations, ultimately lowering the reporting burden for institutions. Importantly, the new model will enable early risk detection as data-driven signals will support proactive and proportionate interventions, leading to better outcomes for customers.

The data collected through the OMNI-Risk Return will be used in several ways. It will inform risk-based and proportionate supervision, determining the nature, frequency and intensity of supervisory activities. The data will also serve as early-warning indicators for conduct, governance, operational and failure risks. Over time, it will enable peer benchmarking and the identification of outliers, support focused enforcement prioritisation and provide evidence for policy calibration.

Reporting through the OMNI-Risk Return is expected to occur annually, though this frequency may be reviewed as the model evolves. An industry pilot is planned for mid-2026, with the full IRS Go-Live scheduled for September 2026. The FSCA anticipates a phased implementation to accommodate varying levels of sector readiness.

The OMNI-Risk Return is structured into twelve sections, each capturing key risk drivers across business models and operations. These sections cover:

• Group structure, ownership and shared services (including inter-group funding and beneficial ownership links to Financial Action Task Force ("FATF") risk jurisdictions)
• Geographical presence (jurisdictions and physical footprint)
• Governance (board composition, diversity, skills, remuneration and incentives, non-compliance tolerance and remediation, insurancehttps://www.ensafrica.com/news/detail/10820/fsca-unveils-omni-risk-return-a-new-era-for-r and guarantee claims)
• Customer base and politically exposed persons ("PEPs") (legal entity mix, natural person segments, PEPs and exposure to grey- or black-listed jurisdictions)
• Handling of customer assets (fiduciary scale, third-party collections, allocation timeliness, border and metropolitan flows, cross-border transfers, unclaimed assets, high-risk product transactions, and arrear retirement fund contributions)
• Transaction volumes, distribution channels, and composition (channel risk and reliance, Financial Market Infrastructure ("FMI") and Credit Rating Agency ("CRA") activity, intermediary force profile)
• Product and agreement terminations (customer- and institution-initiated, insurance lapse, cancellation, surrender, non-renewal, trade cancellations or failures, and listings quality)
• Advertising and communications (channels, spend, amendments, direct customer communications)
• Complaints management (volume, resolution, turnaround times, Ombud escalations and outcomes)
• Information technology ("IT") and data governance and Protection of Personal Information Act ("POPIA") (audit findings, data quality, emerging technology usage, system availability, breaches, and impact)
• Outsourcing and organisational capacity or skills (vacancies, conduct-related training, extent of outsourcing)
• Financial data (revenue or turnover, expenditure, funding and gearing, inter-group funding, and group turnover context)

A key compliance requirement is that each submission must include a formal Declaration confirming the accuracy and completeness of the information, signed by a member of the governing body or executive management. Submissions without this Declaration will be considered incomplete.

In summary, the OMNI-Risk Return marks the first step in the FSCA's modernised, outcomes-based supervisory approach under the IRS. Industry input by 30 November 2025 is critical to ensuring a streamlined, proportionate framework that improves consistency, reduces burden and strengthens early risk detection across South Africa's financial sector.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.