Blog post

Many organisations still treat compliance awareness like fire‑fighting. Nothing happens for months. Then a regulator moves, a sanction hits the news, or a board suddenly wants assurance – and training becomes urgent. Activity spikes, reports are pulled, and a few months later nobody is sure what the record really shows.

The South African enforcement backdrop

In South Africa, the pattern is visible across FICA, POPIA and the Consumer Protection Act.

• Under FICA, anti‑money laundering enforcement has become much sharper, with large administrative sanctions and a steady stream of penalties for weak risk management and compliance programmes.
• Under POPIA, enforcement has moved from theory to practice, with ongoing investigations, enforcement notices and court applications around data breaches, direct marketing and failure to follow the Regulator’s instructions.
• Under the CPA, consumer‑protection enforcement has also become more visible again, with fines, settlements and sector inspections reported through the National Consumer Commission and Tribunal.

The underlying risks have been there all along. Customers still have rights under the CPA. Personal information is still collected and exposed under POPIA every day. Accountable institutions still sit inside FICA’s regime.

What tends to move is training attention.

When a particular law is noisy, budgets and calendars appear. When the headlines move elsewhere, that awareness often loses its slot again.

Why reactive compliance training produces weak evidence

Reactive campaigns launched in a hurry usually look strong on the surface and fragile underneath.

They often:

• include the wrong people because audience mapping is rushed
• use generic content that tries to cover everyone and lands sharply for almost no one
• choose routes that do not fit the workforce’s real working conditions
• leave behind a patchwork of exports, spreadsheets and ad hoc reports that nobody wants to maintain.

When a board, regulator or customer later asks what was done, it becomes hard to show that the right employees received the right awareness in a way they could realistically complete – and hard to produce a clean report of who was included, what they received, what they completed and who remains outstanding.