National Credit Act

The National Credit Act (NCA) operates in a sector where credit providers, credit bureaux and related credit-market participants rely on the accurate, controlled and confidential handling of consumer credit information. From a cybersecurity perspective, this makes confidentiality, data accuracy, secure records, access control and governance-friendly evidence important parts of managing credit information risk.

Act no: 34 of 2005

Type: Rules-based

Purpose: To promote a fair, transparent, and accessible credit market by regulating consumer credit and protecting consumers from unfair practices.

Credit providers, Credit bureaux, Debt counsellors, Payment distribution agents, Alternative dispute resolution agents, Consumers.

Financial institutions, retail credit providers, and entities involved in processing consumer credit information.

• Confidential Consumer Credit Information: Any person who receives, compiles, retains or reports confidential consumer information under the Act must protect the confidentiality of that information. [Section 68]
• Consumer Credit Record Accuracy: Credit bureaux must take reasonable steps to verify the accuracy of consumer credit information. [Section 70(2)(c)]
• Consumer Credit Record Security: Credit bureaux must maintain consumer credit information records in a manner that satisfies prescribed standards. [Section 70(2)(e)]
• Access and Correction Rights: Consumers have the right to access their credit information and request corrections of inaccurate information. [Section 72(1)]

The National Credit Regulator may impose administrative fines for non-compliance, which can be up to 10% of the annual turnover of the credit provider during the preceding financial year. [Section 151(3)]

Certain contraventions of the Act may constitute offenses, leading to criminal prosecution and penalties. [Section 160]

The National Credit Regulator may suspend or cancel the registration of a credit provider or credit bureau for failure to comply with the Act. [Section 57]

Non-compliance can lead to public censure, loss of consumer trust, and negative publicity, adversely affecting the organization’s reputation and business operations. [Section 150]

Provides a safe, non-invasive external vulnerability scan of your public digital footprint, highlighting security weaknesses that may be visible to attackers.

• Confidential Consumer Credit Information: Identifies externally visible vulnerabilities that could increase the risk of unauthorised access to confidential consumer credit information. [Section 68]
• Consumer Credit Record Security: Helps management document external risk exposure around systems used to maintain consumer credit records, supporting security oversight. [Section 70(2)(e)]

Supports DMARC implementation and monitoring to help reduce domain spoofing risk, improve outbound email trust, and move safely towards enforcement.

• Confidential Consumer Credit Information: Supports stronger email-domain authentication to reduce the risk of spoofed emails using the organisation’s domain where confidential consumer credit information may be communicated or relied on. [Section 68]

Provides a simple point-in-time Governance Record showing how the domain is set up to help protect against email impersonation, based on externally visible email authentication signals.

• Confidential Consumer Information: Helps management document domain-level email impersonation risk, supporting oversight of email-domain trust where confidential consumer credit information may be communicated or relied on. [Section 68]

• Department of Justice: Link to the Act
• Information Regulator: Code of Conduct for Credit Bureaux

(Links verified and active as of May 2026)