The Prudential Authority (PA) says Ithala’s “outdated” banking system has made the institution susceptible to cyberattacks — with tension between the regulator and the state-owned entity boiling over.
The PA in its presentation to the parliamentary standing committee on finance, dated September 4, said Ithala had been operating an outdated core banking system that was discontinued several years ago and was not supported by the developer.
“The lack of a modern banking system has resulted in Ithala struggling to comply with the principles of risk data aggregation and risk reporting. Furthermore, Ithala has been impacted by several cyberattacks since 2021 and remains susceptible to more,” the PA stated.
“An initiative to modernise its core banking system resulted in an unsuccessful Tech Mahindra project, which was clouded by maladministration and R34.97m of irregular expenditure in 2021.
“The PA conducted a section 7 investigation on the Tech Mahindra project and uncovered the mismanagement in which Ithala did not take action to recover the lost funds other than reporting a criminal case with the police.”
Ithala denied it had been a victim of several cyberattacks over the past four years and said it upgraded its systems last year. Thulani Vilakazi, CEO of Ithala, said the company’s systems were holding up well.
“According to the IMF, as we become more reliant on digital banking and payments, the number of cyberattacks has tripled over the last decade, and financial services is the most targeted industry. Attackers target large and small institutions, rich and poor countries, and operate without borders,” he said.
“Fighting cybercrime and reducing risk must therefore be a shared undertaking across and inside countries. In SA all the big banks have been victims of cyberattacks. Ithala is therefore not immune to this threat. However, Ithala has had no cyberattack. Hence, there has been no financial implication.
“We have always taken every measure to ensure that client information and assets are secure. Client information and assets have never been compromised. We will continue to strengthen our cybersecurity environment to prevent cybersecurity attacks and put effective measures in place to protect client’s data in the event of a cybersecurity attack.”
He said the company had launched a civil case, and a criminal case had been instituted against Tech Mahindra to recover monies looted from the company.
Ithala’s ambitions of being a fully fledged bank were dealt a blow in December after a repayment administrator was appointed to look after its affairs, in a move that essentially begins the process of winding down its deposit-taking activities.
The Reserve Bank has appointed Johan Kruger, one of SA’s leading investigators into Ponzi and pyramid schemes, as Ithala’s repayment administrator after a court order in December. According to the Bank’s website, a repayment administrator is appointed to “manage and control the repayment of the money unlawfully obtained”.
While not a bank, Ithala takes deposits due to an exemption granted to it by the PA. Ithala has, until recently, been operating with a banking licence exemption notice, which is renewable every 12 to 24 months.
The last exemption lapsed in December after Ithala failed to meet some of the conditions laid out by the PA. The regulator declined to give the company a new exemption.
The PA also raised concerns about Ithala’s high cost structure relative to its nature, size, complexity and risk profile.
“Accumulated loss between the financial period March 31 2008 and March 31 2024 amounted to R520m after a circa R92m loss for March 31 2024. Despite the committed capital injections, these merely absorb losses, hindering capital deployment to grow the balance sheet.”
The Financial Sector Conduct Authority last month suspended Ithala’s licence, accusing it of failing to meet financial soundness requirements, saying solvency was a critical element for the viability of any financial services provider.
According to a presentation by Ithala to parliament earlier this year, the bank said nearly two-thirds of its loan book was home loans. It had about R2.9bn in deposits at the end of November 2023 with 37.1% of this made up of fixed deposits.
Ithala’s presentation showed it had 27,475 stokvel accounts valued at R290m, with 38 branches in KwaZulu-Natal. There were 328,704 customers holding 398,522 accounts.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.