Legal & Risk: What Businesses Need to Watch

Legal & Risk: What Businesses Need to Watch

2026-06-03

This week’s news highlights two critical legal and compliance risks that may be overlooked by businesses operating in South Africa and globally.

1. South Africa’s Crypto Law Uncertainty: A Compliance Minefield

South Africa’s legal landscape for cryptocurrencies remains in flux, as conflicting court rulings continue to muddy the waters. A recent judgment by Johannesburg High Court Judge Stuart Wilson declared Bitcoin “both money and capital” under exchange control rules, directly contradicting a 2025 Pretoria High Court ruling that deemed it “capital.” This inconsistency creates significant uncertainty for businesses engaging in crypto transactions, particularly those relying on cross-border transfers or compliance frameworks tied to the Exchange Control Regulations, 1961.

The ambiguity risks exposing enterprises to legal non-compliance. For example, a company facilitating crypto transfers may inadvertently breach exchange control laws if it interprets court rulings inconsistently. Businesses must review all contracts involving crypto to ensure alignment with current legal interpretations and consider adding clauses that explicitly define Bitcoin’s status under South African law. Additionally, entities holding crypto assets should reassess their risk exposure, as inconsistent rulings may complicate dispute resolution or regulatory reporting.

2. Critical Infrastructure Cyberattacks: POPIA and Incident Response Risks

The hacking of South Africa’s flagship supercomputer, Lengau, underscores the growing threat to critical infrastructure. The CSIR’s Centre for High Performance Computing reported that user credentials and private keys were compromised, leading to malware infections. While the incident itself is technical, the legal implications are stark. Under Section 17 of the Protection of Personal Information Act (POPIA) Act 4 of 2013, businesses must disclose data breaches “without undue delay” and take steps to mitigate harm.

Yet, the Lengau breach highlights a potential gap in compliance: many organizations lack robust incident response plans. A business operating in a sector reliant on data processing (e.g., healthcare or finance) could face POPIA enforcement action if it fails to demonstrate adequate safeguards or timely breach notification. The SABS executives’ disciplinary action after a 2024 attack further illustrates that leadership accountability for cybersecurity lapses is escalating. Companies must now ensure their POPIA compliance frameworks include real-time breach detection and escalation protocols.

Compliance Actions for Human CLOs

• Audit crypto-related contracts for clarity on Bitcoin’s legal status, referencing Exchange Control Regulations and advising on jurisdiction-specific interpretations.
• Strengthen cybersecurity protocols aligned with POPIA, including mandatory breach reporting drills and third-party vendor audits.
• Revise incident response plans to address both technical and legal requirements, ensuring alignment with Section 17 of POPIA and sector-specific regulations.

Review Note:

The crypto classification conflict requires a qualified legal opinion to navigate overlapping court rulings. The Lengau breach emphasizes the need for specialized POPIA compliance checks, particularly for businesses handling sensitive data.

---