FNB fined R1m for its home-loan app leak as the regulator finds a POPIA offence

The Information Regulator has fined First National Bank R1 million under the Protection of Personal Information Act (POPIA) over the home-loan app flaw that let other customers see applicants' personal details. In a statement on 26 October, the regulator went further than a fine: it found that FNB committed an offence under section 105 of the Act, which deals with the unlawful processing of account numbers.

For FNB's customers the finding matters more than the amount. The regulator says the bank's security safeguards fell short of what section 19 of POPIA requires, that its handling of repeated security incidents had significant shortcomings, and that its rules for how long it keeps personal information were weak.

The same statement fined Central Johannesburg TVET College R500,000 for failing to comply with an earlier enforcement notice.

What the regulator did

The FNB matter began as a compliance assessment under section 89 of POPIA. The regulator says it opened that assessment after FNB filed a security-compromise notification under section 22, following media reports that customer information had been exposed and that people had gained unlawful access to personal information through the bank's digital home-loan application platform. The exposed information included account numbers.

The assessment found significant shortcomings in how FNB identified, classified and responded to repeated security incidents that interfered with the confidentiality of personal information. Those findings, the regulator said, raised concerns about whether the bank's technical and organisational measures were enough to protect personal information against unlawful access and other unauthorised processing.

The regulator then found deficiencies in the security safeguards section 19 requires, and weaknesses in the governance around how long personal information is kept. On the section 105 offence, it found that FNB reasonably ought to have known there was a risk, that the contravention was likely to cause substantial damage or distress, and that the bank failed to take reasonable steps to prevent it. The infringement notice and the R1 million administrative fine follow from that finding.

The statement closes with a wider instruction. The regulator called on public and private bodies to review their compliance programmes, strengthen information-security safeguards, make sure information officers do the job the Act gives them, and respond promptly when the regulator issues a directive.

The college fined in the same statement

Central Johannesburg TVET College was issued an enforcement notice on 22 May 2026 after the regulator found it had contravened several parts of POPIA. Three people had complained that their personal information was shared with third parties without legal justification.

The notice ordered corrective steps inside set timeframes. Those steps included registering an information officer and a deputy, apologising to the complainants, writing and submitting a POPIA compliance framework, training employees, and taking disciplinary action against the employee responsible for the unlawful disclosure.

At the end of the 120 days in the notice, the college sent a report. The regulator decided the college had not complied. It cited a failure to report the security compromise in the prescribed way, the absence of a compliance framework, a delayed apology, and missed deadlines. It then issued an infringement notice and a R500,000 fine.

What went wrong at FNB

The home-loan exposure goes back to February 2023, when ITWeb reported that a customer applying for a home loan through the FNB app could see other applicants' names, ID numbers and contact details. FNB said then that a technical error had made the information visible to other applicants who logged in through its digital channels, and that it had switched the function off.

In April 2024 the regulator told ITWeb that 88 applicants had their details exposed. FNB had wrongly given 3,173 home-loan customers the access rights meant for its staff on the app's nav>>Home feature, and 696 of them scrolled through the list of applications in progress. Selecting an application could reveal the rest of what the applicant had captured.

Read in order, those figures describe a permissions failure rather than a break-in. Staff-level access was handed to ordinary home-loan customers. Hundreds of those customers opened the list. The records of 88 applicants were exposed, and the regulator's October 2026 statement says the exposed information included account numbers. That is what makes it a section 105 matter.

The other findings

According to MyBroadband's report on the regulator's findings, app users alerted FNB to the flaw twice before the bank acknowledged the second complaint months later. The same report says the regulator objected to FNB building a database of people linked to money laundering, and of politically exposed persons, from newspaper articles. The regulator's view, as reported, is that newspapers are not a "public record" under section 12 of POPIA, so the bank needed another lawful basis to collect that information.

MyBroadband also reports that FNB's retention schedule allowed some records, including cancelled employee tax certificates, to be kept indefinitely without a stated legal reason. The regulator's own statement confirms weaknesses in FNB's retention governance but does not list the records.

How this compares

POPIA allows administrative fines of up to R10 million. The regulator's first infringement notice, in 2023, was a R5 million fine against the Department of Justice and Constitutional Development after it failed to renew antivirus licences. FNB's fine is a fifth of that, and a tenth of the statutory ceiling.

The lesson for other banks is about access control. Nobody broke into FNB's systems. The exposure came from paying customers being handed permissions meant for staff, and from the bank not closing the gap when users reported it. The regulator's own account adds the governance layer: incident handling, section 19 safeguards, and retention rules that could not explain why some records were kept.

What is still open

Neither the regulator's statement nor MyBroadband's report includes a response from FNB. MyBroadband reports the bank has 30 days to pay. POPIA also lets a party that receives an infringement notice choose to contest it in court instead of paying, and FNB has not said which route it will take.

The regulator has not said whether the 88 applicants were compensated, or whether any of their details were later misused. In 2024 FNB said it had notified the affected applicants and put fraud monitoring on their accounts.

Sources: Information Regulator media statement, 26 October 2026; ITWeb, 21 February 2023 and 25 April 2024; MyBroadband, 26 October 2026.