The National Credit Regulator (NCR) could not verify several performance targets in its 2025/26 annual report after a cyberattack disrupted access to supporting records, according to findings by the Auditor-General of South Africa (AGSA).
The findings relate to the regulator’s investigations into credit providers and debt counsellors, as well as enforcement action taken against those found to be non-compliant with the National Credit Act (NCA).
The NCR’s annual report for the financial year ended 31 March 2026 was tabled in Parliament in 2026. It shows that the cyberattack affected the availability of supporting performance information for the first and second quarters of the reporting period.
Auditor-General unable to verify reported targets
Auditor-General Tsakani Maluleke said the audit team could not determine whether the achievements reported against four selected performance indicators were correct because adequate supporting evidence had not been provided.
The indicators covered investigations conducted on credit providers and debt counsellors, as well as enforcement action following investigations that identified non-compliance with the NCA.
The NCR reported conducting 614 investigations into credit providers against a target of 500. It also reported 771 investigations into debt counsellors, against a target of 400.
For enforcement action against non-compliant credit providers, the regulator reported an achievement of 96.25%, compared with a target of 85%. For debt counsellors, it reported 98.93%, against a target of 80%.
However, the Auditor-General said the reported achievements could not be verified and might be higher or lower than the figures presented.
“The unavailability of supporting performance information for some indicators in Quarter 1 and Quarter 2 was caused by a cyberattack and by management’s failure to establish and maintain secure, isolated and effective off-site backup arrangements to safeguard critical information and ensure its recoverability in the event of a system disruption,” Maluleke said in the report.
The Auditor-General also identified inadequate record-keeping as a significant internal control deficiency, saying the NCR had not maintained complete, relevant, accurate and readily accessible information to support its performance reporting.
Financial audit remains unqualified
The findings on performance information are separate from the audit of the NCR’s financial statements.
The regulator retained an unqualified audit opinion on its financial statements. This means the audit opinion on its financial position and financial results was not qualified. However, the inability to verify selected performance indicators means the reported figures for those areas could not be independently confirmed.
The NCR is responsible for regulating South Africa’s consumer credit market. Its mandate includes monitoring credit providers, investigating alleged contraventions of the NCA and taking enforcement action where necessary.
The audit findings therefore relate to information used to account for some of the regulator’s work in carrying out that mandate.
NCR reports progress during 2025/26
Despite the audit findings, the annual report records other activities undertaken during the year.
The NCR said it secured approximately R83 million in consumer redress through refunds and account adjustments. Its credit provider compliance department also conducted 14 on-site compliance monitoring visits and held 20 compliance visibility meetings.
In his overview, chief executive Otsile Maseng noted that information and communications technology disruptions, funding constraints and frozen positions affected the regulator’s delivery during the year.
The report sets out the cyberattack-related findings alongside the regulator’s reported activities and its financial results for 2025/26.
The audit findings do not establish that the reported investigations or enforcement actions did not take place. They show that the supporting records were not available for the Auditor-General to confirm whether the reported targets had been achieved.
