DATA PROTECTION DIGEST

Archive · March 2026

March 2026: archive

The 5 archive entries on developments from March 2026.

ZA · ENFORCEMENT

High Court rules construction guarantees are insurance; FSCA's boundary vindicated

The Gauteng High Court interdicted Fusion Guarantees (Pty) Ltd from issuing construction guarantees, holding in a 23 March 2026 judgment (Elasah Risk Consultants v National Credit Regulator and Others) that such guarantees meet the definition of non-life insurance under the Insurance Act 18 of 2017: premiums paid, an undertaking triggered by an uncertain event, and indemnification of loss.

23 March 2026 · Enforcement
KE · LEGISLATION

Kenya publishes draft VASP Regulations for public consultation

The National Treasury published the Draft Virtual Asset Service Providers Regulations 2026 for public consultation on 17 March 2026, the first implementing instrument under the VASP Act 2025. Developed with the CBK and CMA through a multi-agency task force and accompanied by a Regulatory Impact Statement, the draft sets out licensing and authorisation processes for all VASP categories, from exchanges to custodial wallets to payment processors, and incorporates FATF Recommendation 15 and Travel Rule requirements.

17 March 2026 · Legislation · Crypto & digital assets
RW · GUIDANCE & POLICY

Rwanda's CMA sets out its regulatory approach to tokenised assets

CMA Rwanda set out a regulatory approach to the tokenisation of financial assets, presented at the Inclusive FinTech Forum in Kigali in early 2026: securities tokenisation, real-world asset tokenisation and tokenised funds, treated under the existing Capital Markets Act rather than a new statute. Formal tokenisation guidelines had not been published as at our coverage date.

ZA · ENFORCEMENT

FSCA fines former Steinhoff director R358.75 million

The FSCA imposed an administrative penalty of R358,750,000 (approximately USD 18.9 million) on Stephanus Johannes Stehan Grobler, formerly Steinhoff International's chief legal and treasury officer, for materially misleading financial statements covering 2014 through the 2017 half-year, in breach of the Financial Markets Act. The penalty is among the largest individual fines in the FSCA's history, alongside the R475 million penalty earlier imposed on former CEO Markus Jooste. This is market-integrity enforcement, not data protection enforcement.

2 March 2026 · Enforcement
ET · GUIDANCE & POLICY

Ethiopia's central bank declares birr-paired P2P crypto trades illegal, promises a framework

On 1 March 2026, the National Bank of Ethiopia declared all birr-paired peer-to-peer cryptocurrency transactions illegal unless explicitly authorised, citing foreign exchange manipulation, fraud and the absence of anti-money laundering safeguards. The prohibition is drawn narrowly to birr-paired peer-to-peer transactions rather than digital assets generally, and authorisation is expressly contemplated: the NBE confirmed it is developing a comprehensive digital asset framework in consultation with global peer regulators. The ban follows Ethiopia's July 2024 reform programme and a roughly 200% birr devaluation, during which the NBE has been closing currency arbitrage channels, peer-to-peer crypto trading among them.