Why SADC regulators must govern as a system - and what it costs the public when they don't
Consider a single mobile money service, offered by one provider to consumers across a country. That service may simultaneously be subject to central bank oversight for payment systems and financial stability; communications regulation governing network infrastructure; financial intelligence requirements relating to suspicious transactions; and revenue authority obligations relating to taxation.
Four regulators. One product. And - in the space between them - a blind spot that none of them fully owns.
Each regulator governs its part of the risk. The greater challenge lies in governing the interaction between those risks. This is not simply a coordination problem. It reveals a deeper weakness in the architecture of modern regulatory governance: institutions whose mandates were designed vertically are increasingly required to govern risks that move horizontally - across sectors, technologies, and national borders.
The consequences are not abstract. When that governance gap goes unaddressed, it is not regulators who ultimately bear the cost. It is the consumers whose transactions fall through supervisory blind spots, the depositors whose savings sit in institutions that a fragmented regulatory system failed to monitor adequately, the taxpayers whose revenues leak through gaps in cross-agency coordination, and the economies whose growth trajectories stall because investors and development finance institutions cannot satisfy themselves that the regulatory environment is sound. A governance failure between mandates reaches people. It reaches them through financial instability, through consumer harm, through institutional failure, and through the slower, quieter damage of an investment climate that lacks the credibility to attract the capital a developing economy needs.
The question is therefore no longer only whether each regulator is well governed. It is whether the regulatory system itself is governed well enough to see, understand, and respond to risks that fall between institutional mandates.
Institutions whose mandates were designed vertically are increasingly required to govern risks that move horizontally.
Convergence Is Not Coming. It Has Arrived.
The regulatory environment that many institutions were originally designed to oversee no longer exists in the form it once did. Digital financial services, fintech platforms, AI-powered products, and cross-border payment infrastructure have progressively collapsed traditional sector boundaries. A regulated entity that might once have been clearly a bank, an insurer, a telecoms provider, or a payment operator may now operate meaningfully across several of these domains simultaneously.
The governance architecture has not always evolved at the same speed. Regulatory mandates remain necessarily institution-specific, defined by what each regulator is statutorily authorised to see and do. But systemic risk does not organise itself according to legislation. A network failure becomes a payments problem. A payments problem creates consumer harm. Weak transaction monitoring creates anti-money laundering (AML) exposure across the system. Poor data governance undermines regulatory intelligence held by multiple institutions. An AI-enabled financial product can simultaneously raise questions of prudential risk, consumer protection, data sovereignty, infrastructure resilience, and individual accountability - questions that no single regulator is positioned to answer alone.
The International Organisation of Securities Commissions identified this challenge as early as 2021, when it found that AI governance in financial markets requires regulatory frameworks capable of addressing risks that cross traditional supervisory boundaries. The Australian Prudential Regulatory Authority’s (APRA) April 2026 letter to regulated entities sharpened the point: governance, risk management, and operational resilience practices are not keeping pace with the scale, speed, and complexity of AI adoption. The same observation applies to the governance frameworks of the regulatory institutions overseeing those entities.
The result is a growing governance gap: not necessarily an absence of regulation, but an absence of visibility across the interaction between regulatory mandates.
Governance Contagion: When Your Neighbour's Governance Becomes Your Risk
Contagion is a familiar concept in financial stability. A shock in one institution spreads through counterparty exposures, infrastructure dependencies, and confidence effects. Governance can behave in precisely the same way - and the mobile money example illustrates how this happens. A governance failure at the financial intelligence unit (FIU) -- delayed reporting, captured decision-making, inadequate data standards -- does not stay within the FIU. It creates opacity that propagates into AML risk at the central bank, which depends on FIU intelligence to assess systemic exposure; into revenue leakage at the tax authority, which relies on financial transaction data it can no longer trust; and into consumer harm across the payments infrastructure, where risks that should have been caught go undetected.
There are at least three mechanisms through which this occurs more broadly. The first is trust contagion: public confidence in regulatory institutions is rarely allocated with precision, and a serious failure at one regulator damages perceptions of the entire regulatory environment. The second is regulatory arbitrage: where governance capabilities and enforcement standards differ materially across institutional boundaries, sophisticated entities will exploit those differences, and a weakness in one part of the system will undermine stronger governance elsewhere. The third is coordination failure: cooperation arrangements assume a capable and trustworthy institution on the other side of the relationship - if one participant cannot provide reliable information, protect shared data, or sustain independent decision-making, the effectiveness of every institution that depends on that cooperation is impaired.
Research on cross-border banking in Sub-Saharan Africa confirms the systemic dimension: where cross-border supervisory coordination is weak, financial stability is demonstrably more vulnerable, particularly in jurisdictions where foreign bank affiliates are systemically significant. SADC's increasingly integrated financial system is not insulated from this dynamic.
Shared dependency creates shared governance responsibility. A regulator's governance is not entirely a private institutional matter.
An MoU Is Not the Same as System Governance
Regulators across the region are not unaware of the need for cooperation. Memoranda of understanding (MoU), bilateral agreements, information-sharing arrangements, and regional forums already exist in various forms. These structures are important. But the existence of a cooperation mechanism does not demonstrate that effective coordination is taking place.
The more useful governance question is not: Do we have an MoU? It is: What evidence demonstrates that the MoU works when the system is under pressure? Can institutions identify emerging cross-sectoral risks together? Are responsibilities clear when an issue falls across mandates? Is shared information reliable and timely enough to support decision-making? Can the institutions demonstrate that their cooperation has improved over time?
These are governance questions, not administrative ones. They also illustrate why addressing the governance gap does not require the creation of a super-regulator or the surrender of statutory independence. What is required is not an additional layer of bureaucracy, but a different kind of accountability - one that governs the dependencies between mandates, not just the institutions that hold them.
From Asserted Governance to Demonstrable Governance
Traditional governance assurance has placed substantial emphasis on structures and compliance: legislation, policies, committees, reporting obligations, audit processes, and formal accountability mechanisms. These remain necessary. But they answer only part of the governance question.
While a regulator may have an independence provision in its enabling legislation, the more important question is whether its decisions demonstrate independence in practice. It may have a conflict-of-interest policy. The important question is whether conflicts are identified, disclosed, and managed when difficult decisions arise. It may have an information-sharing agreement. The important question is whether information moves reliably and usefully when another regulator needs it.
This is the difference between asserted governance and demonstrable governance. The OECD's Best Practice Principles for the Governance of Regulators make clear that regulatory governance must be capable not only of being performed but of being verified - by parliament, by the public, and by peer institutions that depend on it. The standard should increasingly be: if your governance were examined tomorrow, what evidence would you produce?
Institutions may in fact be practising sound governance without creating the evidence trail that allows others to rely upon it. In a stand-alone institution, that is a risk management gap. In an interconnected regulatory ecosystem, it is a systemic one.
The SADC Opportunity
For SADC, the convergence of digital finance, AI-driven products, and cross-border financial flows presents both a risk and an opportunity. The risk is that regulatory complexity continues to grow while governance remains predominantly institution-specific - leaving the most consequential problems to accumulate in the spaces between mandates. The opportunity is to address those spaces deliberately, and to do so before a crisis forces the issue.
This does not require regulatory merger or identical governance arrangements across member states. It requires something more practical: a shared definition of what effective regulatory governance looks like; evidence standards that move beyond structural compliance to demonstrable outcomes; and a proportionate peer accountability mechanism through which systemic governance weaknesses can be identified collectively before they become crises.
The SADC Peer Review Panel -- which convenes Finance Ministers and Central Bank Governors to monitor macroeconomic convergence and provide collective accountability -- demonstrates that regional peer engagement is both structurally possible and politically credible. There is no principled reason why the same logic cannot extend to the governance resilience of the regulatory ecosystem itself.
Investor confidence, development finance, and sovereign credit assessments all attach, in part, to the perceived integrity of a country's regulatory environment. A SADC region that can demonstrate system-level governance maturity -- not just the compliance of individual institutions -- is a more credible destination for the long-term capital that economic growth in the region requires.
The Question That Cannot Be Deferred
The governance gap between SADC regulators is not a future problem. It exists now, in the blind spots between mandates, in the MoUs that commit to coordination without specifying what coordination requires, in the AI systems deployed by supervised entities whose governance implications no single regulator fully oversees.
Good governance is not, in the end, an institutional achievement. It is a public service. Regulators who cannot demonstrate that their governance is working - and that the system of which they form a part is governed as a whole - are not merely falling short of a technical standard. They are failing the consumers, depositors, taxpayers, and economies that depend on them.
The question is not whether SADC regulators need to govern better. The question is whether they will build the shared architecture to govern as a system - deliberately, before the cost of not doing so is borne by those least able to afford it.
Because until someone owns the space between the mandates, it will remain the place where systemic risk is most easily allowed to grow unseen.
END
Words: 1,745
For further information contact:
Jené Palmer (CGF: Director)) - Cell: +27 (0)82 903 6757 / E-mail: [email protected]
Terrance M. Booysen (CGF: Chief Executive Officer) - Cell: +27 (0)82 373 2249 / E-mail: [email protected]
CGF Research Institute (Pty) Ltd - Web: www.cgfresearch.co.za
Follow CGF on X: @CGFResearch
Click below to read more...
