VDMALaw

16/10/2026

09/10/2026

You paid for your logo, but do you actually own it?

Many South African businesses are surprised to learn that, in most cases, the designer keeps the copyright unless it is transferred to the business in writing. Swipe through to see what the law says and how to protect your brand.

06/10/2026

Embedded Payments in South Africa: Key Legal Considerations for Businesses

Payments in South Africa are no longer limited to a till or a checkout page. You can now pay from a smartwatch, a car dashboard, a game controller or a social media app. This is called embedded payments, and it is one of the most exciting changes in our growing fintech sector.

For businesses, this opens up new ways to reach customers. It also raises an important point: how you design a payment is a legal decision.

Before you build payments into your platform, ask yourself:
• Who holds the customer relationship? Your business, the payment provider or a partner?
• Who starts the payment, and who confirms the payer’s identity? Your answers decide who is responsible when a payment is unauthorised or fails, or when a customer disputes it.
• Is your activity regulated? The South African Reserve Bank looks at what a business actually does and the risk that creates, not what it calls itself. Under the National Payment System Act, you may need a licensed partner.
• How is customer data handled? Embedded payments rely on a lot of personal information, so POPIA, F**A and data security duties apply in full.
• Have you covered consent, refunds and chargebacks? Pay particular attention to vulnerable consumers and minors.

The SARB’s Payments Ecosystem Modernisation Programme supports fast, simple, inclusive and secure digital payments, which is good news for innovators. The message is clear: payments can become invisible, but accountability cannot.

At VDMA, we help businesses and fintechs set up their payment arrangements so they can innovate with confidence and stay compliant.

02/10/2026

POPIA compliance can no longer be treated as a box-ticking exercise.

The Information Regulator has issued an enforcement notice to the SABS after a ransomware attack, citing excessive processing, weak consent mechanisms and poor security safeguards, with 90 days to comply. It has already imposed fines and is investigating Truecaller, Gauteng e-Government, the eThekwini Municipality and the Department of Basic Education.

It received over 1,220 breach notifications in five months, and now wants the power to impose fines immediately, closer to the European GDPR model.

If your business processes personal information, expect the Regulator to ask for evidence, not intentions. Review your safeguards, consent processes and breach response now. Fines of up to R10 million are possible.

We advise on POPIA compliance, Regulator investigations and breach response. Get in touch before the Regulator does.

30/09/2026

AI in Credit Decisions Leaves a Gap in Accountability

A bank's AI model declines a loan application. The applicant disputes it. Who answers for that decision?

That question doesn't have a settled answer yet, in South Africa or globally. Banks are deploying AI in credit decisions, risk scoring, and fraud detection faster than regulators are building frameworks to allocate responsibility between the institution, the developer, and any third-party provider in between.

The exposure isn't hypothetical. It's operational, the moment a customer challenges an automated decision and no one can point to a clear chain of accountability.

If your institution uses AI in decision-making, know who owns the outcome before a regulator or a court asks.

24/09/2026

Celebrating South African Heritage Day!

On this Heritage Day, we celebrate the diverse cultures, languages, and traditions that make South Africa the nation it is. At VDMA, we recognise that our strength lies in this diversity — the different backgrounds and perspectives that shape how we work and who we are.

As we reflect on our shared heritage, we remain committed to building a future rooted in unity, respect, and progress.

15/09/2026

Directive 12 raises the bar on risk management submissions

National Treasury has published Directive 12, setting out new requirements for accountable institutions to submit their risk management and compliance programmes (RMCPs) — the latest tightening of South Africa's F**A/AML compliance framework.

For banks, financial services providers, and other accountable institutions, this is a timely reminder: your RMCP isn't a “file and forget” document. Regulators expect it to be current, substantively reviewed, and ready for submission on demand.

What this means in practice:
→ Revisit your RMCP against the updated submission requirements
→ Confirm your risk-rating methodology still reflects your actual client and product risk profile
→ Make sure sign-off and governance trails are audit-ready

Getting ahead of directives like this is far cheaper than remediating after a finding. If you're unsure where your institution stands, it's worth a compliance health check now rather than later.

**A

09/08/2026

Honouring the Women Who Shape VDMA and South Africa

This National Women's Day, we pause to honour the women whose strength, insight, and determination continue to shape South Africa — in law, in business, and in every community they lead.

At VDMA Law, we're proud to work alongside women who bring sharp thinking; quiet resilience, and unwavering integrity to everything they do. Their leadership doesn't just move our firm forward — it moves our profession forward.

Today is a reminder that equality isn't a milestone we reach once, it's a commitment we renew every day: in the opportunities we create, the voices we amplify, and the spaces we make room for.

To the women of VDMA, and to women everywhere driving change — thank you. Your impact is felt far beyond today.

05/08/2026

Limited Liability, Unlimited Exposure: Personal Risk Under the Close Corporations Act

Close corporations have largely given way to the (Pty) Ltd, but plenty are still trading, and the entity form's decline doesn't mean the risk has. Members of a CC can still find themselves personally liable for the corporation's debts, even though a CC is meant to offer the same limited liability protection as a company.

The Close Corporations Act pierces that protection in specific circumstances: where members fail to maintain the statutory solvency and liquidity requirements before making payments to themselves, where a member's contribution obligations go unmet, or where a corporation is run recklessly or with intent to defraud. For members who assume a CC works exactly like a private company, that exposure often comes as an unwelcome surprise.

If your business, or a client's, still operates through a close corporation, it's worth revisiting governance practices, distributions, and members' contribution records to understand where personal exposure may exist.