Most small businesses don't set out to break the law — they just don't know exactly where the line is, because the line isn't written anywhere obvious. Three real ones worth knowing, if you're in finance-adjacent, property, or any business built around a promise to a customer.
1. "We'll get you approved" — the National Credit Act
Assessing whether someone qualifies for credit — a loan, finance, any lending decision — is regulated under the National Credit Act. Since November 2016 there's no small-transaction exemption: anyone assessing or extending credit in a regulated way needs to be registered with the National Credit Regulator. If your business helps customers with paperwork or organizes documents for a lender, that's fine — the moment you say "you qualify" or "you're approved," you've stepped into NCR territory, registered or not.
2. "Verified agent" — the PPRA and the Fidelity Fund Certificate
South African property practitioners (what most people call estate agents) are regulated by the Property Practitioners Regulatory Authority, and every one of them needs a valid, annually-renewed Fidelity Fund Certificate to legally operate. It's not a nice-to-have credential — trading without one is operating illegally. The only authoritative way to check is the PPRA's own public register at theppra.org.za, not a badge on someone's website.
3. "We'll never share your data" — POPIA
The Protection of Personal Information Act governs consent, storage, and use of anyone's personal data — and it applies whether you're a five-person business or a listed company. Sensitive documents (ID copies, bank statements, payslips) need real access controls, not just "we said we'd keep it safe." Direct marketing needs actual opt-in consent, not an assumed one.
The honest version of each promise
- Instead of "we'll get you approved": "we'll get your documents organized and ready for a registered lender to assess."
- Instead of an unverified "verified agent" badge: a real FFC number, stated plainly, with a link to check it yourself.
- Instead of a vague privacy promise: private storage, short-lived access links, and a real answer to "where is my data" if anyone asks.
None of these are hard to fix once you know where the line actually is — the expensive version is finding out after a complaint, not before.
Automating this instead of doing it by hand.
CAI Systems maps what a South African business actually does, automates the repeatable parts, and runs an AI agent on its own WhatsApp number. If something here is work you keep redoing, have us test your response time first — it costs nothing.