State-owned bank wrote off R68.76 million because it could not keep track of its cards

Postbank had to write off R68.76 million in customer bank cards due to inadequate record-keeping and internal control failures.

The write-off stems from historical control failures at Postbank surrounding the distribution and accounting of SASSA grant beneficiary cards.

This was revealed in Postbank’s annual reports over the past five years, which also showed that the Auditor-General of South Africa (AGSA) attempted to address the problem.

The root cause of this write-off dates back to when Postbank still formed part of the South African Post Office (SAPO).

Before Postbank took over the direct distribution of social grants in October 2022, SASSA cards were distributed through SAPO branches.

In the 2018 financial year, Postbank purchased a bulk batch of SASSA cards to be distributed through these branches.

However, Postbank failed to maintain an accurate card inventory tracking system or perform proper reconciliations of cards received, held in vaults, or issued to beneficiaries.

These weaknesses in Postbank’s card management enabled criminal syndicates to exploit them, leading to a series of fraudulent transactions.

These syndicates would use grant cards at contactless-enabled merchant terminals around Johannesburg.

The transactions were then authorised on the terminal networks but were never settled, resulting in financial losses of millions of rands.

In February 2022, the AGSA formally notified Postbank of a material irregularity for failing to maintain effective internal controls over customer bank cards.

This constitutes a breach of section 51 of the Public Finance Management Act, which sets out the general responsibilities of accounting authorities for public entities such as Postbank.

It also means that Postbank contravened its own internal group card management policy by leaving physical card stock unmonitored and unreconciled.

All of this culminated in Postbank having to process a formal write-off of customer bank cards valued at R68.76 million.

While a multi-million-rand write-off may not seem significant for a public entity with R10.03 billion in assets, Postbank reported a loss of R5.2 million for the 2025/26 financial year.

The bank attributed this loss to a R44 million SARS-related interest charge, saying it would have posted a R42 million profit were it not for this expense.

In addition, the impact of these internal control breaches ultimately cost Postbank far more than the R68.76 million write-off.

Impact of internal control failures

In March 2022, after the AGSA issued a formal notification to the bank about these breaches, Postbank responded that its card-handling processes had been enhanced.

It said that standard operating procedures were implemented, that random sample testing was conducted on card delivery, and that vault access control was enforced.

However, when the AGSA evaluated this submission, it found the response inadequate.

The AGSA noted that key management policies remained unapproved drafts, that user access controls were still unmonitored, and that the system used to enforce internal controls could generate point-in-time inventory reports.

Based on these findings, the AGSA formally referred the matter to the Directorate for Priority Crime Investigation, also known as the Hawks, in June 2024.

In 2025, the AGSA issued further binding remedial action orders requiring Postbank to strengthen its card management controls and discontinue legacy SASSA Gold cards entirely.

Over that same period, Postbank had spent R24.8 million to securely destroy Gold card chips that were no longer required and to roll out replacement cards to some grant beneficiaries.

However, following a detailed audit assessment, the AGSA concluded in May 2026 that Postbank had failed to take appropriate action to resolve the material irregularity.

The audit revealed persistent weaknesses in stock management, manual overrides of controls during biometric authentication failures, and incomplete card destruction processes.

As of Postbank’s 2025/26 financial year, the AGSA confirmed that it was still in the process of determining further statutory enforcement actions regarding this irregularity.

It should be noted that the mass issue of Black Card 2.0 to replace the legacy SASSA Gold cards only started in April 2026, with the full phase-out expected by 30 November 2026.