Identity
Multi-factor authentication, conditional access, Entra ID governance and regular reviews of privileged access.
Asset management IT and support for financial services firms
Asset management IT means two things in financial services: running the technology of asset managers, advisers, insurers and fintechs, and keeping a verified register of every IT asset they own. Arke Technologies, in Johannesburg, does both for South African firms, with security controls and evidence mapped to the FSCA and Prudential Authority Joint Standards.
Financial services IT: what it is and who it serves
Financial services IT, or IT for financial services, is the technology, support and security behind firms that manage, advise on, insure or move other people's money. In South Africa that includes asset and wealth managers, discretionary and advisory financial services providers, insurers and brokers, lenders, fintech companies, and payroll and administration bureaux.
Their IT answers to regulators, auditors and clients whose money attracts criminals, so financial services IT support has to produce evidence as well as fixes. We provide it under one SLA, alongside your in-house team or as a full managed IT service.
Financial services cybersecurity regulations
We work to the rules a South African financial institution's IT must meet:
- Joint Standard 1 of 2023 (IT governance and risk management). Issued by the Prudential Authority and the Financial Sector Conduct Authority (FSCA), it sets out how boards govern IT and manage IT risk, including risk from third-party providers.
- Joint Standard 2 of 2024 (cybersecurity and cyber resilience). In force since 1 June 2025, it requires banks, insurers, market infrastructures, collective investment scheme managers and the other institutions it names to run a cybersecurity programme, test their systems and report material cyber incidents. Check its scope against your licence category.
- FICA. Accountable institutions must identify and verify clients, keep records for at least five years, and report suspicious and unusual transactions to the Financial Intelligence Centre.
- FAIS. Financial services providers must keep records of the advice they give for at least five years, and retrieve them for complaints and the FSCA.
- POPIA. Client financial information must be secured, and breaches reported to the Information Regulator and the people affected.
- King IV Principle 12. Boards govern technology and information as a strategic asset.
- PCI DSS and GDPR. Card data brings PCI DSS; clients or investors in the European Union bring GDPR.
Cybersecurity for financial services
Cybersecurity for financial services starts with the controls attackers test first:
Email and payment fraud
SPF, DKIM and DMARC, email security filtering, and a rule that changed bank details are confirmed by phone.
Detection
Microsoft Defender and Microsoft Sentinel collect and correlate security events; monitoring is automated and continuous, and human response follows your SLA. See managed detection and response.
Vulnerability identification
Vulnerability identification in cyber security means scanning on a schedule, penetration testing that we scope, perform and retest, and remediation tracked to closure.
Encryption
Data encrypted in transit and at rest. We inventory each digital certificate in network security, for websites, VPNs and email, and renew it before it expires.
Resilience
Backups isolated from the production network and restore-tested, and incident response plans rehearsed before they are needed.
Our managed security operations in South Africa cover Microsoft 365 hardening, Microsoft Sentinel and Entra ID governance.
What is asset management in IT?
IT asset management (ITAM) is the discipline of knowing every device, software licence and cloud service a firm owns or pays for: where it is, who uses it, what state it is in, and when it must be renewed or retired. The IT asset management definition is simple. Doing it in a regulated firm is not, because an asset nobody knows about cannot be patched, licensed or wiped.
Asset management in cyber security, and asset management in information security, are the same discipline seen through risk. The CIS Controls open with inventories of hardware and software, and ISO/IEC 27001 requires an inventory of information and associated assets. Asset management for IT hardware adds the lifecycle: procurement, warranty, reassignment and secure disposal.
In an asset management company the phrase covers both the firm's IT and its asset register. Digital asset management is different again: software for storing and finding media files.
Fintech software development and AI banking solutions
What is fintech software? Any application where money or financial data moves: client portals, onboarding apps, payment flows, lending engines and reporting platforms. The build standard matters more than the feature list.
Our software development team delivers custom fintech software development: web applications, APIs, mobile apps and payment gateway integration with PayFast, Yoco, Paystack, Peach Payments and Stripe, with audit trails, role-based access, encryption and POPIA controls from the first sprint. We built the Server Hub commerce platform, which takes PayFast and Yoco payments, and the ESGnet reporting platform for investor-facing sustainability reporting aligned with GRI and SASB.
When you compare fintech software companies or banking software development companies, ask who owns the code, how releases are approved, how keys are held, and how a security finding is handled. A credible provider answers each question in writing.
AI banking solutions work best on narrow, auditable jobs: reading onboarding documents for FICA, summarising client files, drafting replies for an adviser to approve. We build them on the principle that AI recommends and people decide, with every AI action logged. See AI consulting and implementation.
Governance, reporting and continuity
- Service-level agreement. Scope, exclusions, on-site policy and term, fixed before work starts. Incidents are prioritised from P1 (critical outage) to P4 (low-impact request), with response and resolution targets matched to the impact of downtime and agreed in your SLA.
- Third-party risk evidence. Regulators expect you to manage your IT provider as a third party, so we supply the due-diligence documents your process asks for.
- Monthly service review and report, covering tickets, security posture, asset register changes, restore tests and open risks, in a form your risk committee can table.
- Change control, documented runbooks, a named service lead and a written escalation path.
- Confidentiality. Every remote session is approved and logged, and everyone with access to your systems is bound by confidentiality and our security controls.
- Continuity and exit. Delivery is remote-first on our own tooling, by a certified team under one contract, with your systems documented as we go. You own your data, credentials and documentation; when a contract ends we hand over in an orderly way, in line with your exit plan for the provider.
What financial services IT costs
Last reviewed: September 2026.
We price managed IT per user per month, set after an assessment, and quote projects such as a SIEM deployment or a fintech build per project. Published South African managed IT rates run from about R180 to R400 per user per month (matnet.co.za, September 2026), with some providers listing R450 (MiBOT, September 2026). Published hourly rates for IT project work run from about R550 to R750 ex VAT (matnet.co.za, September 2026).
What drives the price is the number of users and sites, the evidence your regulator and auditors expect, security log volumes, penetration-testing scope and the number of systems to integrate. A finance director weighing whether managed IT is worth it can think of a car maintenance plan rather than insurance: the value lies in scheduled servicing that prevents the breakdown, not only in paying for help afterwards.
Procuring from Arke
Level 1
B-BBEE contributor
135% procurement recognition
Arke Technologies (Pty) Ltd, a registered company since 2017, is a Level 1 B-BBEE contributor (sworn affidavit available on request), giving your firm 135% procurement recognition. Company documents and a bank confirmation letter are available on request, as are our Central Supplier Database number and SARS tax compliance status. You can buy through a proposal and signed SLA, a purchase order or a response to your request for proposal. See company facts, and our pages on legal and professional services among the industries we serve.