BSE Governance, Risk & Resilience
Board oversight, principal risks and the October 2025 trading outage
October 2025 outage
Material event — 21 October 2025 trading outage
Four trading days lostFailure
Network firewall failure prevented core trading and clearing systems from communicating with one another and external participants
Continuity response
Suspension followed published business-rules framework · Obligations managed manually using existing CSDB and BISS procedures; no settlement failure occurred
Restoration
Emergency migration to a next-generation firewall
Remediation
Board commissioned an independent post-incident review · Board-level technology resilience committee established · Disaster recovery, asset lifecycle management and change-management discipline
Full outage evidence log (all 7 rows) →
What failed vs. what happened afterwards
What failed
- Network firewall (outage cause)
- Legacy technology architecture — component and network-architecture dependence (PR1 drivers)
- Disaster-recovery readiness — DR testing gaps (PR1/PR5 drivers)
What happened afterwards
- Emergency firewall migration (REM01, completed)
- Independent review commissioned (REM08)
- Board-level resilience oversight established
- Active-active disaster-recovery programme underway (REM04, in progress)
Both lists are drawn directly from the governed outage cause, the PR1/PR5 principal-risk driver text, and the remediation-tracker action text below — not a separate disclosure.
At a glance
"No low principal risks" among the seven selected risks does not mean the full Group register contains none. Board composition changed during FY2025: Aobakwe Monyatsi was appointed on 12 March, Davies Tele resigned on 2 April, and Gregory Matsake was appointed on 7 July.
Remediation tracker
Remediation is not proof the resilience problem is solved.
Principal & emerging risks
Principal risks
A table, not a reconstructed heat map — numeric coordinates aren't consistently disclosed| Risk | Rating | Direction |
|---|---|---|
| Technology resilience, cyber security, and data protection | High | Stable |
| Talent, key-person dependency, and execution capacity | Medium | Watching |
| Market integrity, surveillance, and regulatory compliance | Medium | Stable |
| Capital-market depth, liquidity, and structural concentration | High | Structural |
| Operational resilience and business continuity | Medium | Active treatment plan |
| Market integrity, surveillance, and regulatory compliance [published duplicate] R015 — see notes | Medium | Active monitoring |
| ESG, sustainability leadership, and stakeholder reputation | Medium | Rising |
Emerging risks — monitoring, not scored
Full risk register (principal + emerging, all 14 rows, with working labels) →
Board composition, attendance & fees
Board composition (BSE)
Aobakwe Monyatsi appointed CEO 12 Mar 2025 · Davies Tele resigned 2 Apr 2025 · Gregory Matsake appointed 7 Jul 2025 — composition varied during the year. CSDB has a separate 8-member board (see the full table below).
Committees — nomenclature warning
Unresolved Other sections refer to "Finance and Audit," "Risk and IT" and a dedicated resilience committee. It's unclear whether these are renamed, new, or temporary bodies.
Full board, attendance & fees table — BSE and CSDB, all 17 directors →
BSE and CSDB populations are kept separate (R020 — the composition table lists seven CSDB directors; the attendance table includes eight).
Assurance
Three lines of assurance
Business units — Own risks; identify risks; design and operate controls; report events
Risk and Compliance — Oversight, framework, challenge and independent risk reporting; unfiltered reporting line to Risk and IT Committee
Internal Audit — Independent and objective assurance to Board through Finance and Audit Committee
Grant Thornton — Unqualified opinion on consolidated and separate annual financial statements for year ended 31 Dec 2025
BSE Board — States responsibilities discharged, King IV applied and NBFIRA requirements met
The financial audit opinion does not assure every non-financial metric, risk rating or commitment. King IV is a self-assessment, not independent certification.
Full assurance register (all 5 layers) →
Grant Thornton's unqualified opinion covers the financial statements only — not every non-financial metric, risk rating or commitment. King IV is a BSE self-assessment.
Related pages
GATE A2 EVIDENCE VERIFIED — CORE DATA RELEASE APPROVED
Source: BSE Integrated Report 2025 pp. 80–99, 110, 114 — batch-06 structured extraction
(`bse_disc_*`). GATE A2 evidence review completed 2026-09-07 (186 rows verified, 13
NOT_APPLICABLE, 0 findings); bse_disc_release.status =
A2_VERIFIED (historical: formerly VISUAL_FIRST_PASS).
The disclosure layer was not given a separate production approval beyond GATE A2.
Numeric governed model: bse_canonical_v1_0_2 — database release approved 2026-09-08.
Dashboard deployment and publication are governed separately (GATE B, Phase 10–11).
Full reconciliation register →
