An analysis of legal accountability for artificial intelligence systems in the South African financial sector

1 Introduction

Generally, in South Africa, no tangible attempt has been made to embrace and regulate the legal conundrum of the use of AIS in the financial sector, particularly, in the banking industry.1 However, a raft of legislation and policy framework are in place to regulate transactions and activities in the financial sector without addressing the legal status of the systems.2 South Africa will have to be innovative and creative in developing and adapting existing artificial intelligence (AI) ethical principles on the deployment and management of AIS to remain relevant and competitive in a highly globalised economy.3 This is said against the backdrop that the digital economy of the Fourth Industrial Revolution (4IR)4 remains to be dominated by a host of key merchants and corporations in the forms of hardware manufacturers, software designers, sellers, equipment and software installers, facility owners, AI owners, AI users, and trusted third parties, amongst others.5 All of these have a clear responsibility to ensure that AIS enjoys smooth sailing in minimising and averting causation of harm and consequently legal liability. Given the existing liability regime, it would be an uphill task to properly identify and apportion liability to any of these players in the context of the deployment and use of various AIS.6

The purpose of this article is to evaluate existing sectoral legislative enactments and policy framework which seems to lend credence to the feasibility of the recognition of AIS as legal persons. This discussion will also reflect on the impact and challenges companies must grapple with as the emergence and reality of the 4IR intensify.

Most companies in the financial and retail sectors are already deploying AIS in their variegated forms in their business operations.7 Due to their strategic location in these sectors, they use these systems in servicing both themselves and customers in order to enhance and enrich efficiency and effectiveness in service delivery. Equally, corporate management in the sector also uses AIS as a support system for decision-making at both management and board levels. Nowadays, AIS is being used as a guide to arrive at particular decisions that would enhance business productivity and profitability.8

2 Aspects of constitutional and legislative recognition of AIS

The transformative nature of the Constitution of the Republic of South Africa, 1996 (the Constitution) appears to be amenable in recognising the legal status of AIS. Section 8(3) of the Constitution provides that in interpreting the Bill of Rights to a natural or juristic person the courts must develop rules and common law to give effect to a constitutional right and limitations on the proviso that a limitation is in accordance with the provisions of section 36(1) of the Constitution. These provisions may open space for the recognition of non-human business entities such as AIS products and services.

Section 8 of the Constitution provides an impetus for accommodating the legal personality such as AIS by way of developing common rules and for curtailment of constitutional rights that may be allocated to AIS. Therefore, it could be argued that the courts may resort to sections 8(2)-(3), as well as section 36 of the Constitution to hold AIS accountable.9 Similarly, the interpretation clause in section 39(2) requires the courts and related bodies to consider international and foreign laws when interpreting any legislation to promote the spirit, purpose, and object of the Bill of Rights. Subsection (3) is more relevant in that the Bill of Rights accommodates any other rights conferred by common law or any other legislation provided it is in line with the overall provisions of the Constitution. 10

Essentially, the Internet and its sources have now become an essential commodity and occupy a central place in the operation of AIS, in conjunction with the Internet of Things (IoT), generally described as:

The network of physical objects-“things”-that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the internet. These devices range from ordinary household objects to sophisticated industrial tools.11

However, it is not accessible to most people in South Africa, the provision of section 32 of the Constitution provides for the right of access to information held by the state and any person in order to exercise or protect any right. The 4IR is driven by internet connectivity and data infrastructure, which are inextricably linked to the provision of basic services such as health, work, food, education, and personal security, amongst others.

Given this constitutional framework, the South African courts may have to apply purposive interpretation and be guided by decisions of other jurisdictions wh en confronted with issues relating to the legal personality and accountability of AIS. For instance, in a matter involving pension funds for municipal employees, the court adopted a purposive interpretation of statutes to properly clarify the definition of pensionable emoluments as provided for in the relevant regulations.12 The court defined statutory interpretation as entailing a process of attributing meaning to the words used in a document, legislation, or some other statutory instruments having regard to the context provided by reading the particular provision or provisions in light of the document as a whole and the surrounding circumstances.13 The court went further to illustrate the process and held that:

The process is objective not subjective. A sensible meaning is to be preferred to one that leads to insensible or unbusinesslike results or undermines the apparent purpose of the document. Judges must be alert to, and guard against, the temptation to substitute what they regard as reasonable, sensible or businesslike for the words actually used. To do so regarding a statute or statutory instrument is to cross the divide between interpretation and legislation.14

The regulatory framework for the financial sector in the banking industry, insurance, and intermediary is largely self-regulatory and institutionalised from a financial safety and market conduct perspective.15 To this end, the Financial Sector Regulation Act 9 of 2017 (FSRA) provides for the establishment of the Twin Peaks supervisory model in the form of the Prudential Authority (PA) and Financial Sector Conduct Authority (FSCA) to promote financial stability respectively.16 The PA is charged with the responsibility to ensure the safety and soundness of financial institutions in the interest of customers and the broader public, while the FSCA deals with the conduct of financial institutions and fair treatment of customers, and integrity of the financial market.17 The possible use of currency for illegal, money laundering, and terrorist activities are regulated through the Prevention of Organised Crime Act 121 of 1998 (POCA), the Financial Intelligence Centre Act 38 of 2001 (FICA), and the Protection of Constitutional Democracy against Terrorist and Related Activities Act 33 of 2004 (CDTRA).18 The South African Reserve Bank is responsible for ensuring that the national payment system complies with the provisions of the National Payment System Act 78 of 1998.19 These laws regulate functions relating to risk management in relation to audits, credit certifications, and identity verifications as mandated by the sections 7 and 8(1) and (2) of the Financial Advisory and Intermediatory Services Act 2002 amongst others.20 If left unchecked and monitored, the use of AIS for these services may pose unimaginable risks paving the way for a plethora of criminal activities.

Another interesting development is the recent regulation of crypto currencies by the FSCA in Government Gazette, as a temporary measure pending enactment of appropriate legislative instrument.21 As a market conduct regulator of financial institutions, the FSCA enjoys wide powers conferred in terms of the FSRA.22 The definition of financial products was used to regulate crypto currencies.23 Amongst others, a financial product is defined in section 1 of the FIAS with reference to any other instrument acknowledging, conferring or creating rights to subscribe, to acquire, dispose of or convert such instruments as a participatory interest in one or more collective investment schemes.24 However, this is subject to section 2 which provides for exclusions of any financial product exempted by the Registrar. It therefore appears that these provisions resonate with the decision to recognize the usage of crypto currencies.25 Based on these provisions, the FSCA was rightly empowered to issues a General Notice in the Government Gazette recognizing crypto currencies as crypto assets in line with the Act.26

Crypto assets are defined broadly as digital representation of value not issued by a central bank, but is capable of being traded, transferred, or stored electronically, by natural and legal persons, for the purpose of payment, investment, and other forms of utility.27 According to the FSCA, the definition of crypto assets is a replicates the definition adopted by the Financial Action Task Force (FATF), which is an inter-governmental global anti money laundering and terrorist financing body that sets out international standards aimed at the prevention and combating illegal activities.28 This digital representation applies to cryptographic techniques by using distributed ledger technology. 29

Apart from this declaration by the FSCA, crypto assets have not been regulated under South Africa’s financial regulations, or otherwise, which has left traders exposed.30 However, this is not the end as efforts are underway to regulate them under the draft Conduct of Financial Institutions Bill, whose object is to establish a consolidated regulatory framework for the conduct of financial institutions in support of the FSCA and further enhance innovation as well as the sustainable development of innovative technologies, processes and practices within the context of a sustainable competition in the provision of financial products and financial services. 31

Therefore, financial regulations in the sector will also be applied mutatis mutandis to crypto assets, suppliers and trading platforms.32 Of critical importance is the protection of customers using digital currency while preserving and enhancing the integrity of currency flow in the light of deployment of AIS in the sector within the parameters of the credit and consumer protection legislation.33 It would seem that developments in the financial and blockchain technology front may offer some glimmer of hope in the conceptualisation of the legal personality of AIS.34 To put it in perspective, blockchains relate to software decentralised technologies which follow rules of formatting and processing protocols that are expressed in a computer code resulting in the invention of crypto currencies.35 Basic blockchain protocols can perform simple functions such as exchanging values for crypto currency or ownership of digital assets through automated smart contracts to perform complex financial transactions amongst others without human involvement.36

Before delving into the legal intricacies of crypto currencies, it is imperative to reflect on legal accountability and liability in the financial sector and in particular, the banking sector in South Africa.

3 AIS accountability in corporate governance, financial, and banking sectors

As duties and responsibilities of corporate leadership become more complex and digitised, companies will steadily rely on AIS in their operational and management systems in the foreseeable future.37 A possibility exists that AIS may have to be explicitly roped in to complement the leadership and managerial hierarchies of companies.38 This could be the case where a company’s board of directors solely rely on recommendation of AIS in its investment decisions or even in instances of disputes on intellectual property ownership produced by AIS.

However, legislative bottlenecks contained in the Company Act 72 of 2008 may prove to be an impediment to this. To demonstrate this, section 1 of the Act defines a company to mean a juristic person incorporated in terms of the Companies Act, a domesticated company, or a juristic person that has registered before a certain period.

In South African terms, the definition of a board, shareholder, and company director contains a personality element in section 1 of the Company’s Act. Certainly, AIS is not accommodated in the reference to juristic persons in these provisions. Apart from the legal status of AIS in corporate governance, it would also be critical to consider the legality of delegated or de jure directors in corporate settings. While the Companies Act provides for the appointment of proxies, it is also not clear on the validity of the acts committed by de facto directors.39 Section 58 provides for the right of a shareholder to appoint a proxy, who is entitled to all rights and privileges enjoyed by a shareholder provided due process of appointment was followed. However, the Companies Act is silent on the definition of a proxy and an agent. Applying common-law principles, the assumption is that liability arises once such acts or decisions are officially endorsed and adopted by relevant company structures.

Section 5(1) requires that the Companies Act must be interpreted and applied with the view of promoting national economy, transparency, and high standards of corporate governance. Other purposes include balancing the rights and obligations of shareholders and directors in companies.40 The requirement for the balancing of these rights and obligations is critical in minimising biases and boosting the independence of company directors and boards in the event AI is deployed and incorporated into the corporate governance ecosystem. 41 Hamadziripi and Chitimira are of the view that the use of augmented AI would enhance the independence of directors since directors with dissenting opinions might be encouraged to contribute their views by simply relying on decision-support AI recommended as the basis of their dissent. 42

The business judgment rule in section 76(4)(a) could also be useful as it is closely linked to the fiduciary duty of care as provided for in section 76(3)(c) of the Companies Act. The provisions impose an obligation on the part of directors to take reasonable diligent steps to become informed and satisfied about any matter concerning the operations of a company before a decision is taken. A director can only be protected and exonerated if acted independently in good faith considering the interest of the company. In South Africa, a company can sue and be sued in its own name or directors individually. In the case of Hlumisa Investment Holdings (RF) Limited v Kirkinis interpreting the so-called proper plaintiff rule.43 The court held that shareholders, in their own name, cannot sue company directors for a misleading audit finding which resulted in the devaluation of their shares.44

The requirements for business judgment rule and the duty to act with care, skill, and diligence present difficulties when liability arises when company directors and board members relied on AIS to arrive at a particular decision. The matter also becomes more difficult when the decision was solely taken by the AIS. For example, in 2014 a Hong Kong-based company, Deep Knowledge Venture, appointed an AIS in the name of VITAL (Investment Tool Verification to Advance Life Sciences) to its board of directors on an observer basis.45 It was granted all the rights enjoyed by other board members including voting rights despite the fact that it does not have the status of directorship as required by the laws in Hong Kong.46 As the first AI to serve on the board, VITAL was mainly used in taking decisions relating to investments.47

The financial sector adopts a fit and proper requirement as a yardstick to determine and meet the requirements in section 6A of the Financial Advisory and Intermediary Service Act 37 2002 (FAIS). In terms of sections 6A(1)(aa)-(dd) of the FAIS, the registrar is entrusted with the responsibility to classify financial service providers into key individuals, representatives, key individuals, and compliance officers. Based on this, the registrar determines the fit and proper requirements in each category. Amongst others, in terms of sections 6A(2)(a)-(d) of the FAIS, the determination of fitness and properness depend on competency, qualifications, continuous professional development, and experience. While it is clear to apportion liability, it may also turn out to be difficult to identify where fault emanates based on these classifications. It is in this context that the question of eligibility of coopting AIS into corporate governance comes into the picture.

In the course of business, board members often share confidential information amongst themselves using various platforms. They use this for data review, risk management systems, and audit systems. In the financial services sector, AI-based risk-management systems have also been used to perform legal compliance functions like detecting credit card fraud and money laundering.48 Since the main task of the corporate board is monitoring management, both the information flow to the board as well as risk management are crucial aspects of corporate governance. Thus, AI clearly holds promise if it can help with these important tasks.

In the South African context, the provision of financial advice to clients places financial planners under onerous fiduciary duty and regulatory obligations, especially in cases where AIS is deployed.49 In section 1 of the FAIS, advice is defined to include “any recommendation, guidance or proposal of a financial nature furnished, by any means or medium, to any client or group of clients.” It is pertinent to point out that the deployment of AIS, is to some extent, a delegated authority to perform certain tasks.50 Hence, the AIS will surely execute instructions fed into it but if there is an error or omission, where does the liability or accountability lie? Novelli et al opines that the consequences of and liabilities for the delegated decisions, for example, approval of a loan or not lie with the decision-makers- programmers/authors/creators that fed the AIS and ends with the accountability of the (legal) entity executing the decision-making process for the impact of the decisions.51 Therefore, the aspects of precision in outcome are imperative and this calls for the deployment of well-functioning AIS to discharge the task. In order to give credence to this assertion, Novelli et al emphatically indicate that:

Compliance is about binding AIs to align with ethical, legal, or technical norms. This goal defines the design, development, and deployment standards to be met throughout the entire lifecycle of an AIs, but it is rather generic if it is not implemented by good practices. Compliance is often translated into preliminary checks by AIs providers, as is the case in the AI Act where ex-ante compliance is crucial to bring high-risk AIs to market.52

Even though responsibility and accountability may be used synonymously, one could immediately point out the difference.53 While responsibility is an individual obligation of the creators in charge of a certain decision-making process, the accountability for the explanation of the decision and the consequences stays with the legal entity accountable for such decisions. 54

4 Crypto currencies, AIS, and the evolution of corporate legal personality

Various stakeholders including individuals and community groups can invest and trade tokens (Bitcoins) online using blockchain technology.55 This trading is formalised and takes place through smart contracts known as Decentralised Autonomous Organisations (DAO), created by its founders and joined by any stakeholders having an interest.56 DAO has been described as advanced smart contracts that use programmable blockchain protocols to automate transactions and corporate governance through tokens. 57

DAOs are created and overseen by developers until they gain membership when their tokens are bought through digital wallets.58 By acquiring these tokens, purchasers participate fully in its activities which are akin to those of company shareholders and directors.59 Once they are developed into this form, developers and Bitcoin holders are on equal footing, arriving at decisions collectively according to encoded rules through smart contracts.60 It is against this backdrop that, in their current form, DAOs raise a number of legal questions. One of the critical questions raised is that there is no separation between ownership and control of the entity when it comes to corporate governance. In addition, it further raises issues of contractual law, data privacy, intellectual property, and cyber security amongst others.61

The liability of DAO members depends on whether or not they are members of a DAO that is linked to a limited liability company.62 If a DAO is not linked to a limited liability company, its members will be held individually and severally liable to satisfy the amount of debt.63 It is therefore clear that the unlimited liability in this way would serve as a drawback discouraging members from making risky business decisions as this may lead to the loss of their personal assets. Another critical aspect to consider is the division and degree of liability obligations between multiple stakeholders within the value chain. It may not be clear whether the systems caused harm as a result of manufacturing defects, data collection, or malfunctioning arising from negligence or fault.

In 1966, the United Nations Commission on International Trade Law (UNCITRAL) was established and entrusted with the important responsibility to modernise and harmonise international trade targeting key areas of commercial law involving domestic and foreign companies through a non-tariff barrier to trade.64 One of the directives adopted by UNCITRAL in 2017, the Model Law on Electronic Transferable Records (MLETR),65 legally enables the use of electronic transferable records that are equivalent to sums of money and supports paperless digital trade using crypto assets.66 In this way, the MLETR provides for the regulation of blockchain technologies to a particular extent.67 However, it falls short of including emerging corporate entities, as legal persons, in the form of DAOs. In its current form, DAO is faced with difficulties in engaging in credible and legal commercial transactions including tax obligations.

The consequences of this uncertainty regarding its legal status are not conducive for potential investors given the liability risks involved.68 Similarly, innocent community members and other stakeholders are left with no recourse once funds invested in blockchain business such as DAOs disappear into the hands of unscrupulous developers and founders.69

5 Legal personality challenges in the AIS-related blockchain activities

The disunity in defining AIS came to the fore in the Sarcuni case70 in the Southern California state in the US where the plaintiff’s bone of contention centred on the uncertainties and frustrations stemming from the impasse to define and bringing AIS within the parameters of a legal person.71 This is a putative class action lawsuit by individuals from various countries regarding the bZx DAO’s legal status and the potential liability that may arise therefrom.72 At the time of writing, the case was before the court, where the plaintiffs have instituted a claim against the DAO and its co-founders after invested funds were siphoned off in a cyber-attack from a decentralised finance protocol.73 The plaintiffs alleged that developers and founders of the bZx DAO were negligent. In addition, they also alleged that by failing to create a general partnership, the defendants (bZx DAO) acted as a legal entity in which crypto assets were transferred thus making it a general partnership.74 Based on these, the plaintiffs argue that bZx DAO, its co-founders, and its members be jointly and severally held liable for negligence for the theft of approximately USD$55 million in funds from a decentralised finance protocol.75 It is important to indicate that these co-founders include a number of juristic persons in the form of investment firms. 76

Central to the plaintiff’s arguments is that bZx failed to take security measures necessary to protect the funds held in security protocols, despite the fact that such measures were implemented by some of its partners.77 What also ameliorated matters is the fact that the founders of bZx promised that such funds would be transferred to a general partnership which is a legal entity before they were siphoned off.78

Another important aspect that the court may have to assess is the distinction between ownership and control to determine the liability of a decentralised autonomous organisation.79 Realising the risks associated with skeletal access keys to zBx protocol, developers and investors may prefer to be in possession and control of such keys for practical reasons.80 The courts may also view this as an indication of control in determining liability between and amongst participants.81

The determination of liability would also compel the court to assess the nature of the DAO in totality including the threshold of ownership, which may involve the original development team, early investors as well as passive users of the underlying protocol, and varying degrees of individuals linked to the tokens they own or control. 82

In conclusion, any decision in Sarcuni is likely to have wide-reaching implications for the legal status of DAO and its participants across the world. It can be concluded that if the court answers in the affirmative it will imply that AIS in the form of DAO would be conferred with a status of legal personality with plaintiffs entitled to compensation for their losses.83 If the verdict goes another way, the status quo will remain leaving plaintiffs with no legal remedy.84 Similarly, this would also serve as a caution to developers, founders, and members of DAO about their potential liability in the future. To mitigate these potential risks, participants in DAOs may have to consider traditional means of protection such as a corporate vehicle as blockers without compromising the flexibility that comes with this kind of business.

6 Conclusion

In South Africa, despite the fact that there is no single legislative framework harmonising the regulation of the legal personality of AIS, a fairly solid base has been laid to cope with and manage actions and conducts emanating from the deployment and use of AIS. With measurable leverage, regulatory bodies in the finance and banking sector have been able to rise to the occasion and develop regulations to level the playing field. 85

Most companies in the financial and banking sectors are already deploying AIS in their variegated forms in their business operations.86 Due to their strategic locations in the sector, they use these systems in servicing both their customers and clients in the name of efficiency and effectiveness.87 Equally, corporate management in the sectors also employs AIS support systems for decision-making at both management and board levels.88 Currently, the systems are used as a guide to arrive at particular decisions that would enhance business productivity and profitability. South Africa will have to be innovative and creative in developing and adapting existing AI legal principles to remain relevant and competitive in a highly globalised economy.

7 Recommendations

Against the backdrop of the discussion, the following recommendations are expounded for consideration when dealing with legal issues and regulatory frameworks underpinning AIS:

Firstly, responsible authorities at all levels should ensure that data collection processes are democratic, transparent, and accountable with the view of eliminating any form of discrimination, biases, and prejudice.

Secondly, the law reform commission should consider reviewing the Companies Act to include the definition of a “board member”, “shareholder”, “agent”, and “proxy” to be in line with the role of AIS in corporate governance. Thirdly, the Presidential Commission on AI, together with the Department of Justice, and the South African Law Commission should strengthen research into the investigation of the possibility of conferring legal personhood to AIS and their legal liability.

Finally, South Africa should consider clustering various economic sectors, like the financial sector, in order to properly regulate and manage the introduction of AIS in a concerted manner. More importantly, the government should consider establishing a public liability company to deal with all the liability claims emanating from harm caused by AIS.