Managing risks and compliance

Telkom has a well-defined risk and compliance approach that supports the PIVOT strategic pillars and is well integrated into operational processes. Our operating environment is characterised by ever-changing threats and unprecedented opportunities. This requires us to balance potential challenges and rewards by consistently monitoring our risks and opportunities.

Telkom is committed to complying with all applicable laws and regulations. We actively support key non-binding codes and standards, such as King IV and a range of International Organization for Standardization (ISO) standards. The ISO standards guide our policies, risk management and information security processes.

Telkom reports annually on performance against the risk and compliance plan. Where required, improvement areas are identified and used as input in the review of the following financial year plan. In reviewing our Group risks and opportunities, we consider both internal and external contexts.

To determine the effectiveness of our risk and compliance management, Telkom performs control self-assessments and compliance control validation reviews. The annual reviews ensure we meet the King IV requirements. Any undue or unexpected risks, and those risks outside appetite, are reported with the necessary mitigating actions, responsibilities and timeframes.

In a dynamic and competitive industry, it is imperative to have an effective enterprise risk management (ERM) strategy. The enterprise risk management framework (ERMF) has been designed to navigate the risk inherent to our business. All business units, support functions, processes, projects and other controlled entities are subject to the ERMF.

ERM transformation project outcomes

In FY2026, we undertook an ERM transformation project to ensure the ERMF remains robust, forward-looking and responsive to an increasingly complex and dynamic risk environment.

A core focus of the project was the redesign of Telkom’s risk universe and taxonomy to improve clarity, consistency and comparability of risks across the Group and its subsidiaries.

The transformation project strengthened:

• Alignment between risk management and strategic objectives
• Monitoring of performance against set appetite and tolerance levels
• Understanding of interdependencies between risks and their aggregation
• Integration of risk management with organisational resilience and performance reporting
• Visibility, accountability and monitoring of strategic risk exposure across the Group

The transformation enabled more integrated insights at Group level, supporting timely decision-making and proactive management responses.

The ERM transformation project reinforced Telkom’s commitment to embedding risk and opportunity considerations into strategic planning, capital allocation and operational decision-making. The Group is enhancing its capacity to anticipate disruption, respond with agility and protect long-term stakeholder value.

The project will continue to mature in FY2027 and beyond, further embedding leading practices and fostering a strong risk-aware culture across the Group.

Regulatory risk focus

Telkom operates in a highly regulated environment, and regulatory risk is one of the Group's principal risks and material themes. To ensure compliance, we focus on:

Licence to operate – Spectrum allocation and licence conditions remain a priority amid evolving regulatory frameworks. These require proactive compliance monitoring and stakeholder engagement.

Data privacy and digital regulation

– Large-scale data processing, digital service coverage, and complex cyberthreats require that we enhance our cybersecurity capabilities and third-party oversight, and embed robust data governance frameworks to safeguard information and maintain stakeholder trust.

Regulatory compliance – We maintain a comprehensive regulatory universe and continuously monitor digital, interception, and cybercrime legislation. This enables a proactive approach to mitigate compliance gaps and improve our processes.

Market conduct and consumer relations

– Our shared value of customer centricity places customers at the core of our purpose and value creation. Compliance with the Consumer Protection Act is a cornerstone of our approach, supported by enhanced controls to safeguard customer interests. This year, we launched consumer-focused training to ensure improved consumer experiences.

Environmental, health and public safety

– We remain committed to environmental, health and public safety by ensuring compliance with the National Environmental Management Act (NEMA). We have also assessed the impact of Administrative Adjudication of Road Traffic Offences (AARTO) amendments on our operations and are implementing appropriate controls to strengthen compliance and mitigate associated regulatory risks.

We confirm that no material or repeated regulatory penalties, sanctions or fines for contravention of statutory obligations were reported in FY2026.

Our risk management and compliance governance structure

Emerging risks and/or opportunities and topical events	Mitigation and/or response
Disruption from OTT, fintech, and broader competition Disruption from OTT players, fintech companies, and retail banks with strong digital platforms is eroding Telkom’s traditional market position. Beyond the typical OTTs like WhatsApp and Netflix, competitors from adjacent industries (e.g. banking) are aggressively entering the digital and telecommunications space, blurring the sector boundaries.	Launch innovative new products and services to achieve sustainable competitive advantage Improve digital transformation through customer experience projects Create customer stickiness through targeted campaigns and loyalty programmes
Workforce and skills Telecoms operations are undergoing rapid digital transformation, driven by 5G, AI, cloud and automation. However, workforce capabilities have not kept pace. There is a growing gap between current skill sets and those required for next-generation networks and digital services.	Align talent needs with future-state business and technology priorities such as digital, cloud and AI-driven functions We partner with universities, industry alliances and technology providers to build future talent pipelines We continuously strengthen leadership development to support an agile, digital-first culture and drive transformation at all levels Refer to our human capital section and the sustainability report
AI data centres as an opportunity Competitors and hyperscalers are expanding data centre AI infrastructure and localising AI services, while making advanced tools more accessible to reduce costs and latency. This is expected to accelerate digital transformation across sectors such as finance, healthcare, logistics and manufacturing, and enhance the quality of their digital products and user experiences. BCX can position itself as an implementation partner by rolling out AI infrastructure services once these are market-ready. Due to the high investment required to deploy AI infrastructure, BCX remains cautious while preparing to be an executing partner through key skills development.	Collaborate with potential partners to drive co-investment due to the huge financial investment required By prioritising the development of advanced professional and managed services capabilities in AI, we ensure readiness and competitiveness in the evolving landscape Leverage internal collaboration and the OneTelkom approach to drive our AI cloud ambitions
Gambling and possible network abuse There is growing use of mobile and digital platforms to access online gambling services provided by illegal or grey market operators. This poses risks to platform owners. The telecoms industry, and Telkom specifically, might be accused of being an enabler of the gambling problem facing society.	Engagement with other operators through the Communication Risk Information Centre (COMRIC) to find an approach that helps to reduce the social impact of online gambling Launch digital awareness campaigns to educate customers, particularly young adults and vulnerable groups, on the safe use of mobile/digital platforms

Our key strategic risks

As part of the ERM transformation journey undertaken in FY2026, Telkom identified 12 top strategic risks related to strategy implementation. This is a transition from the six risks identified and tracked in FY2025.

The two heatmaps below reflect the shift in Telkom's risk profile between FY2025 and FY2026.