Blue Label logo
2025 INTEGRATED ANNUAL REPORT

Currently viewing: Material risks and opportunities | Next: Stakeholder relations

Material risks and opportunities

The main purpose of risk management is to position the organisation to understand adequately and respond to potential risks and opportunities that could materially impact the execution of our strategy and our ability to create value.

Blu Label’s primary risks and opportunities are identified within the context of our strategy to proactively respond to everchanging internal and external operating environments. In pursuing our goals toward creating, preserving and realising value for our stakeholders, we are strengthening the link between our strategy and the Group’s risks and opportunities by applying our Enterprise-wide Risk Management (ERM) process within the context of key business requisites.

Our ERM process ensures the adequacy, appropriateness and effectiveness of our responses, mitigating potential significant negative business impacts to deliver on our business targets.

Description

Since most of the Group’s inventory is of a virtual nature, defence against cybercrime will remain a top priority. Cyber-attacks can lead to reputational damage, business disruption and ultimately loss of revenue.

The Group is dependent on the systems and platforms that enable its products and services on which it manages its merchant base. Blu Label’s technology spend has increased in recent years in support of its importance to both organic and inorganic growth, as well as simultaneously to improve system availability and resilience as the volumes of both the number and types of transactions increase.

Strategic response and mitigating measures

  • Blu Label places significant focus on the security of all systems, both production and enterprise to pre-emptively detect, prevent and manage security threats and recover expediently in the event of a cybersecurity breach.
  • Independent third parties continually conduct periodic vulnerability scans and penetration tests to ensure that Blu Label’s systems are secure, and new threats are actively monitored and appropriately addressed through our 24/7 security operations centre.
  • A Security Operations Centre (SOC) has been implemented and is now fully operational. The SOC provides real-time threat detection and analysis of our environment and assists in countering cybercrime risks. The optimisation of the SOC is also currently ongoing. Furthermore, the SOC is being used for threat intelligence and is assisting in developing and rolling out assurance programmes that incorporate internal and external reviews of our data storage practices.
  • Our National Institute of Standards and Technology (NIST) Cybersecurity Framework is structured or aligned to the three lines of defence model. This allows for a dynamic approach focusing on assembling and arranging capabilities that allow for quicker response and optimising our cybersecurity initiatives. Our maturity scores are independently assessed by internal audit for factual accuracy.
  • We have appointed the appropriate skills set to manage our IT security. To bolster our cyber security, we have outsourced the entire function to a capable, highly skilled and adequately resourced service provider.
  • An advanced cloud-native platform has been implemented to counter malware threats.
  • A data loss prevention tool has been implemented, which provides real-time visibility, threat protection and data security for cloud services and websites.
  • All Blu Label staff members are mandated to participate in an ongoing cybersecurity awareness training programme, as part of cybersecurity culture and posture.
  • Cyber insurance cover is in place to protect the Group in the event of a breach.
  • We monitor the Group’s cyber incident response and containment in real time.
  • Blu Label has achieved full certification on ISO 27001:2022 for its main trading platform/system.
  • ISO 27001:2022 provides a recognised framework for information security and outlines best practices for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). ISO 27001:2022 assists companies to achieve many benefits such as digital trust with clients and other key stakeholders. Achieving this certification demonstrates our commitment to maintaining stringent standards for information security. It represents a resounding endorsement for digital security in the highly competitive telecoms and fintech industries in which we participate.

Description

Unfavourable economic conditions and heightened inflation are negatively impacting on consumer disposable income. Consumers are forced to prioritise their buying habits based on needs, leaving less or no disposable income to buy discretionary products (e.g. universal vouchers and event tickets).

South Africa faces a dynamic set of material risks and opportunities shaped by domestic and global geopolitical developments. Heightened geopolitical tensions, shifts in global trade alliances, and volatility in commodity prices could create uncertainty for investment flows and currency stability. The balance between risk and opportunity will be influenced by the outcome of local political stability, policy direction, and the country’s ability to maintain investor confidence amid a shifting global landscape.

Strategic response and mitigating measures

  • We have brought innovative products to market to assist economically distressed consumers in purchasing essential services.
  • The Group is currently assessing the potential impact of these geopolitical risks on our value chain.

Description

Due to the nature of its digital inventory, the Group is vulnerable to fraudulent activities. Blu Label maintains zero tolerance for fraud and irregularities. All incidents are investigated, irrespective of the size or value.

The ongoing rollout of new products/solutions increases our exposure to potential fraud-related activities.

E-tokens are a form of electronic cash utilised for secure transactions. The Group relies on the high-volume, low-margin distribution and sale of these e-tokens of value. Therefore, Blu Label must protect its virtual stock from theft and cybercrime.

Strategic response and mitigating measures

  • We continue to refine operational controls, security and our infrastructure to mitigate the risk of fraud.
  • Fraud and ethics are discussed at Board level by both the Social, Ethics and Transformation Committee (SETC) and the Audit, Risk and Compliance Committee (ARCC).
  • Our ethics hotline, hosted by Deloitte, remains available for anonymous reporting of any instances or suspicions of fraud.
  • Staff are mandated to participate in digital programmes that enhance awareness relating to fraud and ethics. A code of conduct, disciplinary and fraud policies are in place.
  • We have developed a Fraud Management Framework that addresses the risk of fraud within the Group.
  • The confidentiality, integrity and availability of virtual stock is managed through role-based access control, secure transfer of supplier/customer files and encryption with hardware security modules.
  • The internal audit function performs independent assurance on these controls’ design adequacy and effectiveness.
  • A robust set of automated internal controls assists in timeous detection and prevents the theft of voucher pins and related digital products.
  • Insurance cover is in place to protect the Group in case of a breach.

Description

Certain prominent financial institutions and retailers rely on Blu Label to process their substantial transaction volumes. A lapse in the Group’s service delivery to these stakeholders could negatively impact its profitability and/or reputation.

Strategic response and mitigating measures

  • Blu Label maintains long-standing relationships with these parties and has an impressive track record of service delivery
  • Mature failover and business continuity mechanisms provide a high degree of certainty that we maintain uptime beyond 99%, even as transaction volumes continue to grow.
  • As part of our operational resilience framework and practices, we actively monitor and enhance our business continuity and disaster recovery plan (DRP).

Description

The prepaid airtime and data market in South Africa — led by Vodacom, MTN, Telkom Mobile, and Cell C — continues to face margin compression. The environment is highly competitive, with all major networks targeting the same consumer segment. To retain market share, networks offer increased value to consumers (more data and airtime for the same or lower spend), leading to lower adequate margins.

The entry and growth of Mobile Virtual Network Operators (MVNO) has further intensified competition, while ongoing economic pressure is reflected in declining recharge trends across the sector.

In addition, the prepaid electricity market also continues to face margin compression.

Strategic response and mitigating measures

  • Long-term agreements with network operators are in place to secure revenue continuity.
  • The Group diversifies into adjacent product categories to reduce reliance on high-volume, low-margin lines.
  • Continued engagement with suppliers to preserve margin where possible.
  • Ongoing product diversification and innovation to offset structural margin pressure.

Description

The failure of Cell C’s strategy and execution of its business plan would not only negatively impact the investment. Still, it would also have a knock-on effect on the Blu Label Group, in that there is substantial credit risk exposure and a portion of its profitability stems from its trading relationship with Cell C.

Strategic response and mitigating measures

  • The Cell C recapitalisation transaction, in September 2022, achieved the deleveraging of its balance sheet, providing it with liquidity to operate and position itself to achieve long-term success for the benefit of its customers, employees, creditors, shareholders and other stakeholders.
  • Cell C implemented a turnaround strategy, focusing on operational efficiencies, reducing operational expenditure and optimising traffic. This included significantly reducing capital expenditure and converting a fixed-cost infrastructure-based network to a variable operational expenditure model. This, together with the recapitalisation of the debt structure, resulted in a significant improvement of its liquidity and enabled Cell C’s long-term sustainability.
  • Cell C has taken a capital-light approach to its mobile network, utilising its spectrum assets and physical network infrastructure owned by other mobile network operators. Cell C will leverage the flexibility that comes with its capital-light model and the ability to roam across partner networks. It will invest further to enhance customer offerings and experience. Over the past 24 months, the strengthened Cell C executive management team has successfully returned the Cell C business to a strong growth trajectory with significant improvement in both operational and financial metrics, driving the sustainable growth and profitability of Cell C going forward.
  • The proposed restructure of Cell C is expected to encompass various ancillary transactions, aimed at optimising Cell C’s capital structure and balance sheet in preparation for a potential separation and future listing on the JSE. Should Blu Label elect to implement the proposed restructure, it is envisaged that the various restructuring steps will be inter-conditional and contingent upon the potential listing of Cell C. Implementing of the restructure and potential listing will remain subject to, among other conditions, approval by the boards of Blu Label and Cell C, requisite shareholder and regulatory consents, and favourable market conditions.
  • To contribute to the success of Cell C, Blu Label is represented on the Board of Directors, affording it complete oversight of the performance of the Company.

Description

Business continuity management plans (BCM) and DRP ensure that the business is prepared for severe interruptions and that business processes continue with minimum downtime during cases of emergency or disaster.

If the business continuity plans (BCP) are misinterpreted or not correctly in place, the potential breakdown of critical business processes could harm the Group’s profitability and reputation.

Strategic response and mitigating measures

  • Blu Label’s business continuity management steering committee meets bi-annually to ensure the Group is prepared to counter any risk.
  • We are currently reviewing the effectiveness of our business continuity management system to ensure that we manage our continuity risks effectively.
  • Business continuity simulation testing was performed in certain material subsidiaries during FY25 which validated the effectiveness of our recovery strategies and ensured team readiness.
  • We have engaged with an external service provider to review the content of our BCP and they will be tested during 2025 via practical scenario tests.

Description

Electrical power is an essential input in all modern-day economies and a large part of Blu Label’s business involves the vending of airtime and electricity products. The power crisis had a two-fold impact on our business; namely, many of our merchants do not have back-up power resources to continue to vend during power outages, and secondly, consumers no longer buy products at the same level due to the lack of electricity/back-up resources in their domestic environments.

Strategic response and mitigating measures

  • We will continue to maintain and enhance back-up power at our centres around South Africa for the medium to long term.

Description

The new employment equity (EE) regulations in South Africa, particularly the introduction of sectoral targets for designated groups, pose a risk of potential penalties for employers who fail to meet these targets. Designated employers, which include the Group, must align their EE plans with these sectoral targets.

Failure to meet these targets, without justifiable reasons, can result in penalties and potential legal action.

Strategic response and mitigating measures

  • A focused employment equity plan (2025–2030) is under review for alignment with the revised Ministerial Information and Communication Technology (ICT) sector targets.
  • Quarterly tracking of progress across occupational levels in the Group.
  • Executive dashboards have been produced and monitored indicating EE targets and performance.
  • EE Forum functioning across divisions documenting progress and challenges to assist the Group in achieving its diversity goals, which the Social and Ethics Committee oversees.
  • Bursary, learnership, and internship pipelines targeting designated groups to assist in meeting sector targets.

Description

Blu Label has an opportunity to play a role in climate change mitigation, both in terms of its own carbon footprint efficiency and decarbonising the supply chain for products and services that are digitally distributed.

Strategic response and mitigating measures

  • Integrate climate risks and opportunities into the risk management framework, including considering renewable energy sources for our operations.
  • Digitally connecting consumers and businesses in the supply chain significantly reduces the carbon associated with travel and maintaining physical retail establishments. The more volumes built and products and services transacted through our digitised distribution channels, the greater the positive impact made.
  • Reaching out to our material suppliers, via questionnaires, to gauge the extent of their environmental responsibilities, including:
    • Greenhouse gas (GHG) emissions;
    • Energy efficiency;
    • Renewable energy;
    • Water quality, consumption and management
    • Sustainable resources management;
    • Waste reduction; and
    • Reuse and recycling.

Description

Our gradual progress in implementing AI technologies, aimed at driving efficiencies and improving business performance, is underpinned by a strong commitment to responsible data use. This includes carefully considering AI’s ethical implications and ensuring data is used responsibly and ethically.

Strategic response and mitigating measures

  • We have defined and implemented a generative AI governance framework and policy to manage the adoption and implementation of AI.
  • A central AI repository is maintained to track all AI usage within the Group.
  • Implement robust data governance policies, a set of rules and procedures for managing data, that comply with privacy regulations in line with the Protection of Personal Information Act, 2013 (POPIA).
  • Implement security measures which include data protection, continuous monitoring and detection of threats.

Description

A significant portion of South Africa’s population is underserved in terms of its ability to access formal financial services. Following the substantial increase in access to cellular phones and data, Blu Label can offer consumers and informal businesses access to low-cost digital means of e‑commerce transactions.

The rapid expansion of mobile phone and data penetration presents an opportunity for Blu Label to play a significant role in facilitating digital inclusion. Our low-cost, accessible e‑commerce and financial transaction platforms enable consumers and informal businesses to participate more efficiently in the digital economy, reducing cash dependency, expanding market reach, and enhancing transactional convenience.

Strategic response and mitigating measures

  • Creating financial inclusion for communities through our innovative products and services that digitally connect consumers to anywhere-anytime products and services that would ordinarily be out of reach to many consumers.
  • Increase connectivity to drive economic participation within underserved communities.
previous

BLU Label Unlimited Integrated Annual Report 2025

next