08 Nov Business Extortion in South Africa: Why Companies Need a Response Plan

A threatening message, a demand for “protection money” or pressure to award work to a particular supplier can place a business in a difficult and potentially dangerous position.

Recent action by the National Prosecuting Authority provides a timely reason for employers to examine how they prepare for extortion threats.

On 30 October 2026, SAnews reported that the NPA’s Asset Forfeiture Unit in Mpumalanga had obtained a provisional freezing order over assets estimated at R99 million. The order arose from ongoing police investigations into alleged organised criminal activities, including extortion.

For businesses, the practical question is whether employees and management know how to recognise a threat, report it and protect the information investigators may need.

What the R99 million order concerns

According to SAnews, the order was obtained in the Mpumalanga Division of the High Court in Middelburg under section 26 of the Prevention of Organised Crime Act.

The restrained assets included properties in Centurion and Pretoria, luxury vehicles, and bank accounts and investments to be surrendered to a court-appointed curator.

The report concerns a provisional restraint of assets linked to alleged criminal activity. It does not establish that the individuals concerned have been convicted of extortion.

Recognising an extortion demand

Business Against Crime South Africa’s extortion information portal describes demands that may involve money, work, contracts or another benefit, accompanied by threats against people, property or reputation.

It also identifies so-called protection arrangements, where a business owner is pressured to pay to keep a business safe from vandalism or burglary.

The context matters. A commercial disagreement, supplier complaint or request for work should not automatically be labelled extortion. Businesses should record the actual words used, the benefit demanded and any accompanying threat so that the circumstances can be properly assessed.

Preparing employees to report threats

Receptionists, security officers, site supervisors and procurement employees may be the first people to receive a threatening call, message or visit.

A practical response plan should give them clear instructions about whom to contact and how to escalate an urgent concern. Suggested planning measures include:

• Naming a responsible manager and an alternative contact.
• Establishing a process for contacting police and the organisation’s security provider.
• Defining when staff should move to a safer area or restrict access.
• Identifying who will coordinate communication with employees, investigators and legal advisers.
• Keeping emergency contact information accessible.

These are general preparedness measures. The response to a specific threat should reflect the circumstances and prioritise the safety of those involved. Employees should not be expected to confront suspected offenders or investigate threats themselves.

An independent security management review can help businesses assess whether responsibilities, contractor instructions and incident escalation procedures are clearly defined.

Preserving information safely

Business Against Crime South Africa identifies information gathering, evidence protection, effective reporting and cooperation with law enforcement as relevant elements of managing extortion incidents.

Depending on the incident, potentially relevant records may include messages, emails, call details, CCTV footage, visitor records and payment demands.

Businesses should consider how these records can be retained without exposing staff to additional danger. For example, relevant CCTV footage may need to be secured before routine deletion, while original messages should be retained alongside any screenshots.

Reviewing CCTV control-room management can help organisations assess how operators identify incidents, escalate concerns and maintain reporting standards.

A factual incident log can help organise what is known. It should distinguish between what someone directly saw or heard and what has been reported by another person. Staff should avoid altering original records or circulating sensitive material unnecessarily.

Reporting the incident to SAPS

SAPS advises victims to call 10111 for emergency police assistance or visit a police station to report a crime.

When a case is registered, the complainant receives a Crime Administration System reference number, commonly called a CAS number. This should be retained for enquiries about the investigation.

Business Against Crime South Africa also makes clear that recording an incident on its information-sharing portal does not replace reporting it to SAPS.

Reviewing the business’s security arrangements

Preparation should also examine how a threat would be managed at the premises concerned.

Useful questions include whether visitors can reach staff without authorisation, whether CCTV recordings are accessible when needed, and whether security officers understand the escalation procedure.

An independent security audit and risk assessment can help management identify gaps across access control, incident reporting, communication and operational procedures. SSC Legacy’s audit scope includes incident and emergency readiness, security technology, policies and procedures.

SSC Legacy provides security audits, independent security management and corporate intelligence services to support organisations seeking to understand their exposure and strengthen their preparedness.

To discuss your organisation’s security risks, contact SSC Legacy, email info@sscinfo.co.za or call +27 11 786 8556.

Sources

• SAnews: NPA clinches R99 million freezing order — 30 October 2026.
• Business Against Crime South Africa: Extortion and Violence at Economic Sites.
• SAPS: Reporting a Crime.

Information checked on 6 November 2026.