Mobile operators would have to check a customer’s fingerprint or face against Department of Home Affairs records before activating, reactivating or swapping a SIM, under draft rules from the communications regulator, and the industry body that speaks for the big networks says it cannot endorse the plan as written. The Independent Communications Authority of South Africa (Icasa) published the Draft Numbering Plan Fifth Amendment Regulations, 2026 for public comment in the Government Gazette on Wednesday 28 October, according to TechCentral.
What Icasa is proposing
In its media statement of 29 October, Icasa says the draft aims to establish a mobile subscriber registration regime that improves consumer protection and strengthens its ability to act against unauthorised use of mobile numbers. It introduces mandatory biometric verification for new and existing subscribers when numbers are activated or reactivated, and when a SIM swap is requested. It also limits how many numbers a licensee may assign to one subscriber, and limits how long numbers assigned to visitors stay active.
The detail comes from the draft itself, as reported by TechCentral. An operator would have to verify a subscriber’s identity “through biometric verification against the department of home affairs records” on activation or reactivation of a number. Existing customers are covered too: operators would have two years to verify current subscribers the same way. Icasa’s explanatory memorandum puts South Africa’s mobile subscriptions at 117.3 million.
On SIM swaps, a favourite tool of fraudsters who hijack numbers to intercept one-time banking passwords, operators would have to refuse a swap if the person asking does not match the records of the subscriber assigned the number. The cap is five numbers per subscriber per operator. Companies are exempt from the biometric checks, because their relationship with operators is governed by contract, but the draft does not exempt them from the cap. Foreign nationals other than permanent residents would get numbers that stay active for no longer than their visa is valid, or 90 days.
Fines would run from R2-million to R4-million per contravention for breaking the core verification rules, including approving a swap for someone whose identity does not match. Failing to verify identity before a swap, or exceeding the five-number cap, would cost R1-million per contravention. According to ID Tech and TechCentral, the draft does not define what counts as a single contravention.
Dates and open questions in the timeline
The biometric rules and the five-number cap would take effect 12 months after the final regulations are published, TechCentral reports. It adds that it is unclear whether the two-year window for existing subscribers runs from publication or from that later date, because the draft refers only to “the date of the regulations coming into effect”.
The comment period is described differently by two sources. Icasa’s statement says interested parties have 30 days from the date of publication to submit written representations. TechCentral says they have 30 working days from 28 October. We have not seen the Gazette notice itself, so readers who plan to submit comments should confirm the closing date with Icasa directly.
Why the networks object
The Association of Comms & Technology (ACT), which represents Vodacom, MTN, Telkom, Cell C, Rain and Liquid Intelligent Technologies, told TechCentral that it backs stronger SIM registration but not these measures. “We would distinguish between supporting the objectives of the proposed regulations and endorsing the specific measures in their current form,” chief executive Nomvuyiso Batyi said in a written response.
ACT raised four lines of argument, as reported:
First, overlap with the Regulation of Interception of Communications Act (Rica). SIM registration is Rica’s job under section 40, and the Department of Justice and Constitutional Development is its custodian, while Icasa is using its power to regulate numbering resources. Batyi said the draft could “introduce uncertainty, duplicate implementation costs and potentially disrupt progress already made by industry”. Icasa’s memorandum says its verification requirement is distinct from Rica registration.
Second, cost and feasibility. ACT listed the checks against Home Affairs records, system integration and operational readiness as needing further assessment. In a later interview with TechCentral, Batyi put the cost of a Home Affairs check at R10, and said it “adds up”.
Third, timing. Icasa amended the same regulations in July, setting rules for deactivating dormant SIMs. Batyi said further substantive obligations in such a short period “raises questions regarding regulatory predictability, policy coherence and the cumulative compliance burden imposed on licensees”.
Fourth, the cap itself. ACT’s own framework, signed by members in June, would allow up to 20 SIMs per person per network, four times Icasa’s limit, though Batyi said the figure is “not cast in stone”. She was also sceptical of re-verifying every existing subscriber within two years, comparing it with the stalled migration to digital television. ACT has said it will make formal representations to Icasa.
The regulator’s case
Icasa councillor Dikeledi Catherine Mushi, who chairs its Numbering Resources Committee, told Eyewitness News that Icasa wants every number to have a person behind it. She described what the public calls SIM fraud as number fraud, because the regulator does not regulate SIM cards but the numbers on them. She said operators would still need subscribers’ full personal details such as name and ID number, since the biometric check alone is not a record of who holds a number. Icasa told TechCentral it would not comment on ACT’s criticism.
The regulator first introduced subscriber identity verification rules in March 2023 but suspended them until a commencement date it never set. Its explanatory memorandum says most operators told it last year that they had rolled out biometric verification, yet only for post-paid customers, not prepaid. The draft limits use of the biometric data to identity verification and requires operators to delete subscriber records within 30 days of a number being deactivated, unless the law or a contract requires otherwise or the subscriber consents.
What it could mean for business
Prepaid is where the volume sits. MTN South Africa chief executive Ferdi Moolman said in August that MTN alone puts about 90 million prepaid SIMs into the market each year, and the industry between 200 million and 300 million, TechCentral reports. Any biometric step at the point of sale, including at informal vendors, would therefore touch very large numbers of transactions. ACT says its own solutions centre on “liveness” tests to confirm a real person is present, and that the Competition Commission, which oversees the industry plan, has told it any technical solution must be brought back for approval.
Businesses that run many lines, such as courier fleets, point-of-sale terminals or field teams, should note that a company is exempt from biometric checks but not from the five-number cap per operator, as the draft stands. Whether staff-held numbers registered to individuals are caught is not addressed in the sources we read.
Nothing here is final. The draft goes through comment and a final decision by Icasa, and the rules would then take 12 months to bite. For more on the regulator’s recent work, see our coverage of Icasa’s proposal for direct licences for new network operators and the earlier Icasa comment deadline on telecom rules, or browse Tech & Telco.
Sources: TechCentral on ACT’s response and TechCentral on the 20-SIM proposal.
