South Africans activating a Sim card, swapping one or keeping an existing number would have their fingerprint or face checked against Department of Home Affairs records under draft rules published by the Independent Communications Authority of South Africa (Icasa).
The regulator published the Draft Numbering Plan Fifth Amendment Regulations in the Government Gazette on 28 October. The draft would require operators to verify subscribers biometrically when a number is activated or reactivated and when a Sim is swapped. Operators would have two years to verify existing customers in the same way. Icasa’s explanatory memorandum puts the number of mobile subscriptions at 117.3 million.
The rules target Sim-swap fraud, in which criminals move a victim’s number to a new card to intercept one-time banking passwords. Under the draft, operators would have to refuse a swap if the person making the request does not match the records of the subscriber assigned to the number.
| Indicator | Value |
|---|---|
| Mobile subscriptions | 117.3m |
| Population (including 21m minors) | 63m |
| Average subscriptions per adult | 2.79 |
| Number cap per subscriber, per operator | 5 |
| Penalty for core verification breaches | R2m–R4m per contravention |
| Digital banking fraud incidents, 2025 | 110,074 |
| Digital banking fraud losses, 2025 | R2.4bn |
| Annual cost of telecoms-linked fraud | R5.3bn |
The fraud figures show the scale of the problem. The South African Banking Risk Information Centre recorded 110,074 digital banking fraud incidents in 2025, up almost 13% on the previous year, with losses rising from R1.86 billion to R2.4 billion. Mobile banking accounted for the highest number of Sim-swap-related incidents. The Communication Risk Information Centre estimates that telecoms-linked fraud costs the country R5.3 billion a year, and that close to 60% of mobile banking fraud is tied to Sim swaps.
The draft also caps the number of mobile numbers an operator may assign to one subscriber at five. Because the cap applies to each operator separately, a person could still hold more than 20 numbers across all licensees. Icasa based the cap on an average of 2.79 subscriptions per person, calculated by dividing total subscriptions by a population of 63 million, of whom 21 million are minors. That makes the figure an average per adult. Companies are exempt from the biometric checks because their relationships with operators are governed by contract, but the cap still applies to them. Numbers issued to foreign nationals without permanent residence would stay active only for the validity of their visa or for 90 days.
Penalties for breaching the core verification rules, including approving a swap for someone whose identity does not match, range from R2 million to R4 million per contravention. Failing to verify identity before a swap, or exceeding the cap, would carry a fine of R1 million. The draft does not define what counts as a single contravention.
Prepaid Sims are likely to be the hardest part to implement. Icasa’s memorandum says most operators told it last year that they had introduced biometric verification, but only for post-paid contracts. MTN alone puts about 90 million prepaid Sims into the market each year. MTN South Africa chief executive Ferdi Moolman said in August that the industry sells between 200 million and 300 million a year.
The operators have already signalled that they oppose the draft. The Association of Comms and Technology, which agreed an interim framework in June to tighten Sim registration, said the proposals differ materially from that framework on registration limits, biometric requirements and implementation. The association argues that the rules overlap with the Regulation of Interception of Communications Act (Rica), the existing law on Sim registration, and that reform should be made through Rica. Icasa says its verification requirement is separate from Rica registration.
Biometric data is classed as special personal information under the Protection of Personal Information Act. The draft limits its use to verifying identity and requires operators to delete records within 30 days of a number being deactivated, unless a law or contract requires them to keep it.
This is Icasa’s second attempt. A 2022 proposal drew tens of thousands of comments through a public campaign, most of them opposed. Rules introduced in March 2023 were suspended without a commencement date being set. The new rules would take effect 12 months after the final regulations are published, and the public has 30 working days to comment.