Buying a SIM card in South Africa may soon require more than an ID document and a utility bill. Under ICASA’s proposed Fifth Amendment to the Numbering Plan Regulations, published on 28 October 2026, mobile licensees would have to verify every subscriber’s identity biometrically against Department of Home Affairs records before activating or re-activating a mobile number.
ICASA presents this as a know-your-customer and anti-fraud measure and insists that it is distinct from SIM registration under the Regulation of Interception of Communications and Provision of Communication-related Information Act, 2002 (“RICA”). In practice, it would turn every mobile operator into a processor of fingerprints and facial images on a national scale, raising hard questions about privacy, security and whether the cure is proportionate to the disease.
What would change
At the heart of the proposal is a new regulation 6A(5): on activation or re-activation of a mobile number, the licensee must verify the subscriber’s identity through biometric verification against Home Affairs records. ICASA’s explanatory memorandum makes clear that this means real-time fingerprint and facial recognition, a notable expansion of the fingerprint-only definition of biometric data introduced in 2023.
The net is cast wide. The same check would apply to every SIM swap, and a swap must be refused if the identities do not match. Existing subscribers are not grandfathered: proposed regulation 24A gives licensees two years to verify their entire existing subscriber base biometrically. Licensees would also be limited to five mobile numbers per subscriber, and numbers assigned to foreign visitors would lapse with their visa or after 90 days.
Juristic persons are exempt, on the basis that companies cannot provide fingerprints or faces and are adequately identified through registration documents and their authorised representatives.
Is it overly intrusive?
Biometric information is special personal information under the Protection of Personal Information Act, 2013 (POPIA), and its processing is prohibited unless a section 27 exception or an authorisation by the Information Regulator applies. A regulation imposing the obligation would probably give operators a lawful basis, but that does not end the enquiry: the processing must still be lawful, reasonable and limited to information that is adequate, relevant and not excessive for its purpose.
That is where the proposal is most vulnerable. The Information Regulator has flagged biometric systems as high-risk technology that demands proportionality between security needs and privacy rights, and it has recorded public concern about the collection of personal information beyond what is necessary. ICASA must explain why less invasive tools, such as RICA’s existing documentary verification, enhanced SIM-swap controls or targeted biometric checks for high-risk transactions only, would be insufficient.
Three features sharpen the concern. First, the requirement is universal: it applies to every natural-person subscriber in a market where ICASA itself counts at more than 117 million mobile subscriptions. Second, it is effectively compulsory: a person who declines biometric verification cannot obtain or keep a mobile number, which in practice means exclusion from mobile banking, government services and work. Third, ICASA has been here before. Its 2023 biometric proposal drew objections based on the constitutional right to privacy and POPIA’s section 26 prohibition, and implementation of the relevant provisions was suspended.
To its credit, the draft confines biometric data to subscriber identity verification and requires records to be deleted within 30 days of deactivation, broadly tracking POPIA’s retention principle. These safeguards are welcome, but they govern what happens to the data after collection, not whether collection is necessary in the first place.
The security risk for data subjects
A compromised password can be changed; a compromised fingerprint or face cannot. That permanence is what makes biometric data so useful for identity assurance and so dangerous when it leaks. A breach could expose subscribers to lifelong identity theft and fraud, the very harms the regulations aim to prevent.
The proposal also multiplies the points of exposure. Biometrics would be captured at retail stores, franchises and dealer outlets across the country, transmitted to Home Affairs and matched in real time. Each link in that chain, from capture devices and dealers acting as operators to transmission channels and the Home Affairs interface, is a potential point of failure. POPIA requires responsible parties to identify foreseeable risks and maintain appropriate safeguards, to bind operators contractually to those safeguards, and to notify the Regulator and affected data subjects of any security compromise.
Yet the draft is silent on security. Unlike RICA, which expressly requires the SIM-registration process, records and storage facilities to be secure and accessible only to designated persons, the draft prescribes no security standards for biometric capture, transmission or storage.
For subscribers, the change is personal. Activating, re-activating or swapping a SIM would require biometric verification linked to Home Affairs records, and foreign nationals face the added prospect of their numbers lapsing with their visas.
What it means for MNOs on the ground
For mobile network operators, the burden is primarily operational, and it is substantial. ICASA notes that most licensees have already rolled out biometric verification, but only for post-paid offerings. Extending it to prepaid customers means deploying capture devices and real-time Home Affairs connectivity at every point of sale, including informal and rural distribution channels.
The retrofit is the biggest task. Every existing natural-person subscriber would need to be re-verified within two years, requiring customer outreach, in-store or assisted re-verification and, presumably, suspension of numbers that are not verified in time, although the draft does not say what happens to them. The timeline is also unclear: regulation 24A runs for two years from the regulations coming into effect, while the commencement clause defers regulation 24A by 12 months from publication.
Beyond onboarding, operators would need to rebuild SIM-swap journeys around biometric checks, including remote and eSIM swaps; build systems to enforce the five-numbers-per-subscriber cap; track visa expiry dates and deactivate foreign nationals’ numbers automatically; and maintain fallback and dispute processes for failed matches, Home Affairs outages and data-quality errors. POPIA’s information-quality condition means a failed biometric match cannot simply be treated as conclusive.
The stakes are high. Contraventions of the core verification, record-keeping and transitional provisions would attract fines of between R2 million and R4 million per contravention. If each unverified subscriber is treated as a separate contravention, the exposure could be enormous.
A duplication of RICA?
Partly. Section 40 of RICA already prohibits SIM activation unless the operator has recorded and verified the subscriber’s names, identity number and address, using an identity document and proof of address, and it requires that information to be stored securely.
The draft shares RICA’s objective of linking every mobile service to a verified person but differs in method and legal basis: RICA relies on documents, whereas the draft relies on biometrics matched against Home Affairs records. ICASA acknowledges the overlap but maintains that its requirement is distinct from RICA SIM registration. Operators may well ask whether two parallel identity regimes, administered by different authorities, are the most efficient route to the same end.
Conclusion
Tackling SIM-swap fraud and anonymous numbers is a legitimate goal. But fingerprinting and face-scanning an entire nation’s mobile subscribers is a heavy tool, and the question remains; is it necessary, proportionate or secure?
The draft is open for public comment until 9 December 2026 (30 working days from publication). Written representations may be submitted to ICASA at numberingresourceplancommittee@icasa.org.za. Operators, privacy advocates and consumers should make their voices heard.
--
Read the original publication at ENS
About Afriwise
Afriwise is a legal intelligence platform forAfrica,covering the laws and regulations of 40+ countries, built with 170+in-countrylaw firms. For South Africa, Afriwise offers the consolidatedstatutorydatabase with Ask Lexiwise AI-assisted research, Sentinel regulatorymonitoringbacked by more than twenty years of continuous coverage, practicalguidancedeveloped with in-country law firms, and compliance solutions.
