South Africa’s communications regulator, the Independent Communications Authority of South Africa (Icasa), has proposed new rules that would require mobile operators to verify subscribers’ fingerprints or facial details against government records before activating SIM cards, processing SIM swaps or retaining existing mobile numbers.
The proposed amendments to the country’s numbering plan regulations, published in the Government Gazette on Wednesday, would also require operators to verify the identities of existing subscribers within two years and limit individuals to five mobile numbers per network.
The draft regulations are aimed at tightening subscriber identity verification and tackling fraud involving mobile numbers, including SIM-swap scams in which criminals hijack victims’ numbers to intercept banking verification codes and gain access to their accounts.
Under the proposal, operators would have to match a subscriber’s biometric information against records held by the Department of Home Affairs before activating or reactivating a mobile number. They would also be required to reject SIM-swap requests if the applicant’s identity does not match the records of the person registered to the number.
Icasa estimates that South Africa has 117.3 million mobile subscriptions, making the verification exercise a major undertaking for the country’s telecommunications industry.
The proposed five-number limit would apply separately to each mobile operator, meaning subscribers could still hold more than five numbers across different networks. Icasa’s explanatory memorandum notes that a person could, in practice, have more than 20 mobile numbers across multiple operators.
Companies would be exempt from biometric verification because they cannot provide fingerprints or facial images, although they would still be subject to the proposed limit on the number of mobile numbers assigned to them.
The draft also addresses the treatment of foreign nationals. Visitors and other foreign nationals without permanent residency would be issued mobile numbers that remain active for no longer than the validity of their visas or 90 days, according to the proposal.
Operators that violate the core identity-verification requirements could face fines ranging from 2 million rand to 4 million rand per contravention. Failure to verify a subscriber before a SIM swap or breaching the five-number limit could attract a fine of 1 million rand per contravention.
However, the proposal could prove difficult to implement, particularly in South Africa’s vast prepaid mobile market.
See also: Court Rejects Tesla Owners’ Bid for Refunds Over Self-Driving Software
Icasa’s memorandum states that most operators told the regulator in 2025 that they had introduced biometric verification, but that the systems had largely been implemented for post-paid customers rather than prepaid subscribers.
MTN alone has been reported to distribute about 90 million prepaid SIM cards annually, while the industry as a whole distributes between 200 million and 300 million, according to comments by MTN South Africa Chief Executive Officer Ferdi Moolman in August.
The industry’s prepaid scale could make it challenging and costly to verify millions of existing users and new subscribers under the proposed rules.
The plans also raise data-protection questions because biometric information is classified as special personal information under South Africa’s Protection of Personal Information Act. The draft restricts the use of biometric data to identity verification and requires operators to delete subscriber records within 30 days of a number being deactivated, subject to legal, contractual and consent-based exceptions.
The regulator previously introduced subscriber identity-verification rules in March 2023 but suspended their implementation pending a commencement date. Icasa said the latest draft followed a process to refine the provisions and make them easier to implement.
The proposed biometric requirements and five-number cap would take effect 12 months after the final regulations are published. However, the draft does not clearly establish whether the two-year deadline for verifying existing subscribers would begin from publication or from the later date on which the regulations take effect.
The proposals are open to the regulatory process and are not yet final requirements.
About the Author
Cecilia Attah is a tech analyst with a degree from Benue State University. She covers tech news and startups at TechRegard with a focus on how technology is transforming Africa and shaping the global landscape.
