ICASA drafts biometric checks for every SIM activation and swap

ICASA drafts biometric checks for every SIM activation and swap

29 October 2026: South Africa's communications regulator ICASA has published draft rules that would require mobile operators to check a subscriber's biometrics whenever a number is activated, reactivated or moved to a new SIM, for existing customers as well as new ones. The Draft Numbering Plan Fifth Amendment Regulations, 2026 also cap how many numbers an operator may give one subscriber and limit how long visitors' numbers stay active. Interested parties have 30 days from publication to comment.

Not yet independently verified. Not yet independently verified. ICASA's release states the aims and the 30-day comment period; the fines, the five-number cap, the timings and the treatment of companies come from TechCentral's reading of the gazetted draft, which we have not read ourselves. We will update this when it can be confirmed, and remove this note.

What ICASA says the draft is for

ICASA's release of 29 October describes the aim as establishing "a mobile subscriber registration regime in South Africa", improving consumer protection and the regulator's management of numbers, and strengthening enforcement against the unauthorised use of mobile numbers. The biometric requirement gives effect to the Numbering Plan Second Amendment Regulations of 2023 (Government Gazette No. 48328), which first set out the idea. The draft follows the Fourth Amendment Regulations of 2026 (Gazette No. 55631), which standardised how mobile numbers are recycled.

The regulator has framed the rules around SIM swap fraud, where a criminal persuades an operator to move a victim's number to a new SIM and then intercepts one-time passwords sent by banks and other services.

The detail in the gazetted text

TechCentral, which read the gazetted draft, reports these terms:

• Operators verify identity against Department of Home Affairs records, by fingerprint or face, on activation, reactivation and every SIM swap.
• Existing subscribers must be verified within two years; the draft is not clear whether that runs from publication or from the date the rules take effect.
• An operator may assign no more than five numbers to one subscriber.
• Numbers given to foreign nationals who are not permanent residents stay active only for the length of their visa, or 90 days.
• Operators delete subscriber records within 30 days of a number being deactivated, unless a law, a contract or the subscriber's consent requires them to be kept.
• The biometric rules and the cap apply 12 months after the final regulations are published.
• Fines run from R2 million to R4 million per contravention for breaches of the core verification rules, such as approving a swap for a mismatched identity, and R1 million for failing to verify before a swap or exceeding the cap.

TechCentral gives the comment period as 30 working days, against the 30 days in ICASA's release; respondents should work to the earlier date until the gazette notice settles it.

Where businesses come in

Companies and other juristic persons cannot supply fingerprints or a face, so TechCentral reports they are exempt from the biometric check but not from the five-number cap. If the final text keeps that, a business that buys staff phones, fleet trackers or connected devices on contract from one operator would hit the limit almost at once, unless IoT and machine-to-machine numbers are treated separately. The draft's handling of those numbers is the point most worth raising in a submission.

For operators, mobile virtual network operators and the identity verification vendors that serve them, the rules mean a Home Affairs biometric match in every activation and swap flow, a two-year re-verification programme for the existing base, and a retention schedule for the records collected. Banks that rely on SMS one-time passwords stand to benefit from fewer fraudulent swaps.

Our identity management software category lists seven products.

Related on TrustList:

• Brazil makes facial biometric checks mandatory for mobile phone lines
• Swiss court: PostFinance needs express consent before taking voiceprints

Sources

• ICASA: ICASA publishes Draft Numbering Plan Fifth Amendment Regulations, 2026, 29 October 2026
• TechCentral: Icasa wants your fingerprint before you can get a Sim card, 29 October 2026