Radar: ICASA wants Home Affairs biometric checks for every SIM, and a five-number cap per network

ICASA has published draft rules that would make mobile operators check every subscriber against Home Affairs biometric records before a number is activated, re-activated or moved to a new SIM. The same draft caps each person at five mobile numbers per network. Written comments are due within 30 working days of publication on 28 October, which falls on 9 December 2026.

For most South Africans the change would happen at the prepaid counter. ICASA's explanatory note says most operators told it in 2025 that they already verify customers biometrically, but only on post-paid contracts. Prepaid users would be brought into the same fingerprint or face check, and existing subscribers would have to be re-verified too.

The proposal is General Notice 4217 of 2026 in Government Gazette 55631, an amendment of the Numbering Plan Regulations, 2016. ICASA chairperson Mothibi Ramusi signed it on 23 October. It is a draft. The dates below apply only if the final regulations look like this text.

Timeline if the draft stands

The biometric and SIM-swap rules would take effect 12 months after the final regulations are published. Operators would then have two years from the date the regulations come into effect to verify their existing subscribers against Home Affairs records. That is a long tail. A final regulation published in 2027 would not start the checks until a year later, and the clean-up of people already on the network would run for two years after that.

Companies and other juristic persons are excluded from the biometric checks. ICASA says their contracts already cover know-your-customer requirements, and a company cannot supply fingerprints or a facial image. The five-number cap and the SIM-swap rule, as written, are about natural persons.

What operators would have to do

At activation or re-activation, the operator must verify the subscriber "through biometric verification against the Department of Home Affairs records". For a citizen it keeps the full name, ID number and the place, date and time of the check. Permanent residents add a certified copy of their permit. Foreign visitors are recorded by passport number, issuing country and a local address, plus visa number, type and expiry where a visa is needed.

A visitor's number would stay active for no longer than the visa is valid, or for 90 calendar days. ICASA says it modelled this on Ghana, Turkey, India and the UAE. The draft does not say those countries' systems were copied in detail. It says the visitor limit was modelled on them.

A SIM swap would need the same biometric check, and the operator "must not approve a request for a SIM-swap" if the requester does not match the subscriber on record. That targets the fraud in which a criminal takes over a victim's number to receive bank one-time PINs. The draft does not change how subscribers are warned of a pending SIM swap. That gap still matters for someone abroad, or asleep, when the warning SMS arrives.

The draft limits how the data may be used. Biometric data may only be used for identity verification, and the records must be disposed of within 30 days of a number being deactivated, unless a law, a contract or the subscriber's consent allows longer.

Penalties are steep. Breaching the biometric verification, record-keeping, visitor and SIM-swap refusal rules, or missing the two-year re-verification, would cost an operator R2 million to R4 million per contravention. Skipping the SIM-swap identity check or breaching the five-number cap would cost R1 million per contravention. The draft states those ranges. It does not say how many contraventions ICASA would count if one operator failed the same check across many stores.

The five-number cap

ICASA bases the cap on 117,316,338 mobile subscriptions against a population of about 63 million, of whom about 21 million are minors, which it puts at 2.79 subscriptions per person. With households averaging 3.2 to 3.4 people, it says five numbers per person per network is enough. Because the cap applies per operator, ICASA notes that a person could still hold more than 20 numbers across networks. Five on Vodacom, five on MTN, five on Telkom and five on Cell C is the arithmetic the draft itself allows.

The cap is tighter than every major operator's current practice. According to MyBroadband, Vodacom allows 100 numbers per subscriber, Telkom 20, MTN 10, and Cell C sets no limit. Those are the operators' own limits, not ICASA's. If the draft becomes a regulation, Vodacom's 100 and Cell C's unlimited would both be above the new ceiling.

What is still open

The draft does not say what happens to people who already hold more than five numbers on one network. It is silent on who pays for Home Affairs verification, and on how operators would run fingerprint or face checks for prepaid customers who buy SIMs away from operator stores. A spaza or a street vendor is not a biometric booth. The draft requires the check and does not describe the counter where it would happen.

ICASA says the check is separate from RICA registration, so prepaid users would face both. Anyone can ask to make oral submissions if ICASA holds public hearings. Written comments go to numberingresourceplancommittee@icasa.org.za by 9 December, and ICASA lists Elias Letlape on 012 568 3323 for enquiries.

Sources: Government Gazette 55631, General Notice 4217 of 2026, signed 23 October and published 28 October; MyBroadband on current operator number limits.