What ICASA actually proposed
On 28 October 2026 the Independent Communications Authority of South Africa (ICASA) published General Notice 4217 of 2026 in the Government Gazette. It proposes amendments to the Numbering Plan Regulations, 2016, made under sections 4 and 68 of the Electronic Communications Act, 2005. The Gazette gives interested parties 30 working days to comment by email. ICASA's consultation page and press reporting put the deadline at 9 December 2026. The draft redefines "biometric data" as "physical characteristics of a natural person, such as facial images or fingerprints."
As reported by TechCentral and by the law firm ENS, the draft would require operators to verify a subscriber's identity against Department of Home Affairs records using a face or fingerprint. The check would apply on activation, reactivation and SIM swap. Existing subscribers would have two years to be re-verified, and they are not grandfathered. The draft also caps subscribers at five numbers per operator. Contraventions of the core verification, record-keeping and transitional provisions would carry fines of R2 million to R4 million per contravention. TechCentral adds that failing to verify before a SIM swap, or exceeding the cap, would cost R1 million. The draft does not define what counts as a single contravention. Operators would have to delete subscriber records within 30 days of deactivation, and the rules would take effect 12 months after final publication.
The strongest case for the plan
The regulator's problem is real. SIM-swap fraud drains bank accounts, and anonymous or bulk-registered numbers feed scams. An ICASA councillor told EWN that "every number has to have somebody sitting behind it." TechCentral also reports that ICASA's explanatory memorandum notes that a subscriber may, in practice, hold more than 20 numbers across licensees. It says biometric checks have so far been implemented only in post-paid offerings. A Home Affairs match is harder to forge than a photocopied ID and a utility bill. If the fraud is concentrated at the swap, a biometric gate there is a defensible instrument.
Where the design fails a proportionality test
The trouble is the breadth of the remedy. The draft treats a fraud problem concentrated in SIM swaps as grounds to biometrically re-verify every subscriber in the country. ENS observes that the draft is "silent on security." It says nothing on how matching is done, who holds the templates, or what happens when a breach occurs. Fingerprints cannot be reissued. A regime that makes private operators collect them at scale, backed by seven-figure fines, creates a honeypot that does not exist today. Two TechCentral commentators argue that "no private company should be forced to collect fingerprints, and none should be allowed to store or share them." On that view, a match-and-discard design is the minimum safeguard.
The 30-day deletion rule is welcome, but it covers records after deactivation. It does not address what operators keep while a subscriber is active, which is the period that matters for a breach.
Exclusion is the second cost. People whose Home Affairs records are missing, wrong or stale, including recently documented residents, would be locked out of a basic communications service. The draft's two-year re-verification window means a large share of the installed base would face this at once. ACT's CEO put the unit cost at "R10 per check… It adds up." That is a per-subscriber tax on the cheapest service tier, in a market where prepaid is the norm.
The legal-authority question
The Association of Comms & Technology (ACT) represents Vodacom, MTN, Telkom, Cell C, Rain and Liquid. It wants a cap of 20 SIMs per person per network, and it accuses ICASA of overreach. Its CEO, Nomvuyiso Batyi, told TechCentral: "There are challenges that we see, where you're giving yourself powers that you do not have." She also said "the 20 is not cast in stone." ACT's objections centre on overlap with RICA, the existing SIM-registration regime. ICASA's position, as reported, is that its verification requirement is separate from RICA registration. ICASA declined to comment further.
This is ACT's allegation, not a finding. But the point deserves a serious answer, because the draft rests on the Numbering Plan Regulations, which are a resource-management instrument made under the Electronic Communications Act. Mandating biometric collection from the public is a significant intrusion on privacy, so it would normally need an explicit legislative mandate. It should not be added to a numbering schedule. If ICASA's reading is wrong, the rules could be struck down after operators have spent years building systems. That is the worst outcome for investment and for fraud control alike.
A proportionate alternative
ICASA can reach most of its goal with narrower tools:
- Target the swap, not the base. Require biometric or equivalent strong authentication only for SIM swaps and reactivations of dormant numbers. Leave routine prepaid activation on documentary checks.
- Match, don't store. Operators should receive a pass/fail response from Home Affairs and keep no templates. The regulations should say so.
- Set a risk-based cap. A five-number ceiling is arbitrary. A higher default with enhanced checks above a threshold would stop bulk abuse without hitting ordinary multi-device households.
- Define the penalty unit. A fine "per contravention" with no definition of contravention invites ruinous, unpredictable liability.
- Resolve the RICA overlap first. Parliament or the responsible ministers, not a numbering schedule, should decide whether biometrics belong in SIM registration.
The comment window runs to 9 December. The most useful submissions will not argue about 5 versus 20 SIMs. They will ask ICASA to show why a narrower control would not work, to justify its statutory authority, and to publish a security architecture before any operator is asked to hold a fingerprint.