Enforcement Begins
On July 1, 2026, South Africa's Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA) entered a new enforcement phase. Under the framework announced by Justice Minister Mmamoloko Kubayi in March, all licensed telecommunications operators must now verify SIM card registrations against the Department of Home Affairs biometric database — using fingerprints and facial recognition — before activating any subscriber. Failure to comply carries penalties of up to R5 million or 10 years imprisonment under Section 40 of RICA.
The case for the measure is genuine and deserves to be stated plainly. South Africa loses an estimated R5.3 billion annually to telecommunications fraud, with 60 percent of mobile banking fraud attributed to SIM-swap attacks in which fraudsters register replacement SIM cards using stolen or fabricated identity documents. Extortion networks, kidnapping syndicates, and financial scammers have long exploited improperly registered SIM cards as untraceable communication channels — ICASA estimates that 62 percent of extortion cases involve unregistered or fraudulently registered SIMs. In that context, mandating biometric verification is not bureaucratic overreach but a direct response to documented, large-scale criminal infrastructure.
The Biometric Architecture
The enforcement mechanism relies on the Home Affairs Department's upgraded digital verification system, which matches subscriber fingerprints and facial photographs against the National Population Register. According to the department's own reporting, the system has reduced its identity-matching error rate to below one percent and is already connected to public and private sector clients. Telecoms operators are required to submit compliance plans — the Association of Communications and Technology (ACT), the industry body representing South Africa's major mobile networks, agreed to deliver those plans by end of June 2026.
In technical terms, the integration is more robust than many comparable mandates in the region. India's Aadhaar-linked SIM registration faced repeated implementation setbacks before stabilizing. South Africa's iteration has the advantage of a mature biometric registry and an established legal framework that already required identity-document verification. Eight countries — including Nigeria, Thailand, and the UAE — already mandate biometric SIM checks, providing proof of concept that the approach can work at scale.
The eSIM Loophole
Here is where the enforcement logic breaks down. Foreign eSIM providers — including widely marketed international data services — openly sell South African mobile connectivity to anyone with a compatible device. These providers operate outside South African jurisdiction: they are not licensed by ICASA, do not participate in the Home Affairs verification process, and are not subject to RICA's penalty regime.
The legal gap traces to Section 40(1)(b) of RICA, which exempts foreign visitors from the full registration requirements — an exemption designed to allow tourists to use temporary SIMs without bureaucratic friction. In the eSIM era, that carve-out has metastasized into something larger: a permanent channel through which South African residents, not just tourists, can obtain functional local connectivity without ever registering their identity biometrically. The device-side activation is invisible to ICASA. No fingerprint is captured; no facial image is matched.
A legal analysis published in De Rebus, the South African attorneys' journal, concluded that while eSIMs fall within RICA's scope under a purposive reading of the statute's definition of "SIM card," the practical enforcement mechanism against foreign providers simply does not exist. RICA's penalty regime applies to South African-licensed operators. A provider headquartered in Europe or Singapore, serving subscribers via remotely provisioned eSIM profiles, has no legal exposure under current South African law.
The structural irony is stark: every compliant South African telco must run each new subscriber through a biometric check at activation, while a competitor offering functionally identical connectivity from outside the regulatory perimeter faces no equivalent obligation. This is not a minor edge case. Apple, Samsung, and Google now ship virtually all flagship devices with eSIM capability, and the international data eSIM market is growing rapidly.
The Regulatory Gap ICASA Must Close
ICASA's position is further complicated by a jurisdictional split. The RICA database is administered by the Department of Justice, not ICASA — limiting the regulator's ability to audit compliance, cross-reference subscriber complaints, or identify anomalous registration patterns in real time. TechCentral has reported ICASA's own push to gain administrative control of RICA, precisely because the current divide between the regulator and the database leaves enforcement authority and technical capacity in different hands.
Closing the eSIM gap requires action on two tracks. First, ICASA should assert that any provider offering connectivity to South African subscribers — regardless of where the eSIM profile originates — must either hold a South African licence or route activations through a licensed domestic operator. Brazil's ANATEL established exactly this precedent in September 2025, ruling that eSIM provisioning for Brazilian subscribers requires full MVNO licensing. South Africa has a ready model.
Second, the Justice Ministry's legislative proposal flagged by Minister Kubayi in March 2026 — but not yet tabled — needs to explicitly define activation of an eSIM profile for use in South Africa as a registration event subject to Section 40 biometric verification. Without that textual amendment, the Section 40(1)(b) exemption will continue to shelter any foreign provider willing to market through it.
Proportionality Remains the Test
None of this analysis endorses the biometric mandate without reservation. Collecting fingerprints and facial imagery from every mobile subscriber is a significant data collection exercise, with material implications under the Protection of Personal Information Act (POPIA) — particularly given the documented risk of Home Affairs database breaches. Proportionality demands that any enforcement expansion be matched by robust data minimization rules, breach notification timelines, and independent audit of how biometric records are stored and accessed after subscriber verification.
The enforcement that began July 1 is a serious attempt to address a costly and well-documented fraud problem. But a mandate that domestic telcos must follow while foreign eSIM providers walk around it is not a security measure — it is a compliance burden that raises costs for licensed operators without securing the network. ICASA and the Justice Ministry have until the eSIM market matures further to close the structural gap. That window is open now; it will not stay that way.