On 1 October 2026, at Constitution Hill in Johannesburg, Home Affairs Minister Leon Schreiber used his own credential in the MyMzansi app to show South Africa's first working digital ID. Director-General Tommy Makhode played the verifier. According to TechCentral's account of the demo, Schreiber generated a QR code, withheld his ID number while sharing other fields such as nationality, and then declined a second request, after which the verifier was denied access. The design is good. The surrounding legal and operational scaffolding is not yet ready.
The case for the state's approach
The strongest argument for a government wallet is that South Africa's identity infrastructure is stretched and increasingly fraud-prone. A phone-bound credential reduces queues at Home Affairs offices and lets a person prove one fact without handing over a photocopy of an entire ID. Banks, landlords and employers routinely collect far more than they need. Selective disclosure, where the verifier asks for specific fields and the holder approves or declines each one, is the right architecture for ending that over-collection. The department has also said use will be optional and that the Smart ID card will continue alongside the digital version, according to South African Government News Agency reporting on the draft regulations.
That is a real improvement on a mandatory model, and it is why this is a better starting point than many government app programmes elsewhere.
What has not happened yet
The public cannot enrol. TechCentral reports that no launch date was given, and that Home Affairs' annual performance plan targets completing the hosting infrastructure by 31 March 2027, with citizens receiving credentials in the 2027/2028 financial year. The wallet itself was shown with mock-up documents rather than real data for items like birth and marriage certificates.
The legal basis is also unsettled. The draft amendments to the Identification Regulations, gazetted under the Identification Act of 1997, closed for comment on 6 June 2026 according to the government news agency. They are still under review. A demonstration of working software ahead of final rules is acceptable. Building public dependence on the system before the rules are final is not.
The liveness problem
Identity specialists quoted by TechCentral faulted the draft regulations partly because they rely on flat, two-dimensional selfies for liveness checks. This matters because remote verification is the feature that makes a digital ID convenient, and it is also the feature attackers target. A 2D selfie check is comparatively easy to defeat with replayed video, printed images or AI-generated faces. If the wallet can be issued on that basis, then a fraudster who defeats the check inherits a government-grade credential that banks and agencies will trust more than a forged document.
The proportionate fix is not to abandon remote onboarding. It is to set a security outcome in the regulations, such as tested resistance to presentation attacks, and let vendors meet it with the best available method. Hard-coding a particular technique in a regulation invites obsolescence within a year or two.
Privacy law is the real constraint
Home Affairs holds what Research ICT Africa calls 'the most sensitive personal information database in the country'. Its submission on the draft rules argues that the department did not meet its Protection of Personal Information Act (POPIA) obligations before publishing them, that there is no clear plan for privacy impact assessments and cybersecurity audits when data moves onto other government systems, and that the Information Regulator is not meaningfully involved. It also argues no comprehensive Digital ID Policy has been consulted on, and urges suspending the regulations until safeguards exist. I would not go as far as suspension, because the technology is promising and delay has costs. But the substance of those objections is sound.
POPIA already gives the framework. As the statute's text shows, it treats biometric information as special personal information in Chapter 3, Part B, with a general prohibition on processing and narrow authorisations, including in section 33. A national wallet built on facial biometrics falls squarely in that territory. Schreiber has said the final rules will impose 'hard limits' on how people's data may be used. Those limits should be written into the regulations, not left to departmental policy, and the Information Regulator should audit compliance independently.
The Green ID Book deadline
The awkward parallel track is the phase-out of the paper-based Green ID Book. TechCentral reports that production stops on 31 March 2027 and that the book stops being valid identification on 31 March 2028. About 14.7 million citizens and permanent residents hold only that document. Home Affairs says it will first extend Smart ID cards to groups previously excluded, including naturalised citizens, permanent residents and South Africans abroad.
This is not a digital ID mandate, and the department is right to keep the two separate. But the combined effect should be watched. If the digital wallet becomes the cheaper or faster way to prove identity while a card remains the only fallback, people without smartphones or reliable data will be pushed toward the card queue just as the book expires. A voluntary system is only voluntary if the alternative stays workable.
What good rules would look like
- Outcome-based liveness standards, independently tested, rather than a fixed selfie method.
- Published privacy impact assessments and Information Regulator oversight before any enrolment opens.
- Statutory limits on verifier requests, so businesses cannot make the wallet a condition of service when a lesser check would do.
- A guaranteed non-digital path for the entire life of the programme, not only the pilot.
South Africa has built a wallet that demonstrates data minimisation in practice. The task for the next six months is to make the regulations as careful as the demo.