TechCabal reported on 26 October 2026 that South Africa plans to let regulated fintechs reach the national payment network directly, reducing their reliance on banks. I could not retrieve that article, so this piece rests on the Reserve Bank's own documents and on secondary legal analysis of them. The policy is sound in direction. Whether it delivers cheaper payments depends on how the Reserve Bank (SARB) sets authorisation conditions, including security obligations.
What actually changed
The SARB has withdrawn the Payments Association of South Africa's recognition as the payment system management body, according to the SARB's transition page. Functions, staff and intellectual property are moving to the SARB and to PayInc.
The SARB takes over rules and standards for the national payment system. It also takes over licensing, authorisation and registration of payment institutions and third-party payment providers. PayInc takes over rule-making for six clearing houses: EFT credit, EFT debit, Authenticated Collections, PayShap, Registered Mandate and real-time clearing. Some functions moved on 11 August 2026 and the transition was completed on 2 September 2026. SAnews reports the same dates and the SARB's assurance that the change "will not affect the ability of consumers and businesses to make or receive payments."
The second leg is the access regime. In Prudential Communication 10 of 2026, published on 20 May 2026, the Prudential Authority said it intends to issue an Exemption Notice. The notice would exempt specified payment activities from the definition of the business of a bank. It also endorsed a draft Authorisation Framework for those activities. Both documents were put out for comment, so I could not confirm that they are final.
The case for tight control
The strongest argument for caution is systemic risk. A payment network is only as secure as its weakest participant. A thinly capitalised or poorly defended non-bank connected directly to clearing infrastructure can become a route for fraud or an operational failure that spreads. Banks have historically acted as gatekeepers by sponsoring and vetting these firms. Removing that layer without replacing it would be reckless. The SARB is right to insist on safeguards.
Why the design still looks proportionate
The draft framework replaces bank gatekeeping with regulator gatekeeping. According to the ENS analysis on Mondaq, it requires authorisation, capital, safeguarding of client funds, governance and risk controls, operational and technology requirements, and AML/CFT duties. Capital minimums are tiered by activity. They are R8 million for Tier 1 e-money issuers, R3 million for acquirers and R2 million for payment initiation providers. Cross-border payments are excluded from the draft.
That tiering is the right instinct. Tech In Africa reports that SARB applies a proportionality principle, with requirements scaled to a firm's size and risk. It also reports that the earlier draft directive covered cybersecurity and reporting mechanisms. Security duties tied to activity and risk protect the network without barring small innovators.
Bank sponsorship does not disappear. ENS notes that it stays in the framework for closed-loop systems, clearing, settlement, acquiring and third-party payment providers. The reform is therefore partial. Non-banks would no longer always need a competitor bank as a partner for e-money and remittance services. They would still depend on one for several of the activities that matter most to merchants.
The risks to watch
First, compliance cost can recreate the barrier the reform removes. ENS says established fintechs are likely to benefit most and smaller firms face material compliance costs. If the authorisation process is slow or opaque, the cost saving that TechCabal reports will reach only well-funded players.
Second, the SARB now holds the rulebook and the licensing pen. The SARB's own page says licensing, authorisation and registration, plus payment rules and standards, have moved to the SARB. Moving away from industry self-regulation can improve accountability. It also concentrates discretion in one body. Published criteria, decision timelines and a route to appeal should accompany the framework.
Third, security expectations should be set as outcomes, not as a fixed list of products or vendors. Mandating specific technology ages badly. Requiring incident reporting, tested controls and clear accountability does not.
The criminal-law backdrop
Payment security is also a matter for criminal law and policing. The Cybercrimes Act 19 of 2020 originated as the Cybercrimes Bill (B6-2017), which Parliament passed in December 2020 and which has since partially commenced, according to the Parliamentary Monitoring Group. Nothing in the documents I reviewed ties the payment reform to new police powers or a new cybersecurity bill, so I draw no such link. The practical point is narrower. Fintechs that connect directly will handle fraud and intrusion incidents themselves and must report them to the authorities. Clear rules about what regulators and police can demand from them, and when, will matter as much as capital thresholds.
Bottom line
Opening payment rails to regulated non-banks is a pro-competition move that the evidence on tiered, activity-based regulation supports. The test is execution. The SARB should finalise the framework with published, risk-scaled requirements and predictable timelines, and should keep security duties outcome-based. If it does, direct access could lower costs and widen choice. If it does not, South Africa will have swapped bank gatekeepers for a regulatory bottleneck.