On 6 October 2026, TimesLIVE published an op-ed by Johan van Graan, a former Vodacom chief risk officer. It argues that a loophole in section 40 of the Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA, Act 70 of 2002) lets one person register many SIMs in their own name and sell them on, leaving the eventual user anonymous. He links the problem to police work on the deaths of 11 women in Ekurhuleni, where phone-tower data can end at a name that belongs to no actual user. He asks Parliament to amend RICA to allow biometric or facial verification.
The strongest case for biometrics
The argument deserves a fair hearing. If a SIM is registered to someone who never used it, the register stops serving its purpose, which is to let lawful investigators attach a number to a person. Van Graan points to India, South Korea, Nigeria and Kenya as places with biometric or enforced registration. He also argues that biometric checks would curb SIM-swap fraud. Police tracing a suspect's phone have little patience for a register full of false names, and the victims' families have none.
The problem is real, and the government appears to accept that. In a reply to a parliamentary question, the Minister of Communications relayed ICASA's advice that the regulator is consulting the Department of Justice on reviewing Chapter 7 of RICA, which governs SIM registration. ICASA also said it had resolved to amend the Numbering Plan Regulations of 2016 to require biometric data collection at activation. That provision was deferred for further stakeholder consultation on technical and functional specifications, and ICASA said it was seeking guidance from the Information Regulator on the Protection of Personal Information Act (POPIA).
What the op-ed itself concedes
The most useful part of the piece is its description of where the law stands. According to van Graan, the Minister brought RICA's existing penalties into force on 1 July 2026, with fines of up to R5 million and prison terms of up to 10 years. He argues these do not yet reach the operators and distributors who tolerated bulk fake registration. The government has also signed a voluntary industry framework and promised a draft legislative proposal. His assessment: "Neither is law."
That matters for the policy choice. The present gap is about enforcement and incentives. The remedy he spends the most time on, the section 40 loophole, is a drafting and liability problem. His own proposals include tamper-proof SIM packaging so that SIMs cannot be pre-registered, and shared liability for distributors who profit from bulk fake registration. None of these needs a face scan. They target the supply side, where the abuse is organised, rather than the ordinary subscriber.
Why biometrics should come second
Biometric SIM registration builds a database tying a person's face or fingerprints to every phone number they hold. That database becomes an attractive target and a tool whose purpose can expand. South Africa already has a regulator that says it lacks the power to police the register: ICASA told the same parliamentary reply that the Electronic Communications Act does not empower it to regulate SIM registration. In April 2025, TechCentral reported that ICASA told Parliament's communications committee it wants RICA administration moved to its oversight and lacks access to the RICA database run by the Department of Justice. A biometric mandate would be layered onto this split, with the regulator, the Justice department, Home Affairs and the Information Regulator all having a stake.
The evidence from other countries cuts both ways. Mandatory biometric registration has coincided with SIM disconnection drives and with exclusion of people who lack documents or whose fingerprints read poorly. Those exclusions fall hardest on poorer and rural users, the group that mobile connectivity most helps. A pro-innovation approach should be wary of any rule that makes basic connectivity depend on passing an identity check that fails the people least able to contest it.
There is also a proportionality question about the stated purpose. Van Graan frames the measure around serious violent crime. The measure would apply to every subscriber, and nearly all of them are not suspects. A proportionate regime asks first whether the same investigative benefit can be had from enforcing the law that already exists against the people breaking it.
A sequenced reform
A workable order of operations looks like this:
- Enforce first. Apply the penalties that took effect on 1 July 2026 to distributors and operators who facilitate bulk or false registration, and publish the enforcement record so that the voluntary framework can be judged on results.
- Close section 40 in text. Amend the provision so that registering SIMs for resale is not permitted, and so that a SIM cannot be activated until the end user's details are recorded. Tamper-proof packaging is a cheap complement.
- Pilot targeted verification. Use a live check against Home Affairs records for high-risk events, such as SIM swaps and bulk activations, rather than for every subscriber at the point of sale. Home Affairs has reportedly indicated it can support real-time identity checks.
- Settle the legal basis before building. Any biometric requirement should go through the Information Regulator under POPIA, with retention limits, purpose limitation and an independent audit, as ICASA itself said it was seeking guidance on.
The case for facial verification is not frivolous, and a narrow, risk-triggered form of it may eventually earn its place. But Parliament would be legislating on the strength of a gap that has not yet been tested against the penalties already on the books and a draft bill that does not yet exist. The sensible course is to make the existing law bite on distributors, close the drafting hole in section 40, and bring biometrics in only where the evidence shows that cheaper tools fail.
The 11 victims in Ekurhuleni deserve a register that works. That is an argument for accountable sellers and enforceable rules. It does not by itself justify a national biometric database of every phone owner.