South African Telecom Operators Express Disagreement with Icasa's Plan for Biometric SIM Card Verification
Read more
TechCentral
techcentral.co.za

South African Telecom Operators Express Disagreement with Icasa's Plan for Biometric SIM Card Verification

Major mobile operators in South Africa, acting through an industry association, are refusing to support the measures proposed by Icasa regarding biometric verification of SIM cards and the five-number limit, as these regulatory proposals overlap with the existing SIM card registration law, Rica, and could disrupt the industry's own efforts to clean up the SIM card market.

The Association of Communications and Technology (ACT), which represents companies Vodacom, MTN, Telkom, Cell C, Rain, and Liquid Intelligent Technologies, stated its support for the general goal of strengthening SIM card registration but does not approve of the proposed measures in their current form.

ACT CEO Nomvuso Bathi, in a written response to TechCentral regarding the draft regulations, emphasized: 'We differentiate between supporting the goals of the proposed provisions and approving specific measures in their current form.' She added that there are significant differences between Icasa's proposals and the frameworks developed by the industry, especially concerning SIM card registration limits, biometric verification requirements, and practical implementation conditions.

The proposed amendments to the numbering plan regulations, which were published for comment on Wednesday, require operators to verify the subscriber's face or fingerprint against Department of Home Affairs data upon activation, re-activation, or replacement of a SIM card. Operators will be given two years to re-verify existing customers, and no operator can assign more than five numbers to one subscriber. Violation of the core verification rules will incur fines ranging from 2 to 4 million rand per violation.

Cost and Five-Number Limit

Bathi noted that an additional assessment is required on several issues, including the cost and technical feasibility of verifying subscribers against Department of Home Affairs data, the necessary infrastructure for system integration and verification, as well as operational readiness and consequences for existing subscribers.

The five-number limit, she said, 'requires careful consideration, especially in light of South Africa's socio-economic conditions and the legitimate reasons why consumers and businesses may need multiple SIM cards.' The Icasa proposal exempts companies from biometric checks but not from this limitation.

ACT also objected to the pace of change. In July, Icasa introduced amendments to the same regulations, establishing norms for deactivating inactive SIM cards. Bathi stated that 'introducing additional substantial obligations in such a short period calls into question regulatory predictability, policy consistency, and the cumulative compliance burden placed on licensees.'

A deeper dispute concerns which law should govern SIM card registration. This is the task of Rica, according to section 40 of the Act, and the Department of Justice and Constitutional Development is its custodian. Instead, Icasa is using its authority to regulate numbering resources.

Bathi stressed: 'While Icasa has a legislative mandate to regulate numbering resources, there needs to be greater clarity regarding the justification for introducing substantial subscriber registration and identification requirements through a separate regulatory instrument.' She added: 'We are concerned that overlapping regulatory processes could create uncertainty, duplicate implementation costs, and potentially undermine progress made by the industry.'

Icasa's explanatory note states that the verification requirement 'differs' from SIM card registration under Rica. The regulator informed parliament last year that it wished to transfer the management of Rica from the Department of Justice to itself.

Operators have their own plan. In June, ACT announced a temporary enhanced identity verification system, stricter registration control, and increased oversight of SIM card distribution channels, and submitted proposals to the Department of Justice for reforming section 40. Broader use of biometric authentication at registration points was one of the solutions discussed by the industry. Bathi reported last October that amendments to Rica continue to stall: 'Every time they are updated and sent up the chain, they are returned.'

Industry Plan

ACT reported that over the past two years, it has engaged with the Competition Commission and the Department of Justice. Bathi also mentioned that work is currently underway with the Department of Home Affairs to align technical verification standards, and this work has reached the technical development stage.

Icasa's memorandum indicates that most operators informed the regulator last year that they had implemented biometric verification only for contract customers, not prepaid ones.

ACT stated that it will officially submit its objections to Icasa. Interested parties have 30 working days from October 28th to submit comments.

Similar stories

Icasa Regulator Requires Biometric Verification for SIM Card Issuance
Read more
techcentral.co.za

Icasa Regulator Requires Biometric Verification for SIM Card Issuance

According to the draft regulations published by the communications regulator Icasa this week, any operation involving a SIM card—activating a new one, replacing an existing one, or porting a number—will require matching fingerprints or facial data with the Department of Internal Affairs records.

The proposed changes to the numbering plan rules, which were submitted for public discussion in the Government Gazette on Wednesday, mandate that operators must 'verify the subscriber's identity through biometric verification against Department of Internal Affairs records' when 'activating or re-activating a mobile number in their network.'

The new requirements also apply to existing customers. Operators will be given two years to conduct a similar identity check for current subscribers. According to the explanatory note to the draft, there are 117.3 million mobile subscriptions in the country.

Verification When Changing SIM Cards

Similar checks will also be applied in cases of SIM card replacement, which is frequently used by fraudsters to intercept victims' one-time bank passwords. Operators are obliged to refuse replacement if the person requesting it does not match the records of the subscriber assigned the number.

Furthermore, the draft establishes a limit on the number of mobile numbers one subscriber can receive from one operator—five. Companies are exempt from biometric checks because their relationship with operators is governed by contracts, and they cannot provide fingerprints or facial images; however, they are not exempt from this limit.

Icasa justifies this limit partly based on an average of 2.79 subscriptions 'per person.' This figure is derived by dividing 117.3 million subscriptions by the population of 63 million people, of whom, according to the regulator, 21 million are minors, effectively calculating the average for adults. The average household size of 3.2–3.4 people is also taken into account. Since the limit applies to each operator, the memorandum notes that a subscriber 'may practically be assigned more than 20 mobile numbers through different licensees.'

Barrier for Prepaid Services

Foreign citizens staying in the country for a short or long period but who are not permanent residents will receive numbers that will remain active no longer than the validity period of their visa or 90 days.

Operators violating the basic verification rules, including approving a SIM card replacement for a person whose identity does not match, will face fines ranging from 2 to 4 million rands 'for each violation.' Failure to verify the subscriber's identity before a SIM card replacement or exceeding the five-number limit will incur a fine of 1 million rands per violation. The draft does not specify what constitutes a single violation.

The prepaid service segment presents the greatest complexity. The Icasa memorandum indicates that most operators informed the regulator last year that they had already implemented biometric verification, 'but this was only implemented in postpaid services.'

Prepaid SIM cards are sold in huge volumes. Ferdi Moolman, CEO of MTN South Africa, reported in August that only MTN issues 90 million prepaid SIM cards annually, while the entire industry produces between 200 and 300 million.

Operators, acting through the Communications and Technology Association, agreed on a temporary framework in June to tighten SIM card registration while simultaneously insisting on government reform of Rica. Icasa emphasizes that its verification requirement differs from SIM card registration under Rica.

The regulator first introduced subscriber identity verification rules in March 2023 but suspended them until a future start date that was never set. The new draft is the result of a 'clarification of provisions for facilitating implementation' process, as stated in the document.

Biometric data is considered special personal information under the Personal Information Protection Act, which, in the opinion of the Information Regulator, can only be processed in accordance with exceptions in this act. The draft limits the use of this data exclusively to identity verification and requires operators to delete subscriber records within 30 days after number deactivation, unless required by law or contract, or if the subscriber consents.

The biometric rules and the five-number limit will come into effect 12 months after the publication of the final rules. It is unclear whether the two-year period for checking existing subscribers is calculated from the date of publication or from this later date; the draft only states that it is calculated 'from the date the rules come into force.'

Popular