Anyone activating a Sim card, swapping one or keeping an existing mobile number would have their fingerprint or face checked against home affairs records under draft regulations published by communications regulator Icasa this week.

The proposed amendments to the numbering plan regulations, published for comment in the Government Gazette on Wednesday, require an operator, “on activation or re-activation of a mobile number on its network”, to “verify the identity of the subscriber through biometric verification against the department of home affairs records”.

Existing customers would not be spared. Operators would have two years to verify the identity of their current subscribers the same way. Icasa puts the number of mobile subscriptions in the country at 117.3 million, according to the explanatory memorandum attached to the draft.

The same checks would apply to Sim swaps, a favourite tool of fraudsters who hijack victims’ numbers to intercept one-time banking passwords. Operators would have to refuse a swap if the person asking for it does not match the records of the subscriber assigned the number.

The draft also caps the number of mobile numbers an operator may assign to one subscriber at five. Companies are exempt from the biometric checks, because their relationship with operators is governed by contract and they cannot provide fingerprints or facial images, but the draft does not exempt them from the cap.

Icasa bases the limit partly on an average of 2.79 subscriptions “per person”. It arrives at that figure from 117.3 million subscriptions and a population of 63 million, of whom it says 21 million are minors – so the average is really per adult. It also cites an average household size of 3.2 to 3.4 people. Because the cap applies per operator, the memorandum notes that a subscriber “may, in practice, be assigned more than 20 mobile numbers across different licensees”.

The prepaid hurdle

Foreign nationals in the country on short or long stays, other than permanent residents, would get numbers that stay active for no longer than their visa is valid, or for 90 days.

Operators that break the core verification rules, including approving a Sim swap for someone whose identity does not match, would face fines of R2-million to R4-million “per contravention”. Failing to verify a subscriber’s identity before a Sim swap, or exceeding the five-number cap, would cost R1-million per contravention. The draft does not define what counts as a single contravention.

The biggest hurdle is prepaid. Icasa’s memorandum says most operators told the regulator last year that they had already rolled out biometric verification, “yet this has only been implemented in the post-paid offerings”.

Prepaid Sims are sold in enormous volumes. MTN alone has been putting 90 million prepaid Sims a year into the market, and the industry as a whole between 200 million and 300 million, MTN South Africa CEO Ferdi Moolman said in August.

The operators, through the Association of Comms and Technology, agreed an interim framework in June to tighten Sim registration while pressing government to reform Rica. Icasa says its verification requirement is separate from Sim registration under Rica.

The regulator first introduced subscriber identity verification rules in March 2023, but suspended them until a future commencement date that it never set. The new draft is the result of a process “to refine the provisions for ease of implementation”, it said.

Biometric data counts as special personal information under the Protection of Personal Information Act, which the Information Regulator has said may be processed only under the act’s exceptions. The draft limits use of the data to identity verification, and requires operators to delete subscriber records within 30 days of a number being deactivated, unless the law or a contract requires them to be kept, or the subscriber consents.

The biometric rules and the five-number cap would take effect 12 months after the final regulations are published. It is not clear whether the two-year deadline for verifying existing subscribers runs from publication or from that later date: the draft says only that it runs from “the date of the regulations coming into effect”.