ICASA Biometric SIM Rules Fingerprints and Five Number Limit Explained

ICASA Wants Your Fingerprint for a SIM Card and May Limit You to Five Numbers

Buying or swapping a SIM card in South Africa could soon involve more than presenting an ID and proof of address. ICASA has published draft regulations that would require biometric identity verification against Department of Home Affairs records when a mobile number is activated, reactivated or transferred during a SIM swap.

The proposal also introduces a limit of five mobile numbers per subscriber per network. That has immediately started a proper South African argument: stronger protection against SIM-swap fraud on one side, and privacy, cost, access and Home Affairs reliability on the other.

What ICASA is proposing

Under the Draft Numbering Plan Fifth Amendment Regulations 2026, operators would verify a subscriber using biometric data such as a fingerprint or facial image. The identity would be checked against Home Affairs records before activation or reactivation. The same matching process would apply to a SIM swap, which must be refused when the person does not match the registered subscriber.

Existing customers would not simply be grandfathered forever. The draft provides for a large-scale re-verification process over two years. Foreign visitors could receive numbers limited to the validity of their visa or a specified short period. These are draft rules open for comment, not final requirements already in force.

Why biometric SIM checks sound attractive

SIM-swap fraud is brutal because the attacker does not need to steal your physical phone. Once your number is moved to another SIM, criminals may intercept one-time passwords, reset accounts and impersonate you with contacts who trust the number. Document-based RICA checks have not stopped fraudulent registrations or corrupt activity in distribution channels.

A live biometric match could make it harder for somebody with a copied ID to take over a number. It could also help networks tie each active number to a verifiable person instead of a stack of paperwork nobody can confidently trust.

The privacy problem is not small

Biometric information is special personal information under POPIA. You can replace a password after a breach; you cannot issue yourself a new face or fingerprint. Any national-scale system needs strong answers about capture devices, point-of-sale staff, transmission, storage, Home Affairs interfaces, failed matches and audit trails.

South Africans also know that government and commercial systems sometimes go offline at exactly the wrong time. What happens when Home Affairs cannot respond, an older person’s fingerprint will not scan, facial recognition struggles, or the record is simply wrong? A secure system still needs a fair fallback and dispute process.

Why the five-number cap is controversial

Five numbers may sound generous if you own one phone. It looks different to a delivery business, field-services company, family managing devices for children or elderly relatives, technician testing multiple networks, or entrepreneur using connected equipment. The draft frames the restriction as a numbering-management and anti-abuse measure, but legitimate users could be caught in the net.

Industry body ACT, representing major operators, says it supports stronger SIM registration in principle but cannot endorse the draft as written. Its concerns include technical feasibility, cost, overlap with RICA, the five-number limit and the impact on existing subscribers and distribution channels.

What happens next

The proposal is open for public comment until 9 December 2026. That means people do not need to rush to a store for fingerprinting this week, and messages claiming that unverified numbers are about to be disconnected should be treated with suspicion.

The goal—reducing anonymous registrations and SIM-swap fraud—is difficult to argue with. The real debate is whether scanning the faces and fingerprints of an entire mobile population is necessary, proportionate and secure, and whether the five-number cap reflects how South Africans actually use mobile connectivity.

If the rules proceed, businesses should inventory numbers assigned to staff and devices, confirm who legally owns them and stop using personal prepaid SIMs for critical systems without documentation. Consumers should keep account details current and never approve a SIM-swap request they did not initiate.

RandTech IT call to action

RandTech IT can help businesses inventory mobile numbers, secure account-recovery processes and reduce their exposure to SIM-swap fraud before regulatory changes arrive.

Publishing and social copy

Internal link recommendation: Link “SIM-swap and account security review” to the RandTech IT Cybersecurity or Business IT Support page.

Google Business Profile: ICASA wants biometric checks for SIM activations and swaps—and proposes limiting subscribers to five numbers per network. The rules are still in draft, but the debate affects almost everyone.

LinkedIn: ICASA’s biometric SIM proposal has a sensible target—fraud—but a very large privacy and implementation footprint. Businesses should pay close attention to the five-number cap, ownership records and Home Affairs dependency.

Facebook: Fingerprint before you can activate a SIM? ICASA is proposing biometric checks for new and existing subscribers, SIM swaps and a five-number cap per network. It is still a draft, and comments close on 9 December.

Sources

ICASA Draft Numbering Plan Fifth Amendment Regulations announcement

TechCentral report on mobile-operator objections

ENSafrica analysis of the biometric verification proposal