South Africa’s communications regulator has proposed requiring mobile operators to verify subscribers’ identities biometrically against Department of Home Affairs records whenever a mobile number is activated or reactivated, and before any SIM swap.
The Independent Communications Authority of South Africa (ICASA) published draft amendments to its numbering plan regulations for comment in the Government Gazette on Wednesday. The draft requires an operator, “on activation or re-activation of a mobile number on its network,” to “verify the identity of the subscriber through biometric verification against the department of home affairs records,” with a subscriber’s fingerprint or face checked against those records.
Existing customers would also be covered. Operators would have two years to verify current subscribers the same way; the draft’s explanatory memorandum puts South Africa’s mobile subscriptions at 117.3 million. SIM swaps, which fraudsters use to hijack numbers and intercept one-time banking passwords, would also require a match: operators would have to refuse a swap if the person requesting it does not match the records of the subscriber assigned to the number.
The draft limits each subscriber to five mobile numbers per operator. Companies are exempt from the biometric checks because their relationship with operators is governed by contract and they cannot provide fingerprints or facial images, but they remain subject to the cap. Foreign nationals other than permanent residents would get numbers that stay active for no longer than their visa is valid, or for 90 days.
Operators that break the core verification rules, including by approving a SIM swap for someone whose identity does not match, would face fines of R2 million to R4 million per contravention. Failing to verify a subscriber’s identity before a swap, or exceeding the five-number cap, would cost R1 million per contravention.
The draft limits use of the biometric data to identity verification. Operators would have to delete subscriber records within 30 days of a number being deactivated, unless the law or a contract requires them to be kept or the subscriber consents.
ICASA first introduced subscriber identity verification rules in March 2023 but suspended them until a commencement date that it never set, and it said the new draft is the result of a process “to refine the provisions for ease of implementation.” According to the memorandum, most operators told the regulator last year that they had already rolled out biometric verification, “yet this has only been implemented in the post-paid offerings.” ICASA says its requirement is separate from SIM registration under the Regulation of Interception of Communications Act (RICA).
The biometric rules and the five-number cap would take effect 12 months after the final regulations are published. Interested parties have 30 working days to comment.
Sources: TechCentral
–
By the ID Tech Editorial Team
