South Africa (ZA)

Licensing, Authorisation & Market Access

South Africa's payment licensing baseline rests on the National Payment System Act 78 of 1998 and the SARB Act 90 of 1989, under which the South African Reserve Bank is empowered to manage, regulate and oversee payment, clearing and settlement systems. The NPS Act defines service-provider categories including clearing, settlement and non-clearing banks, designated clearing system participants, PCH system operators, system operators and third-party payment providers. There is currently no PSD2-style standalone EMI or PI licence: deposit-taking requires bank status, defining who may lawfully provide payment services in the country. For non-banks (non-bank PI/EMI), the only current lawful route runs through the Payments Association of South Africa, recognised as a payment system management body by SARB in 1999, which keeps records of all third-party payment providers under SARB Third-Party Provider Directive 1 of 2007; to offer TPPP services a firm must register with PASA through a sponsoring bank, with PASA membership currently reserved for registered banks and designated clearing participants. This sponsor-bank dependency is the structural gatekeeping that the reform aims to dismantle.

That reform is the live, escalating item. On 3 March 2025 SARB published a draft Directive prescribing requirements for banks and non-banks conducting payment activities, alongside an Exemption Notice deeming eight specified activities not to constitute the business of a bank under the Banks Act 1990. The framework introduces an activity-based non-bank payment-institution licence per payment function — e-money issuance, instrument issuance, acquiring, third-party services, remittances, clearing and settlement — with closed-loop systems required to register with SARB, and Tier 1 e-money issuer thresholds above R5m/month carrying fund-segregation, minimum-capital and AML obligations. Public comments closed 16 April 2025, and the framework was subsequently revised in November 2025 with a comment deadline of 5 December 2025. This would end the bank-only/TPPP-sponsorship monopoly and enable standalone e-money issuance and direct NPS access for non-bank PI/EMI entrants.

The critical correction this cycle is to the timing. The earlier expectation that first licences would be anticipated in early 2026 is stale: as of June 2026 the framework remains in draft, and the NPS Bill has not yet been tabled. The structural opening is therefore anticipated, not in force, and the finalisation date, NPS Bill tabling and first non-bank PI licence issuance are not knowable from current evidence.

Outlook

The gating events for non-bank market entry are the finalisation of the draft Directive and Exemption Notice and the tabling and enactment of the NPS Bill; neither is dated. Until then, the bank-status and PASA/sponsor-bank routes remain the only lawful paths, and the bank-PSP versus non-bank-PI/EMI distinction persists in full force. Monitoring should focus on movement from draft to final and any signal of NPS Bill tabling.

Conduct, Safeguarding & Promotions

South Africa operates a Twin Peaks supervisory architecture established by the Financial Sector Regulation Act 2017: the SARB Prudential Authority is the prudential supervisor and the FSCA is the market-conduct authority, with section 107 of the FSR Act empowering joint standards. This split defines the conduct and customer-fund-protection obligations payment operators face. The FSCA declared crypto assets financial products under the FAIS Act in 2022, which brings crypto-asset service providers into the conduct perimeter only — it does not amount to NPS payment-services authorisation.

The live safeguarding development sits within the activity-based reform. Historically, non-bank safeguarding has run via sponsor-bank arrangements, with bank PSPs covered by the deposit and prudential regime. The draft framework changes this for non-bank PI/EMI firms by requiring them to segregate customer funds and maintain minimum capital, with Tier 1 e-money issuers required to use segregated accounts and comply with AML rules. This is the explicit segregation, capital and AML overlay the reform introduces for the non-bank perimeter, distinct from the prudential coverage of bank PSPs.

Outlook

The conduct and safeguarding regime is established at the Twin Peaks level but in transition at the non-bank safeguarding layer, which is contingent on finalisation of the activity-based framework. The FAIS crypto declaration keeps CASPs inside the conduct net without conferring payment authorisation, a distinction that will matter as crypto-payments integrations proliferate. Watch for the final segregation and capital calibration as the draft moves toward adoption.

Stablecoins & Digital Money

The digital-money perimeter in South Africa is defined by two reinforcing constraints and one widening gap. First, under SARB's 2009 Electronic Money position paper (NPS 01/2009), only registered banks may issue e-money, which automatically excludes a non-bank stablecoin from the domestic e-money definition; only registered banks keep reserves with SARB. This is a bank-PSP constraint that the activity-based reform would change by enabling non-bank e-money issuance.

Second, and sharpening this cycle, on 28-29 May 2026 SARB, the FSCA, the Prudential Authority and the FIC issued Joint Communication 1 of 2026 clarifying that crypto assets including stablecoins are not money, funds, legal tender or payment instruments under the NPS Act, and that crypto used for payments falls outside NPS regulation. The communication indicated that future NPS Act amendments could allow SARB to designate payment instruments beyond traditional money. This firmly excludes stablecoins from the payment-instrument perimeter, shaping how stablecoin payment products can be offered domestically.

The gap is market-versus-framework. In October 2025 the FSB assessed South Africa as having no framework in place for the regulation of global stablecoin arrangements and partial regulations in place for crypto assets, with SARB and National Treasury preparing a framework for cross-border crypto oversight and updating exchange-control rules. This rating arrived as stablecoin trading surged to roughly R80bn by October 2025, up from under R4bn in 2022 — a widening gap between market practice and regulatory framework. No dedicated in-force non-bank stablecoin or e-money issuance framework exists, and the rand-stablecoin work remains at draft, IFWG and sandbox stage, so the timing and final shape of non-bank e-money issuance is not yet knowable from evidence.

Outlook

The stablecoin trajectory is escalating. The legal status is settled — they are not payment instruments — but the supervisory framework is absent, and the surge in volume creates both a market-development opportunity and a monetary-sovereignty concern. The signalled NPS Act amendments allowing SARB to designate non-traditional payment instruments, plus the cross-border crypto framework in preparation, are the developments to track. Original illicit-finance analysis of the stablecoin surge is routed to FIM.

Operational Resilience & Critical Infrastructure

Operational resilience for South African payment participants is now governed by two layered, in-force instruments that together form the country's analogue to DORA and PS21-3. The Directive on Cybersecurity and Cyber-resilience within the NPS 1 of 2024, issued 17 May 2024 with compliance required from 17 August 2024, mandates governance, critical-asset identification and controls aligned to ISO 27001 and NIST CSF v2, quarterly testing including third-party and cloud providers, recovery of critical systems within two hours (maximum eight hours), and incident reporting to SARB within 24 hours plus a detailed report within 48 hours. These are binding operational-resilience and incident-reporting obligations for all NPS participants, including third-party and cloud providers, applying to both bank PSPs and non-banks, and they represent a material compliance cost and design constraint.

Layered onto this is the PA and FSCA Joint Standard 2 of 2024 on cybersecurity and cyber resilience, made under section 107 of the FSR Act 2017, which requires financial institutions to establish and maintain cyber-resilience capability and to notify the responsible Authority of material cyber incidents. It came into effect on 1 June 2025, extending cyber-resilience obligations across the broader financial-institution perimeter beyond NPS participants.

Outlook

The resilience regime is established and in force rather than evolving; the analytical focus shifts to supervision and enforcement of the two-hour recovery and 24/48-hour reporting requirements, and to how third-party and cloud dependencies are treated under quarterly testing. Both instruments apply across the bank and non-bank perimeter, so reform-era non-bank entrants will inherit these obligations from the outset.

Scheme & Network Compliance

South Africa's scheme and network compliance layer combines a distinctive central-bank-facilitated interchange regime with the standard global four-party scheme and PCI model. SARB's Interchange Position Paper 02/2022 establishes that the central bank facilitates interchange determination to minimise interchange abuse, with objectives of cost-efficiency, secure electronic-payments adoption, interoperability, competition and innovation, transparency and financial inclusion. Interchange may be set bilaterally, multilaterally by schemes such as Visa and Mastercard, or via SARB facilitation, with the process originating from the Competition Commission Banking Enquiry. This central-bank-facilitated interchange directly shapes acquirer economics and merchant fees, with SA credit-card interchange historically higher than EU or Australian levels, and it applies across bank and non-bank participants.

Overlaying this are the global scheme rulebooks. The Visa Core Rules and Visa Product and Service Rules govern client financial institutions, service providers and merchants; issuers and acquirers must ensure PCI DSS compliance at least every 12 months. PCI DSS classifies South African businesses into four levels by annual card-transaction volume — Level 1 above six million transactions requires an external audit, while Levels 2 to 4 use self-assessment questionnaires — and PCI compliance also supports POPIA data-protection obligations. Together these global rulebooks and PCI DSS define the baseline compliance cost for all SA card-acceptance participants, with the POPIA cross-linkage adding data-protection exposure.

Outlook

The scheme-compliance trajectory is stable. The forward watch item is the interaction between SARB-facilitated interchange determination outcomes and the activity-based reform's treatment of acquiring as a licensable non-bank activity, which is expected to compress fees. Precise interchange rate schedules and the post-reform impact on acquirer economics are not quantified in available sources and warrant monitoring.

Payment Corridor Dynamics

South Africa is the largest remittance send-market in Africa, with flows directed mainly to the SADC region. Cross-border remittances operate through Authorised Dealers with Limited Authority under a tiered four-category licensing framework and strict exchange controls per the ADLA Manual, which requires full transaction information. This is a non-bank PI/EMI route under formal authorisation. An estimated 50% of SA-to-SADC remittances flow through informal channels, and sub-Saharan Africa remains furthest from the G20 Roadmap targets, with some corridors exceeding 10% cost. The high informal-channel share and high corridor cost represent the core formalisation and cost-reduction opportunity for non-bank remittance operators. Zimbabwe is the dominant corridor: in the year to end-October 2024 it received 8.5 million formal remittance transactions worth R11.8 billion, served by operators including Mukuru, Sikhona and Mama Money.

The escalating regulatory development is the mandatory migration to the TCIB scheme. In April 2025 SARB issued Directive No. 1 of 2025 requiring all low-value cross-border EFTs within the Common Monetary Area — South Africa, Lesotho, Eswatini and Namibia — to migrate to the TCIB scheme. Per the official Government Gazette 52435, banks must cease SADC-RTGS use for such transfers by 31 March 2027 and execute all low-value CMA transfers through TCIB from 1 April 2027. TCIB is a retail-level real-time ISO 20022 rail connecting banks, fintechs and mobile-money operators across SADC, so the mandate both reshapes low-value cross-border retail rails and opens participation to fintechs and mobile-money operators — a material market-access and infrastructure shift. The high-value backbone remains SADC-RTGS (formerly SIRESS), operated by SARB on behalf of SADC central banks, live since 22 July 2013, currently settling in ZAR with additional currencies under consideration, comprising 16 member countries and owned via the Committee of Central Bank Governors.

Outlook

The corridor trajectory is escalating, anchored by the firm 31 March 2027 cessation and 1 April 2027 commencement markers for the CMA-to-TCIB migration. The opening of TCIB to non-bank operators, set against the ~50% informal share and the dominant Zimbabwe corridor, is the central forward dynamic for non-bank remittance market access.

Industry Structure & Commercial

The structural backdrop is a highly concentrated, bank-dominated market. SARB's Financial Stability Review describes the financial sector as very concentrated, particularly banking, where the six largest banks account for more than 90% of sector assets — a situation persisting over a decade and flagged as a new structural vulnerability. The big four (Absa, FNB, Nedbank and Standard Bank) historically held exclusive control of clearing and settlement, defining the competitive landscape that non-bank entrants and reform aim to disrupt.

The defining structural shift this cycle is the National Payment Utility. Under the Payments Ecosystem Modernisation Programme, in November 2025 (finalised 11 November 2025) SARB acquired a 50% stake in PayInc, formerly BankservAfrica, the national payment operator, forming the base for a central, low-cost interoperable National Payment Utility jointly owned by the central bank and commercial banks. This re-bases national clearing as a public utility, restructuring ownership of core payments infrastructure and the middle mile for non-bank access.

Alongside the infrastructure restructuring, the acquiring market is consolidating. Recent structural shifts include Nedbank acquiring iKhokha, Lesaka Technologies acquiring Adumo and Bank Zero, and Capitec launching a competing merchant solution. Yoco is estimated to hold roughly 35-40% of the independent SME card-acceptance market as the leading non-bank acquirer, facing iKhokha on price, Adumo on distribution and global players via Paystack and Flutterwave. Acquirer consolidation and non-bank share gains signal a rapidly restructuring acquiring market with the bank/non-bank competitive boundary in flux.

Outlook

The industry-structure trajectory is escalating. The interplay between the public-utility re-basing of PayInc, the >90% bank asset concentration, and bank-led re-absorption of fintech acquirers will define the competitive landscape. Discrete announced deals are carried under W13; this module tracks the structural trend. Watch whether the NPU genuinely lowers the barrier to direct non-bank access in practice.

Legal & Litigation

The central legal development is a pair of directly conflicting High Court rulings on whether crypto is capital or money under exchange control. On 1 June 2026 the Gauteng High Court held in Mangundhla and Another v SARB that Bitcoin constitutes both money and capital for South Africa's exchange-control framework; the case involved roughly 1,680 Bitcoin transferred to offshore exchange wallets, and the court held such transfers amount to export of capital that may require exchange-control approval.

This contrasts directly with the 2025 Standard Bank of South Africa v SARB judgment, in which the High Court rejected SARB's argument that cryptocurrency is currency and that it is capital under the Exchange Control Regulations, setting aside SARB's forfeiture order. SARB obtained leave to appeal directly to the Supreme Court of Appeal, and the High Court decision is suspended pending that appeal. The 2026 Budget signalled draft regulations to bring crypto formally within the exchange-control framework. Together, the suspended ruling, the pending SCA appeal and the signalled draft regulations leave the crypto-as-capital question unresolved and high-stakes for cross-border payment operators.

Separately, on enforcement posture, in the 2025 financial year the Prudential Authority imposed administrative sanctions on three banks — Capitec (R56m penalty), Standard Bank (R13m) and HSBC — and on four insurers for non-compliance. This active enforcement against major bank PSPs signals meaningful compliance-failure penalties in the SA banking sector.

Outlook

The litigation trajectory is escalating. Cross-border crypto and stablecoin payment flows remain in material legal uncertainty until the SCA rules or the draft exchange-control regulations are enacted. The PA's FY2025 sanction record indicates a continuing willingness to penalise large banks. The illicit-finance dimension of the exchange-control crypto rulings is flagged to FIM.

Merchant Acquiring & Risk

South African merchant acquiring follows the four-party model, with the acquiring bank or PSP supplying terminals and settling net of fees. The market has shifted from bank-only provision (Absa, Standard Bank, Nedbank) toward fintech acquirers and aggregators — Yoco, iKhokha, Adumo, Flash and Capitec — offering pay-as-you-go and SoftPOS/tap-on-phone onboarding. This is a non-bank PI/EMI-led transition. Yoco saw 40% of new merchant sign-ups in early 2026 via app-only SoftPOS, illustrating a SoftPOS-led informal-to-formal transition. Scheme fines pass from networks to acquirers to merchants via indemnification, a risk-allocation feature of the model.

The regulatory link is direct: the activity-based reform recognises payment acquiring as a licensable non-bank activity, which is expected to compress fees. Together, SoftPOS-led rapid onboarding and the licensable-acquiring reform are compressing acquiring economics and accelerating informal-merchant formalisation — a core market-development dynamic.

Outlook

The acquiring trajectory is escalating. The forward dynamics are the continued substitution of bank-only acquiring by fintech SoftPOS providers, the pace of informal-merchant formalisation, and the fee compression expected once acquiring becomes a licensable non-bank activity under the reform. Merchant-acquiring operational economics remain under-indexed, and precise post-reform fee impacts are not yet quantified.

Product Innovation & Market Development

Product innovation in South Africa is organised around the Payments Ecosystem Modernisation Programme, launched September 2025 to succeed Vision 2025. PEM is built around a public National Payment Utility, a new domestic and regional RTGS, an enhanced fast payment system on a pre-funded real-time model creating opportunities for non-banks and fintechs, alternative messaging networks, a QR+ interoperability standard and PEMKey credentials. SARB hosted its first 2026 PEM industry dialogue on 9-10 April 2026. PEM is the master programme reshaping SA payments infrastructure, with pre-funded fast payments, QR+ interoperability and non-bank participation defining the forward product roadmap.

The leading product story is PayShap, the country's first Rapid Payments Programme service, launched in 2023 on ISO 20022. PayShap had over five million registered ShapIDs by late 2025 and processed roughly 45 million transactions per month — 80% under R500 — up from 5-6 million per month in 2024, with the per-transaction limit raised to R50,000. Capitec launched the first bank open API, Capitec Pay, in 2023, enabling direct bank-to-bank payments via mobile number or ID. PayShap's rapid scaling demonstrates instant-rail traction in low-value and financial-inclusion segments, with open banking still nascent via Capitec Pay.

On central bank digital currency, SARB concluded that resources should be dedicated to existing modernisation initiatives — expanding PayShap, store-of-value interoperability, enabling non-bank e-money issuance and direct NPS participation, QR code standardisation and an open banking/open finance framework — rather than launching a retail CBDC near term. Deputy Governor Rashad Cassim said in June 2026 that there is no compelling need to immediately launch a digital rand, prioritising payment plumbing. No retail CBDC is launched or scheduled, which removes near-term CBDC disruption risk and redirects focus to PayShap and the NPU.

Outlook

The product trajectory is escalating, centred on PEM. The pre-funded fast payment system, QR+ interoperability standard and PEMKey credentials are the forward roadmap; the explicit deprioritisation of a retail digital rand de-risks the CBDC dimension. PayShap's continued scaling and the maturation of open banking from the Capitec Pay base are the developments to track.

Consumer Protection & APP Fraud

The defining consumer-protection feature this cycle is an absence: South Africa has no mandatory APP-fraud reimbursement regime equivalent to the UK PSR scheme. Authorised push-payment losses are generally treated as voluntary and borne by the consumer. This is confirmed via dedicated APP-fraud and ombud searches. APP and social-engineering fraud is rising sharply, with SA banks recording roughly 98,000 digital fraud incidents and about R1.9bn in losses in 2024. Industry is deploying tools such as Scam Signal and exploring consortium models, and with the UK and parts of the EU strengthening reimbursement, analysts expect the SA reimbursement debate to intensify. The absence of mandatory APP reimbursement is a material divergence from the UK and EU; rising scam volumes plus instant rails create growing policy pressure and consumer-liability exposure.

The redress architecture is the National Financial Ombud Scheme, recognised by the Ombud Council and formed by amalgamating the Ombudsman for Banking Services, the Credit Ombud and the long- and short-term insurance ombuds. It resolves consumer complaints against financial institutions for free, channelling R442.9 million back to consumers in its second year, while the FAIS Ombud handles financial-advice complaints. The amalgamated NFO is the primary consumer-redress route for payment disputes, and its scope shapes operator complaint-handling obligations across both bank and non-bank participants.

Outlook

The consumer-protection trajectory is escalating. The combination of no mandatory reimbursement regime, accelerating instant rails via PayShap, and rising scam losses creates intensifying policy pressure that is likely to face a reimbursement debate akin to the UK and EU. Any move toward a reimbursement scheme is the key forward signal; financial-promotion and consumer-fraud enforcement remain under-indexed.

AML/CFT & Financial Crime

This intelligence is sourced from the Sentinel.gi feed and carried as payments-context only; original illicit-finance analysis is routed to the Financial Intelligence Monitor. Per the Sentinel feed, on 24 October 2025 the FATF removed South Africa from its grey list, acknowledging significant AML/CFT improvements following reforms — beneficial-ownership transparency via the CIPC register, stricter FIC Act sections 28-29 reporting, improved enforcement and a successful July 2025 on-site review. South Africa had been grey-listed in February 2023 with eight identified deficiencies. The delisting is expected to ease cross-border payment friction and correspondent-bank due diligence, lowering de-risking pressure, compliance cost and transactional delay for SA cross-border payments. The next full FATF mutual evaluation is expected to run 2026-2027.

Domestic FICA obligations remain fully in force, including risk management and compliance programmes, customer and enhanced due diligence, beneficial-ownership verification and suspicious-transaction reporting on goAML. These apply across both bank and non-bank participants. The original illicit-finance and sanctions analysis of the SA stablecoin surge and crypto-payments integrations is out of WPM scope and routed to FIM. Further detail is available via the Sentinel.gi feed.

Outlook

The AML/CFT payments-context trajectory is established and improving. The grey-list exit is the most material near-term positive for cross-border payments, though the 2026-2027 mutual evaluation will test its durability and persistent domestic FICA obligations temper the relief. WPM carries only the Sentinel surface; original analysis sits with FIM.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank versus non-bank access asymmetry. At the domestic settlement layer, only banks may participate in the settlement system, subject to Payment System Management Body authorisation and Reserve Bank Settlement System (SAMOS) requirements, with the rand also included in CLS. This bank-only settlement access blocks non-bank PSPs from direct settlement, forcing sponsor-bank dependency until NPU reform — a structural constraint the PEM and NPU reform targets.

The same asymmetry runs at the regional and continental level. Both PAPSS and Buna currently restrict access to licensed banks, mirroring older paradigms of financial control even though non-bank providers dominate remittance delivery in many African markets, constraining non-bank correspondent and settlement access regionally. The activity-based reform and the PEM/NPU programme aim to give non-banks direct clearing and settlement access without bank sponsorship, with TCIB intended to interconnect with PAPSS under AfCFTA. Bank-only PAPSS and Buna access excludes precisely the non-bank operators that dominate African remittance delivery — a key correspondent and settlement access barrier the SA reform targets.

On the friction side, the FATF grey-list exit (carried via Sentinel under W11) is expected to ease correspondent-banking de-risking pressure for SA cross-border payments.

Outlook

The correspondent and settlement trajectory is escalating. The defining tension is between bank-only access at SAMOS, PAPSS and Buna and the reform agenda — activity-based authorisation and the NPU — designed to open direct non-bank clearing and settlement without sponsorship. Whether the reforms translate into genuine direct non-bank access, and whether TCIB-PAPSS interconnection materialises, are the forward markers.

Commercial Intelligence

The commercial cycle is running ahead of the regulatory one. In 2025, South African startups raised a combined $335.9 million across 42 deals, a 234% surge from $100.4m in 2024, at an average deal size of roughly $7.99m, while fintech M&A increased 72% year-on-year with 67 deals. This signals a strong capital and consolidation cycle in SA fintech and payments.

The most strategically significant payments event is Stitch. The company raised $55m in April 2025 in a Series B led by QED Investors, bringing total funding to $101m, and acquired Exipay (rebranded Stitch In-Person Payments) and later Efficacy Payments, an SARB-designated Clearing System Participant enabling direct card issuing and processing. The Efficacy acquisition gives a non-bank a direct clearing-participant capability — a strategically significant route around sponsor-bank dependency.

In M&A, Yoco (estimated valuation exceeding R12 billion) made its first major acquisition, buying local AI software startup Dyner.AI in June 2026, with the deal value not publicly disclosed, and in May 2026 appointed former Solaris CEO Carsten Höltkemeyer as its first non-founder CEO — signalling maturation and diversification of the leading SA non-bank acquirer beyond core payments. The acquirer-consolidation cluster also includes Nedbank acquiring iKhokha and Lesaka Technologies acquiring Adumo and Bank Zero, alongside Capitec launching a competing merchant solution; these deal values are not publicly disclosed. This pattern signals a bank-led re-absorption of the fintech acquiring layer.

In funding, Lula, an SME-focused lending-as-a-service platform, secured ZAR 340 million (around $21 million) from Dutch DFI FMO in February 2026, structured entirely in local currency — institutional capital flowing into the SA fintech SME segment. In partnerships, H2 2025 digital-payments tie-ups included Absa CIB partnering with Ripple for digital-asset custody starting with stablecoins, plus Mukuru/VALR, Luno/Discovery Group and Luno/SuperGroup, with Ozow/MoneyBadger and Binance Pay at 650,000+ merchants as further crypto-payments integrations. These signal institutional entry into stablecoin custody and payments despite their non-payment-instrument legal status.

Outlook

The commercial trajectory is escalating. The strategic thread is non-bank acquisition of direct clearing capability (Stitch/Efficacy) set against bank-led re-absorption of acquirers (Nedbank/iKhokha, Lesaka/Adumo). Several deal values — Yoco/Dyner.AI, Nedbank/iKhokha, Lesaka/Adumo+Bank Zero, Absa CIB/Ripple — are not publicly disclosed, limiting quantitative commercial-significance assessment. The crypto-payments partnerships carry illicit-finance significance flagged to FIM.