The full compliance checklist for South African telecoms and ICT providers

A licensed operator's file needs to show three things at once: current ICASA licensing and fee compliance, RICA subscriber records that stand up at every SIM activation, and evidence that any recent regulatory amendment — numbering, spectrum fees — has actually been implemented, not just noted.

Reviewed by TefCo Compliance Research — last verified 15 September 2026.

In short

Licence documents and the annual fee forecast are the baseline; RICA records are the operational backbone.
Where ICASA sets a transitional period for a regulatory amendment, keep dated evidence of implementation before the period closes.
POPIA and RICA overlap in subscriber data handling — a provider needs both a lawful basis for processing and a RICA-compliant retention and access process.

Licensing and fees

Current ECS, ECNS or broadcasting service licence issued by ICASA.
Annual forecast of licence fees and Universal Service and Access Fund contributions, submitted by end of April in the prescribed Schedule 3(1) format.
Proof of payment of the calculated annual licence fee once invoiced.
Any radio frequency spectrum licence and associated spectrum fee payment records, where applicable.
Records of responses to any ICASA information request issued under section 4 of the ICASA Act.

RICA subscriber records

A documented process to record and store MSISDN numbers before any SIM activation.
Identity verification records — full names, identity number and at least one address — for South African citizens and lawful permanent residents at activation.
A retained, auditable trail showing the process was followed for every activation, not just spot checks.
A documented lawful process for any disclosure of stored subscriber information, since courts have confirmed such information may not be disclosed for purposes RICA does not permit.

The Supreme Court of Appeal has confirmed that subscriber information obtained under RICA sections 39 and 40 may only be disclosed in the limited circumstances RICA allows — not simply because a third party wants to identify a wrongdoer.

Numbering and technical compliance

Documented compliance with the current Numbering Plan Regulations, including any amendment-specific transitional requirements.
Subscriber notification records where number deactivation or recycling rules apply — the current numbering amendment requires a minimum of two reminders before deactivating an inactive number.
Records of number retention or resuscitation requests handled under the current regulations.

Data protection alongside RICA

A POPIA-compliant lawful basis for processing subscriber personal information collected under RICA.
Information officer registration with the Information Regulator, where applicable to the entity.
Data retention and deletion policies that reconcile RICA's retention duty with POPIA's minimality principle.

Frequently asked

Does a small ICT reseller without its own network need an ICASA licence?

It depends on whether the entity is itself providing an electronic communications service or network service, or reselling under another licensee's licence. Confirm the current licensing category directly with ICASA before assuming an exemption.

Is RICA compliance a POPIA compliance issue too?

Yes — the subscriber information RICA requires a provider to record and store is personal information under POPIA, so both Acts apply to the same dataset with different obligations.

What happens if a licensee misses the end-of-April forecast date?

ICASA issues the forecast requirement by annual notice under the licence fee regulations; a licensee should treat this as a hard date and confirm directly with ICASA if it is at risk of missing it.

Sources

TefCo Corporate Compliance (Pty) Ltd is a compliance management platform, not a legal, tax or advisory firm. This guide is general information, not advice. Fees, dates and thresholds change — confirm current figures with the regulator before you rely on them.