There’s no doubt that, despite South Africa’s pedestrian economic growth rates, there are sectors still offering investors plenty of opportunity, and payments is one of these.
The banks’ payment profit pools are under direct attack from a chiming register of payment fintechs including Stitch, Yoco, Peach, Ozow and Lesaka.
Stitch raised $55m last year and has been buying its way deeper into the payments stack; Nedbank bought iKhokha; Capitec has moved on Walletdoc; Lesaka is adding Bank Zero to a platform already enlarged by Adumo; and Pepkor is combining Flash and Shop2Shop in a transaction that values the resulting fintech business at more than R20bn.
Some are calling it a revolution. I suspect war might be a more apt word.
I get the sense that the banking sector’s peace was shattered by the Reserve Bank’s determination to press hard on the accelerator to modernise our still clunky and far too costly payments system.
Governor Lesetja Kganyago used the Bank’s recent payments conference to outline a system that will open payment infrastructure to appropriately regulated non-banks, push PayShap further into everyday commerce, introduce interoperable QR codes and eventually create a reusable digital identity for payments.
The ambition is difficult to fault. Payments, as Kganyago correctly observed, are economic infrastructure. Expensive or unreliable payments impose costs on an economy much as broken railways, ports or electricity networks do. South Africa has watched countries such as India and Brazil build cheap, ubiquitous instant-payment systems while we continue routinely paying bank charges to send someone a few hundred rand.
PayShap was supposed to change that.
Since its launch in 2023 it has processed more than a billion transactions worth more than R1-trillion. That’s impressive until you realise PayShap handled only about 6% as many transactions as cards last year. Cash still dominates payments. The governor wants PayShap ultimately to become as ubiquitous as cash.
Kganyago was also right to reject the idea that every company touching a payment must become a bank. Banks require unusually onerous regulation because they take short-term deposits and turn them into longer-term loans. A payments company doesn’t necessarily create the same balance sheet risk.
So the Bank proposes an activity-based regime. Do the same activity, create the same risk, face similar regulation.
Importantly, the fintech lobby is not arguing that openness should mean a regulatory free-for-all. When I recently spoke to Lincoln Mali, CEO of Lesaka Technologies and president of the Association of South African Payment Providers, he was emphatic: “We are as invested in the stability of the system as fintechs. We are as invested in the security of the system.”
What the challengers want, he said, is an “open competitive environment” that remains “secure” and “stable”.
SIM-swap vulnerability
Quite right. But what happens when the financial system becomes substantially more open and instantaneous while one of its most important identity credentials, the mobile number, remains relatively easy to hijack?
South Africa already has a digital-fraud problem of industrial proportions.
The South African Banking Risk Information Centre says digital-banking fraud losses reached R2.4bn in 2025, up from about R1.9bn the previous year. More than 70% of those losses involved banking apps.
Meanwhile, the Communications Risk Information Centre estimates fraud affecting the telecoms sector costs more than R5.3bn annually. Most importantly, it has reported that roughly 60% of mobile-banking fraud is associated with SIM-swap attacks.
The telecoms network has become part of the banking security perimeter. And its defences are not necessarily comparable. Banks have spent billions building Financial Intelligence Centre Act systems, biometrics, device authentication, behavioural analytics and increasingly sophisticated fraud engines.
Yet the mobile number attached to that meticulously authenticated bank account ultimately depends upon a SIM-registration regime whose weaknesses have been debated for years. And that matters enormously once mobile numbers become convenient aliases for instant payments.
Unfortunately, ease has always attracted two constituencies: customers and crooks.
The danger is not that the Reserve Bank is proposing some Wild West populated by “unregulated wallets”. Kganyago explicitly says non-bank entrants will face requirements covering governance, safeguarding customer funds, operational resilience and reporting. The Bank plans to publish the authorisation framework by the end of November.
Indeed, the governor understands the identity problem. One of his four building blocks is a single-digital identity for payments which would be reusable with verifiable credentials stored in a wallet controlled by the customer.
That may prove to be one of the most important pieces of the whole project. But it raises a sequencing question.
Before vastly increasing the number of institutions capable of initiating instantaneous payments, shouldn’t we first ensure that a change of control over somebody’s cellphone number triggers an equally instantaneous warning throughout the financial system? Why shouldn’t every bank and payments provider know in real time that a SIM has just been replaced? And why, in 2026, are we still debating whether SIM activation and high-risk SIM changes should require substantially stronger biometric verification?
None of this is an argument for protecting the banking oligopoly behind regulatory walls. But for a country only recently off the Financial Action Task Force grey list, these are questions we must grapple with.
