Beyond Compliance: Why infrastructure readiness will define SARB authorisation for South African Payment Service Providers, e-money issuers, and fintech operators
Fintech innovation across Africa has grown rapidly, expanding digital services and financial inclusion. As the ecosystem matures, the regulatory framework is evolving alongside it. The South African Reserve Bank (SARB) is strengthening requirements for Payment Service Providers, e-money issuers, and fintech operators to ensure a secure and resilient payment ecosystem. The draft Authorisation Framework introduces a structured two-tier e-money licensing regime Tier 1 (above R5 million average monthly transaction value, R8 million minimum capital) and Tier 2 (below R5 million, R5 million minimum capital) and, critically, for the first time enables non-banks to hold client funds and operate payment activities without mandatory bank sponsorship.
Today, authorisation goes beyond capital and documentation. Institutions must demonstrate secure, scalable, and auditable payment infrastructure meaning compliance increasingly starts with technology architecture, which for many fintechs becomes a key readiness challenge.
In practice, many fintech operators do not build this infrastructure internally. Instead, they rely on regulated-grade payment infrastructure platforms that provide switching, reconciliation, risk management, and scheme connectivity aligned with central bank requirements.
The Real Pain Points in SARB Authorisation
Fragmented infrastructure
Many fintech platforms grow through a patchwork of systems:
- One provider for switching
- Another for fraud monitoring
- Separate reconciliation tools
- External KYC engines
- Manual dispute workflows
While this approach allows companies to launch quickly, it creates significant challenges when preparing for regulatory review. Regulators require end-to-end traceability of transactions, risks, and controls. When systems are fragmented, producing this evidence becomes complex and time-consuming often delaying the authorisation process. Across the African payments ecosystem, BIS analysis indicates that standard fragmentation can add 20–50% to per-transaction processing costs a structural burden that compounds directly when preparing a regulatory-grade audit trail.
Operational capability must be proven
Under the SARB framework, fintech operators must demonstrate that they can operate safely within the National Payment System.
This includes capabilities such as:
- Real-time reconciliation
- Secure switching infrastructure
- Auditable transaction records
- Robust fraud and AML decisioning
- Consumer protection and dispute workflows
These are not simply compliance policies. They must be embedded within the operational technology stack.
Interoperability with the Payment Ecosystem
Participation in the National Payment System also requires technical interoperability with banks, schemes, and settlement networks. Institutions must support standards such as:
- ISO 8583
- ISO 20022
- Nexo
- Scheme integrations
Developing and maintaining this level of interoperability is complex, and many fintech operators discover this gap only when preparing for licensing. South Africa was one of the first countries on the continent to adopt ISO 20022 at policy level, yet the regional picture remains hybrid: of 21 assessed African payment systems (SIIPS 2023), 10 operate on ISO 20022, 6 remain on ISO 8583, and 5 use proprietary formats. Regional platforms such as PAPSS (now connecting 19 central banks and 150+ commercial banks) and TCIB (serving 16 SADC countries) are built exclusively on ISO 20022 making standards interoperability a commercial imperative, not merely a compliance checkbox.
Risk-Based Compliance Expectations
Regulators aligned with FICA (Financial Intelligence Centre Act ) frameworks increasingly expect adaptive AML and fraud monitoring, rather than static rule-based systems. Institutions must implement capabilities such as:
- Machine-learning risk models
- Configurable risk policies
- Investigation workflows
- Full audit trails of compliance decisions
Few fintechs design their initial infrastructure with this level of sophistication. The stakes are tangible: South Africa’s FATF grey-listing experience demonstrated the direct commercial cost of AML deficiencies, with terminated correspondent banking relationships forcing an estimated 70% of SADC cross-border remittances into informal channels. Regulators have drawn the lesson and built it into the framework’s expectations.
