If your business collects money from customers on behalf of merchants, runs a digital wallet, processes card payments or moves funds between people, you are operating in the national payment system. That system is tightly regulated, and many fintechs only discover how tightly when a bank partner, investor or regulator asks which authorisation they hold.
The rules are also changing. The South African Reserve Bank (SARB) has been working for several years to open the payment system to non-bank providers, and in 2025 it consulted on a new activity-based framework that would change how payment businesses are authorised. Fintechs building or scaling payment products now need to understand both the current rules and where they are heading.
This article gives an overview of the National Payment System Act, the main categories of payment businesses, and the practical steps to stay compliant.
The National Payment System Act
The National Payment System Act 78 of 1998 (NPS Act) is the main statute governing payment, clearing and settlement in South Africa. The SARB is responsible for overseeing the national payment system and may issue directives under the Act.
The Payments Association of South Africa (PASA) is recognised under the NPS Act as the payment system management body. PASA manages the participation of banks and other participants in clearing, and plays a role in authorising certain non-bank participants.
Alongside the NPS Act, the Banks Act 94 of 1990 matters because taking deposits from the public as a business is reserved for registered banks. A payment business that holds customer funds must be structured so that it does not unintentionally conduct “the business of a bank”.
Who needs authorisation under the current rules
Third-party payment providers
Section 7 of the NPS Act regulates persons who, as a regular feature of their business, accept money or payment instructions from one person to make payment to a third person. SARB Directive 1 of 2007 sets out the conditions for these third-party payment providers (TPPPs). Typical examples include payment gateways and businesses that collect payments on behalf of merchants or billers. TPPPs must generally be sponsored by a bank and registered through PASA.
System operators
A system operator provides services to two or more persons in respect of payment instructions, for example by processing transactions or delivering payment instructions to banks. SARB Directive 2 of 2007 regulates these operators, who must also be authorised through PASA.
Participants in clearing and settlement
Historically, only banks and a small number of designated institutions could participate directly in clearing and settlement. Non-banks have generally needed a sponsoring bank to access the payment system.
Other regimes that often apply
- Electronic money. The SARB has historically taken the view that only banks may issue electronic money, with non-banks partnering with a bank.
- Cross-border payments. Money remittance and foreign exchange transactions are subject to exchange control rules and the authorised dealer system.
- Anti-money laundering. Many payment businesses have obligations under the Financial Intelligence Centre Act 38 of 2001, either directly or through their bank partners’ requirements.
- Credit. If the product includes deferred payment or “buy now, pay later”, the National Credit Act may apply. See our article on lending and BNPL.
- Personal information. Payment data is personal information under the Protection of Personal Information Act 4 of 2013.
The shift to activity-based authorisation
In March 2025, the SARB published a draft directive and a draft exemption notice for comment. Together, they propose an activity-based authorisation framework for banks and non-banks that conduct payment activities. The draft directive lists activities such as acquiring, issuing payment instruments, electronic money, money remittance, payment accounts and stores of value, third-party payment provision, clearing and settlement, with requirements covering governance, capital, safeguarding of client funds and reporting.
The draft exemption notice, made under the Banks Act, would treat certain pooling-based payment activities as not constituting the business of a bank, provided conditions are met. This would allow authorised non-banks to offer those services without relying on a bank to hold the funds. The drafts also propose that closed-loop payment systems, such as some gift card and store-value schemes, register with the SARB.
A broader amendment of the NPS Act to support direct non-bank participation is also in progress. At the time of writing, the new framework is not yet fully in force and its final form and commencement dates should be confirmed with the SARB before relying on it. Until then, the current directives and PASA processes continue to apply.
Practical steps for payment businesses
- Map your money flows. Draw out exactly who pays whom, through which accounts, and who holds funds at each point. Regulatory analysis starts here.
- Identify your activities. Determine whether you act as a TPPP, a system operator, an issuer, an acquirer or a remitter, or a combination of these.
- Check bank and PASA requirements. Confirm whether you need bank sponsorship and PASA registration under the current directives, and build this into your launch timeline.
- Protect customer funds. Make sure customer money is held in properly designated accounts and is not mixed with your operating funds.
- Review your contracts. Merchant, bank partner and technology agreements should allocate liability for fraud, chargebacks, outages and data breaches.
- Build compliance in. Put AML, sanctions screening, data protection and complaints procedures in place before you scale.
- Track the reforms. Monitor SARB publications on the activity-based framework so that you can apply for the right authorisation when it becomes available.
How O’Reilly Law can help
We advise fintechs, payment providers and merchants on the regulatory classification of payment products, PASA and SARB requirements, bank partnership and merchant agreements, and related AML, credit and data protection obligations. We also help businesses prepare for the SARB’s activity-based authorisation framework as it develops.
Contact us to discuss the regulatory position of your payment product.
Related reading: Lending, BNPL and the National Credit Act: who must register · Crypto asset service provider licences in South Africa
This article is general information and not legal advice. Correct as at November 2026.