KYC and identity verification APIs in South Africa

Building a financial product in South Africa means working with FICA, the Financial Intelligence Centre Act. Any accountable institution (banks, insurers, payment providers, lenders, estate agents) must run a KYC process before onboarding a customer. This guide covers what FICA requires from a developer's perspective, which tools the Wycord registry indexes for each layer, and how to scope a compliant KYC stack.

What FICA requires: five layers

FICA-compliant onboarding for a natural person covers five areas:

1. Identity verification against the Department of Home Affairs (DHA) database
2. Biometric liveness check, required for higher-risk tiers
3. Address verification for natural persons
4. AML and sanctions screening: sanctions lists, Politically Exposed Persons (PEP), Politically Influential Persons (PIP), and adverse media
5. Source of funds classification via bureau data

For a juristic person (company), add CIPC verification and director identity checks.

The current FIC implementation reference is Guidance Note 7B, issued August 2026. Not every product requires all five layers. A basic lending affordability check and a tier-3 account opening have different risk profiles and therefore different Risk Management and Compliance Programme (RMCP) requirements. But any FICA-scoped KYC build needs a plan for at least the first four.

Layer 1: validate the ID number before you call an API

A South African ID number is 13 digits encoding date of birth, gender, citizenship status, and a Luhn checksum. Validating the format before calling a live DHA lookup costs nothing and eliminates data-entry errors before they hit a billable API call.

Two verified open-source libraries in the Wycord registry cover this:

• south-african-id-validator: TypeScript, available on npm and GitHub. Validates the Luhn checksum and extracts date of birth, gender, and citizenship status.
• za-id-number: Python, available on PyPI and GitHub. Same structural validation and data extraction, useful for backend Python stacks.

Both are free, open-source, and verified in the registry. A number that fails Luhn will never match a live DHA record. Run one of these locally as a pre-filter.

Layer 2: live verification against the Department of Home Affairs

Once the format is valid, the live check goes against HANIS, the Home Affairs National Identification System. HANIS holds the biographic and biometric records for every SA ID number. Developers cannot call HANIS directly. Access runs through licensed bureaus that hold data-sharing agreements with DHA.

The only SA-native KYC API currently indexed in the Wycord registry is Datanamix, a credit bureau registered with the National Credit Regulator. Note: as of September 2026 it is listed as a community submission pending verification review, not yet marked verified. The developer hub is at datanamix.com/developer-hub with a free sandbox; production requires a commercial contract.

Datanamix exposes several DHA verification variants:

• Profile ID Verification: checks the ID number against the DHA bureau dataset
• Realtime ID Verification: live HANIS query
• Realtime ID Verification Plus Photo: live HANIS query returning the DHA passport photo
• ID Scan To HANIS Verification: compares an uploaded document scan against the HANIS record
• ID Photo From HANIS: returns the DHA photo alone

Which variant your RMCP requires depends on the account tier and transaction risk level. A basic affordability check may only need the bureau-based Profile ID Verification. A tier-3 account opening typically requires a live Realtime check with the DHA photo to confirm the document matches the person in front of the camera.

Layer 3: biometric liveness and face match

A photo match alone is not biometric verification. FICA-grade biometric checks require 3D liveness detection: proof that a real person is present, not a printed photo or a replay attack.

Datanamix uses FaceTec for its biometric layer, described as "industry-leading 3D liveness detection, facial matching, and photo ID verification." The flow produces a 3D liveness scan, confirms a live person is present, and matches the face against the DHA photo retrieved from HANIS.

Datanamix also exposes a Realtime Fingerprint Bio endpoint for fingerprint-based biometric verification where fingerprint scanners are in play.

Layers 4 and 5: address, AML, and source of funds

Address verification in the more advanced implementations runs through bureau data rather than document upload. Datanamix's Address Plus Profile IDV combines an address check with an identity verification step.

AML and sanctions are covered by two products with distinct scope:

• Sanctions Standard: AML sanctions list + crime data + PEP screening
• Sanctions Premium: adds PIP (Politically Influential Persons) screening and adverse media monitoring

The distinction matters: South Africa's FICA framework explicitly covers PIPs, a category broader than PEP. If your RMCP requires PIP coverage, the standard product does not include it.

Source of funds classification draws on NCR (National Credit Regulator) bureau data and is included in Datanamix's FICA Factory bundle.

Company KYC: CIPC searches and director verification

For business onboarding, the CIPC (Companies and Intellectual Property Commission) is the company registry equivalent of DHA. Datanamix exposes three CIPC products:

• CIPC Standard Search: company registration lookup
• CIPC Company Search Plus: enhanced company data
• CIPC Director Search: lists the registered directors of a company

Combined with a consumer identity check on each listed director, this covers the beneficial ownership requirement in most RMCP frameworks.

The FICA Factory: bundled KYC as a single API call

For teams that want a fully bundled, paperless KYC workflow rather than assembling individual API calls, Datanamix's FICA Factory is described as "licensed software designed for accountable institutes to digitise FICA when onboarding customers during account origination processes, aligned with any RMCP."

The consumer bundle covers: 3D facial liveness, DHA identity verification, address verification, AML/PEP/adverse media screening, and NCR source of funds. The business bundle adds CIPC company verification, director identity checks, and sanctions screening. Pricing requires a commercial contract.

What to use when

Need	Tool
Validate SA ID number format (no API cost)	south-african-id-validator (TypeScript) or za-id-number (Python)
Bureau-based DHA identity check	Datanamix Profile ID Verification
Live DHA check with photo	Datanamix Realtime ID Verification Plus Photo
3D liveness + DHA face match	Datanamix FaceTec biometric
AML + PEP + sanctions	Datanamix Sanctions Standard
PIP + adverse media (higher risk tier)	Datanamix Sanctions Premium
Company registration + director check	Datanamix CIPC search suite
Fully bundled FICA-aligned workflow	Datanamix FICA Factory API
Bank account ownership confirmation	Stitch or Ozow (open banking, not KYC)

The current landscape

The SA KYC stack has a clear architecture: open-source validators as a free pre-filter, a licensed bureau API for DHA and credit data, biometric and AML products on top. The gap compared to Nigeria or Kenya is the depth of the provider ecosystem. The Wycord registry returns three KYC-related resources for South Africa, and the only API-level provider is Datanamix, which is pending its full verification review.

Browse all South Africa resources at wycord.com/countries or explore the full registry at wycord.com/apis.