Verifying a customer's physical address and contact details is an essential component of Know Your Customer (KYC) compliance in South Africa, and one that businesses frequently underestimate. While identity verification confirms who a person is, address and contact verification confirms where they are and how they can be reached. Both are essential for meeting regulatory obligations, preventing fraud, and maintaining accurate customer records.

This guide explains what South African law requires for address verification, which documents and methods are acceptable, and how to verify both physical addresses and contact details such as mobile numbers as part of a compliant KYC process.

For a foundational explanation of KYC and what it involves, refer to our guide: What is KYC? Know Your Customer Explained for South African Businesses.

Address and contact verification serves two distinct but related purposes. The first is regulatory compliance. Under the Financial Intelligence Centre Amendment Act (FICA), Accountable Institutions are required to establish and verify the residential address of their clients as part of customer due diligence. The second is fraud prevention. A verified address and a verified contact number make it significantly harder for a fraudster to operate behind false or stolen details, and they provide a reliable means of reaching and identifying a customer throughout the relationship.

Getting this wrong carries real consequences. The Financial Intelligence Centre (FIC) can impose administrative sanctions of up to R50 million per contravention, and recent enforcement has been active. Capitec Bank was fined R56.25 million in December 2024, Standard Bank received a R13 million penalty in January 2025, and Grindrod Bank was fined R10.73 million in December 2023, with deficiencies in customer due diligence among the cited failures. For an explanation of which businesses carry these obligations, refer to our guide: What is an Accountable Institution? FICA Obligations Unpacked.

FICA requires Accountable Institutions to establish and verify the particulars of their clients, including residential address, before establishing a business relationship or concluding a single transaction. The detail of how this is done is guided by the FIC's Guidance Note 3A on client identification, which has been declared authoritative.

Two principles from the guidance are particularly important. The first is recency. Good practice is to require that any document used as proof of address be no older than three months from the date of submission, so that it reflects the client's current place of residence. The second is the risk-based approach. The FIC has made clear that decisions on how residential addresses are verified should be based on the institution's own risk framework, and that overly restrictive document requirements can frustrate legitimate clients. In other words, an Accountable Institution has latitude to determine acceptable proof of address according to the risk a client presents, provided its approach is documented and consistently applied.

The FIC and the South African Revenue Service (SARS) provide a practical, non-exhaustive list of documents that many businesses use as a baseline for proof of residential address. Commonly accepted documents include a utility bill, such as a water or electricity account, a telephone or other municipal account, a current lease or rental agreement, a recent bank statement on official bank documentation, and a property managing agent statement. In each case, the document should be in the name of the client and should reflect a physical residential address.

There are two important constraints to apply. The document should generally be no older than three months, and it must point to a physical location. PO Box-only details are typically not accepted, because a postal address does not confirm where a person actually resides and is of limited use for deliverability or investigation. Where a residential address does not have a conventional street address, a utility document reflecting the erf or stand number and suburb is commonly used instead.

Because the list is non-exhaustive, an Accountable Institution may accept other documents as valid proof of address in line with its risk framework. This flexibility is particularly important for clients who may not hold conventional utility accounts, including many foreign nationals, refugees, and asylum seekers.

Address verification in South Africa can be conducted in two ways, and understanding the difference is increasingly important as digital onboarding becomes the norm.

Manual verification relies on the client submitting a physical or scanned proof of address document, which the business then reviews for validity, recency, and consistency with the client's other details. This method is well established but slower, more prone to forgery, and more burdensome for both the client and the business.

Electronic verification confirms a client's address against trusted independent data sources, such as credit bureau records, in real time. Electronic address verification uses the individual's ID number to source their address data, which is then cross-referenced against verified data already held about the individual, returning a confirmation without requiring the client to locate and submit a document. This approach is faster, harder to defraud, and well suited to digital onboarding at scale. It also produces a clean, automatically generated audit record. For a broader explanation of how digital verification works and why it matters, refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?

A compliant address verification process can be broken down into four clear steps.

Begin by obtaining the client's residential address as part of the onboarding process. The address provided forms the basis of the verification and should be a physical residential address rather than a postal box.

Decide whether to verify the address electronically against trusted data sources or through a submitted proof of address document. Many businesses use electronic verification as the primary method for speed and reliability, falling back to document verification where electronic confirmation is not available. The choice should align with the client's risk profile and your documented risk framework.

Where a document is used, confirm that it is no older than three months, that it is in the client's name, and that it reflects a physical address. Check the address for consistency against the client's other verified information, and treat any discrepancy as a flag requiring further investigation.

Capture and retain a record of the verification, including the method used, the source or document relied upon, and the outcome. This record forms part of the customer due diligence file that FICA requires you to maintain.

Verifying a client's contact details, particularly their mobile number, is an increasingly important component of KYC, both for maintaining accurate records and for fraud prevention.

Mobile number verification confirms that a phone number is valid and genuinely associated with the individual presenting it. This matters because the mobile number is often the channel through which a business communicates with a client and, in many cases, authenticates transactions. Verifying that the number genuinely belongs to the client reduces the risk of impersonation and ensures that communications and one-time authentication codes reach the right person.

SIM swap detection is a critical extension of mobile verification. In a SIM swap attack, a fraudster takes control of a victim's mobile number in order to intercept one-time PINs and authentication messages. Telecommunications fraud, including SIM swap attacks, cost South Africa more than R5.3 billion in 2025. A mobile verification check that detects a recent SIM swap provides an immediate fraud warning, flagging that a number may have been compromised before it is relied upon for authentication. For a detailed explanation of how this connects to payment security, refer to our guide: How to Detect and Prevent Bank Account Fraud in Payments.

Email verification, while generally lower-risk, confirms that an email address is valid and deliverable, which supports accurate record-keeping and reliable communication with the client throughout the relationship.

South Africa applies a Risk-Based Approach (RBA) to AML/CFT compliance, which means that the depth of address and contact verification applied should be proportionate to the risk a client presents. A low-risk client may require standard address confirmation, while a higher-risk client may warrant more rigorous verification through multiple independent sources.

The key requirement is that an Accountable Institution defines its address and contact verification standards within its Risk Management and Compliance Programme (RMCP), applies them consistently, and is able to justify its approach to the regulator. The RBA gives businesses flexibility, but that flexibility must be exercised within a documented and defensible framework.

FICA requires Accountable Institutions to retain customer due diligence records for at least five years after the end of a business relationship or the conclusion of a transaction. For address and contact verification, this means retaining not only the documents or data relied upon, but also the verification results themselves, including the outcome of any electronic checks. A customer file that contains only submitted documents, without the corresponding verification results, is incomplete from an audit perspective. Maintaining a complete record of every verification is the most effective protection against the kind of administrative sanctions that have characterised recent FIC enforcement.

To verify addresses and contact details effectively and compliantly, businesses should adopt a few key practices. Use electronic verification where possible, for speed, accuracy, and a clean audit trail. Apply the three-month recency standard consistently to any documents accepted. Define acceptable proof of address and contact verification methods clearly within your RMCP, and apply them consistently across all clients. Verify mobile numbers and screen for recent SIM swaps before relying on a number for authentication. Retain a complete record of every verification, including the result, for at least five years. Finally, build flexibility into your address requirements so that legitimate clients without conventional utility accounts are not unfairly excluded.

As South Africa's leading provider of world-class identity verification, KYC, and due diligence solutions, ThisIsMe gives businesses the tools they need to verify physical addresses and contact details quickly, accurately, and in full compliance with FICA. From electronic address verification against trusted data sources to mobile number verification and SIM swap detection, our solutions help businesses confirm where their customers are and how to reach them, while strengthening fraud defences and maintaining an audit-ready compliance record. To experience our full suite of verification solutions and find out how we can serve your business, contact our team here.