SARB's Amended Authorisation Framework: Closing The Loop On Closed Loop And TPPPs

The South African Reserve Bank published an amended version of the Draft Authorisation Framework in respect of specific payment activities, on Friday, 14 November.

We have reviewed the November draft against the draft circulated in March earlier this year, and note material changes to the regulation of closed‑loop payment instruments and third‑party payment providers (TPPPs). We previously raised concerns regarding the treatment of gift cards under the Draft Authorisation Framework – and welcome the changes in the November draft.

Closed‑loop payment instruments and systems

The November draft significantly expands and clarifies the regulation of closed‑loop arrangements. Whereas the March draft simply required registration of closed‑loop systems, the November draft introduces a detailed registration regime, including scope, thresholds and compliance expectations. Notable developments include:

• A clarified definition with explicit exclusions and inclusions: the November draft refines what constitutes a closed‑loop system, expressly excluding on‑us transactions within open‑loop systems and most gift cards/loyalty schemes, while including closed‑loop instruments that are redeemable for cash within the scope for registration.
• A quantitative threshold and migration trigger: a 12‑month transaction cap of ZAR3 million is introduced for closed‑loop operators; exceeding this threshold triggers notification and may require authorisation to operate in the interoperable environment.
• Risk‑based due diligence thresholds and operational requirements: the November draft prescribes simplified due diligence for low‑value activity under ZAR10 000 and full due diligence above that level, together with detailed application content, funds‑segregation arrangements, and ongoing reporting.
• Sponsorship as a pathway for sub‑threshold operators: entities below prescribed thresholds may operate via sponsorship with an authorised/designated payment institution, subject to prior approval and accountability requirements.

Collectively, these changes move closed‑loop regulation from a principles‑based registration requirement (March) to a granular, risk‑tiered regime with explicit onboarding, safeguarding, and escalation mechanics (November).

Third‑party payment providers (TPPPs)

The regulation of TPPPs is materially re‑cast. The March draft set general operational, onboarding and technical requirements, but the November draft introduces a tiered authorisation framework and prudential parameters:

• Tiering by business scale: TPPPs are split into Tier 1 (>ZAR5 million average monthly transaction values) and Tier 2 (≤ZAR5 million), with differentiated authorisation and ongoing compliance requirements.
• Defined capital and safeguarding obligations: minimum and ongoing capital requirements are codified for each tier, together with mandatory segregated trust accounts and comprehensive governance, risk and reporting obligations.
• Funds‑holding discipline: the November draft states that beneficiary funds may not be held for more than 30 days from receipt, reinforcing reconciliations and records management for both aggregated pay‑ins and pay‑outs.

These changes align TPPPs more closely with other payment institutions in respect of prudential soundness, client‑funds protection and supervisory visibility.

Other material changes

Beyond the closed‑loop and TPPP updates, we note one cross‑cutting shift relevant to all client‑funds models:

• Treatment of interest on segregated accounts: the March draft contemplated a prohibition on interest; the November draft permits interest earned on segregated client‑funds accounts to accrue to the payment institution (with an expectation that low‑fee products be offered), while confirming that clients do not earn interest. This has pricing, disclosure and product‑design implications.

Should your organisation need assistance with reviewing its services against the newly published draft authorisation framework, to determine which services will fall within the scope of the current draft and understand the compliance obligations that would apply, get in touch with the team below.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.