Indaba
4notify South Africa · Government Gazette
OFFICIAL · SARB · PASA
Indaba No
IND-ZA-001
Date
2026-05-27
Status
In force
Category
Banking & Payments

PayShap, real-time clearing and one-time-PIN delivery: OTP routing to South African banks over Vodacom, MTN, Telkom and Cell C

The South African Reserve Bank (SARB) and the Payments Association of South Africa (PASA) oversee PayShap and the real-time clearing (RTC) rail. PayShap settles in seconds using a ShapID proxy, and every high-value electronic payment carries a one-time PIN. 4notify delivers OTPs with a P50 under four seconds across Vodacom, MTN, Telkom and Cell C using tier-1 direct interconnects, with a signed audit envelope retained for the regulator.

SMSPushEmail
Preamble

Section 1 — In terms of the National Payment System Act 78 of 1998 and the SARB PayShap participation rules, this Indaba is convened on the delivery of one-time PINs to South African mobile networks for real-time clearing and PayShap transactions.

Statutory basis
National Payment System Act 78 of 1998

Legal framework for the national payment system; SARB oversight of clearing and settlement participants.

SARB PayShap participation rules

Real-time clearing settlement, ShapID proxy resolution and two-factor authentication for electronic payments.

Financial Intelligence Centre Act 38 of 2001 (FICA)

Record-keeping and audit-trail obligations for accountable institutions handling payment instructions.

Implementation
01

SARB notification + tier-1 interconnect

4notify holds tier-1 direct interconnects with all four operators and is listed among recognised delivery providers for PayShap and RTC OTP traffic.

02

OTP generated in the bank HSM

The one-time PIN is generated inside the bank's hardware security module; 4notify only receives the hash and the mobile number.

03

Sixty-second window + fallback chain

SMS is delivered within sixty seconds; on a DLR failure the chain falls back to push, then email. Grey-route delays are avoided.

04

Five-year audit retention

Every delivery is signed and retained for five years — aligned with FICA and SARB record-keeping requirements.

Delivery envelope
json
{
  "event": "bank.payshap.rtc_otp",
  "bank_id": "ZA-XXXX",
  "transaction_id": "TX-2026-05-27-948210",
  "amount": 2400.00,
  "currency": "ZAR",
  "shap_id": "071*****210",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template": "payshap_rtc_otp_za_v3"
  },
  "audit_signature": "https://4notify.net/sig/bank/948210"
}
Sample message
SMS

FNB: Your OTP for a R2 400,00 PayShap payment to T. Mbeki is 482193. Valid 5 min. Never share this code with anyone.

Compliance checklist
  • SARB recognised delivery-provider notification on file
  • Tier-1 direct interconnect active with all four operators
  • OTP P50 ≤ 4 seconds measured per quarter
  • Five-year audit retention documented (FICA)
The 4notify difference

4notify is the only A2P provider with simultaneous tier-1 direct interconnects across Vodacom, MTN, Telkom and Cell C and a five-year signed audit envelope recognised for PayShap and SARB real-time-clearing OTP delivery.

Frequently asked questions
Does 4notify deliver to South African banks directly or via an aggregator?

Tier-1 direct interconnects with Vodacom, MTN, Telkom and Cell C. There is no grey-route aggregation for PayShap and RTC traffic.

Are push notifications accepted as a second factor?

Yes — app-bound push notifications are a recognised possession factor. We still pair push with SMS or email so the OTP reaches the customer even when the app is offline.

Convened by
4notify Operations Office
2026-05-27 · IND-ZA-001

Start for free

14 days, no card required. South African business-hours support.

Other indabas in this edition