You are here:
System Operator (SO)
System Operator (SO) Authorisation and Compliance
If you process payment instructions for two or more clients, you should apply for authorisation from PASA to act as a system operator (SO).
However, authorisation is compulsory if, in addition, you:
- Process more than 10,000 payment transactions per month, or
- Process a combined payment value exceeding R10 million per month
Compliance
PASA is required by the National Payment System Act 78 of 1998, section 4(2)(c) to authorise criteria for the authorisation of SOs and to authorise SOs complying with these criteria. These requirements align with SARB’s System Operator Directive 2 of 2007.
Overview of criteria
Detailed requirements for SOs can be found in PASA’s
Criteria for System Operator Authorisation.
In summary, the document covers:
- Basic authorisation criteria
- Financial criteria
- Operational and technical criteria
- Legal and contractual requirements
- Risk requirements
- Reporting requirements
In addition, you will find guidance on:
- How to make a new application
- How to lodge complaints or disputes
- The cancellation, withdrawal or termination of authorisation
- The period of authorisation
- The consequences of non-compliance
FAQ
No. Currently, only registered banks and designated clearing participants may be PASA members. However, you must be authorised with PASA to offer SO services.
Access to our website and portal is currently reserved for PASA members only.
If you render payment instruction services to two or more clients domestically, you should apply for authorisation by PASA to act as an SO. To apply, you must meet the requirements in Criteria for System Operator Authorisation. If you are still unsure, please email SO@pasa.org.za for guidance.
To process more than 10,000 transactions or a combined value exceeding R10 million per month, you must be an authorised SO. Below these thresholds, you should still seek authorisation if you service two or more clients.
No. To meet the requirements of SARB’s System Operator Directive 2 of 2007, you must already be in operation. This includes servicing two or more clients, being a going concern, and more.
Yes. You can find our fee structure on the application form.
Include your PCI Compliance Certificate or an Attestation of Compliance. This confirms that a Qualified Security Assessor (QSA) has thoroughly assessed and tested your environment, and found it fully compliant with the current standards.
If you apply for authorisation in the card payment system but do not hold your own PCI compliance certification, PASA will request that you provide a Report on Compliance (RoC). Your name should appear on the RoC as being evaluated under a third party’s certification, for example, your parent company.
No, unless they are requested by the PASA Membership and Compliance Team.
Your application will be assessed as a new request, and the once-off application fees will be payable.
Authorisation takes 21 working days after receipt of all required information and documentation, and provided all requirements are met.
PASA support
For further queries or guidance, email
SO@pasa.org.za
- National Payment System Act 78 of 1998
- SARB’s System Operator Directive 2 of 2007
- PASA’s Criteria for System Operator Authorisation
- Any other law, regulation, requirement applicable to their business model.
