How to Verify South African Supplier Bank Accounts: AVS, CIPC, and VAT

Paying a South African supplier for the first time, or acting on a request to change an existing supplier's banking details, means answering two separate questions: does the bank account belong to the party you are paying, and is the company behind it legitimate. South Africa has strong infrastructure for the first question and a public registry for the second. This guide explains how each works, and where a straightforward account match still leaves a gap.

Fraud figures: SABRIC Annual Crime Statistics, 2024.

The account layer: BankservAfrica's AVS

South Africa's primary mechanism for confirming a bank account is the Account Verification Service (AVS), operated by BankservAfrica. AVS lets a payer check that a specific account matches the details supplied by the account holder before a payment or debit order is set up. It is widely used across banking, insurance, lending, and payroll to reduce failed payments and account-related fraud.

AVS returns confirmation against a defined set of parameters, typically including:

• Whether the account exists and is open, and whether it has been open for at least three months.
• Whether the account can accept debits and credits.
• The account type (for example current, savings, or transmission).
• Whether the account is linked to the identity number supplied, and whether the name and initials match.

An important characteristic of AVS is that it is a confirmation service, not a lookup. It returns yes or no answers against the details you submit; it does not return the account holder's name, balance, or any other information. In other words, you must already have the details to check, and AVS tells you whether they match the account.

One distinction matters when the supplier is a business. A company's account is verified against the company registration number, not a personal identity number; only for a sole proprietor or individual is the ID number used. Checking a company account against an individual's ID, or vice versa, can cause a legitimate account to fail, so confirm you are matching against the correct identifier for the entity type.

Batch versus real-time

Direct participation in AVS is limited to banks. Businesses generally access it through their bank or through an authorised AVS provider that connects to BankservAfrica on their behalf. When you evaluate a provider, confirm whether they offer real-time checks, which markets and account types they cover, and how identity numbers are handled under data-protection rules.

The company layer: CIPC, SARS, and ownership

Confirming the account is necessary but not sufficient. An account can be valid, active, and correctly matched to an identity, and the business behind it can still be dormant, deregistered, newly formed for a single fraud, or controlled by someone other than who you think. This is where company-level verification applies.

The CIPC company registry

The Companies and Intellectual Property Commission (CIPC) is South Africa's official register of companies and close corporations. Every registered entity has a registration number in the format YYYY/NNNNNN/NN: the year of registration, a six-digit sequential number, and a two-digit code for the entity type.

The two-digit suffix indicates what kind of entity you are dealing with, which is useful context when a supplier's structure does not match the size or nature of the work:

A CIPC check confirms the registered company name and number, the current status (in business, deregistered, in liquidation, or business rescue), the registration date, the registered address, and the listed directors. Status is the field that most often matters: a supplier in the process of deregistration or business rescue is a different risk from an active company, regardless of whether the bank account checks out.

SARS VAT verification

If a supplier charges VAT, the VAT number should be valid and registered to that business. South African VAT numbers are ten digits and begin with the digit 4. SARS provides a VAT Vendor Search that confirms whether a number is registered and returns the associated trading name, which you can compare against the company you are paying. A VAT number that does not resolve, or that resolves to a different name, is a reason to pause.

SARS tax compliance status

Beyond a valid VAT number, many buyers — particularly in enterprise and government procurement — confirm that a supplier is in good standing with SARS. This is done through the Tax Compliance Status (TCS) system. The supplier requests a TCS and shares a secure PIN; the buyer verifies it through SARS eFiling or the SARS Online Query System by entering the supplier's tax reference number and the PIN. The result is returned in real time as compliant or non-compliant. Because the status reflects standing at the moment of the check, it is worth re-running periodically rather than relying on a single result at onboarding.

Beneficial ownership and the CIPC register

Knowing who ultimately owns and controls a supplier is now a formal part of the South African picture. After the Financial Action Task Force placed South Africa on its grey list in February 2023, the country introduced a central beneficial ownership register maintained by CIPC. Companies must record the natural persons who own 5% or more of the company, directly or indirectly, or who otherwise exercise effective control; a company or a trust cannot itself be a beneficial owner. Filings began in 2023 and must be kept current as ownership changes.

South Africa exited the FATF grey list on 24 October 2025, but the beneficial ownership requirements remain in force. One practical point for buyers: the CIPC beneficial ownership register is not publicly searchable — access is restricted to CIPC and competent authorities — so confirming ownership in practice relies on the supplier's disclosure or on registry-sourced data that assembles ownership from company records. A recently incorporated company, a single owner, or ownership that traces to an unexpected party remain the signals worth weighing before releasing a first payment.

B-BBEE: verifying a supplier's empowerment status

One verification step is specific to South Africa and often decisive in procurement: Broad-Based Black Economic Empowerment (B-BBEE). A supplier's B-BBEE status affects the procurement recognition a buyer earns, so most onboarding processes check it early. The proof a supplier provides depends on its size.

Status is expressed as a level from 1 to 8, plus non-compliant, with lower levels carrying higher procurement recognition. Two things matter when verifying it: the certificate or affidavit must be current — certificates are valid for twelve months from issue — and, where a certificate is required, it must come from an agency accredited by SANAS (the South African National Accreditation System). A certificate from an agency not on the SANAS list is not valid, and expired or fabricated B-BBEE certificates are a recurring problem in supplier onboarding.

What an account match will not catch

AVS is effective at what it does: confirming that an account is real, active, and linked to a stated identity. It is not designed to tell you anything about the company. It will not tell you that the entity was deregistered last year, that it was incorporated last month, that its VAT number is invalid, or that its ownership changed hands recently. Each of those can accompany a perfectly valid account.

This distinction is the reason a single check is rarely enough. A correctly matched account is a necessary condition for paying safely, not a sufficient one. There are several company red flags a bank account match alone will not catch, and they are exactly the signals that separate a legitimate supplier from a convincing front.

Why this matters in South Africa

The risk is not theoretical. According to SABRIC's 2024 crime statistics, digital banking fraud incidents rose 86% year on year to almost 98,000 cases, with gross losses of R1.888 billion. Banking apps accounted for 65% of digital fraud cases, with losses exceeding R1.2 billion. The dominant business-payment attacks — vendor email compromise and bank-detail change requests — work by presenting a plausible instruction to change where money is sent. Confirming the account and the company together is the control that interrupts them.

Regulatory context: FICA and POPIA

Two frameworks shape how verification is done in South Africa. The Financial Intelligence Centre Act (FICA) sets customer due diligence obligations for accountable institutions, which makes verifying the identity and legitimacy of counterparties a compliance matter, not only a fraud-prevention one. The Protection of Personal Information Act (POPIA) governs how personal information, including the identity numbers used in an AVS check, is collected and processed. Any verification workflow should have a lawful basis for processing that data and should minimise what it retains.

A practical verification workflow

For a new South African supplier, or a change to an existing one, a defensible sequence looks like this:

1. Confirm the account. Run an AVS check on the account number and type, matched against the company registration number for a business or the identity number for an individual.
2. Confirm the company. Verify the CIPC registration number, that the status is active, and that the registered name matches the supplier.
3. Confirm the tax position. Validate the VAT number if VAT is charged, and where required, verify the supplier's SARS tax compliance status using their TCS PIN.
4. Check ownership. Review the directors and beneficial owners, and note recent incorporation or ownership changes.
5. Check B-BBEE, if relevant. Confirm the affidavit or certificate is current and, where a certificate is required, issued by a SANAS-accredited agency.
6. Monitor. Re-verify on any bank-detail change request, and monitor status and ownership for existing suppliers rather than treating onboarding as a one-time event.

Frequently asked questions