TL;DR

• The legal risk: a credit agreement clause that lets you debit a consumer’s account without their specific authorization is void under the National Credit Act, confirmed by a 2019 High Court ruling against a major bank.
• The fix: DebiCheck ties that authorization to the consumer’s own bank rather than to your paperwork alone, which is the kind of specific, verifiable consent the Act asks for.
• The 2026 change: from 13 April 2026, every debit order type carries a standardized 60-day dispute window, but a validly authenticated DebiCheck mandate stays largely non-disputable regardless.
• What the software has to do: validate mandate parameters before every submission, track for funds instead of resubmitting blind, classify a failure by cause before retrying, and re-authenticate the moment banking details change.
• Where AI fits: once the mandate is lawful, propensity scoring and outreach timing decide when to attempt collection, a separate question from whether you are allowed to.
• The honest caveat: the 2026 dispute-window change and the shift of debit order oversight from PASA to the South African Reserve Bank are documented consistently across trade and legal sources, but neither has been confirmed yet against a primary regulator text we could fetch directly.
  

A credit provider that submits a debit order without the consumer’s own explicit sign-off is leaning on an assumption that used to be legally safe and no longer is. For decades, a bank’s common-law right of set-off let a credit provider treat a customer’s account as recoverable, instruction or no instruction, whenever a balance fell due. The National Credit Act ended that, and a 2019 High Court judgment against Standard Bank spelled out how far the change goes.

The practical answer for anyone building or buying debit order collection software in South Africa: the mandate comes first, and the collection strategy sits on top of it. A properly authorized, bank-validated mandate under DebiCheck is what keeps a collection lawful and defensible. Deciding which account to attempt on which day is a separate question, one a well-run recovery operation still needs to get right.

This piece works through what the Act requires, why DebiCheck answers that requirement more cleanly, what changed for disputes in April 2026, and what a debit order platform needs to handle day to day.

Debit orders carry a legal risk most collection strategies overlook

A clause letting a provider “debit whatever account the consumer holds with us” for an outstanding balance sounds like standard practice. Under the National Credit Act, it is void.

What the Act voids: any provision that authorizes a credit provider to satisfy a consumer’s obligation by charging an asset, account, or deposited amount, unless it falls under a standing debt arrangement or meets the specific conditions in section 124. Section 90(2)(n) states it directly: a clause “purport[ing] to authorise or permit the credit provider to satisfy an obligation of the consumer by making a charge against an asset, account, or amount deposited by or for the benefit of the consumer” is an unlawful provision, with those two narrow exceptions.

In 2019, the Johannesburg High Court applied that section against Standard Bank in National Credit Regulator v Standard Bank of South Africa Limited, which had relied on the old common-law right of set-off to recover amounts from customer accounts. Judge Keightley held that common-law set-off does not survive alongside the Act’s own framework. A charge to a consumer’s account is lawful only if the consumer authorized it, identifying the account, the amount, and the obligation it covers. General banking practice does not substitute for it.

For a credit provider running recovery through debit order, the lesson is specific rather than abstract. The mandate itself has to carry that authorization, on top of whatever the credit agreement’s general terms already say.

DebiCheck versus a registered mandate: why the bank-held record is what protects you

South Africa runs three kinds of debit order, differing in exactly the place the Standard Bank ruling cares about: who holds the record of consent, and who checks a collection against it.

An EFT debit order is the oldest form. The credit provider collects the mandate itself, on paper, by voice, or electronically, and stores it, and the consumer’s bank does not check a collection against it before paying out. A Registered Mandate improves on this slightly: the consumer acknowledges the mandate to the service provider, and the bank validates each collection against agreed parameters, but the provider still holds the underlying record.

DebiCheck moves the authorization itself to the bank. The consumer approves the mandate electronically, through their own banking app, cellphone, or an ATM, at the start of the arrangement, and the bank stores that approval and checks every subsequent collection against it before paying out.

That distinction matters for the same reason the Standard Bank case does. A mandate a credit provider holds and produces on request is evidence the provider itself created and kept. A mandate the consumer’s own bank independently validated and stored is a third-party record the provider cannot be accused of having drafted after the fact, and that is what decides how convincingly a provider can answer a consumer who denies ever authorizing a collection.

What changed on 13 April 2026, and why an authenticated mandate matters more now

From 13 April 2026, South Africa standardized the dispute window across every debit order type, EFT, Registered Mandate, and DebiCheck, at 60 calendar days from the collection date, down from a 365-day window that applied previously. A dispute filed within that period gets reversed automatically for an unauthenticated mandate, and one filed after it needs a bank investigation.

The detail that matters most sits underneath that headline number: a validly authenticated DebiCheck mandate stays largely non-disputable, regardless of the window. The 60-day standardization tightens the clock for a provider defending an EFT or paper mandate. It does little to a provider whose mandates were never disputable on authorization grounds to begin with.

This sits inside a broader shift in who runs the debit order system. From 11 August 2026, the South African Reserve Bank began withdrawing its recognition of the Payments Association of South Africa as the body that manages the national payment system, taking that function on directly. Debit order scheme rules continue to apply through the transition, and the direction of travel is toward tighter, centrally supervised conduct. Both this transition and the 60-day rule’s mechanics are corroborated across several independent trade and legal sources rather than a primary regulator text we could fetch directly, and should be treated with that caveat in any client-facing use.

What debit order collection software has to do, beyond submitting a file

A platform that only sends a debit instruction and reports back a success or failure code is not doing the job a compliant, dispute-resistant collections operation needs. The mandate has a lifecycle, and software has to manage the whole of it.

• Validate mandate parameters before every submission. The amount, date, and frequency of a collection attempt need to match what the bank holds against the mandate rather than what an internal ledger says is owed, since a mismatch is exactly what triggers a DebiCheck rejection.
• Track for funds instead of resubmitting blind. DebiCheck supports a tracking window of up to ten days, where the bank keeps checking for available funds rather than the provider firing a fresh instruction into an account it already knows is empty.
• Classify a failure by cause before retrying. Insufficient funds, a raised dispute, and a closed account each call for a different response. One uniform retry rule wastes attempts on accounts that were never going to pay.
• Re-authenticate the moment banking details change. A new account number needs a new DebiCheck mandate before the next attempt goes out, since resubmitting the old mandate against new details is a collection that was never authorized against that account.
• Surface a mandate suspension the instant the bank reports it. DebiCheck notifies the service provider of a suspension when it happens, and software that only checks on the next scheduled run is working from stale information for however long the gap runs.

These five tasks are specific to the debit order channel. For collections software more broadly, case management, workflow engine, integration, see the broader software evaluation guide.

Where AI-driven collection orchestration sits on top of a compliant mandate

None of the mandate mechanics above answer the question a collections team loses sleep over: which account to attempt today, and when in the cycle to try it. That is a separate layer, where propensity-based scoring and outcome-based retraining do their work, sitting on top of a mandate that is already lawful and authenticated.

iTuring’s platform applies propensity scoring to decide which accounts in a debit order book are worth an attempt on a given day, and continuously retrains against the outcomes those attempts produce, so the timing adjusts to how the portfolio behaves rather than running on a fixed monthly schedule. In one NBFC deployment, “Improve Collections and Optimize Efforts,” that combination of propensity-based targeting and continuous retraining lifted the collections recovery rate by 116%, with 86% predictive accuracy and a two-week deployment. That case study is from India rather than South Africa, noted plainly here since the underlying mechanism of scoring, timing, and retraining is what transfers across markets.

Getting the mandate right is the part of debit order collection that carries legal exposure if it is wrong. Getting the timing and targeting right on top of it is the part that determines how much of what you are owed you recover. A platform built for a South African credit provider needs to do both, starting with the first, and alongside how NCA affordability assessments work at the point of lending, the other half of the same compliance picture.

Sources

1. National Credit Act 34 of 2005, section 90(2)(n) and section 124. https://www.justice.gov.za/mc/vnbp/act2005-034.pdf
2. National Credit Regulator v Standard Bank of South Africa Limited (44415/16) [2019] ZAGPJHC 182, 27 June 2019. https://www.saflii.org/za/cases/ZAGPJHC/2019/182.html
3. Payments Association of South Africa, “Debit Orders” resource page. https://pasa.org.za/pasa-resources/pasa-debit-orders/
4. Payments Association of South Africa, Debit Order FAQ, updated June 2024. https://pasa.org.za/wp-content/uploads/2024/08/Debit-Order-FAQ-1.pdf
5. Fulcrum, “Important Update: Debit Order Dispute Rules Changing 13 April 2026,” 23 February 2026. https://www.fulcrum.co.za/2026/02/23/important-update-debit-order-dispute-rules-changing-13-april-2026/
6. South African Reserve Bank, “Transition of national payment system management functions,” media release, 2026. https://www.resbank.co.za/en/home/publications/publication-detail-pages/media-releases/2026/Transition-of-national-payment-system-management-functions
7. Stitch, “Debit order + DebiCheck best practices for South African debt collection agencies,” 2026. https://stitch.money/blog/debit-order-debicheck-best-practices-for-south-african-debt-collection-agencies
8. iTuring.ai, case study “Improve Collections and Optimize Efforts.” https://ituring.ai/case-study/improve-collections-and-optimize-efforts/