Labour law · 28 August 2026 · 13 min read

Background Checks in South Africa: An Employer’s Guide

Fingerprint scanning for background check

Employers hiring in South Africa typically need four checks: criminal record screening (AFIS fingerprint or a Police Clearance Certificate), ID verification, employment and reference checks, and qualification verification. The first move is practical, not procedural: collect the candidate’s ID details and written POPIA-compliant consent, then order the AFIS or accredited criminal check appropriate to the role. FICA obligations apply where the position touches finance or client funds.

TL;DR:

  • Criminal record checks using AFIS are standard for most roles, but a Police Clearance Certificate is required only for foreign employment or visa purposes.
  • Identity verification is a mandatory first step, with employment and qualification checks tailored to the role’s risk level and regulatory requirements.
  • Criminal checks via AFIS can return results within hours if fingerprints are already on file, while first-time checks or PCCs may take weeks, requiring planning.
  • Employers must adhere to POPIA principles by collecting only necessary data, securing it properly, and retaining records only for the required duration.
  • Proper vendor selection involves verifying accreditation, understanding data handling, and ensuring dispute-resolution processes to mitigate legal and privacy risks.

Table of Contents

Which Background Checks Do Employers in South Africa Actually Need?

Not every role justifies every check. A retail cashier and a chief financial officer carry different risk profiles, and your screening should reflect that rather than applying one template to everyone.

  • Criminal record check (AFIS or PCC): standard for most hires; PCC specifically for foreign employment or visa purposes.
  • ID verification: near-universal first step, confirming the candidate is who they claim to be.
  • Employment and reference checks: standard for any role with prior work history to verify.
  • Qualification verification: required for regulated professions (finance, health, law, engineering) and senior roles claiming specific degrees.
  • Credit checks: typically reserved for finance, cash-handling, or fiduciary positions, and require added consent under credit-reporting rules.

Driving record and professional license checks round out the list for transport, logistics, or licensed-trade roles.

How Criminal Record Checks Work: AFIS Fingerprint Screening vs Police Clearance Certificate

These two documents solve different problems, and confusing them costs employers time. AFIS (Automated Fingerprint Identification System) checks are the standard employment-screening tool. Accredited providers capture fingerprints and query SAPS criminal databases directly, and if a candidate’s prints are already hosted from a previous check, results can come back much faster.

A Police Clearance Certificate, by contrast, is a formal document issued by SAPS through its own application process, typically required for immigration, visa applications, or foreign employment rather than routine domestic hiring. It has its own fee structure and generally must be collected in person. Do not substitute a local AFIS check when a foreign authority specifically demands a PCC.

Where electronic fingerprint capture isn’t available, providers fall back on manual capture using the SAPS 91A form, which then gets couriered for processing. That fallback path adds days, so build it into your hiring timeline for any candidate without prior digital fingerprint records.

Verifying Employment History and Qualifications Without Overreaching

Reference checks work best when they’re structured, not conversational. Ask former employers to confirm dates of employment, job title, and reason for leaving, then log any inconsistency against what the candidate told you.

Acceptable evidence for employment history ranges widely in assurance level:

  • Employer confirmation letter (high assurance)
  • Signed employment contract (high assurance)
  • Recent payslip (moderate assurance)
  • Work email domain confirmation (low, but useful as a quick screen)

For qualifications, you can contact the issuing institution directly or use a third-party verification service, escalating to direct institutional contact when a certificate looks altered or the institution is unfamiliar. A risk-based approach means you verify identity first and only pull additional documentation when something about the role or the candidate’s answers warrants it.

Pro Tip: Keep a simple log of every reference call, including the date, who you spoke to, and their exact answers. If a hiring decision is ever challenged, that log is your best defense.

POPIA, FICA, and What Employers Owe Candidates on Privacy

Background screening puts you in direct contact with sensitive personal data, and POPIA sets firm boundaries around how you collect and store it. Four principles matter most: collect only what the role requires (minimality), use it only for the stated hiring purpose, don’t keep it longer than necessary, and secure it against unauthorized access.

FICA obligations layer on top for roles tied to financial services, where employers or their screening partners may need to run additional know-your-customer checks on staff handling client funds. In practice, this means your consent form should specify exactly which checks you’re running and why, your privacy notice should explain retention periods in plain language, and you should keep an audit trail showing who accessed screening data and when. Documenting the rationale for each check against the actual risk of the role is what separates a defensible screening program from one that invites a POPIA complaint.

Turnaround Times and Costs for Common Background Checks

Timing depends heavily on whether a candidate’s fingerprints are already on file. AFIS checks against a hosted fingerprint database can return results within hours to a couple of days; a first-time capture, especially one requiring manual SAPS 91A submission, can take one to several weeks. A Police Clearance Certificate follows SAPS’s own schedule and generally runs slower than a private AFIS query, so build in extra lead time for any candidate who needs one.

Pricing snapshot: vendor pages commonly list criminal record checks starting from a few hundred rand, with faster turnaround available when a candidate has existing hosted fingerprints. Expedited service, first-time capture, and bundling multiple checks (criminal, ID, qualification) into one package all shift the price up or down.

How to Order a Background Check in South Africa

  1. Collect identity details and written consent. Get the candidate’s full ID information and a signed, POPIA-compliant consent form before requesting anything.
  2. Select checks based on role risk. A junior admin hire and a finance manager don’t need the same screening depth.
  3. Choose your capture method. Use an accredited AFIS provider for standard hires, or direct the candidate to SAPS if a Police Clearance Certificate is specifically required.
  4. Store, evaluate, and retain records. Review results with the relevant hiring stakeholders and keep documentation for the legally required retention period, not indefinitely.

Choosing a Screening Provider Without Getting Burned

A good vendor will show you their accreditation, walk you through their POPIA data controls, and hand you a sample report before you sign anything. Ask specifically how they handle disputed results. Vendors with documented dispute-resolution processes and clear audit trails give you real recourse when a candidate contests a finding, rather than leaving you to sort it out yourself.

  • Confirm AFIS accreditation and ask how they handle hosted fingerprint databases.
  • Request a sample report before committing to a contract.
  • Get pricing in writing, with no vague “from” figures that balloon later.
  • Ask directly how long they retain candidate data and how they dispose of it.

Pro Tip: If a provider promises “instant” criminal history results with no mention of AFIS or hosted fingerprints, treat that as a warning sign rather than a selling point.

Red flags worth walking away from: vague consent language, claims of accessing records no legitimate provider can reach, and no clear answer on how long your candidates’ data sits in their systems.

Limitations and Common Challenges Employers Run Into

Background screening in South Africa has real gaps, and pretending otherwise sets employers up for false confidence. Fingerprint databases only return a match if the candidate’s prints, or a criminal record tied to them, actually exist in the SAPS system correctly captured and correctly linked to their identity. Data entry errors, name variations, and outdated records all produce false negatives, meaning a clean result doesn’t always mean a clean history.

Rural and older records are less consistently digitized than recent urban ones, which slows verification and occasionally produces incomplete results. Candidates who’ve lived or worked abroad add another layer of difficulty: a South African AFIS check tells you nothing about a criminal history in another country, and getting foreign police clearance can take weeks depending on that country’s own bureaucracy.

Qualification verification runs into its own friction. Smaller institutions and older graduates sometimes have incomplete digital records, meaning verification requests can sit for weeks waiting on a registrar’s office to physically locate a file. Employment reference checks face a quieter problem: many companies now restrict what former managers are legally allowed to confirm, often limiting responses to dates of employment and job title, which strips out exactly the behavioral context employers want most.

None of this means checks aren’t worth running. It means employers should treat a clean result as one input among several, not an absolute guarantee, and build extra time into hiring timelines for candidates with international or older work history.

Limitations and Common Challenges Employers Run Into — overview diagram

Running a background check creates legal obligations that don’t end when the report lands in your inbox. Under POPIA, you’re the “responsible party” for any personal information you collect during screening, which means you carry legal accountability for how it’s stored, who can access it, and how long you keep it. A data breach involving screening records, whether from a hacked vendor system or an employee emailing a spreadsheet to the wrong address, exposes you to POPIA enforcement action.

Locked filing cabinet for secure data

Using check results also carries fair-employment risk. South African labor law generally requires that any adverse hiring decision based on a background check be relevant to the specific role, not a blanket disqualification. Declining a candidate for a decade-old, unrelated minor offense when the job has nothing to do with that risk profile can expose an employer to a discrimination claim. The safer practice is tying each check type to a documented, role-specific reason before you ever run it, not after a result comes back and you’re deciding how to justify the decision.

Requestors carry responsibility too. If you’re using a third-party screening provider, verify their accreditation and data-handling practices before you sign a contract, because you can’t outsource your POPIA liability along with the screening task. If a provider mishandles data or overstates its access to criminal records, the reputational and legal fallout still lands on the employer who hired them, not just the vendor.

Reading a Background Check Report and What Comes Next

A background check report is a starting point for a conversation, not an automatic verdict. When a criminal record shows up, look at relevance first: how old is the offense, how does it relate to the role, and has the candidate had opportunity to explain the context. A 15-year-old conviction unrelated to the job function carries very different weight than a recent offense directly tied to the position’s core responsibilities.

Employment verification discrepancies deserve the same nuance. A mismatched job title might reflect an internal promotion nobody bothered to update on paper, while a fabricated employer that doesn’t exist is a different order of problem entirely. Qualification checks that come back as “unable to verify” aren’t automatically damning either. Sometimes it reflects a slow-moving registrar’s office rather than a fabricated credential, so a follow-up call before an outright rejection is worth the extra day.

Once you’ve reviewed the report, document your decision and the reasoning behind it, whether you’re moving forward, requesting clarification, or declining the candidate. That written record protects you if the decision is ever questioned later. If something in the report is genuinely disqualifying, communicate the outcome to the candidate in a way that respects their right to understand and, where applicable, dispute a specific finding. Providers with structured dispute processes make that step considerably easier to manage.

What Actually Matters When You’re Screening a Hire

Employers overthink the exotic checks and underthink the boring ones. Identity verification plus documented consent should be non-negotiable for every hire, full stop, before anything else gets ordered. Criminal and qualification checks belong on top of that foundation, scaled to the actual risk the role carries rather than applied uniformly out of habit or fear.

The bigger blind spot is documentation. Employers who skip the audit trail, who never write down why a specific check was ordered or how a borderline result was weighed, are the ones who get burned when a candidate challenges a rejection months later. The check itself matters less than the paper trail proving you made a fair, role-relevant decision.

— Roel

Expandtosouthafrica: Skip the Compliance Work Screening Doesn’t Cover

Background checks tell you who you’re hiring. They don’t tell you how to legally employ that person once the offer letter is signed, and that’s where most international employers get stuck. Expandtosouthafrica handles the part screening providers don’t touch: BCEA-compliant contracts, ZAR payroll, PAYE filings through EMP201, UIF, SDL, and COIDA, all under POPIA and GDPR data protections.

Expandtosouthafrica

This isn’t a replacement for the AFIS check or the reference call. It’s the operational layer that turns a verified candidate into a legally employed one, without you setting up a South African entity to make it happen. If you’ve already got a screening process sorted and you’re now facing the payroll and compliance side of hiring, look at Expandtosouthafrica’s EOR services to see what the flat monthly fee actually covers, and run your numbers through the employment cost calculator before you extend an offer.

Where to Verify These Processes Directly

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Sources

Government sources and private screening providers serve overlapping but distinct roles, and understanding which does what saves you from ordering the wrong document. SAPS is the authoritative source for Police Clearance Certificates, issued directly by the state for specific personal purposes like visas and foreign employment applications. That process runs on SAPS’s own timeline and requires the candidate’s direct involvement, typically in-person collection.

Private, accredited providers offer AFIS-based criminal checks and broader screening packages, querying SAPS databases through licensed channels rather than issuing government documents themselves. Their advantage is speed and integration: a single provider can bundle criminal, ID, employment, and qualification checks into one workflow, and hosted fingerprint databases let repeat checks return faster than a fresh SAPS application would. Public-record search platforms extend this further by aggregating multiple data sources into one report, which is convenient for high-volume hiring but still relies on the same underlying government records.

The practical rule: use SAPS directly when a specific government or foreign authority requires a PCC, and use an accredited private provider for routine employment screening where speed and bundled convenience matter more than the specific format of the document.