South Africa Tax Reference Number

Detects South African income tax reference numbers (TIN) allocated by the South African Revenue Service (SARS) under section 24 of the Tax Administration Act, 2011. The number is ten digits, may only start with 0, 1, 2, 3 or 9, and its tenth digit is a check digit computed with a modulus-10 (Luhn-style) algorithm documented by SARS.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: ten digits with a five-value leading-digit constraint is a weak structural signal on its own (South African phone numbers are also ten digits starting with 0), so corroborating SARS / tax-reference keywords are required on every tier and the checksum is documented for downstream validators. recommended_confidence is the evidence-gated 75 workhorse tier per registry convention.
Jurisdictions: za
Regulations: POPIA, Tax Administration Act 2011 (South Africa)
Frameworks: ISO 27001, ISO 27701
Data categories: pii, financial
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b[01239]\d{9}\b

Corroborative evidence keywords

tax reference number, income tax, SARS, ID number, identification, ID card, license, permit, registration, certificate

Proximity: 300 characters

Should match

Tax Reference Number = 0001339050 per the SARS assessment (IT34) — SARS-documented example value with label context
income tax reference 0123456789 registered with SARS eFiling — OECD/SARS structure example starting with 0
9123456789 — Ten digits starting with 9 (entity range)
belastingverwysingsnommer: 2001234567 — Afrikaans tax-reference label with number starting 2

Should not match

4123456789 — Tax reference numbers may only start with 0, 1, 2, 3 or 9
512345678 — Nine digits and an invalid leading digit
01234567890 — Eleven digits — too long, not matched inside a longer digit run
0000000000 — Repeated-digit placeholder — passes the SARS modulus-10 check but is suppressed by AllDigitsSameFilter

Known false positives

South African telephone numbers are ten digits beginning with 0 and collide heavily with the bare numeric shape. Mitigation: Every tier requires SARS / tax-reference keywords within the 300-character proximity window; phone-adjacent text rarely carries those terms. The SARS modulus-10 check digit cannot be expressed in regex and is documented in operation for downstream validators.
Bank account, invoice and customer numbers of ten digits starting with a permitted digit. Mitigation: Keyword gating on every tier plus the template-exclusion NOT-group on the high and medium tiers; AllDigitsSameFilter removes repeated-digit test values.