1. Background and context

The Institute for Security Studies (ISS) has monitored and assessed public violence in South Africa since 2013 through its Protest and Public Violence Monitor (PPVM), part of the ISS Crime Hub. This briefing note aims to highlight responses to address the specific crisis generated by the 30 June 2026 deadline set by March and March, an anti-immigrant pressure group led by Ngizwe Mchunu, Nkosikhona (‘Phakelumthakathi’) Ndabandaba, and Jacinta Ngobese-Zuma. The note draws on ISS analytical assessments, the ISS PVM, the HSRC South African Social Attitudes Survey (SASAS) 2025, Afrobarometer Dispatch AD1108 (January 2026), private sector intelligence (Fidelity Business Intelligence, 17 June 2026), Business Against Crime South Africa lead E2-Plus initiative readiness briefings and media reporting from 23 to 26 June 2026.

South Africa stands at a critical junction. The attitudinal backdrop to this crisis is more hostile to migrants than at any point since the democratic transition. HSRC SASAS data show that 42% of South Africans now want no immigrants at all, up from 30% in 2021, while only 15% are willing to welcome all immigrants, down from 34% in 2003. South Africa ranks first among 39 African nations surveyed by Afrobarometer on anti-immigrant attitudes. In KwaZulu-Natal, 60% of adults now reject all immigrants, up from 23% in 2021. These are the conditions under which the 30 June deadline is being activated.

What is the March and March movement?

March and March is an anti-immigrant mobilisation group that has organised marches and community actions across South Africa since 2025. Its leaders have set 30 June 2026 as a self-declared deadline for undocumented foreign nationals to leave the country, threatening community enforcement if the government fails to act. The movement exploits legitimate public grievances about unemployment, crime and service delivery failure. Still, its leaders have been unwilling or unable to prevent armed marchers, forced evictions, and violence against both documented and undocumented migrants, as well as South African citizens from linguistic or ethnic minorities.

Intelligence assessments cited in media reporting indicate that the movement does not operate in isolation. Senior security officials have not ruled out links between March and March and organised criminal networks, including construction mafia operations in KwaZulu-Natal. Multiple intelligence and law enforcement sources allegedly suggest the mobilisation may partly serve as leverage to extort and prevent investigations of a ‘prominent traditional leader’ currently under investigation. Furthermore, some political parties, though officially distancing themselves from violence, have electoral incentives to benefit from the instability this generates ahead of the November 2026 local elections.

2. What is different from the July 2021 unrest

The July 2021 unrest resulted in approximately 354 deaths and R50 billion in economic losses. While that episode is the most frequently invoked comparator, ISS analysis identifies critical structural differences that shape the current risk profile:

Key structural differences

• Target: people, not property. In 2021, the primary targets were malls, warehouses and logistics infrastructure. In 2026, the primary targets are people, specifically migrants and foreign nationals. This makes the violence more intimate, harder to prevent through property protection alone and more likely to produce casualties.
• Organisation and character. 2021 was driven by opportunistic looting following political instigation. 2026 involves organised marches with stated political objectives. However, ISS monitoring confirms that targeting of individuals and businesses is occurring outside the formal march context on its fringes in residential areas, at night and in smaller groups, making it less visible and harder to contain.
• The amabutho dimension. Abahlali baseMjondolo secretary-general, Thapelo Mohapi, has issued a direct warning that amabutho, Zulu male age-regiment groups, have been reactivated and deployed in KwaZulu-Natal. Reports describe armed men systematically driving people from homes, stealing property and seizing businesses in areas including Sherwood, Amawoti and Lindelani. This has structural parallels with the ethnic mobilisation patterns of the late-1980s and early-1990s political conflicts in KZN, a precedent with a very high casualty record.
• Geographic scope. 2021 was concentrated in KZN and Gauteng. The 2026 mobilisation is intended to be nationwide. The first killing associated with the current cycle occurred in Mossel Bay, where a young Tsonga-speaking man was attacked, signalling that violence is not confined to the historically highest-hostility provinces.
• Ethnic expansion risk. Mohapi's warning is that the targeting will expand from migrants to South African ethnic minorities once migrant communities have been driven out. This pattern of scapegoating, beginning with the most marginalised and migrating to domestic minorities, has precedent in multiple African contexts.
• Political landscape. The November 2026 local elections provide an electoral incentive for sustained mobilisation by multiple political actors. The MK Party's presence in KZN complicates the Zulu royal house's countervailing call for restraint.

Factors that reduce risk relative to 2021

• State preparedness is better: the government launched a R600 million security operation, SAPS has pre-positioned resources, and SANDF is on standby. Acting Police Minister Firoz Cachalia and the SAPS Commissioner, on 22 June, both signalled a stronger focus on disarming marchers and on broader public communication that carrying arms to protests is illegal.
• Better coordination with the private sector: the E2 (business-government-security) framework and NatJoints communication channels are established before, rather than after, an outbreak. Private security resources have been activated, including air support, vehicles and personnel to address road blockages, access restrictions and threats to life and property.
• Pre-emptive condemnation has been wider: the Zulu King, COSATU, SAFTU, the ANC, SANTAGO and multiple civil society organisations have publicly condemned violence. The justice, crime prevention and security cluster engaged the Zulu royal family on 22 June to request support in thwarting planned demonstrations.
• Community appetite for looting appears lower than in 2021 in Gauteng and KZN, though vigilante and defensive violence by both anti-migrant groups and migrant communities in affected areas is increasing.

3. Current flashpoints and hotspot assessment

The two-year heat maps of PPVM incidents show clear protest hotspots in the metro areas of South Africa. However, the current patterns reflect that marches will likely spread to towns nationally.

KwaZulu-Natal – Critical

KZN is the primary concern. Fidelity Business Intelligence's June 17 assessment recommended concentrated security deployments across the Durban corridor, hourly situation reports, and contingency planning for key logistics routes. Confirmed incidents have occurred in Sherwood, Umgeni and Kokstad. The most serious recorded incident involved March and March-linked activists arriving at a repatriation processing site for Malawian nationals at Sherwood, Durban, prompting police to deploy stun grenades. More than 10 000 migrants are reported to have sheltered at Sherwood Community Hall in Sydenham after being forced from their homes; 400 refugees were left sleeping in the open on Che Guevara Road after displacement. The amabutho mobilisation reported by Abahlali baseMjondolo is concentrated in KZN residential areas, including Ntuzuma, KwaMashu, Amawoti and Lindelani. The province has recorded the most severe shift in attitudes nationally: KZN hostility to all immigrants rose from 23% to 60% between 2021 and 2025.

Gauteng – High

Gauteng is rated as a moderately high risk, with confirmed mobilisation in Tembisa, the Inner city, Jeppestown and the City Deep market corridor. City Deep represents a critical vulnerability: it is the primary fresh produce hub serving Gauteng, and disruption there carries both food security and supply chain consequences. The Mayfair area has also seen anti-immigrant marches this week (24 June). Gauteng's economic centrality means violence or sustained disruption there generates nationwide economic consequences disproportionate to the local casualty count.

Rest of South Africa – Moderate, with significant exceptions

The Western Cape is rated moderate, with confirmed anti-immigrant activity in Khayelitsha. The Northern Cape, North West, Eastern Cape and Free State are rated low to moderate, but the Mossel Bay killing establishes that violence can occur in unexpected locations.

March and March has confirmed nationwide march plans for 30 June. The ISS PPVM shows that approximately 75% of localities currently experiencing elevated public violence tension exhibit a historical pattern consistent with prior outbreaks; i.e., current events are largely predictable from prior incident data.

4. The criminal justice and political economy dimension

ISS analysis, consistent with intelligence assessments reported in the media, indicates that this crisis cannot be read purely as spontaneous social movement activity. Three interrelated dynamics complicate a straightforward crowd-management response:

Organised crime and extortion links

Multiple intelligence and law enforcement sources, reported by News24 on 25 June 2026, indicate that investigators have spent months examining the role of a KwaZulu-Natal traditional leader linked to construction mafia networks in the financing and strategic direction of March and March. Intelligence officials believe anti-foreigner mobilisation is being used as leverage to protect extortion interests, creating instability that can be traded against exposure to prosecution. If accurate, this means that political negotiation or concession on immigration enforcement is unlikely to de-escalate the underlying threat, since the objective of key actors is not immigration policy change but protection of criminal networks.

Network overlap with July 2021

Security officials are monitoring mobilisation networks that overlap significantly with those activated during the July 2021 unrest and with Zuma-era amabutho structures in KZN. Public figures, including Ngizwe Mchunu and Phakelumthakathi Ndabandaba, have demonstrated the capacity to mobilise along ethnic lines and project the imagery of Zulu warriors. The concern, according to security sources, is that chaos is itself an objective for some actors in this network. This means that chaos may not be a by-product of failed crowd management.

MK Party and electoral dynamics

The November 2026 local elections create an incentive structure in which instability and public anger serve the electoral interests of parties that have positioned themselves as the authentic voice of anti-elite, anti-establishment sentiment. The MK Party has formally condemned tribalism but has every organisational incentive to benefit from the disruption. These dynamics, in which violence serves multiple simultaneous purposes for different actors, mirror the July 2021 situation, which was difficult to contain and even harder to prosecute effectively afterwards.

5. Immediate action recommendations

The following recommendations are oriented to the pre-event window available before 30 June. They are structured by time horizon and are not intended to imply these steps are not already being taken; they are intended to assist in assessing where action is most urgent.

A. Communication and information (now – 30 June)

B. Operational and law enforcement (now – 30 June)

C. Constitutional and humanitarian obligations (ongoing)

6. Medium-term measures (July – November 2026)

Experience from July 2021 shows that the period following an immediate crisis is critical. The following actions are essential to prevent the November 2026 local elections from providing a second mobilisation window:

• Prosecutorial follow-through. A dedicated team of experienced detectives and prosecutors must be assigned to cases arising from the current episode. As cases are concluded, outcomes and sentences must be publicised. The message must go out clearly that instigating or participating in xenophobic violence carries criminal consequences. This was the critical failure after 2021.
• Comprehensive operational review. A dedicated, independent expert review of the state's response (potentially mirroring the Panel of Experts on Policing and Crowd Management) should be commissioned by mid-July. It should assess which early warning signals were available and whether they were acted on, where the operational response succeeded and where it failed; and what specific changes to training, guidelines and inter-agency coordination are required.
• Organised crime investigation. Intelligence and law enforcement investigations into the alleged links between March and March, construction mafia networks and KZN traditional authority structures must be pursued with full prosecutorial intent. If the extortion-leverage hypothesis is accurate, disrupting those networks is the most effective de-escalation tool available for the November election period.
• Structural community interventions. ISS PPVM data confirm that approximately 75% of current flashpoints have a documented history of violent protest and high crime. These areas require sustained, multi-sectoral investment: rebuilding community-police relations, trauma services, food security support, and early warning systems developed with community participation. This is a longer-term agenda, but the medium-term window before the November elections is the critical entry point.
• Political accountability. The November 2026 local elections will test whether anti-immigrant mobilisation translates into electoral gain. Political parties that have explicitly or implicitly benefited from the mobilisation should face sustained public accountability through media, civil society and formal accountability institutions for the role their networks have played in the current crisis.

7. Structural and longer-term imperatives

As in July 2021, the immediate crisis cannot be understood in isolation from underlying structural conditions that have worsened substantially since then:

• South Africa's national unemployment stands at 32.7% (Q1 2026), with youth unemployment at 44.8%. These figures are the structural feedstock for anti-immigrant mobilisation in poor communities.
• More than half of South Africans describe their living conditions as bad. Six in ten went without clean water in the past year; more than half experienced food shortages. Service delivery failure creates the conditions for zero-sum attribution of scarcity to the migrant 'other'.
• Democratic disillusionment is deep: only half of South Africans prefer democracy to any other form of government, and seven in ten are dissatisfied with how democracy functions. The GNU's post-election optimism surge (right-direction sentiment rising from 14% to 39% in 2024) is real but fragile. Sustained violence will erode it.

ISS identifies policing, violence prevention, and criminal justice as core work areas, namely rebuilding SAPS capacity, expanding evidence-based policing, restoring institutional trust, and strengthening the prosecution of financial and organised crime. The current crisis makes the case for that agenda with particular urgency.