KYC for Fintech in Pakistan (SBP, SECP and NADRA)

Regulatory Framework for KYC in Pakistan

NADRA (National Database and Registration Authority) has given Pakistan one of the most robust biometric identity systems in the world. Pair that national register with a tighter AML/CFT/CPF framework after the country left the FATF grey list, and the market now supports fully functional digital onboarding for fintechs, digital banks and EMIs (Electronic Money Institutions).

Four authorities share the regulatory ecosystem:

• State Bank of Pakistan (SBP): Central bank. Regulates banks, MFBs (Microfinance Banks), EMIs, exchange companies and payment service providers.
• Securities and Exchange Commission of Pakistan (SECP): Regulates brokers, NBFCs, insurers, investment funds and corporations.
• Financial Monitoring Unit (FMU): Financial intelligence unit, receives STRs/CTRs.
• NADRA: National identity authority, manages the biometric register and verification APIs.

Primary Legal Basis

• Anti-Money Laundering Act (AMLA), 2010 and regulations: Section 7A defines the Customer Due Diligence (CDD) obligation.
• AML/CFT/CPF Regulations issued by SBP (revised) and SECP (amended via SRO 669(I)/2026).
• NADRA Ordinance, 2000 and NIC Rules amended in 2025-2026 to recognise multimodal biometrics.
• Virtual Asset Act, 2026: Framework subjecting virtual assets to a reinforced KYC regime.

NADRA and Biometric Verification

Every Pakistani customer must present a CNIC (Computerized National Identity Card) or SNIC (Smart National Identity Card) issued by NADRA. A bank account cannot be opened, and financial services cannot be contracted, without a valid CNIC.

NADRA Verification Methods

Banks and MFBs, as reporting entities, have to verify the customer through one of these mechanisms:

• NADRA Verisys: Direct query against the NADRA database. Validates name, photograph, date of birth and document status.
• Biometric Verification (BV): Biometric check with liveness detection via NADRA terminals or authorised APIs.
• Multi-biometrics (2025-2026): Amendments to the National Identity Card Rules expand the definition of biometrics to legally recognise fingerprint + facial recognition + iris, aligned with NADRA systems. Previously only fingerprint was recognised.

Contactless Facial Verification

Facial recognition now underpins biometric verification certificates that NADRA has issued at all its registration centres since January 2026. That widens the options for people who cannot complete fingerprint verification (elderly, manual workers). Banks may deploy contactless biometric verification through mobile apps, under SBP authorisation, capturing and verifying customer biometrics from home.

SBP KYC Requirements for Fintechs

Mandatory Customer Identification

Entities regulated by SBP must collect:

• Scanned copy or photograph of the valid original CNIC/SNIC issued by NADRA.
• NADRA Verisys or Biometric Verification with liveness.
• Socio-economic data: occupation, source of funds, monthly income.
• Account purpose and expected transactional pattern.
• For foreign residents: valid passport, POC (Pakistan Origin Card) or NICOP where applicable.

Mandatory Risk-Based Approach

An Internal Risk Assessment Report (IRAR) is required from each reporting entity. It identifies and assesses ML/TF/PF risks at:

• Customer level.
• Product level.
• Distribution channel.
• Technology.
• Employees.

Periodic updates are required, and the IRAR must be tailored to the entity's risk profile.

Diligence Levels

• Simplified Due Diligence (SDD): Allowed only for low-risk products explicitly identified by SBP.
• Standard CDD: Applied to most customers.
• Enhanced Due Diligence (EDD): Mandatory for PEPs (domestic and foreign), family members and close associates, high-risk jurisdictions, correspondent banking and complex transactions.

SECP KYC Requirements for Fintechs

Brokers, NBFCs, insurers and funds sit under SECP. Digital onboarding has been tightened through its 2020 AML/CFT/CPF regulations, as amended by SRO 669(I)/2026:

Digital Investor Onboarding

A framework for digital investor onboarding was proposed by SECP (2025-2026) to include:

• Mandatory biometric verification via NADRA.
• Investor IBAN verification to ensure traceability of source of funds.
• Validation of consistency between customer data and the originating bank account.
• AML/CFT screening against international and domestic proscribed lists.

Legal Person Identification

Corporate clients require fintechs to collect:

• Certificate of Incorporation and NTN (National Tax Number).
• Memorandum and Articles of Association.
• Board resolutions authorising account opening and signatories.
• CNIC of each director, significant shareholder and signatory.
• Identification of the Ultimate Beneficial Owner (UBO) with ownership above 25%.
• For listed companies, disclosure under the Companies Act 2017.

Virtual Assets: Virtual Asset Act 2026

Approved by the Senate of Pakistan, the Virtual Asset Act 2026 places Virtual Asset Service Providers (VASPs) under a formal licensing regime and requires:

• Reinforced KYC with mandatory NADRA biometrics.
• Beneficiary identification and source of funds for each transaction.
• Implementation of the FATF Travel Rule for transfers between VASPs.
• Mandatory reporting to FMU.
• Compliance with international sanctions and on-chain transaction monitoring.

Exchanges, custodians and crypto services in Pakistan now have their first legal pathway through this legislation, aligned with MiCA-equivalent standards.

Sanctions Lists and Screening

Screening by reporting entities must cover:

• UNSC Consolidated List (United Nations sanctions).
• Schedule IV of the Anti-Terrorism Act, 1997 (domestic proscribed list).
• NACTA Watch List (National Counter Terrorism Authority).
• OFAC, EU and other international lists as applicable.

Reporting and Recordkeeping

• STRs (Suspicious Transaction Reports) and CTRs (Currency Transaction Reports) are filed with FMU.
• Cash transactions and transfers above regulatory thresholds must be reported.
• Minimum 5-year retention of all KYC and transactional documentation from the end of the relationship.

Sanctions for Non-Compliance

• Significant administrative fines imposed by SBP or SECP.
• Custodial sentences and fines under AMLA 2010.
• Suspension or revocation of licences.
• Inclusion in supervised-entity lists with restrictions.
• Personal liability for directors and the designated CAMLCO.

Opportunities for Fintechs

Among South Asian fintech markets, Pakistan now ranks as one of the most attractive:

• Mature biometric verification: NADRA enables end-to-end remote onboarding with low fraud rates.
• FATF grey-list exit: Restored the country's appeal for investment and cross-border services.
• Full digital banking: SBP issues Digital Bank and Digital Retail Bank licences.
• Formalised crypto market: Virtual Asset Act 2026 paves the way for licensed VASPs.

Fintechs, EMIs, NBFCs and VASPs in Pakistan can use Joinble to connect NADRA Verisys and Biometric Verification. The stack covers digital onboarding with face-match, liveness, CNIC validation, IBAN check and AML/CFT/CPF screening aligned with SBP, SECP and AMLA 2010. Continuous risk grading and IRAR generation are automated by our AI Agents, so friction falls without a sacrifice in compliance.

Frequently Asked Questions

What is NADRA and why is it central to Pakistani KYC?

The National Database and Registration Authority — NADRA — manages the national biometric register and issues the CNIC/SNIC. Verification against NADRA via Verisys or Biometric Verification is required for every financial relationship in Pakistan, which makes this register the cornerstone of the country's KYC system.

What types of biometrics are legally recognised in Pakistan?

Fingerprint, facial recognition and iris are legally recognised after the 2025-2026 amendments to the NIC Rules, all aligned with NADRA systems. Only fingerprint carried legal validity before the reform.

Is 100% remote onboarding possible in Pakistan?

Yes. Contactless biometric verification through mobile apps is authorised by SBP. Facial verification certificates have been issued by NADRA at all its centres since January 2026, so banks and fintechs can finish end-to-end digital onboarding without physical presence.

What does the Virtual Asset Act 2026 cover?

Licensing of VASPs in Pakistan sits inside the framework created by the Virtual Asset Act 2026. Reinforced KYC with NADRA biometrics, UBO identification, the FATF Travel Rule and reporting to FMU are required. Formal regulation of the crypto sector in the country starts with this statute.

What is the difference between SBP and SECP regulations?

Banks, MFBs, EMIs, exchange companies and payments sit with SBP. Brokers, NBFCs, insurers and funds sit with SECP. The AMLA 2010 framework applies to both, yet each issues parallel operational regulations. Licence type decides whether a fintech answers to one authority or the other, or to both in mixed business models.

How does Joinble support Pakistani fintechs?

NADRA Verisys and Biometric Verification are integrated by Joinble, with face-match, liveness, CNIC validation and IBAN check, plus AI-Agent-driven automated risk grading and AML/CFT/CPF screening aligned with SBP, SECP and AMLA 2010, including support for the Virtual Asset Act 2026.