Loading...
Foreign exchange, Roshan Digital Account, SBP regulations, PRC & export proceeds
| Requirement | Details | Legal Basis | Reference | |
|---|---|---|---|---|
| Export Proceeds Repatriation | Must be received through banking channels within 180 days | SBP FECL 05/2026 | SBP | |
| IT Export Remittance WHT (PSEB) | 0.25% | ITO 2001 Section 154 | FBR | |
| IT Export Remittance WHT (non-PSEB) | 1% | ITO 2001 Section 153 | FBR | |
| Foreign Currency Account | IT companies can maintain FCAs | SBP BPRD Circular | SBP BPRD | |
| Roshan Digital Account | Non-resident Pakistanis for IT export payments | SBP RDA Framework | RDA | |
| PRC (Proceeds Realization Certificate) | Required for every export remittance | SBP Guidelines | SBP | |
| Cyber Security Framework | Banks must implement SBP Cyber Shield | BPRD C4/2024 | SBP BPRD |
How to receive and process IT export payments in Pakistan
Confirm 0.25% (PSEB) or 1% WHT deducted on remittance per ITO 2001 Section 154A.
Confirm 0.25% (PSEB) or 1% WHT deducted on remittance per ITO 2001 Section 154A.
Non-resident Pakistanis can use Roshan Digital Account for receiving IT export payments.
| Requirement | Details | Legal Basis | Reference |
|---|---|---|---|
| Export Proceeds Repatriation | Must be received through banking channels within 180 days | FECL 05/2026 | SBP FECL 05/2026 |
| IT Export Remittance WHT | 0.25% (PSEB-registered) / 1% (non-PSEB) (Federal/ICT) | ITO 2001 §154A | ITO 2001 |
| Foreign Currency Account | IT companies can maintain FCAs for export proceeds | SBP BPRD Circular | SBP BPRD |
| Roshan Digital Account | Non-resident Pakistanis can open RDA for IT export payments | SBP RDA Framework | RDA |
| PRC (Proceeds Realization Certificate) | Required for every export remittance received | SBP Guidelines | SBP ePRC Portal |
| Crypto Payments | NOT recognized for export proceeds — only SWIFT/banking channels | SBP FECL | SBP |
| 50% FCY Retention | IT exporters can retain 50% of export proceeds in FCY account | BOI Investment Policy 2023 | BOI |
| Form | Purpose | When Required |
|---|---|---|
| Form M | Import declaration | When importing IT equipment |
| ePRC | Export proceeds realization certificate | For every export remittance |
| SBP Declaration | IT service export declaration | With each remittance |
| WeBOC GD | Goods declaration | Only for hardware imports (not software exports) |
| FBR Withholding Statement | Monthly tax deduction report | Monthly (Section 165 ITO 2001) |
Raast is Pakistan's instant payment system enabling real-time digital payments. Key features:
| Reference | Title | Year | Key Points for IT Companies |
|---|---|---|---|
| CRMD CL01/2026 | Cyber Shield — Cyber Resilience Strategy 2025-2030 | 2026 | Mandatory cyber resilience program; IT vendors to banks must align with roadmap |
| BPRD C1/2026 | Teenager Account/Wallet Framework | 2026 | Digital wallet for 13-17 year olds; guardian oversight required |
| PSD C4/2025 | Technology Risk Management Framework | 2025 | Compliance deadline: March 2026. Board oversight, VAPT, device fingerprinting, 30-min fraud SLA |
| BPRD C1/2025 | Consolidated Customer Onboarding Framework | 2025 | Digital KYC/CDD, e-Sign, biometric verification, mandated TAT |
| PSD C2/2023 | No Digital Services to Unauthorized Lending Apps | 2023 | Banks/EMIs must not provide services to unlicensed lending apps |
| PSD C1/2023 | Guidelines for Downtime of Digital Channels | 2023 | 99.5% uptime SLA; 2-day advance notice for planned; 30-min reporting for unplanned |
| PSD CL6/2022 | Mobile Applications Security Guidelines | 2022 | Secure coding, VAPT before launch, certificate pinning, runtime integrity |
SBP has created a Digital Retail Bank (DRB) category — fully digital banks with no physical branches. Three licenses issued:
| Bank | Year | Type | Significance |
|---|---|---|---|
| Easypaisa Bank (SBP DRB licenses, as of April 2026) | 2025 | Conventional DRB | First DRB license — largest mobile wallet operator in Pakistan |
| Mashreq Bank Pakistan (SBP DRB licenses, as of April 2026) | 2025 | Conventional DRB | International bank entering Pakistan as digital-only |
| Raqami Islamic Digital Bank (SBP DRB licenses, as of April 2026) | 2026 | Islamic DRB | First Islamic digital bank — Shariah-compliant digital banking |
As of January 2026, SBP authorizes 6 EMIs for commercial operations and 4 in pilot:
| EMI | App | Status | Products |
|---|---|---|---|
| NayaPay | NayaPay | Commercial | Consumer/Merchant Wallets, Agent, Gateway, Acquiring |
| Finja | OPay | Commercial | Consumer/Merchant Wallets, Agent, Gateway |
| SadaPay | SadaPay | Commercial | Consumer Wallets |
| Akhtar Fuiou | Digitt+ | Commercial | Consumer Wallets |
| E-Processing | OneZapp | Commercial | Consumer Wallets |
| Wemsol | Keenu | Commercial | Consumer Wallets |
| Pilot: HubPay, YAP Pakistan, Cerisma, Toko Lab | |||
| Revoked: TAG Innovation, Careem Payment Solutions, Checkout, CMPECC | |||
| Violation | Penalty | Reference |
|---|---|---|
| Late export repatriation (>180 days) | Penalties under FERA 1947 — up to 5x the amount involved plus continuing penalty of PKR 2,000/day; for SBP administrative action under Section 23K, penalties up to PKR 500,000 per contravention plus PKR 10,000/day continuing (FERA 1947, Sections 23B(4) & 23K). Potential blacklisting by SBP. | SBP FE Manual Ch.12; FERA 1947 |
| Using hawala/crypto for export | Penalties under FERA and PMLA | SBP/AML regulations |
| No ePRC filing | Account freeze; SBP restricts forex transactions | SBP ePRC |
| AML/CFT violations | Fines up to PKR 10M (Federal) + criminal prosecution (per AMLA 2015 §16) | AMLA 2015 |
| False declaration | Criminal penalties under Foreign Exchange Regulation Act | FERA |
Per PSD C4/2025, SBP has established strict 30-minute SLAs and clear liability for digital financial fraud: (Federal (SBP))
| Scenario | Liability | SLA |
|---|---|---|
| Customer reports fraud; dispute not lodged by PI | Originating PI liable for all customer losses | Within 30 minutes of complaint |
| Complaint channel unavailable | Originating PI fully liable | N/A — continuous availability required |
| Beneficiary PI fails to block disputed funds | Beneficiary PI liable for all customer loss | Within 30 minutes of receiving dispute from sender PI |
| False registration due to absent/improper controls | Responsible PI bears full liability | N/A |
| PI cannot establish transaction from registered device | PI must compensate customer | Upon claim verification |
| Delayed transaction alerts | PI fully liable for resulting losses | Immediate notification required |
| Regulation | Key IT-Relevant Requirements | Reference |
|---|---|---|
| Payment Card Security (PSD C5/2016) | Card Security Framework (risk assessment + controls + monitoring); EMV compliance; data breach notification within 48 hours; customer compensation within 2 business days for breach-related losses; fraud resolution management | PSD C5/2016 (Federal (SBP)) |
| Internet Banking Security (PSD C3/2015) | Security Framework (risk assessment + controls + monitoring); two-factor authentication; IDS/IPS required; least privilege principle; anti-phishing; data breach response procedures; annual independent security review | PSD C3/2015 (Federal (SBP)) |
| Security of Digital Payments (PSD C9/2018) | Independent 3rd-party VAPT of all digital channels; free SMS+email transaction alerts; biometric verification for internet banking activation; card on/off controls for online/cross-border; security patches ASAP; data breach compensation within 2 business days | PSD C9/2018 (Federal (SBP)) |
| EFT Regulations | Consumer protection; originator AFI liable for unauthorized transfers; 45-day error resolution; compensation for EFT errors; audit trail and record retention | PS&EFT Act 2007 (Federal (SBP)) |
Per PSD C3/2025, SBP allocated PKR 3.5 billion for Raast P2M QR subsidy: (Federal (SBP))
SBP’s digital merchant onboarding rules enable simplified, fast-track onboarding: (Federal (SBP))
| Wallet Type | Monthly Credit | Max Balance | Verification |
|---|---|---|---|
| Basic E-Money Wallet | PKR 40,000 | PKR 20,000 | CNIC-only |
| Enhanced E-Money Wallet | PKR 400,000 | PKR 200,000 | Biometric + full CDD |
| Basic Minor Wallet (under 18) | PKR 37,000 | PKR 10,000 | Guardian CNIC + minor B-Form |
| Enhanced Minor Wallet (under 18) | PKR 100,000 | PKR 50,000 | Biometric of guardian + full CDD |
For detailed compliance work, the complete text of these critical SBP regulations is available: