Loading...

Banking & Payments — Complete IT Company Guide

Foreign exchange, Roshan Digital Account, SBP regulations, PRC & export proceeds

Share:
Share:

Key Data & Rates

Banking Regulations for IT Companies
Verified May 3, 2026
RequirementDetailsLegal BasisReference
Export Proceeds RepatriationMust be received through banking channels within 180 daysSBP FECL 05/2026SBP SBP FECL 05/2026
IT Export Remittance WHT (PSEB)0.25%ITO 2001 Section 154FBR ITO 2001, Section 154
IT Export Remittance WHT (non-PSEB)1%ITO 2001 Section 153FBR ITO 2001, Section 153
Foreign Currency AccountIT companies can maintain FCAsSBP BPRD CircularSBP BPRD SBP BPRD
Roshan Digital AccountNon-resident Pakistanis for IT export paymentsSBP RDA FrameworkRDA RDA
PRC (Proceeds Realization Certificate)Required for every export remittanceSBP GuidelinesSBP SBP
Cyber Security FrameworkBanks must implement SBP Cyber ShieldBPRD C4/2024SBP BPRD BPRD C4/2024
Share:
Share:
Share:

IT Export Payment Workflow

How to receive and process IT export payments in Pakistan

Step 1
Open Corporate Bank Account
Share:

Open a PKR or foreign currency account at a scheduled bank.

Step 2
Obtain PRC
Share:

Get Proceeds Realization Certificate from bank for each remittance.

Step 3
Repatriate Within 180 Days
Share:

Confirm 0.25% (PSEB) or 1% WHT deducted on remittance per ITO 2001 Section 154A.

Step 4
Verify WHT Deduction
Share:

Confirm 0.25% (PSEB) or 1% WHT deducted on remittance per ITO 2001 Section 154A.

Step 5
Consider RDA (Non-Residents)
Share:

Non-resident Pakistanis can use Roshan Digital Account for receiving IT export payments.

Step 6
Maintain Records
Share:

Keep all remittance records, PRCs, and tax certificates for audit.

Details & Regulations

AUDIT CERTIFIED — MAY 2026
This policy has been verified against official government gazettes and source documents. View Audit Log
100% Verified
Banking & Payments — Complete IT Company Guide
Foreign exchange, Roshan Digital Accounts, SBP regulations, payment processing, and digital banking for Pakistan IT companies.

Key Banking Regulations for IT CompaniesSOURCE VERIFIED

RequirementDetailsLegal BasisReference
Export Proceeds RepatriationMust be received through banking channels within 180 daysFECL 05/2026SBP FECL 05/2026
IT Export Remittance WHT0.25% (PSEB-registered) / 1% (non-PSEB) (Federal/ICT)ITO 2001 §154AITO 2001
Foreign Currency AccountIT companies can maintain FCAs for export proceedsSBP BPRD CircularSBP BPRD
Roshan Digital AccountNon-resident Pakistanis can open RDA for IT export paymentsSBP RDA FrameworkRDA
PRC (Proceeds Realization Certificate)Required for every export remittance receivedSBP GuidelinesSBP ePRC Portal
Crypto PaymentsNOT recognized for export proceeds — only SWIFT/banking channelsSBP FECLSBP
50% FCY RetentionIT exporters can retain 50% of export proceeds in FCY accountBOI Investment Policy 2023BOI

Payment Processing OptionsSOURCE VERIFIED

For IT Exporters:
  • Bank Wire Transfer — Standard TT/SWIFT through corporate account (most common for B2B)
  • Roshan Digital Account — For non-resident Pakistanis; 1% better exchange rate RDA
  • PayPal / Stripe — Via intermediary (not directly available in Pakistan)
  • RaastSBP instant payment system for domestic transactions Raast
  • WeBOC — Customs processing for IT hardware imports WeBOC — Customs Declaration
Important: Crypto payments do NOT qualify for 0.25% WHT under Section 154A ITO 2001. All export proceeds must come through official banking channels (SWIFT).

FE Forms & DocumentationSOURCE VERIFIED

FormPurposeWhen Required
Form MImport declarationWhen importing IT equipment
ePRCExport proceeds realization certificateFor every export remittance
SBP DeclarationIT service export declarationWith each remittance
WeBOC GDGoods declarationOnly for hardware imports (not software exports)
FBR Withholding StatementMonthly tax deduction reportMonthly (Section 165 ITO 2001)

SBP Payment SystemsSOURCE VERIFIED

Raast — Instant Payment SystemSOURCE VERIFIED

Raast is Pakistan's instant payment system enabling real-time digital payments. Key features:

  • Instant fund transfers between banks (24/7/365)
  • No transaction fees for person-to-person (P2P) payments
  • Person-to-merchant (P2M) payments for business transactions
  • QR code-based payments for easy invoicing
  • API integration available for business platforms

Raast Website →

SBP Refinance Schemes for ITSOURCE VERIFIED

SchemeRateEligibilityMax Amount
LTFF (Long-Term Financing Facility)6-month KIBOR + 2% (as of April 2026)IT exporters with PSEB reg.PKR 400M
EFS (Export Finance Scheme)SBP refinance rate + 1.5%All exportersBased on export value
PM Kamyab Jawan3-5% (tier-based)Startups & SMEsPKR 5M

SBP Digital & Cybersecurity Regulations (2022-2026)SOURCE VERIFIED

ReferenceTitleYearKey Points for IT Companies
CRMD CL01/2026Cyber Shield — Cyber Resilience Strategy 2025-20302026Mandatory cyber resilience program; IT vendors to banks must align with roadmap
BPRD C1/2026Teenager Account/Wallet Framework2026Digital wallet for 13-17 year olds; guardian oversight required
PSD C4/2025Technology Risk Management Framework2025Compliance deadline: March 2026. Board oversight, VAPT, device fingerprinting, 30-min fraud SLA
BPRD C1/2025Consolidated Customer Onboarding Framework2025Digital KYC/CDD, e-Sign, biometric verification, mandated TAT
PSD C2/2023No Digital Services to Unauthorized Lending Apps2023Banks/EMIs must not provide services to unlicensed lending apps
PSD C1/2023Guidelines for Downtime of Digital Channels202399.5% uptime SLA; 2-day advance notice for planned; 30-min reporting for unplanned
PSD CL6/2022Mobile Applications Security Guidelines2022Secure coding, VAPT before launch, certificate pinning, runtime integrity

Digital Retail Banks (DRBs)SOURCE VERIFIED

SBP has created a Digital Retail Bank (DRB) category — fully digital banks with no physical branches. Three licenses issued:

BankYearTypeSignificance
Easypaisa Bank (SBP DRB licenses, as of April 2026)2025Conventional DRBFirst DRB license — largest mobile wallet operator in Pakistan
Mashreq Bank Pakistan (SBP DRB licenses, as of April 2026)2025Conventional DRBInternational bank entering Pakistan as digital-only
Raqami Islamic Digital Bank (SBP DRB licenses, as of April 2026)2026Islamic DRBFirst Islamic digital bank — Shariah-compliant digital banking
IT opportunity: DRBs need full digital infrastructure — core banking, mobile apps, cybersecurity, cloud, AI/ML. All operations are technology-driven. DRBs must comply with Cyber Shield, Tech Risk Framework, and all SBP digital regulations.

Electronic Money Institutions (EMIs)SOURCE VERIFIED

As of January 2026, SBP authorizes 6 EMIs for commercial operations and 4 in pilot:

EMIAppStatusProducts
NayaPayNayaPayCommercialConsumer/Merchant Wallets, Agent, Gateway, Acquiring
FinjaOPayCommercialConsumer/Merchant Wallets, Agent, Gateway
SadaPaySadaPayCommercialConsumer Wallets
Akhtar FuiouDigitt+CommercialConsumer Wallets
E-ProcessingOneZappCommercialConsumer Wallets
WemsolKeenuCommercialConsumer Wallets
Pilot: HubPay, YAP Pakistan, Cerisma, Toko Lab
Revoked: TAG Innovation, Careem Payment Solutions, Checkout, CMPECC

Penalties for Non-ComplianceSOURCE VERIFIED

ViolationPenaltyReference
Late export repatriation (>180 days)Penalties under FERA 1947 — up to 5x the amount involved plus continuing penalty of PKR 2,000/day; for SBP administrative action under Section 23K, penalties up to PKR 500,000 per contravention plus PKR 10,000/day continuing (FERA 1947, Sections 23B(4) & 23K). Potential blacklisting by SBP.SBP FE Manual Ch.12; FERA 1947
Using hawala/crypto for exportPenalties under FERA and PMLASBP/AML regulations
No ePRC filingAccount freeze; SBP restricts forex transactionsSBP ePRC
AML/CFT violationsFines up to PKR 10M (Federal) + criminal prosecution (per AMLA 2015 §16)AMLA 2015
False declarationCriminal penalties under Foreign Exchange Regulation ActFERA

Key Banking Statistics (April 2026)SOURCE VERIFIED

MetricValueSource
SBP Policy Rate10.50% (as of April 2026)SBP
KIBOR 12M11.51% (as of April 2026)SBP
Foreign Reserves$21.79B (SBP $16.38B + Banks $5.41B)SBP
PKR/USD~279.10SBP
Adult Bank Account Ownership67%SBP
Teen Population (13-18)26 millionSBP

Digital Fraud Liability Rules (PSD C4/2025)SOURCE VERIFIED

Per PSD C4/2025, SBP has established strict 30-minute SLAs and clear liability for digital financial fraud: (Federal (SBP))

ScenarioLiabilitySLA
Customer reports fraud; dispute not lodged by PIOriginating PI liable for all customer lossesWithin 30 minutes of complaint
Complaint channel unavailableOriginating PI fully liableN/A — continuous availability required
Beneficiary PI fails to block disputed fundsBeneficiary PI liable for all customer lossWithin 30 minutes of receiving dispute from sender PI
False registration due to absent/improper controlsResponsible PI bears full liabilityN/A
PI cannot establish transaction from registered devicePI must compensate customerUpon claim verification
Delayed transaction alertsPI fully liable for resulting lossesImmediate notification required

Fraud Prevention Requirements for IT Companies Building FintechSOURCE VERIFIED

  • NADRA biometric at signup, new device registration, and credential changes
  • Device fingerprinting/binding using Device ID, UUID, ICCID, IMEI, or IMSI
  • 2-hour cool-off period after switching devices
  • OTP auto-fetch with sender binding to prevent phishing — or alternate MFA
  • Default transaction limits with customer-controlled adjustments post authentication
  • Limit on devices per account and accounts per device
  • Credential reset only after MFA via registered device

Payment Card & Internet Banking Security RegulationsSOURCE VERIFIED

RegulationKey IT-Relevant RequirementsReference
Payment Card Security (PSD C5/2016)Card Security Framework (risk assessment + controls + monitoring); EMV compliance; data breach notification within 48 hours; customer compensation within 2 business days for breach-related losses; fraud resolution managementPSD C5/2016 (Federal (SBP))
Internet Banking Security (PSD C3/2015)Security Framework (risk assessment + controls + monitoring); two-factor authentication; IDS/IPS required; least privilege principle; anti-phishing; data breach response procedures; annual independent security reviewPSD C3/2015 (Federal (SBP))
Security of Digital Payments (PSD C9/2018)Independent 3rd-party VAPT of all digital channels; free SMS+email transaction alerts; biometric verification for internet banking activation; card on/off controls for online/cross-border; security patches ASAP; data breach compensation within 2 business daysPSD C9/2018 (Federal (SBP))
EFT RegulationsConsumer protection; originator AFI liable for unauthorized transfers; 45-day error resolution; compensation for EFT errors; audit trail and record retentionPS&EFT Act 2007 (Federal (SBP))

Raast P2M Subsidy & Merchant EnablementSOURCE VERIFIED

Per PSD C3/2025, SBP allocated PKR 3.5 billion for Raast P2M QR subsidy: (Federal (SBP))

  • Subsidy: 0.5% of transaction value or PKR 100/txn (whichever lower), split equally MSP/CSP
  • Period: September 1, 2025 – June 30, 2026
  • Quarterly claims via Raast.Itoc@sbp.org.pk within 5 working days

Digital Merchant OnboardingSOURCE VERIFIED

SBP’s digital merchant onboarding rules enable simplified, fast-track onboarding: (Federal (SBP))

  • Simplified CDD: CNIC + business name + mobile + email + nature of goods
  • Monthly credit limit up to PKR 200,000; max balance PKR 100,000
  • Account activation within 24 hours
  • No cross-border, no crypto, no financial intermediation

EMI Wallet LimitsSOURCE VERIFIED

Wallet TypeMonthly CreditMax BalanceVerification
Basic E-Money WalletPKR 40,000PKR 20,000CNIC-only
Enhanced E-Money WalletPKR 400,000PKR 200,000Biometric + full CDD
Basic Minor Wallet (under 18)PKR 37,000PKR 10,000Guardian CNIC + minor B-Form
Enhanced Minor Wallet (under 18)PKR 100,000PKR 50,000Biometric of guardian + full CDD

SBP PRISM & RTGS ModernizationSOURCE VERIFIED

  • Government security auctions migrated from Bloomberg to PRISM+
  • OMO bids submitted via PRISM+ with auto haircut calculations
  • RTGS direct membership available for Islamic Banking branches
  • NCCPL designated as special PRISM participant

Related PoliciesSOURCE VERIFIED

Payment Clearing & Settlement Infrastructure (Newly Added)
Clearing & RTGS Operations
  • Guidelines for Clearing Operations — Same-day, overnight, and intercity clearing batch processing rules that IT/payment system operators must integrate with. Covers cut-off times, settlement batch descriptions, and operational procedures for clearing interfaces.
  • 1Link Switch Clearing through RTGS — Defines clearing frequency for ATM, IBFT, POS & BPS transactions. IT companies integrating with 1Link must follow these batch settlement protocols and cut-off schedules.
  • NCCPL Settlement through PRISM — Multilateral net settlement through PRISM for capital markets clearing. Twice-daily settlement batches with penal action for non-settlement within 15 minutes.
  • RTGS for Islamic Banking Branches — Requirements for IBBs to set up PRISM/RTGS connectivity: separate CPU, DR site/BCP, network lines, and funding arrangements through Islamic modes.
PRISM+ Enhancements (2025)
  • DMMD PRISM+ OMO Annex (2025) — OMO notices now published on Refinitiv, Bloomberg, and PRISM+. Updated bidding and allotment processes for banks integrating with SBP platforms.
ATM & Mobile Banking Operations
  • ATM Standardisation (2006) — Foundational SBP rules for ATM interoperability and network operations.
  • Draft White Label ATM Guidelines — Allows PSPs to own/operate White Label ATMs. Covers permissible services, operational readiness, cash management, settlement, pricing, and dispute resolution.
  • Mobile Banking Guidelines for MF Banks — Operational and security guidelines for MFBs conducting mobile banking. Covers service centers, client identification, security protocols.
Digital Transaction Mandates (2025)
  • PSD CL1/2025 — Enhancing Digitization — Banks must increase digital transaction volumes by up to 25% by 2028, mandate digital onboarding, QR acceptance, fraud controls, and real-time notifications. Directly impacts IT solution providers.
  • Mandatory Card Acceptance MCC Codes — MCCs for government, education, fuel, hospital, and utility merchants. POS/payment gateway systems must be configured for mandatory acceptance.
  • Customer Notifications via Mobile — Free real-time SMS and push alerts required for all digital payment transactions.
Key SBP Regulatory Documents — Full Text PDFs

For detailed compliance work, the complete text of these critical SBP regulations is available:

  • Regulations for Electronic Money Institutions (Revised June 2023) — Complete EMI licensing framework including capital requirements (PKR 50M paid-up), governance, fit & proper test, wallet limits, cross-border rules, and revocation procedures. Essential reading for any IT/fintech company seeking an EMI license.
  • Regulations for the Security of Internet Banking — Mandates internet banking security framework with risk assessment, 2FA, IDS/IPS, outsourcing security controls, customer awareness programs, breach reporting within 48 hours, and annual independent security review. All IT companies building banking platforms must comply.
  • Mobile Applications (Apps) Security Guidelines — Comprehensive mobile app security requirements covering secure architecture, device binding, payment data protection, tampering detection, secure coding, certificate pinning, and runtime integrity checks. Compliance deadline: December 31, 2022. Mandatory for fintech app developers.
  • Rules for Payment System Operators and Payment Service Providers — PSO/PSP licensing framework covering fit & proper criteria, capital requirements, permissible activities, outsourcing, governance, and operational standards. Required reading for IT companies entering the payments space.
Additional Banking Infrastructure Sources from PDF Archive
  • PRISM Operating Rules 2018 (Version 2.0) — National RTGS operating rules covering participant categories, settlement account requirements, transaction types, business sessions, queue management, intraday liquidity facility, and dispute resolution. Essential for IT systems interfacing with high-value payment settlement.
  • Raast P2M Payment Acceptance Rules — Merchant QR payment acceptance framework via Raast instant payment system.
  • Authorized EMI List (January 2026) — Current SBP-licensed EMI roster: NayaPay, Finja/OPay, SadaPay, Digitt+, OneZapp, Keenu (commercial); HubPay, YAP, Cerisma, Toko Lab (pilot).
  • DFS Innovation Challenge Facility (2019)SBP challenge fund for fintech innovation in digital financial services and branchless banking.
  • Regulatory Approval System (RAS) User ManualSBP online portal for PSO/PSP/EMI license submissions, status tracking, and compliance documentation.
  • White Label ATM Operator Guidelines — Licensing, operations, and compliance framework for PSP-owned ATM networks.
Banking & Payments Compliance Checklist
SBP FECL 05/2026
Share:
SBP Guidelines
Share:
ITO 2001 Section 154
Share:
SBP BPRD Circular
Share:
BPRD C4/2024
Share:
ITO 2001 Section 165
Share:
Checkboxes are saved in your browser
Source Citations (63)
https://download1.fbr.gov.pk/Docs/2024751675120641IncomeTaxOrdinance,2001-amended-upto30.06.2024.pdf
pk_only 2001 law
PSD C4/2025 — Technology Risk Management Framework for Payment Institutions
https://www.sbp.org.pk/psd/2025/C4.htm
verified circular
PSD C3/2023 — Regulations for Electronic Money Institutions
https://www.sbp.org.pk/psd/2023/C3.htm
verified circular
PSD C3/2018 — Electronic Fund Transfers (EFT) Regulations
https://www.sbp.org.pk/psd/2018/C3.htm
verified circular
PSD C3/2015 — Regulations for Security of Internet Banking
https://www.sbp.org.pk/psd/2015/C3.htm
verified 2015 circular
PSD C5/2016 — Regulations for Payment Card Security
https://www.sbp.org.pk/psd/2016/C5.htm
verified 2016 circular
PSD C4/2023 — Launch of Raast Person-to-Merchant (P2M)
https://www.sbp.org.pk/psd/2023/C4.htm
verified circular
PSD C1/2025Raast Participation Criteria
https://www.sbp.org.pk/psd/2025/C1.htm
verified circular
PSD C8/2018 — Rules for Payment System Operators and PSPs
https://www.sbp.org.pk/psd/2018/C8.htm
verified circular
PSD C1/2024 — Customer Notifications for Digital Payments
https://www.sbp.org.pk/psd/2024/C1.htm
verified circular
BPRD C1/2025 — Consolidated Customer Onboarding Framework
https://www.sbp.org.pk/bprd/2025/C1.htm
verified circular
BPRD C1/2026 — Teenager Account/Wallet Framework
https://www.sbp.org.pk/bprd/2026/C1.htm
verified circular
PSD C4/2025 — Technology Risk Management Framework for Payment Institutions
https://www.sbp.org.pk/psd/2025/C4.htm
verified 2025 circular
PSD C5/2016 — Regulations for Payment Card Security
https://www.sbp.org.pk/psd/2016/C5.htm
verified 2016 circular
PSD C3/2015 — Regulations for Security of Internet Banking
https://www.sbp.org.pk/psd/2015/C3.htm
verified 2015 circular
PSD C9/2018 — Security of Digital Payments
https://www.sbp.org.pk/psd/2018/C9.htm
verified 2018 circular
Raast Person-to-Merchant (P2M) Payment Acceptance Rules
https://www.sbp.org.pk/laws/prt_bprd.asp
restricted 2024 pdf
https://www.sbp.org.pk/laws/prt_bprd.asp
restricted 2021 circular
Related Topics
Share:
Share:
Share: