Fintech & Digital Payments
From SECP incorporation through SBP licensing and live integration with banks, EMIs and mobile wallets — the regulatory path a Pakistani fintech actually has to walk.
Fintech & Payments overview
A fintech operating in Pakistan sits under more than one regulator at once. Company incorporation runs through SECP under the Companies Act, 2017 — the same starting point as any other business. But the moment the product touches money movement, a second regulator takes over: the State Bank of Pakistan, acting under the Payment Systems and Electronic Fund Transfers Act, 2007, which is the foundational statute behind every e-money, wallet, and payment-switching framework in the country. Which SBP framework applies, and which existing platforms a fintech needs to integrate with, depends entirely on the business model — and getting that classification wrong at the start is the single most common reason a fintech’s licensing timeline runs long.
SECP Incorporation & Structuring
Entity structure, capital, and shareholding set up correctly from the start — a fintech’s structure has to satisfy SBP’s fitness and propriety review later, not just SECP’s incorporation requirements now.
SBP Licensing (EMI / PSO / PSP)
Applying for the correct licence category with SBP’s Payment Systems Department, through In-Principle Approval, pilot, and final authorisation.
Bank & Wallet Integration
Commercial and technical integration agreements with JazzCash, Easypaisa, NayaPay, SadaPay, and the sponsor banks behind them.
Which regulatory route actually applies
“Fintech” covers several genuinely different licensing paths in Pakistan — the right one depends on whether the company issues its own e-money, or simply integrates with platforms that already do.
Become a Licensed EMI — the NayaPay / SadaPay Model
An Electronic Money Institution issues its own e-money, holds customer wallet balances, and operates independently of any bank partner. This is the path NayaPay and SadaPay both took, licensed directly by SBP under the Regulations for Electronic Money Institutions, 2019 (revised 2023). It carries the highest compliance burden — minimum capital, a security deposit held with SBP, board-level fitness and propriety review — but gives full control over the product and customer relationship.
Integrate with an Existing Bank-Led Wallet — JazzCash / Easypaisa Model
JazzCash and Easypaisa are not standalone fintechs — they are branchless banking products operated by licensed microfinance banks (Mobilink Microfinance Bank and Telenor Microfinance Bank respectively) under SBP’s Branchless Banking Regulations. A company that wants to accept payments or disburse funds through these wallets doesn’t need its own SBP licence; it needs a merchant, API, or aggregator agreement with the sponsoring bank, plus compliance with that bank’s KYC/AML onboarding requirements for the integration.
Become a Payment System Operator / Payment Service Provider
Companies that provide payment infrastructure — switching, aggregation, gateway services — without holding customer e-money themselves are licensed as a PSO or PSP under rules issued by SBP in 2014. This is the category for payment gateways, aggregators, and infrastructure providers sitting between merchants and banks.
The EMI licensing procedure
The path most new fintechs actually need — from incorporation to a live, publicly-available product.
Incorporate the right entity with SECP
Private Limited Company under the Companies Act, 2017, with a capital structure and shareholding pattern that will hold up under SBP’s later fitness and propriety review of directors and sponsors.
Apply to SBP’s Payment Systems Department for In-Principle Approval
Submit the business plan, technology architecture, AML/CFT compliance manual, and sponsor/director fit-and-proper documentation. SBP reviews and grants In-Principle Approval (IPA) once satisfied.
Meet the security deposit and capital requirements
Place the required security deposit with SBP-BSC — split between a non-remunerative current account and government securities held under lien — and demonstrate minimum paid-up capital.
Run the pilot phase
Typically three to six months, with a limited user base, testing KYC/AML controls, two-factor authentication, and transaction monitoring under SBP’s direct oversight before any public launch.
Obtain the final EMI licence
Once SBP is satisfied with the pilot results, the final licence is issued, permitting full-scale public operation, e-money issuance, and wallet-to-wallet transfers.
Integrate with Raast and the wider payment ecosystem
Onboard onto SBP’s Raast instant payment system under its Participation Criteria, and where relevant, negotiate integration agreements with JazzCash, Easypaisa, or partner banks for interoperability.
Meet ongoing technology risk and reporting obligations
Quarterly capital returns to SBP, and compliance with SBP’s Technology Risk Management Framework for Payment Institutions — covering cybersecurity, governance, and incident reporting — on a standing basis, not just at launch.
Where this is heading
SBP has been actively widening this framework — the 2023 revision to the EMI Regulations added services like payment initiation, account information, and inward cross-border remittances; Raast’s Business API, opened to a first small group of licensed fintechs, is turning what was a peer-to-peer transfer rail into genuine B2B payment infrastructure; and the Technology Risk Management Framework introduced in late 2025 sets a compliance deadline in early 2026 for cybersecurity and governance standards across every licensed payment institution. This is a fast-moving area of regulation, and KBL & Associates is building out this practice specifically to track it as it develops.
Governing law & regulators
The statutes and regulatory bodies that actually govern fintech and digital payments in Pakistan.
Foundational statute empowering the State Bank of Pakistan to regulate payment systems, e-money and electronic fund transfers.
sbp.org.pk →Licensing framework for non-bank EMIs such as NayaPay and SadaPay, covering permitted activities, capital, and customer protection.
sbp.org.pk →Governs bank-led mobile wallet models such as JazzCash (Mobilink Microfinance Bank) and Easypaisa (Telenor Microfinance Bank).
sbp.org.pk →Licensing framework for Payment System Operators and Payment Service Providers — switches, gateways and payment infrastructure.
sbp.org.pk →Functional and technical requirements for banks, EMIs, PSOs and PSPs to connect to Pakistan’s national instant payment system.
sbp.org.pk/raast →Cybersecurity, governance and incident-reporting standards for EMIs, PSOs and PSPs, with a compliance deadline in early 2026.
sbp.org.pk →Common questions, answered directly
It depends on the business model: issuing your own e-money requires an Electronic Money Institution (EMI) licence from the State Bank of Pakistan; integrating with an existing wallet like JazzCash or Easypaisa needs only a merchant agreement with the sponsoring bank; providing payment infrastructure needs a PSO/PSP licence.
JazzCash and Easypaisa are branchless banking products operated by licensed microfinance banks, not standalone fintechs. NayaPay and SadaPay are directly licensed Electronic Money Institutions that issue their own e-money independently of any bank partner.
Yes — the State Bank of Pakistan now permits banks to open accounts for licensed virtual asset and payment service providers, including segregated client-money accounts, once the relevant SBP or PVARA licence is in hand.
Other practice areas
Foreign founders and payment operators
SBP licensing, branchless-banking integration and Raast onboarding are frequently run for founders and platforms headquartered outside Pakistan. Corporate formalities and regulator correspondence are handled locally so the founding team does not need to relocate.
Overseas instructions are a routine part of the firm’s work rather than an exception. Where a matter also touches family law — guardianship, succession or a child’s documents — it is handled by the same firm rather than referred out. See child adoption and guardianship from Pakistan or all thirteen practice areas.