Corporate Governance in Pakistan

Ask ten Pakistani CEOs what corporate governance means and most will describe something that applies to other, larger companies: independent directors, audit committees, a code administered by the SECP. That picture is not wrong, but it starts in the wrong place. Governance in Pakistan starts with a single statute — the Companies Act 2017 — and that statute binds every company on the register, from a two-person startup to a listed conglomerate. The codes sit on top. The Act sits underneath everyone.

This page maps the whole structure: which rulebook applies to which company, what the board and its record must actually contain, where related-party dealings fit, and what directors personally carry. It is written for the person who signs the filings, not the person who drafts them.

One statute, several codes

The Companies Act 2017 is the base layer. It governs incorporation, directors' appointment and duties, board and shareholder meetings, resolutions, statutory registers, annual filings, dividends, related-party transactions and the SECP's investigation powers. When a governance defect is described in legal terms, it is almost always a breach of this Act.

Above the base layer, the rulebook depends on what the company is. Listed companies answer to the Listed Companies (Code of Corporate Governance) Regulations 2019 — board composition including independent and female directors, mandatory committees, and disclosure. Public sector companies have a separate and in places stricter regime under the Public Sector Companies (Corporate Governance) Rules 2013, built around independence from the government owner. Banks and SBP-regulated institutions carry the State Bank's own governance and fit-and-proper requirements on top of everything else, and NBFCs answer to the SECP's non-banking finance framework.

A private company outside those categories has no code — only the Act. That is not a light burden. It is simply an unwatched one, until an investor, an auditor or the registrar starts watching.

The board and its record

Pakistani law treats the board as the organ through which the company acts, and it judges the board by its record. A decision that was genuinely made but never minuted is, for most legal purposes, a decision that cannot be proved. This is the single most common governance failure in founder-led companies: the business runs on phone calls and the minute book stops in the year things got busy.

The mechanics are unglamorous and non-negotiable. Meetings must be called, quorate and minuted. Resolutions must exist for the actions that need them — share issuances, borrowing, investments, related-party approvals, the appointment of officers. Registers of members, directors and charges must be maintained, and the prescribed returns filed with the registrar when facts change. Ultimate-beneficial-ownership information for corporate shareholders now belongs in that record too.

None of this requires a governance department. It requires a habit: no significant action without a dated resolution, and no quarter without the registers being brought current.

Officers, committees and the audit

Beyond directors, the Act deals in officers. Certain categories of company must appoint a qualified company secretary; every company of substance needs someone who actually owns the secretarial function, whatever the formal requirement [MANDATORY THRESHOLDS FOR SECRETARY AND CFO APPOINTMENTS — TO BE VERIFIED BY REVIEWING LAWYER]. The auditor's appointment, rotation and remuneration run through shareholder resolutions on a statutory cycle.

Committees are where the codes take over. The 2019 Regulations require listed boards to operate an audit committee and a human resource and remuneration committee, with composition rules that lean on independent directors. Independence itself is a defined status: the Companies (Manner and Selection of Independent Directors) Regulations 2018 set the disqualifying relationships and require selection from the databank maintained under the Act. A friendly outsider who owns shares, takes fees or did business with the company recently will usually fail the tests, and mislabelling them creates a disclosure problem worse than the vacancy.

Private companies can borrow this architecture voluntarily, and the ones planning a listing or a large raise generally should — in stages, starting with a real audit process.

Related-party transactions

If one file decides how a regulator or an investor reads your governance, it is this one. Dealings between the company and its directors, officers, major shareholders or associated companies — a founder's consultancy fee, rent paid to family property, supply contracts with a sister concern — are lawful, but they are conditioned. The Companies Act 2017 and the Companies (Related Party Transactions and Maintenance of Related Records) Regulations 2018 require approval, arm's-length justification and records to match.

Family businesses and founder-led companies breach this regime constantly and innocently, because from inside, the founder and the company feel like the same pocket. The law says they are not. The fix is procedural, not prohibitive: a standing policy, a register of related parties, and board approval with a recorded price rationale before the transaction, not after the auditor asks.

Shareholders, meetings and the cap table

The shareholder layer has its own formalities. The annual general meeting must be held within the statutory window; certain decisions — amending the articles, changing capital, schemes of arrangement — need shareholder resolutions of prescribed kinds; and the register of members is the legal cap table, whatever a spreadsheet elsewhere says.

That last point costs companies real money. When the register, the SECP filing history and the CFO's working cap table disagree, every discrepancy becomes a diligence question, and unexplained discrepancies become price reductions. Reconciling the three is cheap when done annually and expensive when done under a term-sheet deadline.

What directors personally carry

The Companies Act 2017 attaches consequences to individuals, not just to the company. Directors owe statutory duties, and a long list of defaults — filing failures, unauthorised related-party dealings, improper distributions, defective meetings — carries penalties that can name directors and officers personally. The more serious defaults carry criminal exposure. SECP show-cause notices routinely address individuals.

Two practical consequences follow. First, a directorship in Pakistan is not honorary, and anyone joining a board should read the company's filing status before accepting. Second, the record protects the individuals who kept it: a director who can show the resolution, the dissent or the disclosure is in a different position from one who can only describe a conversation.

Governance at three stages

At the startup stage, governance means a clean spine: accurate registers, resolutions for every issuance and grant, related-party dealings papered, filings current. Nothing more — but nothing less, because the first institutional round will audit exactly this.

At the growth and family-group stage, the problems change shape. Multiple entities, overlapping directors, inter-company balances nobody approved. Here governance means group discipline: a delegation-of-authority matrix, a related-party policy that covers affiliate dealings, and one calendar that tracks every entity's obligations.

At the listed or regulated stage, the codes take over and the question becomes evidence: not whether the committee exists but whether its papers show it doing its work. Companies that built the habits earlier find this stage administrative. Companies that did not find it surgical.

The law summarised here is stated as of mid-2026. The Companies Act 2017 and the SECP's regulations are amended periodically, and thresholds, deadlines and penalties move with them — confirm the current position for your company's category before acting on any specific requirement.