Fintech

Fintech is the one technology sector in Pakistan where the regulatory architecture arrived before the industry matured, and it shapes everything. The State Bank built its framework deliberately: EMI regulations issued in 2019 under the Payment Systems and Electronic Fund Transfers Act 2007, PSO/PSP rules for the infrastructure layer, a digital bank licensing framework introduced in 2022, and Raast — the instant payment system rolled out in phases and now central to how money moves domestically. On the other side of the street, SECP licenses the NBFCs through which app-based lending runs and has imposed conduct requirements on digital lenders after a period of genuine abuse in that market [CURRENT REQUIREMENTS — TO BE VERIFIED BY REVIEWING LAWYER]. A fintech founder in Pakistan is therefore never asking whether the business is regulated. The question is which regime, at which stage, and on whose licence.

The perimeter is the product decision

We push clients to answer the licence question before the architecture question, because in this sector the two are the same decision. Stored value makes you an EMI candidate. Routing and switching make you a PSO/PSP question. Bearing credit risk makes you an NBFC question. Each category carries its own capital, governance, and systems requirements, and each has a partner-model alternative — riding on a bank's or licensed entity's authorization — that trades margin and control for speed. The wrong sequencing is expensive in a specific way: features get built that the eventual licence category does not permit, and the pilot stage becomes a renegotiation with the regulator instead of a demonstration. As of mid-2026 the State Bank's approach rewards applicants who arrive with the perimeter analysis already done and punishes, with time, those who make the regulator do it for them. The newer product categories test the perimeter hardest. Buy-now-pay-later sits between SBP and SECP depending on who funds and who bears the credit risk; embedded finance puts a non-financial brand in front of a licensed balance sheet; and the digital bank framework of 2022 created a category whose economics only work for the well-capitalized few. Each of these is a structuring question before it is a licensing question.

Life under the AML Act

The Anti-Money Laundering Act 2010 is the statute fintech founders underestimate most. Its obligations — customer due diligence, ongoing monitoring, record-keeping, and suspicious transaction reporting to the Financial Monitoring Unit — attach to the activity, not to the company's size, and the State Bank examines payments businesses against its AML/CFT regulations with the seriousness Pakistan's international commitments require. For a young company the practical stakes are twofold. First, examination findings are cumulative: the record built in year one is the lens for year three. Second, AML failures are the fastest route from supervision to enforcement, and enforcement in this sector reaches individuals — compliance officers and directors — not just the licence. We build proportionate, written, actually-operating programs: risk assessment, CDD tiers matched to product limits, screening, an STR decision process with a record, and the training file an examiner asks for first.

The paper between the players

Almost no Pakistani fintech operates alone. There is a sponsor bank, an EMI partner, a processor, an agent network, a Raast connection through somebody's participation — and a stack of agreements allocating the risks that make payments businesses fail: fraud losses, settlement failure, chargebacks, data incidents, regulatory penalties triggered by the other party's conduct, and what happens to customers when the partnership ends. These agreements are negotiated once, under time pressure, and then govern years of operations. We treat them as the core asset they are. Raast deserves specific mention: as the rails move from a launch achievement to ordinary infrastructure, the questions shift to operational ones — settlement finality, dispute and reversal handling, liability for downtime, and what a participant owes the customers of a partner riding on its connection. Those answers live in the participation and partnership documents, and the time to read them is before volume arrives. The same discipline applies to fundraising: investment into a licensed or licence-track fintech carries regulatory approval mechanics — shareholding thresholds, fit-and-proper clearance of incoming controllers, sometimes prior no-objection — that belong in the conditions precedent, priced and time-tabled, rather than discovered between signing and closing.

How we serve fintech companies

We take fintechs through the full arc: perimeter analysis and licensing strategy, the application and pilot stages before the State Bank or SECP, the AML program, the partnership and infrastructure contracts, and the rounds that fund it all — with the regulatory approvals sequenced into the deal rather than bolted on. When supervision hardens into an inspection finding or show-cause notice, we answer it with the care of litigation, because in this sector the first answer becomes the permanent record. The frameworks named here are stated as of mid-2026 and move quickly — circulars amend without ceremony — and we confirm the current instrument at the start of every engagement.