What Pakistani regulators actually require - and what they don’t

Every few months a Pakistani business owner forwards us a blog post claiming the State Bank and the SECP have jointly issued a circular making annual penetration testing compulsory for every bank and fintech, with a hard deadline and a requirement to use a CREST-certified firm. It is usually well written. It is also, as far as we can establish, invented: there is no link to any SBP or SECP document, the byline is a bot, and the two regulators do not issue joint circulars under a shared number.

We could sell a lot of work on the back of that post. We would rather tell you what the rules actually say, because the real obligations are quite strong enough, and because a compliance programme built on a fake circular falls apart the first time an auditor asks to see it.

Start with what is not law

Pakistan still has no general data protection statute. The Personal Data Protection Bill has been drafted and redrafted since 2018; the operative draft is the 2023 version from the Ministry of IT and Telecommunication, and as of March 2026 it had still not passed both houses. A private member's bill in the Senate was opposed by the Ministry on procedural grounds while it prepares its own text.

That matters in two directions. There is no national regulator you must notify after a breach, and there are no privacy fines to fear - but there is also nothing stopping the obligation arriving with a year's notice, and the draft already proposes breach notification within 72 hours and penalties in the millions of dollars. Companies that already know where their personal data sits will have a quiet year when it lands. The rest will not.

What is binding, in order of hardness

Electronic Money Institutions: an annual audit, by name

This is the hardest requirement in the country, and it is also the most often missed, because the big international law-firm guides to Pakistani data protection do not mention it. PSD Circular No. 01 of 2019, which carries the Regulations for Electronic Money Institutions, says at section 19(IV) that EMIs “shall get their systems audited from SBP’s approved Panel of Auditors” - before they start trading, and “thereafter on annual basis”. Not periodically. Annually.

The same regulations require that “all security breaches should immediately be reported to relevant stakeholders including PSD, SBP”, with a detailed report within fifteen days, and quarterly returns of information security breaches, suspected and compromised.

One honest caveat we will give you for free: those regulations do not mention penetration testing, vulnerability assessment or PCI DSS anywhere. The obligation is a system audit by an auditor on the State Bank’s panel. Anyone telling you the EMI rules mandate a pentest has not read them.

Banks, DFIs and microfinance banks: periodic, not annual

BPRD Circular No. 05 of 2017 carries the Enterprise Technology Governance and Risk Management Framework. It applied to every bank, DFI and microfinance bank, with a compliance deadline of 30 June 2018, and the board has to review implementation at least quarterly. The testing clauses are worth quoting precisely, because they are routinely misquoted:

• §2.3.1(a) - “FI(s) shall annually conduct a risk-based vulnerabilities identification exercise across the entire institution.” This is the only explicitly annual obligation in the framework.
• §2.7(b)(i) - vulnerability assessments to identify and assess security vulnerabilities, with follow-up validation that the gaps were actually closed. Frequency: periodic, set by the institution’s own policy.
• §2.7(b)(iii) - “FI(s) shall carry out periodic penetration tests to identify vulnerabilities that may affect their systems.” Internal penetration tests must also run when major software or system updates go in.
• §2.7(b)(ii) - periodic scenario testing of response and recovery including “simulation of extreme but plausible cyber attacks.”
• §2.6(b) - incidents reported to SBP’s BPRD within 48 hours. That covers established security breaches involving financial loss, and major disruption leaving customers without service for “more than two (02) hours.”

So: if you are a bank, the State Bank does not require annual penetration testing. It requires an annual vulnerability identification exercise, periodic penetration testing at an interval you set and can defend, and a retest whenever something significant changes. Most banks land on annual anyway, and we think that is right, but the framework itself says the interval is yours to justify - and it says plainly that it “is not ‘one-size-fits-all’”.

The 48-hour clock is the clause that catches people out. It starts whether or not you have finished working out what happened.

Telecom licensees: an approved-firm regime

The PTA’s Critical Telecom Data and Infrastructure Security Regulations, issued 8 September 2020, directed licensees to implement its controls by July 2021 and to have third-party audits done by firms on the PTA’s own approved list. Those firms are graded Cat-I through Cat-IV, and a firm may only audit licensees in its own category or below. If you are a licensee, your choice of auditor is not open - check the current list before you sign anything.

A revised framework was reported in November 2025 that would add data localisation, annual independent cyber audits and 24-hour incident reporting. The reporting on it contradicts itself about whether it is finalised or still out for consultation, so treat it as coming, not here.

Card payments: the obligation comes from your acquirer

We could not find any SBP or SECP instrument that names PCI DSS. For almost every Pakistani merchant and processor, PCI arrives contractually, through the card schemes and your acquiring bank, not through a regulator. Mastercard’s Site Data Protection programme sets the validation level by annual transaction volume: above six million combined Mastercard and Maestro transactions you need a full Report on Compliance; between one and six million, an annual self-assessment questionnaire; above 20,000 e-commerce transactions, an annual SAQ; everyone else, an annual SAQ as well. All third-party processors are Service Provider Level 1 and need a Report on Compliance regardless of volume.

If you are a service provider rather than a merchant, note that PCI DSS requires segmentation penetration testing every six months, not annually. We wrote a separate piece on what changed in PCI DSS v4.0.1.

What the SECP actually said

The SECP published a Cyber Security Advisory, Circular 10 of 2025, in May 2025. It went to registered companies and urged immediate action on access controls, minimising network vulnerabilities, incident response readiness and staff awareness. Every source we could find describes it as an advisory. We could not retrieve the PDF text, and no source we read says it is binding or mentions penetration testing. Treat it as a strong hint from your regulator, not a mandate - and do not let anybody sell you a pentest on the strength of it.

For listed companies, the Code of Corporate Governance Regulations 2019 require a whistle-blowing policy at board level. Beyond that, the specialist guides report no SECP security testing or breach reporting obligations.

PECA, and what it means for people who test

The Prevention of Electronic Crimes Act was amended on 29 January 2025. The amendment created the Social Media Protection and Regulatory Authority, the associated tribunals, and the National Cyber Crime Investigation Agency, which replaces the FIA’s Cyber Crime Wing and now holds exclusive investigative powers over cybercrime. It also added section 26-A on dissemination of false information, with up to three years’ imprisonment and a two million rupee fine.

For our line of work, two things follow. PECA imposes no general breach reporting duty - that comes from your sector regulator if it comes at all. And testing without written authorisation is a criminal matter, not a civil one. Every engagement we run starts with a signed scope and authorisation letter, and so should every engagement anyone else runs for you.

A short, honest checklist

• EMI? Annual system audit by an SBP panel auditor. Breach report to PSD immediately, details within 15 days, quarterly returns.
• Bank, DFI or MFB? Annual institution-wide vulnerability identification. Periodic VA and penetration testing on a documented interval, plus retesting after major changes. 48-hour incident reporting to BPRD.
• Telecom licensee? Third-party audit by a PTA-approved firm in the right category.
• Taking card payments? Find out your level from your acquirer, not from a blog. Service providers: six-monthly segmentation testing.
• Everyone else? Nothing compels you today. The draft bill proposes 72-hour breach notification, and knowing where your personal data lives is the work that pays off either way.

If somebody quotes you a circular number, ask them for the link. We will do the same if you ask us.

What this means for you