As Pakistan’s digital economy expands, the regulatory bodies are drastically tightening the cybersecurity perimeter. Following the recent rollout of the National Cyber Security Framework 2.0, the Federal Board of Revenue (FBR), in conjunction with the State Bank of Pakistan, has announced a new mandate: all registered fintech startups must undergo mandatory bi-annual penetration testing (pentesting) by certified third-party cybersecurity firms.
This directive aims to protect consumer financial data and safeguard the national payment gateway integrations against increasingly sophisticated state-sponsored cyber threats.
Details of the Mandate
Under the new SRO (Statutory Regulatory Order), any fintech company processing more than PKR 100 Million in monthly transactional volume, or integrating directly with the Raast Digital Payments System, must comply with the following:
- Bi-Annual Network & Application Pentesting: Companies must submit a comprehensive vulnerability assessment and penetration testing (VAPT) report every six months.
- Certified Auditors Only: The pentesting must be conducted by firms accredited by the PTA and the Ministry of IT & Telecommunication (MoITT).
- Zero-Day Vulnerability Disclosure: Startups are required to patch critical vulnerabilities (CVSS score 8.0+) within 48 hours of discovery.
Impact on Fintech Startups
This mandate places a sudden operational burden on early-stage fintechs. Conducting rigorous, enterprise-grade penetration testing is resource-intensive. Startups will need to upgrade their infrastructure to withstand simulated DDoS attacks and injection vectors during these audits.
Many companies are expected to migrate away from shared hosting environments to isolated high-performance dual Xeon servers to ensure their underlying hardware meets the compliance requirements for secure data enclaves and hardware firewalls.
Failure to comply with the mandate will result in immediate suspension of API access to the national banking grid and hefty financial penalties.
Building a Resilient Ecosystem
While challenging for startups in the short term, cybersecurity experts praise the FBR’s decision. “You cannot build a cashless economy on a foundation of insecure APIs and unpatched servers,” noted a senior analyst.
By enforcing these rigorous standards, Pakistan is signaling to global investors that its rapidly growing fintech sector is mature, secure, and ready for integration into the global financial ecosystem.
