Statutory Notifications (S. R. O)
GOVERNMENT OF PAKISTAN
SECURITIES AND EXCHANGE COMMISSION OF PAKISTAN -.-.-.-

Islamabad, August 1, 2025

NOTIFICATION

S.R.O.1438(I)/2025.- In exercise of the powers conferred by sub-section (2) of section 282B of the Companies Ordinance, 1984 (XLVII of 1984), the Securities and Exchange Commission of Pakistan hereby makes the following amendments in the Non-Banking Finance Companies and Notified Entities Regulations, 2008, the same having been previously published in the official Gazette vide S.R.O. 76(1)/2025 dated January 22, 2025 and also placed on its website as required under proviso to the said sub-section (2), namely:-

AMENDMENTS

In the aforesaid Regulations,-

(1) in regulation 2, in sub-regulation (1),-

(a) after clause (v), the following new clause shall be added,-

“(va) “Cooling off Period” means period of one business day commencing from the date of issuance of investment report to the unitholder as per Circular No. 10 of 2022;”;

(b) after clause (xiaaab), the following new clause shall be added,-

“(xiaaaba) “Digital Platform” means tool/application/software/solution which uses digital/IT as the primary interface between the Digital AMC, Investor/Unitholder and other parties involved in the process of offering DAMS and includes mobile phone application, web-based portal, internet-based channels, digital distribution/aggregation platforms and other enabling or supplementing support services;”

i. “(xiaaad) “Digital Asset Management Company (Digital AMC)” means a Fund Management NBFC licensed by the Commission to offer Digital

Asset Management Services;”

ii. “(xiaaae) “Digital Asset Management Services (DAMS)” means provision of the asset management services (AMS) to the customers/unitholders through Digital Platform with limited or no human interaction with the customer/unitholders;”

(2) in Regulation 36, for the proviso, the following shall be substituted, -

“Provided that Digital Fund Management NBFCs shall have certain exemptions and shall comply with additional requirements as may be specified by the Commission through circular.”

(3) After “Part V” the following new Part “VA” shall be added, namely: -

“Part VA Requirements to undertake Digital Asset Management Services (DAMS) by the Digital Asset Management Company (Digital AMC)

67AB. The provisions of this part shall apply to Digital AMCs for provision of DAMS and digital services offered by the Asset Management Companies using or intending to utilize Digital Platforms for provision of their services to the customers/investors. The requirements shall be applicable to all Digital Platforms being administered, managed and/or owned by the Digital AMCs.

67AC. DAMS Licensing and Other Eligibility Requirements.- (1) A Fund Management NBFC, subsequent to grant of permission in terms of Rule 4 of the Rules, shall in addition to compliance of all requirements/conditions for grant of license as provided in Rule 5 of the NBFC Rules, shall clearly mention the intention to obtain a license for undertaking DAMS in Form-II of the NBFC Rules.

(2) The SECP in terms of sub-rule 6 and 7 of Rule 5 of the NBFC Rules may, if so satisfied, grant AMS license conditional to the restriction that such Asset Management Company (AMC) shall be eligible to provide DAMS only through digital platforms.

(3) A Fund Management NBFC at the time of application for grant of license to undertake DAMS and during its life, as the case may be, shall comply with the following additional requirements:

(a) A Fund Management NBFC desirous to engage in the business of DAMS, shall along with its application for grant of license, submit a viable business plan and comprehensive financial projections supported by underlying assumptions for a minimum of five years from the commencement of business; where such business plan shall encompass, but not restricted to, the following aspects:

(i). Detailed Digital Business Strategy demonstrating technological resources to offer DAMS;

(ii).IT Organogram outlining the Organizational Structure for IT Operations;

(iii). Evidence showcasing the capacity and expertise of human resources for executing Digital and IT Business Strategies for effectively providing DAMS to prospective investors;

(iv).Comprehensive Business Continuity Planning and Disaster Recovery Strategy Plan (BCP/DRP);

(v). Comprehensive Marketing Strategy with a special focus on retail outreach; and

(vi).Cyber Information Technology Security Strategy and details of Infrastructure Plans outlining data Security Measures.

(b) Such Fund Management NBFC in addition to the requirements under Schedule – I of the NBFC Rules and fit and proper criteria as laid down under Schedule – IX of these Regulations shall comply with following additional requirements for its board of director (BOD) and Key Executives:

(i) The BOD shall include at least one or 1/3 members, whichever is higher, with knowledge and high-level expertise along with a working/business experience of at least three years in emerging technologies and digital space. These technologies may include software development, cloud computing, open APIs, cybersecurity, advanced data analytics, artificial intelligence, and other similar domains. Prior experience of working in a fintech environment or digital infrastructure domain of a local or a foreign Financial Institution servicing retail clientele would be considered as a strong advantage.

(ii) In addition to the requirements regarding the statutory committees of the BOD, it shall establish a BOD level “Information Technology (IT) and Digital Risk Management Committee (the “Committee”)” which shall hold its meetings at least quarterly. Such Committee shall also have representation of senior management from the following areas:

Specialized Information Technology Department or a representative from the service-providing agency’s IT Department;
Risk Management Department;
Compliance Department; and
An Independent Director from the BOD.

The Committee shall be chaired by the Independent Director of the BOD. The committee shall be focused on designing policies and approving strategies for Digital and IT based services related issues including Digital Risk Management and Cyber Security with the objective to identify and mitigate IT-related risks, formulation of BCP/DRP policies and mechanisms, ensuring compliance with prevalent regulations, and overseeing cybersecurity measures. Furthermore, the Committee shall play a critical role in strategic Digital/IT decision-making, vendor efficiency and risk management, and incident response planning. A focus on emerging technology trends shall also be essential aspects of its responsibilities.

(iii) Such Fund Management NBFC shall either establish its own IT Department/Function and the Cyber Security Function or it may utilize agency/outsourced services for the same. Such departments/functions or in case of outsourcing, the service providing agency, shall have a team led by the Chief Technology Officer (CTO) who holds strong qualification and relevant experience in the related fields. The Digital AMCs owing to fast changing needs of data and client identification security, are strongly encouraged to engage services of a Chief Information Security Officer (CISO) in addition to the CTO. The CISO, if so hired, shall have a separate reporting line from the CTO. The CTO and CISO shall have the following minimum qualifications and experience requirements: -

Criterion	Details
Education	Bachelor's or Master's degree in computer science, information technology, information security, cyber security, software engineering, or a related field.
Professional Experience	Minimum 5 years of experience in IT management, information security/cyber security management or Software Development or Networking or Cloud Computing or Data Analytics and/or Emerging IT trends, etc., preferably in the digital financial/fintech services industry.

67AD. Permitted Categories of CIS/Fund and Investor Mix.- (1) A Digital AMC will be eligible to offer DAMS for all categories of Open-End Collective Investment Schemes (CIS), provided it shall only offer DAMS for equity-based CIS if the Chief Investment Officer possesses a minimum of 5 years of experience in fund management/portfolio management of equity.

(2) At least 70% of the AUM of each Open-End CIS shall belong to retail investors at all times during the life of the CIS. However, a newly established perpetual CIS shall ensure compliance with the minimum level of retail investment in the following manner at close of each period after close of IPO:

Period from the date of IPO	% of AUM
12 Months	25%
24 Months and beyond	50%
36 Months and beyond	70%

Provided that, in case of fixed maturity CIS/Plan, compliance in terms of minimum of 70% of retail investments shall be ensured by close of Initial Public Offer or Subscription Period, whichever is later:

Provided further that in case, the Digital AMC fails to ensure compliance with above mentioned thresholds, it shall immediately intimate the grounds to the Commission upon which it believes that the CIS shall be able to ensure requisite compliance within a reasonable timeframe not exceeding 90 days. Where the Commission is not satisfied with the reasons provided by the Digital AMCs, it may take necessary disciplinary action.

(3) A Digital AMC shall not qualify for registration as a Pension Fund Manager unless it has a minimum of three years of experience managing all categories of CIS. Upon achieving the requisite three years of experience across all CIS categories as specified, the Digital AMC may apply to the Commission for registration as a Pension Fund Manager. The Commission, after a detailed evaluation of the AMC’s compliance with the below parameters, may grant approval for such registration:

(a) Strong track record of the DAMS provided by it;

(b) Status of compliance with minimum investor mix requirements for each CIS under its management as stated under regulation 67AD(2) of the Regulations above;

(c) Stability rating of any of the CIS for which it acted or acting as a fund manager (where applicable) shall at least be AA-(f) by a Credit Rating Agency registered with the Commission;

(d) Performance (dividends/bonus, etc., to the unit holders) of the CIS under its management;

(e) HR and Operations strength and necessary skills to offer investment management in pension fund scheme business;

(f) Compliance track record of Digital AMC and CIS under its management with the applicable regulatory framework; and

(g) Client servicing efficiency, Complaint redressal mechanism and trend of monthly investors’ complaint data.

(4) Any existing AMC licensed to undertake AMS business and desirous to provide DAMS only shall comply with the MER conditions in the following manner:

(a) The AMC may continue to meet MER as prescribed for AMS in the Schedule I (currently being Rs. 200/- million) to remain eligible for offering services to all segments of investors, including retail and corporate investors, without any minimum limit on retail segment ratio; and

(b) In the event that such an AMC chooses to convert to a Digital AMC by reducing its equity to meet MER as prescribed for a Digital AMC in the Schedule I, it shall adhere to the requirement of minimum investor mix as prescribed herein for Digital AMCs at the time of conversion and going forward. For clarity, such Digital AMC shall have at least 70% of its AUM of each CIS under its management belonging to retail investors.

67AE.Admissible Sales Load for CIS/Funds or other Charges.- Digital AMC shall be eligible to charge sales load or such other charges/onboarding charges as may be admissible for AMCs. However, the Digital AMC, may with a clear disclosure to the customer in terms of amount and %age, adopt any other feasible mechanism/mode for charging sales load; including deferment of the front-end load until the announcement of the first dividend by the subject CIS (without affecting the principal investment), or at the time of redemption request by the unitholder, whichever occurs earlier.

67AF.Minimum Maintainable Fund Size of CIS by Digital AMC.- (1) The minimum fund size (net assets) of a CIS shall be twenty-five million rupees at all times during the life of the scheme:

Provided that a newly established CIS other than fixed maturity scheme, shall ensure compliance with the minimum fund size requirement in two phases following its IOP period, i.e. attain a minimum of twelve million rupees within six months of the first day/date of the IOP period and ensure compliance with the overall minimum fund size within one year of the close of IOP period.

(2) The Digital AMCs are strongly encouraged to invest or arrange the investment of a seed capital of five million rupees for every new CIS for a minimum period of one year from the close of the IOP period, or until it satisfies the minimum fund size requirements as prescribed above, whichever is later.

(3) Subsequent to the closing of the IOP period; at any time, if the size of a CIS falls below the minimum fund size as specified above, the Digital AMC shall ensure compliance with the minimum fund size within three months of its breach.

(4) If the fund size remains below the minimum fund size limit for consecutive ninety days, the Digital AMC shall immediately intimate the grounds to the Commission upon which it believes that the CIS is still commercially viable and its objective can still be achieved along with following documents:-

(a) Proof of intimation to unit holders through the Digital AMC’s mobile application, email and publication in newspaper; and

(b) a time bound action plan to increase the fund size to the minimum requisite fund size for consideration of the Commission.

(5) Where the Commission is not satisfied with the reasons presented by the Digital AMC in terms of above sub-regulation (4), it may take necessary disciplinary action.

67AG. Expense Disclosures. - In matters of disclosure of expenses (Total Expense Ratio (TER), Management Fee and Trustee Fee) and sales load, the Digital AMC shall diligently adhere to the provisions outlined in Regulation 60(6) of the Regulations or such other instructions as prescribed by the Commission from time to time.

67AH. Cooling-Off Period for New/Subsequent Investment.- (1) A Digital AMC shall clearly communicate the availability of Cooling Off period to the individual unit holders on every transaction.

(2) The cooling-off right shall be exercised by the unit holder through the Digital Platform of the Digital AMCs within the specified cooling-off period.

(3) In case of exercise of cooling-off right within the cooling-off period by the unitholder, the Digital AMCs is obligated to refund any sales load paid by the unit holder. However, Contingent Load (the load charged upon redemption and which forms part of the CIS property) shall be borne by the unit holder. However, the Digital AMCs are highly encouraged to avoid charging such Contingent Load without prejudice to the interests of other unitholders.

(4) The refund for each unit held by a unit holder exercising the cooling-off right shall be based on the Net Asset Value (NAV) per unit applicable on the date the right is exercised by the unitholder. However, in such cases, Digital AMCs may recover the actual costs incurred for client identity verification, such as NADRA Verisys charges or other third-party verification costs, provided these costs are clearly attributable to the individual investor and pertain to their first-time onboarding. This cost recovery or deduction shall not apply to subsequent investments by the same investor.

67AI. Net Asset Value Dissemination and Disclosures.- (1) The Digital AMCs shall ensure that the NAV disclosed and reflected on all digital forums (such as application, website, portal etc.) shall be uniform at all times. In case of any loss to the unitholder due to any discrepancy in disclosure of NAV on digital platforms, the Digital AMCs shall compensate the respective unitholders within 7 working days of becoming aware of such discrepancy.

(2) The Digital AMCs are strongly encouraged to deploy latest investment performance disclosure tools/graphics to make it easy for the investors to understand both quantitative and qualitative movements of their investments, especially in comparison to the performance benchmarks and/or risk adjusted returns.

67AJ. Requirements in case of Appointment of Distributor.- (1) The Digital AMCs

shall sale the units of a CIS digitally through distributors that undertake distribution functions through digital means. The Digital AMCs shall enter into a written agreement with the distributors clearly stating the terms and conditions for avoidance of fraud and mis-selling of CIS units.

(2) The Digital AMCs may engage distributors beyond those classified as digital distributors. However, these distributors must ensure that onboarding and/or investment/redemption and all transactions by unitholders or prospective unitholders are conducted in a paperless manner through a fully integrated Digital Platform based ecosystem.

(3) The Digital AMCs is obligated to inform the Commission within thirty days of signing a distribution agreement with a distributor, along with an undertaking that the distributor has undergone pre-screening by the Digital AMC for compliance with relevant regulatory requirements, including but not limited to licensing, cybersecurity, risk disclosure, Anti-Money Laundering & CFT Compliances, and data protection (as per the prevailing regulatory framework). Additionally, the Digital AMCs must include the names and details of their appointed distributors in their audited annual financial statements.

(4) The Digital AMCs shall be responsible for the acts and omissions of all persons to whom it may delegate any of its functions including the distribution function, as if they were its own acts and omissions.

67AK. Guidelines for Unitholders relating to Investment and Redemption Process.-

(1) The Digital AMCs shall develop and make available to the users/unitholders, the comprehensive guidelines outlining the unitholders’ journey for investments and redemptions through their Digital Platforms. The Digital AMCs are encouraged to use the latest educational and mass awareness techniques to ensure that investors make well-informed decisions.

(2) The Digital Platforms shall include and prominently display a dedicated 'Help or Contact Us' button easily accessible to users/unitholders, which shall offer essential information about a designated contact person responsible for the prompt resolution of any issues, complaints, or queries raised by the investors.

67AL. Prerequisites for Qualifying to be listed in SECP’s Approved Digital Platform List.- The requirements as prescribed under this regulation are applicable to Digital AMCs

as well as the AMCs which are utilizing Digital Platforms for provision of services to their investors/unitholders. No licensed Digital AMC shall launch or make available to the public its Digital Platform without seeking NOC from the respective trustee and without listing it on the SECP's website. DAMS may simultaneously be provided through an App and the Digital AMC’s website or any other form of Digital Platform. Following requirements shall be applicable as pre-qualification for listing of Digital Platforms on SECP’s website:-

(a) Prior to the launch of the DAMS Digital Platform, the Digital AMCs shall seek No Objection Certificate (NOC) from the appointed Trustees for its Digital Platform in the following manner:-

(i) The Company Secretary or the CEO of the Digital AMC shall be required to submit a compliance certificate to the Commission as well as the Trustee(s), duly signed, affirming that the Digital AMC has adhered to requirements of these regulations including the additional requirements for the Composition of BOD, BOD Committees and Key Executive(s).

(ii) The respective trustees (if more than one for different CIS), after conducting due diligence and ensuring the effective compliance of the Digital Platforms in all aspects, including pre-qualification requirements as specified by the Commission and evaluation of both software and hardware infrastructures through User Acceptance Testing (UAT), shall issue the requisite NOC.

(iii)The Digital Platform shall become live within six months of the grant of NOC by the Trustees under intimation to the Commission.

(b) The Commission subsequent to grant of NOC and confirmation from the respective Trustee(s) shall maintain and publish the list of the Digital Platforms on the official website of the Commission.

(c) The Digital AMC, subsequent to the listing of its Digital Platform on the Commission’s website, shall conduct third-party vulnerability assessments, penetration testing, and performance evaluations of the Digital Platforms on an annual basis from the date of listing, with due intimation to the respective Trustees and the

Commission.

(d) In case of any violations or breaches occur after the launch of a Digital Platform, the Trustees reserves the right to revoke the previously granted NOC and to report the same to the Commission. The Commission upon such intimation by the Trustee, may initiate regulatory proceedings against the respective Digital AMC and remove the name of the non-compliant digital platform from the list.

(e) The Digital AMC shall ensure that at the time of accessing/registration of the users/investor; which shall be subsequent to the legitimate download or gaining access of any Digital Platform, all important requirements related to the respective Digital Platform, associated investment risk factors and terms governing the access to user data/information, shall be provided to such user/investor in a summary form along with a warning/disclosure or a prompt (pop up).

(f) The Digital Platform shall be subject to IT/Info Security Audit, once every three years by an Independent Audit Service Provider having qualified Certified Information Systems Auditor (CISA)/Certified ISO27001:2013 Lead Auditor Certification to check compliance with regulatory requirements. The Digital AMC shall submit the report to the Trustee, its external auditor and the Commission within three months of the end of the respective financial year.

(g) The Digital AMCs shall:

(i) conspicuously disclose its full corporate name and licensing status (including license no.) on its Digital Platforms, documentation, published materials and advertisements;

(ii) develop a policy governing Digital Platform’s business objectives, standards, compliance, guidelines, controls, responsibilities and liabilities. As a principle, the policy shall achieve a balance between the security of Digital Platform, convenience and performance. The policy shall at least be revisited annually by the relevant Committee of the BOD and/or when a significant change is made in the business environment;

(iii)ensure compliance of all applicable laws in force in Pakistan related to cyber security, personal data protection, cloud usage and data privacy;

(iv)be responsible for any digital fraud, security breach, operational failure, or system malfunction arising from deficiencies in the design, implementation, or operation of its digital platform, where such incidents are attributable to the negligence, inadequate controls, or failure to exercise due diligence by the Digital AMC; and

(v) be responsible for loss of any unitholder due to delay on their part in taking timely remedial and control measures such as delay in announcement of NAV, blocking digital platforms in case of any cyberattack, delay in disposing dispute requests in a timely manner, etc. In this regard, the Digital AMCs shall compensate for such losses to the unitholders.

(h) The Digital AMCs are encouraged to offer transactional insurance to its unitholders for Debit Card Services or similar offerings, at reasonable and competitive rates. Activation of the insurance shall require clear disclosure and the explicit consent or request of the unitholder.

(i) The BCP/DRP shall be approved by the Committee on Information Technology and Digital Risk Management and endorsed by the BOD: Provided that, the Specialized Information Technology Department, or the service provider in the case of outsourcing, shall maintain a comprehensive log of frequent Disaster Recovery Testing (DRT), which shall be conducted at least quarterly. A summary report of DRT shall be shared with respective Trustees and the Commission on semi-annual basis.

67AM. Conversion of an Existing AMC into a Digital AMC and Vice Versa.- An

existing AMC that holds a valid license from the Commission to undertake AMS may be converted into a Digital AMC, subject to prior approval of the Commission. To proceed with this conversion, such an AMC shall apply for a revised license specifically for DAMS. This application should include:-

(a) Application on Form – II of the NBFC Rules along with an undertaking to surrender the existing AMS license upon grant of DAMS license;

(b) Copy of existing valid AMS License;

(d) Approval of shareholders for conversion into a Digital AMC (if applicable);

(e) NOC for conversion from respective trustees of all CIS under management;

(f) Business Plan as per requirements of the Regulation 67AC(a) including details/profile of requisite human resource evidencing the capacity and expertise for providing DAMS;

(g) Profiles of proposed existing BOD for DAMS;

(h) Profile of CTO heading specialized Information Technology Department;

(i) An undertaking, confirming its compliance with the chosen MER condition at the time of application for DAMS and additional requirements regarding Composition

of the BOD, Committees of the BOD and Key Executives under Regulation 67AC(b);

(j) Undertaking of compliance with the necessary requirements outlined in Part VA of these Regulations, as well as other relevant requirements under prevalent regulatory framework;

(k) The subject applicant shall prior to issuance of DAMS license shall surrender its existing AMS license to the Commission in original; and

(l) Following its conversion, such converted Digital AMC shall seek the Commission's approval to continue managing pension funds (if any), as per the criteria specified under regulation 67AD(3) of the Regulations: Provided that, if the converted Digital AMC is not granted authorization to manage pension funds, it must adhere to the following requirements with respect to the pension funds it currently manages: -

(i). Make immediate arrangements in terms of Rule 6 of the Voluntary Pension System Rules, 2005 for transfer of the management rights of pension funds under its management and subsequently cancellation of its registration as Pension Fund Manager;

(ii).For the CIS under its management, it shall ensure compliance with the following minimum level of retail investment in each year of the post conversion period:

Post Conversion Period	% of AUM
12 months	35%
24 months	70%

Provided that, for every new CIS, at least 70% of its AUM shall belong to retail investors to be achieved in a period as specified in regulation 67AD(2) of the Regulations:

Provided further that, in case such a converted Digital AMC fails to ensure compliance with above mentioned thresholds, it shall immediately intimate the grounds to the Commission upon which it believes that the CIS shall be able to ensure requisite compliance within an extended timeframe not exceeding 90 days or such other time period as may be ascertained by the Commission on case to case basis. Where the Commission is not satisfied with the reasons provided by such converted Digital AMCs, it may take necessary disciplinary action.

(m)A Digital AMC may convert into a conventional AMC upon compliance with the relevant provisions under prevalent NBFC Regulatory Framework including requisite MER compliance.

67AN. Applicable Requirements for AMCs offering AMS through Digital Platforms to their Investors.- AMCs which are using Digital Platforms prior to the date of these requirements or which intend to utilize Digital Platforms for provision of AMS services to their investors:

(a) shall ensure compliance with additional applicable requirements in terms of regulation 67AC of the Regulations regarding composition of the BOD and constitution of the Committee of the BOD within three year or forthcoming election of the board whichever is earlier and for the Key Executive within a time of one year from the date of grant of NOC by the Trustees. In this regard, the concerned AMC shall also submit a duly signed compliance certificate by Company Secretary to the Commission;

(b) may apply sales load as allowed under regulation 67AE of the Regulations;

(d) shall comply with the provisions set forth in regulation “67AL” of the Regulations including but not limited to seeking NOC from the respective Trustees subject to pre-qualification requirements as may be specified by the Commission, within twelve months (year since the date of issuance) of the issuance of these requirements.

Note: The Digital AMC shall adhere to all the applicable requirements as applicable for a conventional AMC under the NBFC Regulations, Circulars and Directives, unless expressly modified or relaxed by the above-stipulated requirements.

______________________________________________________________________________ [No. SCD/NBFC/NBFCR/2025]

(Bilal Rasul)
Secretary to the Commission

Notification: Amendments in Non-Banking Finance Companies and Notified Entities Regulations, 2008