2017-01-23
Added · Updated
The Securities and Exchange Commission of Pakistan amends the Companies (E-Voting) Regulations, 2016 to define authentication as email and SMS code verification and extend applicability to meetings held on or after June 30, 2017. The amendments establish strict eligibility criteria for intermediaries, requiring secure web portals, ISO certification, penetration testing, and background checks for directors and employees. Specific technical mandates include encrypted passwords, CAPTCHA mechanisms, HTTPS protocols, and comprehensive activity logging, while removing previous provisions regarding minimum member thresholds and sub-regulation 3 of regulation 4.
Islamabad, 20th January 2017
S.R.O. 33 (I)/2017.- The following draft amendments to the Companies (E-Voting) Regulations, 2016 proposed to be made by the Securities and Exchange Commission of Pakistan, in exercise of the powers conferred by section 506A of the Companies Ordinance, 1984 (XLVII of 1984) read with clause (ii) of sub-section (1) of section 40 of the Securities and Exchange Commission of Pakistan Act, 1997 (XLII of 1997), is hereby published in the official Gazette for information of all the persons likely to be affected thereby and notice is hereby given that objections or suggestions, if any, received within fourteen days from the date of its publication in the official Gazette will be taken into consideration.
In the aforesaid regulations, -
(1) in regulation 2, in sub-regulation (1), clause (a) shall be substituted, namely;
(a) “authentication” means authentication through email and SMS codes for ensuring communication with legitimate shareholder;”;
(2) in regulation 3, after the word “companies”, the words “to be held on or after June 30, 2017” shall be inserted;
(3) in regulation 4, -
(a) for sub-regulation (1), the following shall be substituted, namely: -
“(1) A central depository licensed under the Securities Act, 2015 (III of 2015) or a share registrar and balloter as registered under the Share Registrars and Ballotters Regulations, 2017 may be eligible to perform the functions of an Intermediary if it fulfills the following requirements, -
(i) owns or provides a web portal for e-voting, computer hardware, software and procedure that;
(ii) are reasonably secure from unauthorized access and misuse;
(iii) provide reasonable level of reliability and correct operation;
(iv) are reasonably suited for performing the intended functions; and
(v) adhere to generally accepted security procedure.
(b) employs persons who are expert in the operation of such hardware and software to discharge the services offered;
(c) possess or provides a secured system based on process of display of electronic ballots, recording of votes of the members and the number of votes polled in favour or against, in such a manner that the entire voting exercised by way of electronic means get registered and counted in electronic registry in a centralized server with adequate cyber security and certified from independent external party auditors or expert regarding information security standard (e.g. ISO Certification), penetration testing and cyber security protection;
(d) the web portal and systems must possess following securities features:-
(i) use of Digital Signature or authentication for communication with legitimate shareholders;
(ii) maintenance of passwords in the encrypted mode in the database;
(iii) CAPTCHA mechanism upon login of e-voting portal;
(iv) secure communication by use of HTTPS protocol and SSL certificate;
(v) all significant activity by web portal users shall be logged; and
(vi) capable of backup of database for data loss prevention;
(e) its directors and employees have not been convicted of an offence involving fraud or breach of trust and not punished for an offence under the Ordinance and any rules made or directive issued thereunder; and
(f) it is not an associated company or undertaking.”
(b) sub-regulation (3) shall be omitted;
(4) in regulation 6, sub-regulation (4), the words “at least five members or by any” shall be omitted;
(5) in regulation 8, sub-regulation (1), clause (b), sub-clause (i), after the words “registered email addresses” the words “and codes through SMS” shall be inserted;
(6) in regulation 9, for sub-regulation (2), the following shall be substituted, namely: -
“(2) Identity of the members intending to cast an e-vote is required to be authenticated through secured electronic signature or authentication for login provided by the Intermediary and shall cast vote online during the time specified in sub-regulation (1) of regulation 8 above.”
EMD/MISC/82/2012
(Bilal Rasul)
Secretary to the Commission
Page 2 of 2