Regulatory Alerts2025-10-03 | PSP&OD Circular No 04 of 2025Added · Updated
Technology Risk Management Framework for Payment Institutions
The State Bank of Pakistan mandates baseline technology risk management requirements for Payment Systems Operators, Payment Service Providers, and Electronic Money Institutions. The framework requires Boards of Directors to oversee technology risks, mandates specific governance structures including Heads of IT and Information Security, and enforces rigorous controls for identity management, network security, and data protection. It establishes strict liability rules for digital financial fraud, holding originating or beneficiary institutions fully liable for customer losses if dispute lodgment or fund blocking occurs outside a 30-minute window. Additionally, the document supersedes previous outsourcing and security regulations, requiring written approval for offshore outsourcing and advance notification for material third-party arrangements.