Can a fintech offer wallet services without State Bank authorisation?

A fintech proposing to issue stored-value wallets or electronic money to customers in Pakistan generally requires State Bank of Pakistan authorisation under the Payment Systems and Electronic Fund Transfers Act, 2007 and the Regulations for Electronic Money Institutions, revised in June 2023. Merely incorporating a technology company or obtaining a software vendor agreement does not authorise the company to hold customer wallet balances as a regulated e-money institution. The appropriate regulatory category depends on who holds funds, who issues the stored value, and who legally provides the payment service.

Analyse what the product actually does

A mobile application may display balances, connect customers to an existing bank or actually issue e-money. These activities are not interchangeable. If a company takes customer money and issues electronically stored monetary value accepted for transactions, EMI regulation can apply. A provider offering only user-interface software for a licensed institution may occupy a different contractual position. The licensing assessment should follow actual functionality, custody and transaction flows rather than the app's marketing description.

The legislative framework

The Payment Systems and Electronic Fund Transfers Act, 2007 provides statutory powers concerning payment systems and electronic money institutions. SBP issued EMI regulations in 2019 and revised them in June 2023. Additional circulars can affect customer onboarding and permitted services. A product designer should consult the current regulations before preparing customer terms, especially where new wallet products, payments aggregation or escrow are proposed.

Distinguish an EMI from a bank

An EMI is not automatically licensed to conduct ordinary banking business, accept deposits as a bank or extend credit merely by operating a wallet. The permissible activities and safeguards follow its authorisation. The business must identify whether it intends to issue stored value, transfer funds, aggregate payments or offer loans. The need for separate banking, microfinance or other permissions cannot be avoided by calling every feature a "digital wallet."

Staged licensing process

SBP's public materials describe in-principle approval, pilot operations and commercial operations authorisation; the 2023 regulations also provide for an initiation phase in specified circumstances. Each stage has its own conditions. In-principle approval is not automatic permission to market unrestricted live wallet services. Limited pilot operations require the appropriate SBP approval and compliance with its terms. Commercial launch follows separate authorisation after satisfactory readiness.

Incorporation and applicant documents

The proposed EMI ordinarily needs a properly registered Pakistani legal entity and supporting governance, financial and operational documentation under the regulations. The application should identify ownership, beneficial shareholders, management, business model and projected transactions. A pitch deck promising rapid financial inclusion is not enough. SBP must be able to assess the firm's fitness, controls and ability to protect customers.

Capital and security arrangements

EMI regulations prescribe financial resource and security requirements at applicable stages. The company should determine the current required amount and its legal form rather than quote an obsolete launch-capital figure. Paid-up capital is different from money held for customers. A parent company's informal willingness to provide additional funds may not satisfy the applicable capital test without proper commitments and records.

Safeguarding customer funds

Customer balances require protection under the EMI framework. The fintech should understand required trust, safeguarding or designated account arrangements and how it reconciles issued value with funds held. Customer money is not automatically working capital that founders may spend on development. Appropriate segregation and reconciliation should be operating before a licensed service accepts wallet balances.

Technology and cybersecurity

The application may need strong authentication, transaction integrity, cybersecurity, disaster recovery and independent testing. A wallet can create direct losses for users if access credentials are compromised. The firm should document system architecture, outsourcing, incident response and business continuity. A generic statement that a cloud provider is secure does not demonstrate the applicant's own compliance with SBP's requirements.

Customer identification and AML

A licensed wallet provider must apply relevant customer due diligence and transaction monitoring rules. Requirements can be tailored to wallet category, limits and customer risk. A proposed simplified onboarding flow must meet current SBP rules rather than avoid identification entirely. Relevant 2026 instructions concerning teenager accounts and wallets demonstrate why the fintech should consult the newest product-specific circulars before designing identity flows.

Agents and merchants

Wallet services may involve merchants, distribution agents or other partners. The licensed provider should define responsibilities, safeguarding, fees and complaint handling. A merchant accepting wallet payment is not necessarily a regulated EMI, but the institution providing e-money must meet its own duties. A company cannot shift all responsibility to a retailer merely because the retailer introduced customers to the app.

Partnering with an existing EMI

A startup may offer technology or distribution services through a licensed bank or EMI, subject to lawful outsourcing and contractual arrangements. The agreement should specify which entity issues value, owns customer relationships, holds funds and handles complaints. A partner's existing authorisation does not transfer to the startup automatically. The startup should avoid suggesting it is independently SBP licensed if it only supplies software to a licensed firm.

Payment gateway or PSO/PSP

SBP distinguishes payment system operators and payment service providers from EMIs. Payment gateways, processing networks and switching services can require separate regulatory treatment. A PSO/PSP that does not hold customer funds is not the same as an EMI issuing value. The business model should be mapped to current SBP categories before filing. Multiple activities may require a carefully structured approval path.

Consumer terms and complaints

Customers should receive accurate terms covering balances, fees, failed transfers, refunds, account restrictions and complaints. The institution should maintain a dispute mechanism and records needed to investigate unauthorised transactions. A blanket contract stating the wallet operator has no responsibility for all failures may conflict with applicable law or regulation. Customer protection is a core regulatory issue, not an optional feature to add after launch.

An app concept example

A startup builds a mobile wallet allowing users to deposit Rs. 10,000 and send balances to merchants. If the startup itself issues stored value and holds the monetary backing, it should analyse the EMI licensing route and may not launch commercially merely because the code works. It can explore a lawful partnership with an authorised institution while pursuing its own approval. Product presentation must identify the true regulated provider.

A software-only example

A developer supplies a mobile frontend to an existing licensed bank, while all customer accounts, custody and transactions remain the bank's regulated responsibility. The developer may not require the same EMI licence solely because it writes the code, although outsourcing, data and cybersecurity duties can still apply. The contractual and operational facts must support the distinction. The developer should not market itself as the wallet issuer without authorisation.

Opinion and recommended course

Issuing electronic money and operating stored-value wallets generally requires SBP authorisation; incorporation or technical readiness alone is insufficient. Map custody and payment flows, identify EMI or PSO/PSP status, satisfy staged licensing and safeguard customer funds. A licensed partnership can be considered, but the roles and public disclosures must accurately reflect who has regulatory permission.

Principal authorities: Payment Systems and Electronic Fund Transfers Act, 2007; SBP Regulations for Electronic Money Institutions, revised June 21, 2023; SBP PSO/PSP Rules; applicable SBP AML/CFT and digital onboarding circulars.