Barrister Hassaan Salahuddin & Taha Hafeez | Salahuddin, Saif & Aslam (Attorneys at Law)
In an NBFC-led digital lending arrangement, a fintech partner may provide the technology and customer-facing platform, but the licensed NBFC remains responsible for the regulated lending activity. A partnership does not, however, remove the need to assess whether any functions performed by the fintech partner require separate regulatory authorisation. The key question is how operational functions and regulatory accountability are allocated.
For international fintech businesses considering Pakistan, a partnership with a locally licensed lender may offer a route to delivering a digital customer experience. A fintech may design the lending journey, operate an application and manage the customer interface without itself originating the loan. The NBFC’s regulatory obligations, however, extend beyond disbursement to credit assessment, borrower verification, reporting and oversight of the platform used. The legal assessment therefore depends on the functions each participant performs, rather than the labels used in the commercial agreement.
The Licence Sits With the Lender
The Non-Banking Finance Companies (Establishment and Regulation) Rules, 2003 (the “NBFC Rules”) define a lending NBFC as an NBFC licensed by the Securities and Exchange Commission of Pakistan (“SECP”) to undertake leasing, housing finance, investment finance or discounting services (rule 2(1)(xxxiii)), and define finance to include a loan, advance or discounting service to any person (rule 2(1)(xx)). A licence is granted for each form of business (rule 5(1)), and a company incorporated as an NBFC may not undertake any other activity (rule 5(6)(l)). The licensing power sits in Part VIII A of the Companies Ordinance, 1984, which section 509(1) of the Companies Act, 2017 preserves for NBFCs.
The Non-Banking Finance Companies and Notified Entities Regulations, 2008 (the “NBFC Regulations”) describe digital lending as providing finance through digital, technology-based or internet-based channels, apps or tools, with limited or no human interaction for loan application, approval, disbursement and repayment (regulation 2(1)(xiaaab)). In the NBFC-led model examined here, the app is a delivery channel for the licensed activity; the analysis does not suggest that every form of lending in Pakistan must be undertaken by an NBFC.
What the Regulations Place on the NBFC
SECP’s power over digital lending is written as an obligation on the NBFC, and it reaches the platform the NBFC uses. Regulation 28(da) provides that Lending NBFCs shall comply with such requirements as SECP may specify by circular, including requirements on digital lending, fair treatment of borrowers and pricing disclosures, disclosure of products and terms, minimum disclosure for digital applications, websites and any other platform used by the NBFC for the licensed activity, information technology and security, personal data privacy and security, cloud storage and limits on the collection of data. The Regulations fix the subject areas, and the detail is left to circulars.
SECP has used that power. Circular No. 12 of 2024, Requirements for NBFCs engaged in Digital Lending, was issued on 15 May 2024 under section 282B(3) of the Companies Ordinance, 1984 and regulation 28(da), and supersedes SECP’s earlier circulars on the subject from 2022 and 2023. Circular No. 8 of 2024 adds guidelines on advertising and call centre conduct. Both are addressed to the NBFC, and the circular defines a “Digital Lender” as a lending NBFC engaged in digital lending through channels, apps or tools that it administers, manages or owns (paragraph 9(a)).
Credit reporting is placed on the NBFC in the same way. Regulation 21 requires an NBFC to give due weight to the credit report from a credit information bureau when it provides finance of Rs 500,000 or more, after netting off liquid assets held as security, and requires NBFCs undertaking digital lending to initiate data sharing with credit bureaus on a real-time basis. Circular 12 goes further for digital lenders: they must hold membership of a credit information bureau, use a credit report in the decision on every loan application, and report to all bureaus in real time (paragraph 3(b)).
The Circular Addresses Partner Models Directly
Circular 12 does not leave partner arrangements to inference. It permits an NBFC to extend its lending services by integrating, through an application programming interface, with digital lending apps, platforms or tools that SECP has whitelisted, and with other digital platforms as SECP may specify (paragraph 2(c)). The permission is conditional from the outset, because it runs through the whitelist.
The whitelist is central to the regulatory treatment of digital channels. Circular 12 requires an application to SECP before launching a digital lending app or other channel and prescribes restrictions on listing and operating apps, including consequences of delisting (paragraph 6). It also addresses the number of apps a digital lender may operate. How these requirements apply to a partner-operated platform, particularly one serving more than one lender, calls for a careful assessment of the actual proposed arrangement.
Circular 12 also imposes requirements governing disbursement and recovery through the digital lender’s accounts and the treatment of credit intermediation fees (paragraphs 1(n) and 1(f)). These provisions are significant where a partnership separates the customer interface, lending decisions and payment functions. The appropriate allocation of those functions depends on the proposed transaction and the applicable regulatory authorisations.
The framework also places technology, security and borrower-data obligations on the digital lender, including requirements concerning vendor arrangements, API access, data storage and digital fraud (Circular 12, paragraphs 7–8 and Annexure C). The involvement of a technology provider does not, by itself, displace the NBFC’s obligations. The precise controls and contractual protections required should be evaluated against the proposed operating model.
A Framework Built by Amendment
The digital lending provisions were not in the original 2008 text. They arrived through amendments to the NBFC Regulations and the AML/CFT Regulations and through SECP circulars. S.R.O. 2120(I)/2025 of 11 November 2025 amended the NBFC Regulations again, including regulation 21 on credit bureau reports and a digital borrower fact sheet for digital lenders. The position therefore has to be read from the current text of each instrument.
Customer Due Diligence: Where Partner Models Meet the Rules
Customer onboarding is often conducted through a fintech partner’s interface. Under the Securities and Exchange Commission of Pakistan (Anti Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing) Regulations, 2020 (the “AML/CFT Regulations”), NBFCs are regulated persons (regulation 3(1)(r)). The framework addresses identity verification and record retention, while Circular 12 prescribes additional digital onboarding and account-verification requirements. The involvement of an app or service provider does not eliminate the NBFC’s responsibility to ensure that applicable customer due diligence requirements are met.
An operational onboarding function must be distinguished from formal third-party reliance under regulation 24 of the AML/CFT Regulations. A fintech may collect customer information or facilitate verification through its platform without necessarily qualifying as a third party on which the NBFC may rely for regulatory purposes. Formal reliance is subject to prescribed conditions, including the status of the proposed third party, and must be assessed against the actual arrangement.
The NBFC must ensure that applicable customer due diligence requirements are met, whether the customer journey is handled directly or through a partner. The use of a technology provider does not, by itself, transfer regulatory responsibility for customer due diligence.
Even where qualifying third-party reliance is available, the NBFC retains continuing AML/CFT responsibilities, including ongoing monitoring and suspicious transaction reporting. The proposed allocation of onboarding functions should therefore be reviewed as part of the wider regulatory structure.
Beyond SECP: The Payment Flow
Circular 12 addresses the accounts through which digital lending disbursements and recoveries must occur. Where banks, wallets or payment service providers are involved, SBP-regulated activities may raise separate questions alongside the SECP framework. The analysis is related to our separate Insight, “Merchant Acquiring in Pakistan: Who May Hold the Merchant’s Money?”
Questions That Decide Whether the Structure Works
The answer depends on the actual roles of the lender, platform and any other service providers. Licensing, platform control, onboarding, credit decisions, borrower data and payment flows must be considered together. These are the questions that determine whether an arrangement requires further regulatory analysis rather than simply a commercial agreement.
Digital lending partnerships may divide the customer journey among several businesses without dividing regulatory accountability in the same way. For an NBFC-led arrangement, the central question is whether each partner’s role is consistent with the NBFC’s licence and the separate obligations that may apply to other participants. Identifying that boundary is essential before a proposed model can be assessed as legally workable.
How SSA Advises NBFCs and Fintech Partners
Salahuddin, Saif & Aslam (Attorneys at Law) advises NBFCs, fintech businesses and international lending platforms on the establishment and licensing of NBFCs, digital lending, partner and embedded-finance arrangements, and regulatory market entry in Pakistan. Drawing on its experience in NBFC licensing and fintech regulatory mandates, SSA examines how proposed commercial models allocate functions across lending, payments, technology and AML/CFT requirements. The firm advises on the regulatory implications of those arrangements, including where a licensed lender and a technology partner operate together.
This article provides general information on the regulatory developments discussed and does not constitute legal advice. Applicable requirements depend on the proposed activities, business structure and regulatory authorisations involved.
About the Authors
Barrister Hassaan Salahuddin (Managing Partner) and Taha Hafeez (Junior Partner) lead the firm’s fintech practice and advise on fintech regulation, digital payments and virtual assets.