Barrister Hassaan Salahuddin & Taha Hafeez | Salahuddin, Saif & Aslam (Attorneys at Law)
Acquiring, gateway services and settlement sit in different licence categories in Pakistan. For an international payment provider, the structure turns on who may hold the merchant’s money.
A gateway operating under the PSO/PSP framework can route a card payment in Pakistan, but it cannot itself hold the payment funds. The first question is therefore not which technology to deploy but which institution will contract with the merchant, receive the funds and settle the transaction. Global descriptions of merchant acquiring treat the acquirer, the gateway and the processor as commercial roles that one company can combine. In Pakistan those roles sit in different licence categories set by the State Bank of Pakistan (“SBP”), and who may hold the merchant’s money is answered by regulation before it is answered by contract.
Acquiring Is Not One Licence
SBP’s Payment Systems Operators and Payment Service Providers Rules (the “PSO/PSP Rules”) define an acquiring bank as the entity that holds the deposit accounts of card acceptors and merchants, collects the transaction data and settles. A payment systems operator or payment service provider (a “PSO” or “PSP”) is something different: a company registered with SECP that acts as an intermediary for the multilateral routing, switching and processing of payment transactions, through services such as an electronic payment gateway, a POS gateway, an e-commerce gateway, a payment scheme, a clearing house or an ATM switch.
The Rules give a PSO or PSP the platform for clearing, processing, routing and switching, and then withhold what a merchant most needs from an acquirer. Under rule 6.5 a PSO or PSP may not act as custodian of a consumer’s money or perform any banking function. Under rule 7.2 settlement takes place at an SBP-licensed commercial bank, and at no point should the PSO or PSP have access to or hold the consumer’s or participant’s funds.
The consequence is structural. A gateway that wishes to offer acquiring has to work with a bank, and under rule 6.6 it makes its agreements with financial institutions licensed by SBP. Under rule 7.1 the roles of the financial institution, the issuer, the acquirer and the PSO or PSP are set by contract between them, and the contract carries what the Rules leave open: who onboards the merchant, who bears the settlement risk and who answers to SBP for what. In our view a provider that cannot say, in one sentence, which institution holds the merchant’s money has not yet decided its Pakistani structure.
The Statute and Three Licence Categories
SBP’s authority rests on the Payment Systems and Electronic Fund Transfers Act, 2007 (Act No. IV of 2007) (the “PS&EFT Act”). Section 3(1) lets it issue rules, guidelines, circulars and directions over service providers, operators of payment systems and issuers of payment instruments; the PSO/PSP Rules were made under it by PSD Circular No. 3 of 23 October 2014, and section 24 is the basis on which an electronic money institution is licensed.
A PSO or PSP is approved in three stages, namely in-principle approval, a pilot and final approval. It must hold paid-up capital of PKR 200 million, or such other amount as SBP prescribes, and it needs SBP’s prior approval for its products, schemes and services (rule 6.4). These permissions shape not only regulatory entry but also the provider’s commercial model, including the functions it may perform itself and those that require a regulated institutional partner. The operating duties that follow are set out later in this article.
Electronic money institutions (“EMIs”) are the third category, regulated under SBP’s Regulations for Electronic Money Institutions, as revised by PSP&OD Circular No. 03 of 2023. Paragraph 7(I) lets an EMI issue and redeem e-money, route, switch and process payment transactions, and provide payment aggregation and payment initiation services, and paragraph 7(I)(d) permits it to “acquire payment instruments of other EMIs and banks/MFBs”. A PSO or PSP authorised under the Rules may upgrade to an EMI licence (paragraph 7(VII)).
An EMI differs from a PSP on the point that matters most here. It may hold customer funds, but only in a trust account at a licensed bank rated at least A, kept apart from its own money (paragraph 16.I); it must hold PKR 200 million of capital to start (paragraph 11); and it may not conduct the business of banking, or process, hold or transfer value in virtual currencies (paragraph 7(III)).
Paragraph 7(I)(d) speaks of acquiring payment instruments and is silent on merchants. Section 24(2) of the PS&EFT Act confines an EMI to the activities specified in its licence, so whether a particular EMI may sign card-accepting merchants and settle to them is answered by its own licence, and not by paragraph 7(I) alone. The scope of an EMI’s acquiring permissions is therefore a matter of its own authorisation and the arrangements proposed; the licence category alone should not be read as conferring unrestricted merchant-acquiring authority.
Four Routes for International Payment Providers Entering Pakistan
An international provider has four routes to Pakistani merchants: a local PSO or PSP company, a partnership with a bank, microfinance bank or EMI, participation as or through a Raast merchant service provider, or service from abroad with Pakistani institutions performing the domestic functions. Each is defined by the permissions it relies on. A PSO or PSP company operates its own gateway under SBP approval but cannot hold merchant funds. A regulated partner can provide acquiring and settlement, but its licence does not by itself cover what the provider does. A Raast merchant service provider onboards merchants for account-to-account acceptance. A cross-border service remains subject to foreign exchange law and to the rules that apply to the activity carried on in Pakistan.
These routes are not interchangeable. Commercial labels such as “gateway”, “aggregator” or “acquirer” do not necessarily determine the regulatory character of a service, and which structure fits turns on the services performed, the movement of funds and the permissions held by each institution involved.
Raast Changed the Acquiring Proposition
A provider entering Pakistan is no longer designing only for card acceptance. SBP’s Raast Person to Merchant (“P2M”) service, launched by PSP&OD Circular No. 04 of 2023, puts account-to-account payment, merchant QR codes and request to pay at the centre of merchant acceptance, and SBP has set dates for banks, microfinance banks, EMIs, PSOs and PSPs to support it.
The Raast merchant service provider onboards businesses, including aggregators, marketplaces and billers, after due diligence. It offers five acceptance modes, namely request to pay now, request to pay later, IBAN, merchant alias and static or dynamic QR code, and credits merchants in real time or within the agreed timelines (paragraph 5). It may embed Raast merchant services in partner apps if it complies with SBP’s regulations (paragraph 6(c)), and other regulated entities that wish to become merchant service providers notify SBP’s Digital Innovation and Settlements Department and complete the integration (paragraph 8).
Circular Letter No. 01 of 2024 and Circular No. 02 of 2025 then required banks, microfinance banks and EMIs to enable existing and new merchants for Raast P2M and to provide digital acceptance solutions, either directly or through authorised PSOs, PSPs, payment schemes and third parties offering merchant acquiring services. In our view the practical effect for an international provider is to widen the field in which Pakistani banks may look for acceptance partners.
The Cross-Border Route
Cross-border acquiring is not one proposition. A provider may want to collect from Pakistani consumers for overseas merchants, from international consumers for Pakistani merchants, or to process domestic payments between Pakistani consumers and merchants. These are commercially distinct, and their regulatory treatment may differ. Permission for one flow should not be assumed to extend to another.
On the fourth route, SBP’s FE Circular No. 01 of 2026 of 22 May 2026 adds paragraph 11A to Chapter 14 of the Foreign Exchange Manual. It lets Authorized Dealers remit for Pakistani companies that act as intermediaries or aggregators between foreign service providers and users in Pakistan, with the rupees collected locally. Its scope is narrow: it covers digital advertising and IT-related services, and it excludes financial services.
In our view paragraph 11A is therefore not a route for collecting rupees from Pakistani merchants and remitting them abroad. FE Circular No. 07 of 2020 (paragraph 39, Chapter 12 of the Foreign Exchange Manual) is also of limited help, since it concerns e-commerce exports of goods. The treatment of an offshore acquiring arrangement therefore depends on its activities, its settlement flows and the permissions held by each institution involved.
A Special Case: Stablecoin Acceptance
Stablecoin-linked merchant acceptance raises a distinct regulatory question. Regulation 3(6) of the Pakistan Virtual Asset Services Regulations, 2026 provides that virtual assets shall not facilitate, or be used or recognised as, a means of payment for domestic commercial transactions, except where SBP has specifically approved, and an EMI must refrain from processing, holding or transferring value in virtual currencies. It should therefore not be treated as an ordinary extension of a payment gateway offering. The question is considered in our article, From Experimentation to Execution: Pakistan’s Next Phase of Fintech Regulation.
Technology, Data and Records
Technology is where the licensing position becomes an operating obligation. For an SBP-authorised PSO or PSP, that includes requirements on local facilities, outsourcing, regulatory approvals, transaction records and technology risk management. An international provider working through a bank or EMI partner should expect those requirements to reach it through the partner’s contract and diligence.
Questions That Determine the Regulatory Position
The regulatory assessment does not end with identifying a licence category. Four connected considerations frame the analysis: regulatory permissions, the movement and custody of funds, institutional arrangements, and operational compliance. Their application depends on the proposed business model and the specific permissions of the institutions involved.
For an international payment provider, the real challenge is not connecting Pakistani merchants to its technology. It is establishing a legally workable allocation of licensing, custody, settlement and regulatory responsibility among the institutions involved, and fitting the arrangements to the permissions each of them holds.
How SSA Advises Payment and Fintech Businesses
Salahuddin, Saif & Aslam (Attorneys at Law) advises domestic and international financial institutions, payment service providers and fintech businesses on navigating Pakistan’s financial regulatory framework. The firm’s practice encompasses regulatory licensing, payment and settlement structures, institutional partnerships and cross-border financial services. Our approach combines regulatory interpretation with an understanding of how financial services businesses are structured, authorised and operated in Pakistan.
This article provides general information on the regulatory developments discussed and does not constitute legal advice. Applicable requirements depend on the proposed activities, business structure and regulatory authorisations involved.
About the Authors
Barrister Hassaan Salahuddin (Managing Partner) and Taha Hafeez (Junior Partner) lead the firm’s fintech practice and advise on fintech regulation, digital payments and virtual assets.