Taha Hafeez | Junior Partner, Salahuddin, Saif & Aslam (Attorneys at Law)
Connecting to Pakistan’s instant payment system does not necessarily mean a business can move and settle payments independently. For fintechs and payment platforms, the real question is what they can do directly, where a banking partner is needed, and who remains responsible.
For a fintech or payment platform looking to operate in Pakistan, access to Raast can be an important part of its payment offering. Depending on the business model, a provider may need to work through a bank or another regulated institution, even where it has the technology to connect directly.
The State Bank of Pakistan (“SBP”) has established four participation categories that determine how businesses can access Raast, whether they can settle payments themselves, and what responsibilities they retain. These distinctions matter when deciding how to enter the market, structure a partnership and develop a payment service as transaction volumes grow.
Access to Raast Is Not the Same for Everyone
Raast is Pakistan’s instant payment system, supporting payments between individuals, businesses and government departments. For a business that wants to use it, the first question is not only whether it is eligible to participate, but what form that participation can take.
SBP’s Raast Participation Criteria (the “Criteria”), issued under PSP&OD Circular No. 01 of 2025 on 21 February 2025 under the Payment Systems and Electronic Fund Transfers Act, 2007, set the framework. They took effect immediately and apply to existing and future participants. Raast is owned and operated by SBP or its subsidiary, and its use cases are bulk payments, person-to-person and person-to-merchant payments and payment initiation services (paras 1 and 2).
Eligibility to apply is wide. It reaches banks and microfinance banks, regulated non-bank financial institutions, government bodies, corporates and SMEs, and business platforms, payment aggregators and fintechs (para 3(i)), as well as entities with a pending SBP licence application and a valid in-principle approval (para 3(ii)).
Eligibility is not the same as category. Access is given under four categories, namely Direct Settlement Participants, Direct Non-Settlement Participants, Payment Initiation Service Providers and Indirect Participants (para 4), each with its own requirements. A participation category determines how an entity reaches the payment system. It does not, by itself, authorise the underlying financial activities conducted through that access.
Who Can Settle Payments Directly?
Being eligible to connect to Raast is not the same as being able to settle payments. Direct settlement is reserved for specified regulated financial institutions and government bodies, and other businesses must consider a different arrangement even where they have the technical capability to connect.
A Direct Settlement Participant (“DSP”) holds its own settlement accounts with SBP, connects directly to Raast and must pre-fund those accounts to contain liquidity, credit and settlement risks (para 4 and para 4(a)(ii)). Only the entities in paragraph 3(i)(a) to (c) may apply, namely banks and microfinance banks, regulated non-bank financial institutions and government bodies. A business that qualifies only as a corporate, platform or fintech under paragraph 3(i)(e) or (f) cannot be a DSP, although one that separately qualifies under paragraph 3(i)(a) to (c) is not excluded because it is also called a fintech.
A Direct Non-Settlement Participant (“DNSP”) connects directly but relies on a bank to settle for it. It must enter into a legally binding Sponsorship Arrangement with that bank to manage its position accounts and replenish funds on time (para 4(b)(ii)), under which the bank assumes responsibility for clearing and settling its Raast transactions (para 1). Direct connectivity therefore does not remove the need for a regulated settlement relationship, and the DNSP keeps its own obligations to SBP as a participant (para 5).
A Payment Initiation Service Provider (“PISP”) starts payments but does not settle them. It is authorised by SBP to send payment orders directly to Raast through a direct technical connection (para 4(c)). That connection enables payment initiation, on the user’s consent, from an account or wallet held at a financial institution (para 1). It does not, by itself, give the PISP settlement or position accounts, and the Criteria do not describe it as a holder of customer funds. Any eligible applicant under paragraph 3(i), including a DSP or DNSP, may apply, and every PISP must comply with SBP’s relevant regulations.
Can a Fintech Reach Raast Through a Partner?
For a foreign platform, the indirect route raises three questions. Can it enter through an existing regulated institution, what does that institution remain responsible for, and will the arrangement still work as the business grows? The Criteria answer each of them.
An Indirect Participant (“IP”) reaches Raast through a regulated participant instead of connecting itself. It meets none of the conditions for direct participation and offers Raast services to its customers through technical, legal and operational arrangements with a regulated participant (para 4(d)(i)). The Criteria put the heavier load on that participant. It must adopt onboarding policies covering due diligence on the IP and its sponsors, the business use case, risk management, consumer protection and legal compliance, and it is responsible for processing, clearing and settlement on the IP’s behalf (para 4(d)(ii)(a) and (b)). It must assess the arrangement on an ongoing basis, tell SBP immediately of any significant risk, and report to SBP each quarter the name, nature of business and transaction volume and value of every IP (para 4(d)(iii) and (iv), Annexure A).
The agreement between the participant and the IP must carry set terms. Transactions originated by the IP are irrevocable and final once Raast has acknowledged and validated them, the IP must comply with SBP’s instructions and keep its systems secure, and SBP may assess those systems or require a third-party assessment (para 4(d)(ii)(d)). Most significantly, SBP may require the IP at any time to become a DSP or DNSP, or to obtain an authorisation or licence from SBP, having regard to the nature of its business, its transaction volumes and values or any other factor.
Indirect participation may therefore be a less infrastructure-intensive route than direct connection, depending on the business model and the sponsoring participant’s requirements. But because SBP can require a move, a structure that suits pilot volumes may not remain the right one at scale.
Who Answers When Something Goes Wrong?
The practical question is who bears the loss when something fails. Each participant assumes liability for losses arising from a failure of controls at its own end (para 5(ii)), and must comply with the Payment Systems and Electronic Fund Transfers Act, 2007 and the Anti-Money Laundering Act, 2010 and keep customer data secure and confidential. DSPs, DNSPs and PISPs also sign agreements with SBP and complete technical integration under its Integration Specifications (para 5(i)). Onboarding is staged, from application and a non-disclosure agreement through a participant agreement to be signed within ten working days, an integration plan, conditional approval for a pilot and commercial go-live, and SBP may end the process at any stage if progress is unsatisfactory (para 6).
One provision matters to any provider that markets itself on its Raast connection. On-boarding of an unregulated entity on Raast does not imply that the entity is regulated by SBP (para 6(ix)). SBP may also suspend or terminate participation with immediate effect where, among other grounds, a participant threatens the security, integrity or reputation of Raast or fails to replenish its account in time, and it may reject an application without giving reasons (paras 8(i) and 8(ii)(b)).
What Does This Mean for Merchant Payments?
The merchant side of Raast shows why the category matters. SBP has required regulated entities to enable existing and new merchants to accept Raast payments (Person to Merchant), directly or by partnering with an SBP-regulated EMI, PSO or PSP (PSP&OD Circular Letter No. 01 of 2024), and has permitted banks, microfinance banks and EMIs to meet merchant acceptance requirements through authorised PSOs, PSPs, payment schemes and other third parties offering merchant acquiring services (PSP&OD Circular No. 02 of 2025, paras 1 and 3). Those arrangements run through regulated institutions, and who may hold the merchant’s money within them is the subject of our separate Insight, Merchant Acquiring in Pakistan: Who May Hold the Merchant’s Money.
The same pattern shows in the economics. PSP&OD Circular No. 03 of 2025 allocated a time-limited government subsidy of PKR 3.5 billion to eligible Raast P2M QR transactions between 1 September 2025 and 30 June 2026, shared between the merchant’s and the customer’s financial institution (paras 2 and 3), and we have not seen an extension. The circular is addressed to SBP-regulated entities, so in our view a fintech that reaches Raast through a regulated participant should expect any share of the subsidy to depend on its contract with that participant.
Choosing the Right Route to Raast
Three questions decide the structure. What can the business be under the Criteria? Which bank settles for it, and on what terms? And does the model still work if SBP requires a move to a direct category, or an authorisation of its own, as volumes grow?
For an international provider, access to Raast is therefore not simply a question of connectivity. The participation category determines how settlement is arranged, where operational responsibility rests and which regulatory obligations attach to the business. The right structure has to suit the service at launch and also the possibility that SBP will require a different participation arrangement as the business develops.
This article provides general information on the regulatory developments discussed and does not constitute legal advice. Applicable requirements depend on the proposed activities, business structure and regulatory authorisations involved.
About the Author
Taha Hafeez is a Junior Partner at Salahuddin, Saif & Aslam (Attorneys at Law). He advises on fintech regulation, digital lending, payments and virtual assets.