SBP Allows Exchange Companies to Use VPNs
Use of Virtual Private Networks (VPNs)
The State Bank of Pakistan has permitted exchange companies to use Virtual Private Networks (VPNs) for conducting operations such as currency exchange, inward and outward remittances, utility bill payments, and related activities.
As per the Regulatory Framework for Exchange Companies, these companies must establish redundant network connections to primary and secondary sites using VPNs or dedicated links. Additionally, internet access should be restricted to ensure secure and reliable operations.
Regulations for Exchange Companies
The State Bank of Pakistan (SBP) has implemented stringent regulations for exchange companies, encompassing high paid-up capital requirements, operational compliance, monitoring systems, and robust security controls. Companies must ensure that both primary and secondary data centers are located within Pakistan.
Exchange companies are permitted to outsource workloads to local Cloud Service Providers (CSPs), provided they implement strict security measures to protect operating systems, software, networks, security devices, and databases. Additionally, monitoring and control procedures must be established to regulate access to sensitive data and systems for both users and vendors.
Public Services by Exchange Companies
Exchange companies may install banks’ ATMs for PKR at their outlets under mutually agreed terms with the respective banks, without requiring prior approval from SBP. They are also allowed to conduct branchless banking as agents for banks and microfinance institutions, following SBP’s Branchless Banking Regulations.
Furthermore, companies can enter agreements with utility providers, such as WAPDA, KE, PTCL, and SSGC, to collect utility bills in PKR on their behalf.
Business Continuity and Disaster Recovery Plans
Exchange companies must develop comprehensive Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) to minimize financial losses, maintain uninterrupted customer service, and mitigate disruptions to business operations.
Guidelines for Remittance Operations
Before commencing inward home remittance operations, exchange companies must seek prior approval from SBP. They are required to surrender 100% of foreign currency (FCY) received as inward remittances in equivalent US Dollars in the interbank market on the same day.
For outward remittances, companies are only authorized to process transactions for personal accounts, including personal financial transactions. They are strictly prohibited from handling outward remittances for trade or commercial purposes, including payments for services, commissions, or similar transactions, whether for individuals or corporate clients.
Guidelines for Outward Remittances and Documentation
Exchange companies are permitted to effect outward remittances up to 75% of the inward home remittances mobilized during the preceding month.
Companies must retain copies of identification documents, such as the Computerized National Identity Card (CNIC), National Identity Card for Overseas Pakistanis (NICOP), Pakistan Origin Card (POC), or passport (with a valid visa or other proof of legal stay for foreigners in Pakistan). These copies should be made after verifying the original documents.
Additionally, companies are required to conduct biometric verification for all transactions involving Pakistani nationals and maintain a record of this verification.