SECP proposes scrapping attested documents, introduces facial scan for investor verification

Pakistan's securities regulator has proposed sweeping changes to its anti-money laundering framework that would allow investors to be onboarded entirely through digital channels.

The Securities and Exchange Commission of Pakistan (SECP) published the draft amendments to the Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing (AML/CFT/CPF) Regulations, 2020.

The initiative, led by SECP Chairman Dr. Kabir Ahmed Sidhu, would be instrumental in moving away from decades-old reliance on paper documents for customer verification in banking and corporate sectors.

The most immediate change removes the word "attested" from verification requirements across the regulations. Under the current framework, customers submitting identity documents to brokers, asset managers, and other regulated entities must have those documents certified by a gazetted officer. The proposed rules eliminate that requirement, accepting plain copies, physical or digital, in its place.

IBAN as proof of identity

In a significant expansion of acceptable identity documents, the draft introduces the International Bank Account Number (IBAN) as valid proof of identity for the first time. An IBAN maintained at any Pakistani bank can be used, provided it is verified by the regulated person or a third party formally notified by the commission, such as the National Clearing Company of Pakistan (NCCPL) through the RAAST instant payment system.

There is a compliance condition attached: where an IBAN is used as the sole identity document, all customer receipts and payments must flow exclusively through that same verified account. The restriction is designed to preserve transaction traceability and close a potential gap that could arise if customers later transact through unverified accounts.

Multi-biometric system formalised

The amendments also formalize the use of NADRA's Multi Biometric Verification System (MBVS), which includes facial recognition, as the standard for identity authentication, replacing older references to generic "biometric verification." The language is also forward-looking, allowing any alternate verification system offered by NADRA in the future to qualify, without requiring a fresh regulatory amendment.

Regulated persons will be required to retain either a physical or digital log of NADRA Verisys or MBVS checks as documented proof of customer identity verification.

Corporate onboarding updated

For corporate customers, the document requirements have been updated to align with the current SECP company registration forms. Newly incorporated companies will be required to submit Form-1 and Form A/Form 24, while already-incorporated companies will submit Form-9, replacing older form references that no longer reflect current practice.

Compliance responsibility unchanged

Despite the shift toward digital verification, the commission has made clear that regulated persons — brokers, asset managers, and other capital market intermediaries — will continue to bear full responsibility for know-your-customer (KYC) checks, customer due diligence, transaction monitoring, and overall AML compliance. The changes ease the mechanics of verification, not the obligation to conduct it.

The draft regulations have been posted to the commission's website for objections and suggestions.