Pakistan Payments Operator Guide: SBP Licensing, PayPak Acquiring, and FX Repatriation

Pakistan runs two parallel non-bank payment licences out of the same regulator, and the market guide doesn't have room to separate them: the State Bank of Pakistan (SBP) licenses Electronic Money Institutions (EMIs) that may hold customer float, and Payment System Operators/Payment Service Providers (PSOs/PSPs) that explicitly may not. Both start at the same capital number. Neither states a foreign-ownership cap. And underneath both sits a card-acquiring layer — 1LINK and its domestic scheme PayPak — that SBP is now pushing harder than at any point since Raast launched.

This is a companion piece to the Pakistan market guide, which covers Raast's headline growth, the JazzCash/EasyPaisa wallet duopoly, and the broad card-penetration picture. Here the focus is what a foreign operator actually needs to plan around: which licence fits which business model, what capital and ownership rules genuinely say (as opposed to what gets repeated about them), how card acceptance for the international schemes actually gets wired up, and — the section most guides skip — the documented mechanics of getting money back out of the country.

SBP's licence map: EMI versus PSO/PSP

The dividing line between Pakistan's two non-bank payment licences is custody of customer money, not scale or sophistication. An Electronic Money Institution (EMI), licensed under SBP's Regulations for Electronic Money Institutions (2019), issues e-money and may hold the resulting float — the balance sitting in a NayaPay or SadaPay wallet is EMI-issued e-money, and EMI capital is sized against exactly that liability. A Payment System Operator or Payment Service Provider (PSO/PSP), licensed under SBP's 2014 Rules for PSOs and PSPs, is built the opposite way: the rules state plainly that a PSO/PSP "will not act as custodian of consumer's money or perform any banking function," and every transaction it processes must settle through a commercial bank licensed by SBP, not through the PSO/PSP's own books. A payment gateway, an ATM switch, an e-commerce or POS gateway, or a remittance gateway is a PSO/PSP; a stored-value wallet is an EMI. A business plan that mixes the two — routing transactions and holding a wallet balance — needs to structure as, or partner with, both.

Both licences start at the same headline number: PKR 200 million minimum paid-up capital, and both require a security deposit of at least 10% of that required capital held at SBP-BSC, split 5% in a non-remunerative current account and 5% in government securities kept under lien. From there they diverge. PSO/PSP capital rises by a flat 25% for each additional PSO/PSP-related business line the same entity operates — running a switch and a POS gateway under one licence costs more than running either alone. EMI capital instead scales with the institution's actual float: PKR 200 million covers up to PKR 4 billion in average daily Outstanding E-Money Balance (OEB), rising to PKR 200 million plus 5% of OEB between PKR 4 billion and PKR 10 billion, PKR 500 million plus 7.5% of OEB between PKR 10 billion and PKR 20 billion, and PKR 1.25 billion plus 10% of OEB above PKR 20 billion — and at least half of an EMI's initial capital must be paid up in cash rather than other instruments. Neither regulation is small-business-friendly: both are two-stage processes running In-Principle approval, then a supervised Pilot phase (a PSO/PSP must commence its pilot within six months of approval or reapply), then final licensing — with a Fit and Proper Test applied to sponsors holding 10% or more of shares, directors, the CEO, and key executives throughout.

Licensing is not a one-time gate either. A PSO/PSP must get SBP's prior approval before offering a new product, scheme, or service, and separately before any change to its Memorandum or Articles of Association, ownership structure, CEO, Board of Directors, or technology platform — meaning a change of control after licensing is itself a supervised event, not a private transaction the licensee reports after the fact. Pricing is constrained too: charge schedules must be fixed for a minimum of six months at a time and reported to SBP on a half-yearly basis, and outsourcing any function requires SBP's prior sign-off, which matters for an operator planning to run technology or operations out of a regional hub rather than inside Pakistan. Transaction records must be retained for at least ten years, and any security breach — suspected or confirmed — has to be reported to SBP's Payment Systems Department immediately, with a formal incident report following quarterly.

As of 24 February 2025, six EMIs were in commercial operation — NayaPay, Finja, SadaPay, Akhtar Fuiou Technologies, E-Processing Systems, and Wemsol, the sixth to reach that stage — with one additional EMI (HubPay) in pilot and three more (YAP Pakistan, Cerisma, Toko Lab) holding in-principle approval and building toward pilot. That's a small, still-forming field relative to the wallet volume JazzCash and EasyPaisa carry under older Branchless Banking authorisations — a structural quirk covered in the market guide, not repeated here.

The foreign-ownership question, answered from the text

Neither the PSO/PSP rules nor the EMI regulations state a foreign-ownership percentage cap. That silence could be read either way — as genuine openness, or as an unaddressed gap — so it's worth checking what the documents actually contemplate rather than stopping at the absence of a number. The PSO/PSP rules go further than silence: their Fit and Proper Test paperwork explicitly provides for non-Pakistani sponsors and directors, requiring a CNIC/NICOP and passport for a non-resident Pakistani, and for a foreign national specifically, a passport copy attested by the Pakistani embassy in that person's country or by that country's embassy in Pakistan. That is not boilerplate a regulator includes by accident — it is the paperwork path for a foreign sponsor to actually hold shares and a board seat, built into the same document that sets the PKR 200 million capital bar. The only ownership-adjacent restriction anywhere in the rules is structural rather than nationality-based: no more than 50% of a PSO/PSP's directors may be from the same family.

That the paperwork makes room for foreign sponsors at entry does not carry over into indifference after licensing: because any subsequent change in ownership requires SBP's prior approval (the same provision that gates a change of CEO, Board, or technology platform), a foreign investor buying into an already-licensed PSO/PSP — rather than seeding a new one — still has to clear SBP's Fit and Proper Test and get the transfer approved before it takes effect. The rules stay silent on a foreign-ownership cap at entry; they are explicit that an ownership change arriving unannounced is not permitted.

What the rules do not relax, regardless of who owns the entity, is Pakistani incorporation. There is no cross-border licensing route — a foreign PSP cannot operate under an SBP licence held abroad, only through a company registered with Pakistan's Securities and Exchange Commission (SECP) and licensed by SBP in its own right. Combined with the capital-and-deposit bar (PKR 200 million paid-up plus a further 10% locked at SBP-BSC for as long as the licence is active) and a Fit-and-Proper and on-site inspection process that runs months, the practical calculus for most foreign operators is the same one that shows up in every SBP-regulated market: a direct licence is open to foreign capital in principle, but the commercial default is a relationship with an already-licensed Pakistani PSP — PayFast, Safepay, NayaPay — or a wallet, rather than carrying the capital and compliance build alone.

Card acquiring: 1LINK, PayPak, and what actually routes where

Card acceptance for the international schemes in Pakistan is gated through a single domestic switch. 1LINK describes itself as the first entity in the country providing gateway services for International Payment Schemes (IPS) — Visa, Mastercard, UnionPay International, and JCB — "to licensed entities including banks and affiliates to issue/acquire cards that can be used on the Global Payment Network." In practice, that means a foreign PSP cannot wire up Visa or Mastercard acquiring in Pakistan independently from outside the country: issuing and acquiring for those networks runs through 1LINK connectivity held by SBP-licensed banks and their affiliates, which is the structural reason foreign acquirers with strong direct presence elsewhere in South Asia and MENA tend to have thin, partnership-based Pakistani coverage rather than their own rails.

1LINK also owns and operates PayPak, Pakistan's own domestic card scheme, launched in 2016 under SBP's guidance — the 28th domestic card scheme launched anywhere in the world, on 1LINK's own account, with every PayPak transaction routed locally and no cross-border transfer of transaction data. PayPak has moved from a niche debit-card product to an active policy instrument: SBP has already rolled out co-badged PayPak cards that work on both domestic and international rails, and expanded PayPak's e-commerce acceptance. As of August 2026, 1LINK has proposed making PayPak issuance mandatory for government employee salary accounts, social-safety-net and subsidy beneficiaries, and mass-transit payment systems, alongside tax incentives on PayPak point-of-sale and e-commerce transactions — explicitly framed by SBP as part of a strategy to reduce Pakistan's dependence on Visa and Mastercard. None of that is final regulation as of this writing; it is a proposal SBP and 1LINK have put forward, not an enacted mandate, and it should be tracked as such rather than treated as already in force. But the direction is unambiguous, and an operator planning multi-year Pakistani acceptance should build PayPak support as a genuinely separate integration rather than an afterthought behind Visa/Mastercard, because SBP's own policy signal is that the afterthought status won't last.

However acceptance gets built, the underlying PSO/PSP rulebook still governs what happens when a transaction fails or is disputed on the Pakistani side: every contract between a PSO/PSP and the banks or merchants it serves must define a dispute-resolution mechanism with an agreed turnaround time, banks and PSOs/PSPs are required to cooperate in good faith before escalating to arbitration, and a comprehensive complaint-redressal process — with outstanding-complaint reporting to SBP on a quarterly basis — is a licensing condition, not an optional service-level commitment. For a foreign PSP relying on a Pakistani acquiring partner, that means the dispute and chargeback handling terms sitting inside the partnership contract are doing real regulatory work, not just commercial boilerplate — and they are worth reading as closely as the pricing schedule.

FX access and repatriation — the mechanism, not the policy line

This is the section market overviews tend to compress into a single reassuring sentence, and it is worth unpacking because the actual mechanism is more specific — and more workable — than a generic "liberal repatriation regime" claim suggests. The governing document is SBP's Foreign Exchange Manual, issued under the Foreign Exchange Regulation Act (FERA) 1947 — the repatriation mechanics below trace to the Manual's Chapter 20 (Securities) and Chapter 14 (Commercial Remittances) as last revised in 2021 and 2020 respectively, so an operator should confirm with an Authorized Dealer that no intervening amendment has moved a threshold before relying on the numbers here. Section 13 of that Act requires SBP permission before any Pakistani security is transferred to "a person resident outside Pakistan" — a term that, notably, also captures a Pakistan-registered company controlled directly or indirectly by a non-resident, so a foreign-owned local subsidiary inherits the same FX treatment as the foreign parent itself. SBP grants a standing general exemption from that permission requirement for several cases, the one that matters for a foreign operator being private placement of new or initial shares with foreign investors by a public or private limited company — the FDI equity route. The conditions are specific rather than open-ended: the issue price must be paid in foreign exchange through normal banking channels, and the price cannot be less than fair value — the quoted market price for listed securities, or a chartered-accountant-certified break-up value for unlisted ones.

Getting capital into repatriable status starts at the point it enters the country, not when repatriation is requested. The receiving Authorized Dealer bank issues a Proceeds Realization Certificate (PRC) as documentary evidence the investment came in through normal banking channels, and the company must intimate the share issuance to its designated Authorized Dealer — for onward registration with SBP — within 60 days. From there, dividend and capital-exit repatriation follow different, separately documented paths. Dividends move under Chapter 14 of the Manual: once SBP has authorized a company's designated Authorized Dealer to handle that company's non-resident dividend remittances, the bank can pay each dividend without seeking SBP's approval case by case, provided the payment is net of Pakistani tax and the bank has reviewed an auditor-certified application, the audited (or interim) financial statements, and a certified board or shareholders' resolution declaring the dividend. Capital exit — a share sale rather than a dividend — runs under Chapter 20 on a documentation ladder that scales with transaction size: for disinvestment proceeds within fair value, standard buyer/seller particulars, a share purchase agreement, and AML/CFT due diligence; above fair value, additional valuation-justification documents from the buyer; and specifically, once an investor's total disinvestment remittances exceed USD 50 million within a rolling six-month window, the Authorized Dealer must additionally obtain an independent third-party valuation review from a QCR-rated practicing chartered accountant before releasing the transfer.

There is also a deliberately separate, slower-paperwork alternative worth knowing exists even if most FDI won't use it: the Manual permits issuing or transferring Pakistani securities to a non-resident on a non-repatriation basis, where the investor pays in foreign exchange or rupees but files a clear undertaking that no repatriation of capital or dividends will ever be claimed on that holding. It exists for cases where repatriation rights are not the point — a diaspora investor building a rupee-denominated position, for instance — and it is registered at the investor's Pakistan address rather than processed through the FDI machinery above. It is not a workaround for an operator that actually wants to move profit out; it is the opposite structure, and the two should not be confused when scoping an entry.

None of this amounts to a repatriation restriction in the sense of a cap or a ban — every threshold described above is a documentation and verification gate, not a ceiling on the amount that can leave the country. But it is a real compliance workstream with real lead time, and the practical lesson is the same one that applies in every FDI-gated market: the PRC and the Authorized Dealer relationship need to be set up at the moment capital first enters Pakistan, not reconstructed retroactively when the first dividend or exit becomes due.

Raast: cost recovery, not a permanent zero-fee mandate

Raast's headline framing — a free, SBP-operated instant payment rail — needs one correction that matters for anyone pricing around it. Raast's own site describes the system as "designed to operate at a cost recovery model in order to make digital payments affordable to end users of all socio-economic backgrounds" — cost recovery, not a permanent zero-fee guarantee, even though Raast P2P transfers specifically are described elsewhere on SBP's site as free of charge with no minimum transaction size. That distinction leaves room for P2M (merchant) pricing to move above zero over time even if P2P stays free, and it is the more accurate way to describe SBP's commitment than a blanket "zero-cost mandate."

Raast also launched in two genuinely separate phases, not one. The first, Bulk Payments — organisation-to-person disbursements — launched in January 2021. Person-to-Person (P2P), the phase most coverage treats as "Raast's launch," followed over a year later: SBP issued the instructions enabling P2P fund transfers on 3 February 2022. By SBP's own Q3 FY26 report (the quarter running January to March 2026), Raast processed 742.1 million transactions worth PKR 23.3 trillion; P2P accounted for 664 million of those transactions (up 10% quarter-on-quarter) worth PKR 18.9 trillion, while P2M reached 55.9 million transactions, up from 36.3 million the quarter before. P2M is growing off deliberate government support rather than organic pull alone: a PKR 3.5 billion subsidy programme running September 2025 to June 2026 reimburses merchants 0.5% of each QR-based P2M transaction's value or PKR 100, whichever is lower, and daily P2M transaction counts moved from roughly 60,000 in June 2025 to approximately 1.1 million by June 2026 alongside it. For an operator building Pakistani merchant acceptance, P2M is real, fast-growing, and subsidy-assisted — but at 55.9 million transactions against P2P's 664 million in the same quarter, it remains a small fraction of Raast's total volume, not yet the default the way P2P has become.

What this means for operators

Pakistan's structure rewards specificity over generic market-entry assumptions. The EMI/PSO-PSP split determines which licence a business plan actually needs, and it's a custody question, not a scale question. Foreign ownership is not the constraint either regulation imposes — Pakistani incorporation, capital, and a Fit and Proper Test are, and the PSO/PSP rules' own paperwork assumes foreign sponsors will use it. Card acceptance for Visa and Mastercard runs through 1LINK-connected banks whether an operator likes it or not, and PayPak is moving from optional to policy-favoured fast enough that ignoring it is a decision with a shelf life. And profit repatriation, treated correctly, is a banking-channel process with named documents and named thresholds — a PRC at entry, an authorized-bank relationship for dividends, and a valuation-review trigger at USD 50 million in disinvestment over six months — not a policy sentence to take on faith. Build the FX paperwork alongside the capital-inflow transaction, integrate PayPak as a first-class rail rather than an afterthought, and treat Raast P2M as early-stage infrastructure worth watching rather than a rail already carrying default merchant volume.

One more planning detail is easy to underweight: none of the obligations covered here are front-loaded and finished at licensing. Ownership changes, new products, and outsourcing arrangements all require SBP's prior approval on an ongoing basis; pricing schedules and complaint records get reported to SBP on a recurring cycle; and an EMI's capital requirement itself moves with the float it is actually carrying, not a number fixed at launch. A Pakistan entry plan that models SBP engagement as a one-time licensing project — capital raised, approval granted, done — will be right about the first eighteen months and wrong about everything after it. Budget for SBP as a standing counterparty, not a gate to clear once.