Back in April, SECP proposed a simple idea: let banks vouch for investors instead of forcing them to submit the same documents to every broker, fund, and insurer they deal with. On July 11, that proposal became regulation. The regulator amended the AML/CFT/CPF Regulations, 2020, and gave regulated entities a new tool: verify a customer through their IBAN instead of a stack of paperwork.
For anyone who’s tried to open a brokerage account, invest through a regulated fund, or participate in a startup funding round in Pakistan, the old process is familiar:
- CNIC copy
- Bank statement
- Sometimes a second round of biometric verification, because the first one expired or didn’t sync with the new system
Every regulated entity ran its own version of the same check, and every version cost the investor time.
What Actually Changed
Securities brokers, futures brokers, insurers, takaful operators, NBFCs, and Modarabas can now complete KYC using a customer’s International Bank Account Number instead of collecting fresh documents each time. An IBAN is the unique identifier tied to a bank account, allowing institutions to confirm that an account belongs to an already-verified customer without restarting the entire verification process.
If your bank has already verified you and your bank account is tied to your CNIC, a fund or broker can check that record and move on. No separate paper trail. No repeat trip to a branch.
Three other pieces came in alongside it:
- Own-name transactions only. Every future transaction has to run through a bank account held in the investor’s own name, closing a gap where money could move through third-party accounts with little traceability.
- Facial recognition added. Biometric verification now includes facial recognition, aligned with NADRA’s systems, so identity checks don’t depend solely on fingerprint scanners at a branch counter.
- Immediate account blocking. If NADRA blocks or impounds a CNIC, the linked investment account gets blocked immediately, rather than sitting open until someone notices.
SECP also settled a smaller but practical question: digital logs now count as valid records for AML/CFT compliance. Institutions no longer need to keep physical files just to satisfy an audit.
Why This Matters More for Startups
Read the coverage and you’d think this is a stock-market story. It isn’t. Or at least, not only. A meaningful share of startup capital in Pakistan moves through vehicles that fall under SECP’s NBFC and securities-broker categories: venture funds structured as NBFCs, investment vehicles that operate through licensed intermediaries, and other platforms that fall under SECP’s AML requirements. Each of those institutions had to run its own KYC process for every investor, every time.
That friction shows up in deal timelines. A founder closing a round with five angels and two funds isn’t just waiting on term sheets. Each investor’s onboarding with the fund’s custodian or broker adds its own delay, and until that clears, money doesn’t move. IBAN-based verification doesn’t remove KYC. It removes the part where the same investor proves their identity five separate times to five separate institutions in the same month.
The Numbers Behind the Timing
There’s a numbers context worth noting here. SECP reported, in a separate announcement on investor account growth, that investor accounts in Pakistan’s stock market rose 48% in the last fiscal year, reaching 583,052 by the end of FY2025-26, up from roughly 393,000 a year earlier. Investors between 18 and 30 accounted for 45% of the new accounts opened in the first half of 2026.
That’s also the demographic increasingly participating in investment products and emerging startup investment opportunities. A faster, less repetitive onboarding process lowers the barrier for exactly the people who were already showing up in growing numbers.
What Founders and Fund Managers Should Do Now
If you run a venture fund structured as an NBFC, or you work with a broker or custodian to close rounds, ask them directly whether they’ve updated their onboarding flow to use IBAN verification yet. The regulation is live, but rollout speed will vary institution to institution, and SECP’s own statement makes clear that regulated entities still carry the compliance burden, not the regulator.
If you’re an angel investor who’s been through KYC with three different platforms this year, the next one should be faster. Worth confirming before you commit to a deal with a tight closing timeline.
And if you’re building anything in fintech or investment infrastructure for Pakistan, this is a signal about direction. SECP tied this change to RAAST and the National Clearing Company of Pakistan back in April, when the proposal first surfaced. The regulator is building toward instant, bank-backed identity checks as the default, not the exception. Products that still rely on manual document uploads and lengthy verification cycles are building against where the regulatory direction is headed, not with it.
The three-month gap between proposal and rule is short by SECP’s usual pace. Whether this makes onboarding better for investors will depend less on the regulation itself and more on how quickly brokers, funds, and platforms integrate it into their systems.
