SBP Allows Exchange Companies to Use VPNs

State Bank of Pakistan has allowed exchange companies to utilize Virtual Private Networks (VPNs) to execute its operations of currency exchange, inward and outward remittances, utility bill payments and others. The Company shall establish redundant network connections to primary and secondary sites through Virtual Private Network (VPN) or dedicated links i.e. internet access must be restricted, according to the Regulatory Framework for Exchange Companies. The banking regulator rolled out a strict mechanism for exchange companies, including high paid-up capital requirements, operational compliances, monitoring systems and security controls. According to the regulations, exchange companies must ensure that both their primary and secondary data centers are situated within Pakistan. The company may outsource its workload to local Cloud Service Providers (CSPs). The company shall put in place security requirements to safeguard operating systems, software, networks, security devices and databases. The company shall set monitoring control procedures to allow access to the users and vendors on sensitive data/information and systems. Exchange Companies Services for Public The company may install banks’ ATMs for PKR at their outlets as per the terms and conditions agreed upon between the respective bank and the Company without getting prior approval of SBP. Exchange Company may conduct branchless banking activities as an agent of banks and Microfinance banks who offer these services under Branchless Banking Regulations issued by SBP. The company may enter into agreements with utility companies like WAPDA, KE, PTCL, SSGC etc. for collection of utility bills in PKR on their behalf. Exchange Companies shall develop a comprehensive Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) as part of the business continuity planning process. The goal of the BCP shall be to minimize financial losses to the institution, serve customers with minimal disruptions and mitigate the negative effects of disruptions on business operations, the framework stated. The company will seek prior approval of SBP before commencing inward home remittance operations. The company will surrender 100% of FCY, received on account of inward home remittances, in equivalent US Dollars, in the interbank market on the same day. The company is authorized to effect outward remittances only on personal accounts of individuals i.e. personal financial transactions. b) The company is not allowed to effect any outward remittances on account of trade and commercial transactions of any nature including payments against services, commission etc., whether on account of individuals or on behalf of corporate clients. The company can effect outward remittances up to 75% of the inward home remittances mobilized by it during the preceding month. d) The Company will retain copy of identification document i.e. Computerized National Identity Card (CNIC), National Identity Card for Overseas Pakistanis (NICOP), Pakistan Origin Card (POC), Passport (having valid visa on it or any other proof of legal stay of a foreigner in Pakistan) as the case may be; after having seen the original document. The company will carry out biometric verification of Pakistani Nationals for all transactions and maintain the record thereof.