Pakistan country pack.
Pakistan pack for banks, Islamic banking institutions, microfinance banks, SECP-regulated NBFCs, insurers and brokers, listed companies and federal state-owned enterprises. It covers SBP's internal audit, corporate governance, AML/CFT/CPF, Shariah governance, ICFR, operational risk and cloud outsourcing rules, SECP's listed-company code, AML and NBFC regulations, the SOE Act 2023 regime and PECA 2016. Five checklist templates, a regulatory calendar and retention rules are included.
Frameworks and regulations.
| Instrument | Applies to | Requirements | Status |
|---|---|---|---|
| SBP Enterprise Technology Governance & Risk Management Framework State Bank of Pakistan · BPRD Circular 05/2017 | Banks, Islamic banks, Microfinance | 8 | Being confirmed |
| Guidelines on Internal Audit Function State Bank of Pakistan · BPRD Circular No. 02 of 2019, 3 April 2019 (with enclosed guidelines) | Banks, Islamic banks, Microfinance | 25 | Source checked |
| Corporate Governance Regulatory Framework State Bank of Pakistan · BPRD Circular No. 05 of 2021, 22 November 2021; G-14(2)(v) amended by BPRD Circular Letter No. 24 of 2025, 12 December 2025 | Banks, Islamic banks | 22 | Source checked |
| Anti-Money Laundering, Combating the Financing of Terrorism & Countering Proliferation Financing (AML/CFT/CPF) Regulations State Bank of Pakistan · Consolidated text updated up to 28 November 2022 (BPRD Circular Letter No. 33 of 2022) | Banks, Islamic banks, Microfinance, Exchange houses | 20 | Source checked |
| Shariah Governance Framework for Islamic Banking Institutions State Bank of Pakistan · IFPD Circular No. 08 of 2024, 22 November 2024; effective 1 January 2025 | Islamic banks, Banks | 24 | Being confirmed |
| Instructions on Internal Controls over Financial Reporting (ICFR) State Bank of Pakistan · OSED Circular No. 01 of 2014, 7 February 2014; BSD-1 Circular Letter No. 01 of 2021, 6 July 2021 | Banks, Islamic banks | 11 | Source checked |
| Implementation of Operational Risk Management Framework State Bank of Pakistan · BPRD Circular No. 04 of 2014, 20 May 2014 (Annexure 1); loss-data reporting deferred by BPRD CL 06/2017 and CL 27/2017 | Banks, Islamic banks | 13 | Source checked |
| Framework on Outsourcing to Cloud Service Providers State Bank of Pakistan · BPRD Circular No. 01 of 2023, 16 January 2023 | Banks, Islamic banks, Microfinance, Payment providers | 10 | Being confirmed |
| Non-Banking Finance Companies and Notified Entities Regulations, 2008 Securities and Exchange Commission of Pakistan · As amended; consolidated text updated to 22 February 2024; lending-framework amendments announced by SECP on 14 November 2025 | Finance companies, Microfinance | 17 | Being confirmed |
| Listed Companies (Code of Corporate Governance) Regulations, 2019 Securities and Exchange Commission of Pakistan · S.R.O. 1163(I)/2019, 25 September 2019; amended by S.R.O. 906(I)/2023 (7 July 2023) and S.R.O. 920(I)/2024 (June 2024) | Listed companies, Banks, Islamic banks | 28 | Source checked |
| Securities and Exchange Commission of Pakistan (Anti Money Laundering, Countering Financing of Terrorism and Countering Proliferation Financing) Regulations, 2020 Securities and Exchange Commission of Pakistan · S.R.O. 921(I)/2020, 28 September 2020; amended by S.R.O. 562(I)/2022 and S.R.O. 1356(I)/2023 (21 September 2023) | Finance companies, Insurers, Capital market firms, Microfinance | 21 | Being confirmed |
| State-Owned Enterprises (Governance and Operations) Act, 2023 Parliament of Pakistan; Finance Division (Central Monitoring Unit) · Act No. VII of 2023 (30 January 2023), amended by Act No. XII of 2024; SOE Ownership and Management Policy 2023; SOE (Audit Committee, Internal Control and Risk Management) Regulations 2024 (CMU, 31 October 2024) | State-owned enterprises | 23 | Being confirmed |
| Prevention of Electronic Crimes Act, 2016 Parliament of Pakistan · 2016 Act as amended (including the 2025 amendment); edition to be confirmed | Large enterprises, Banks, Islamic banks, Microfinance and more | 8 | Being confirmed |
Checklists in the pack.
- SBP Internal Audit Function Review
- SBP Shariah Governance and Compliance Audit
- AML/CFT/CPF Independent Testing (SBP and SECP)
- SBP ICFR Annual Assessment
- SECP Code of Corporate Governance Compliance Review
Regulators.
- SBP State Bank of Pakistan
- SECP Securities and Exchange Commission of Pakistan
- FD-CMU Finance Division, Central Monitoring Unit (SOEs)
Who it is for
Banks, Islamic banks, Microfinance, Finance companies, Insurers, Capital market firms, Exchange houses, Payment providers, Listed companies, State-owned enterprises, Large enterprises.
Regulatory calendar.
20 recurring deliverables, each with the regulator, the instrument and the deadline rule. Some examples:
| Deliverable | Regulator | How often | Deadline |
|---|---|---|---|
| Annual risk-based audit plan approved by the Board Audit Committee | SBP | Every year | Before the start of the plan year; risk assessment refreshed at least yearly |
| Quarterly audit plan implementation status to the BAC | SBP | Every quarter | Each quarter, at the next BAC meeting, with deviations documented |
| CIA's annual independent opinion on internal controls to the BAC | SBP | Every year | Once a year; no fixed date set (align with year-end BAC cycle) |
| CIA's annual confirmation of internal audit independence, minuted by the BAC | SBP | Every year | At least once a year |
| External quality assessment of the internal audit function against IIA Standards | SBP | Every 5 years | Within five years of the previous assessment (the first was due by 30 June 2020) |
| Annual ICFR Long Form Report or Board Audit Committee assessment | SBP | Every year | Within three months of financial year-end; banks that completed every road-map stage prepare it but need not submit it to SBP |
Reporting conventions.
- Reports in English and Urdu
- Amounts in PKR
Regulators issue instruments and expect reports in English, with Gregorian dates and Latin numerals. The one bilingual rule found: SBP's Shariah Governance Framework requires the annual Shariah Board report to be published in the annual report in English with an Urdu translation (section 3E). SBP circulars are cited as '<Department> Circular No. NN of YYYY' or 'Circular Letter No. NN of YYYY' (for example BPRD, IFPD, OSED, BSD-1, CRMD, ACFID, PSP&OD); SECP instruments are cited by S.R.O. number. Amounts are in PKR (often written Rs.). Banks and DFIs report on a calendar year; many companies and SOEs use a 1 July to 30 June financial year, so calendar anchors must be set per client.
Kept current.
Content version 2026.10, reviewed 27 October 2026. Descriptions are AuditHD's own; each framework links to the official text. License this pack on its own or with other countries; International standards are always included.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.