PSPOD Circular Letter No 01 of 2022 - Security of Digital Payments

The Presidents/CEOs
All Banks/ MFBs

Dear Madam/Sir,

Security of Digital Payments

Please refer to Clause (iii) of PSD Circular No. 9 dated November 28, 2018, wherein the Banks/MFBs were advised to send free of cost transaction alerts to their customers through both SMS and email (where email addresses of customers are available) for all international and domestic digital transactions including but not limited to ATMs, POS terminals and Internet banking transactions. It was also mentioned that such transaction alerts shall be generated and relayed to the customers immediately after execution of the transaction.

2. However, it has been observed that these instructions are not being meticulously complied with; and customers do not receive SMS alerts immediately despite posting of transactions in their accounts resulting in non-compliance of regulatory instructions as well as causing difficulty for sender and receiver of funds. Similarly, a number of times, customers also do not receive their One-Time Passwords (OTPs) via SMS on time due to which they face difficulty in completing their transactions.

3. Banks/MFBs are henceforth advised to ensure that all OTPs as well as SMS alerts for financial transactions are generated and sent immediately after customers' accounts are either debited or credited.

4. In addition, customers shall also receive the credit/debit confirmation advice through email and in-app notifications (where applicable and available).

5. These instructions are applicable with immediate effect and failure to comply with the above instructions will lead to penal action by SBP as per the relevant legal and regulatory provisions.

6. Please acknowledge receipt of this Circular Letter via an email to [e-mail].

Yours sincerely, Sd/- (Shoukat Bizinjo) Additional Director