Mobile Banking Consent Form (Pakistan)

A Mobile Banking Consent Form in Pakistan evidences that consent has been freely given, identifying exactly what has been agreed to and by whom.

The Electronic Transactions Ordinance 2002 is the foundational statute for digital transactions in Pakistan. Section 5 of the Electronic Transactions Ordinance 2002 grants legal recognition to electronic documents and digital signatures, providing that information shall not be denied legal effect solely because it is in electronic form. Section 9 governs electronic contracts, confirming that offer and acceptance communicated electronically are valid contracts under the Contract Act 1872. The consent given through a Mobile Banking Consent Form — whether in paper or electronic form — is legally binding under these provisions.

The State Bank of Pakistan's Branchless Banking Regulations (most recently revised in 2023) govern the provision of mobile financial services (MFS) through branchless banking agents and mobile applications. Major banks offering mobile banking in Pakistan include Meezan Bank's Meezan Mobile App, HBL Mobile, UBL Omni, Standard Chartered Mobile Banking, and Habib Metro Bank. Digital wallet and branchless banking services such as Easypaisa (Telenor Microfinance Bank), JazzCash (Mobilink Microfinance Bank), and NayaPay (NayaPay EMI, regulated by SBP as an Electronic Money Institution under the EMI Regulations 2019) each require consent from users.

The Payment Systems and Electronic Fund Transfers Act 2007 (PSEFT Act) governs the operation of payment systems including mobile money transfers, fund transfers through RAAST (Pakistan's instant payment system operated by the SBP), and IBFT (Interbank Fund Transfers) processed through the National Institutional Facilitation Technologies (NIFT). The PSEFT Act 2007 requires all payment service providers to obtain informed consent from users before processing electronic fund transfers.

Data privacy considerations are governed by the Personal Data Protection Act 2023 (PDPA 2023), which introduced formal data protection requirements in Pakistan for the first time. Banks processing personal financial data through mobile banking platforms must comply with the PDPA 2023's requirements for consent, data minimisation, purpose limitation, and breach notification. The Prevention of Electronic Crimes Act 2016 (PECA 2016) — enforced by the Federal Investigation Agency (FIA) Cybercrime Wing — criminalises unauthorised access to electronic banking systems and identity theft, making strong consent and authentication documentation critical for both banks and customers.

Two-factor authentication (2FA) using the customer's registered mobile SIM, issued under Pakistan Telecommunication Authority (PTA) regulations, is mandatory for mobile banking logins under the SBP's Digital Financial Services Policy 2020. The Mobile Banking Consent Form must record the mobile number and the CNIC linked to the SIM through the PTA's biometric SIM verification process, confirming that only the registered account holder can activate mobile banking.

A Mobile Banking Consent Form in Pakistan is required whenever a bank account holder wishes to activate or expand their access to electronic banking services through a mobile device, and whenever the bank needs documented authorisation before processing mobile transactions on the customer's account.

A Mobile Banking Consent Form is needed when a new or existing account holder at any scheduled bank regulated by the State Bank of Pakistan applies at a branch or through an online portal to activate the bank's mobile application. The form records the customer's informed consent to the bank's mobile banking terms, the specific services authorised (balance enquiry, fund transfer, bill payment, cheque request, and so on), and any transaction limits applicable.

A Mobile Banking Consent Form is required when a corporate entity authorises a specific employee — such as the accounts manager or CFO — to access the company's corporate internet banking or mobile banking portal. Corporate mobile banking consents must identify the authorised user's name, CNIC, designation, and the scope of authority (view-only, initiation-only, or full transaction authority).

A Mobile Banking Consent Form is needed when a customer registers for a branchless banking service through an agent network — such as Easypaisa agents (operated by Telenor Microfinance Bank under SBP Branchless Banking Regulations) or JazzCash agents (operated by Mobilink Microfinance Bank). The agent records the customer's biometric consent using a fingerprint scanner linked to NADRA's biometric verification system, and the consent form documents the services activated.

A Mobile Banking Consent Form is required when a bank sends push notifications, marketing messages, or conducts automated KYC updates through the mobile banking application — the customer's explicit consent for data processing under the Personal Data Protection Act 2023 (PDPA 2023) must be documented before these activities commence.

A Mobile Banking Consent Form is needed when a customer reports unauthorised mobile banking transactions to the bank and the SBP Banking Conduct and Consumer Protection Department (BCCP) — the original consent form documents what the customer authorised, enabling the bank to distinguish between authorised and fraudulent transactions under the Payment Systems and Electronic Fund Transfers Act 2007.

A valid Mobile Banking Consent Form in Pakistan under the Electronic Transactions Ordinance 2002 and SBP Branchless Banking Regulations must include the following essential elements to create a legally binding authorization and satisfy regulatory documentation requirements.

Account Holder Identity: Full legal name, NADRA CNIC number (13-digit), date of birth, and address of the account holder exactly as registered with the bank. The CNIC must match the biometric SIM registration with the Pakistan Telecommunication Authority (PTA) for two-factor authentication purposes.

Bank Account Details: Name and branch of the bank, bank account number (IBAN format: PK followed by 22 alphanumeric characters under the SBP IBAN standardisation), and account type (current, savings, or PLS savings account under the SBP's Profit and Loss Sharing framework).

Mobile Device and Number: The mobile phone number linked to the account for OTP (One-Time Password) delivery, the mobile device type and IMEI number (if required by the bank), and confirmation that the SIM is registered in the account holder's name under PTA biometric verification. The SBP's Digital Financial Services Policy 2020 mandates that mobile banking be activated only on SIMs biometrically verified to the CNIC of the account holder.

Scope of Authorised Services: An explicit list of services the account holder consents to activate — balance enquiry, fund transfer via RAAST or IBFT, bill payment through 1-Link, cheque book request, ATM card management, loan application, investment in government securities (Pakistan Investment Bonds, Treasury Bills), or foreign remittance receipt through Roshan Digital Accounts regulated by the SBP.

Transaction Limits: Daily transaction limits for various categories (single transfer, total daily outflow, international transfers), which the SBP's Consumer Protection Regulations require to be disclosed in writing before activation. Any variation from the bank's standard limits must be specifically consented to.

Data Privacy Consent: Under the Personal Data Protection Act 2023 (PDPA 2023), the form must contain specific consent for the bank to process the customer's personal financial data for mobile banking operations, to share data with authorised third parties (payment switches such as 1-Link and NIFT, credit bureaus such as eCIB, and SBP reporting systems), and to retain transaction data for the period prescribed by the SBP Anti-Money Laundering Act 2010 regulations (minimum five years).

Security Acknowledgement: The account holder's acknowledgement of their responsibility to safeguard their mobile banking PIN, password, and OTPs, and that the bank is not liable for transactions authenticated by valid OTPs — consistent with the SBP's Guidelines on IT Security. This acknowledgement is important in disputes under the Payment Systems and Electronic Fund Transfers Act 2007.

Termination Rights: The account holder's right to deactivate mobile banking services at any time by visiting the branch or calling the bank's customer care number, and the bank's right to suspend services for security breaches or suspected fraud under the Prevention of Electronic Crimes Act 2016 (PECA 2016).

Signature and Date: Physical or electronic signature of the account holder and the bank officer processing the request, with date and branch stamp. Under the Electronic Transactions Ordinance 2002, electronic signatures are legally valid.

Forms-legal.com provides this Mobile Banking Consent Form (Pakistan) template as a practical resource for bank customers and institutions. The template reflects the Electronic Transactions Ordinance 2002, Payment Systems and Electronic Fund Transfers Act 2007, SBP Branchless Banking Regulations, and Personal Data Protection Act 2023. Customers with disputes about unauthorised mobile transactions should contact the SBP's Banking Conduct and Consumer Protection Department (BCCP) at [email protected].