SBP ‘looking into’ NADRA-MasterCard agreement

Spokesman says information sought from the two parties; concerns come amid security of national database

ISLAMABAD: The State Bank of Pakistan has decided to look into the agreement between MasterCard - an online payment processing company - and National Database and Registration Authority (NADRA) amid concerns over the mandate of NADRA and security of the national database.

“We are looking into this (agreement) and getting more information from the two parties about this arrangement,” said Abid Qamar, chief spokesman for the central bank, while talking to The Express Tribune.



NADRA’s decision to enter into a strategic agreement with MasterCard has raised the stakes, as the database authority has preferred a company that does not have its servers in Pakistan. It also did not take the requisite regulatory approvals before venturing into an area that does not fall in its jurisdiction, according to sources in the SBP and NADRA.

On January 18, MasterCard “announced strategic collaboration with Pakistan’s NADRA technologies”. The announcement was made during MasterCard’s participation in the World Economic Forum Annual Meeting in Davos, Switzerland.

The announcement that the agreement was signed in Switzerland also raised many eyebrows. Even after one week, NADRA has not yet issued an official communiqué.

MasterCard said that the “the move will allow Pakistani citizens to carry out financial transactions and receive government disbursements by utilising the unique 13-digit identification number of their identity card.” Citizens will also be able to use their CNIC to send and receive domestic and international remittances, it added.

The press release suggested that the arrangement was not only restricted to foreign remittances but will also involve government-to-people payments (like BISP disbursements) and people-to-government payments (fees).

Contradiction

However, NADRA does not have the mandate to render payment services and venturing into any such area would require prior approval of the central bank, said the sources. The payment service falls under Payment Service and Electronic Funds Transfer Act of 2007.



Sources said that despite signing the agreement, NADRA has not yet approached the central bank. They said prima facie, it does not have a mandate to render this service.

Unlike the MasterCard press release, it will be a tripartite arrangement among NADRA, MasterCard and Faysal Bank, said a NADRA official while speaking on condition of anonymity. He said that the purpose of involving Faysal Bank was to meet the regulatory requirements of the SBP.

However, the MasterCard press release was silent about the role of any other player in this arrangement.

“To encourage financial inclusion in the country, we shall welcome any arrangement in compliance with the legal and regulatory requirements for financial transactions,” said the SBP spokesman while responding to a question on Faysal Bank’s likely role in the deal.

Sources said that NADRA has also not obtained the necessary authorisation from Pakistan Remittance Initiative and without its authorisation it cannot receive remittances from abroad.

The spokesman of NADRA, Faiq Ali, declined to comment. NADRA chairman was also not available.

Possible problems

The payment processing centres or the servers of Mastercard are in foreign jurisdictions, some not friendly to Pakistan, which may create issues like replication of the users’ data, said sources and industry people.

NADRA hosts sensitive data on the total population and according to insiders there are roughly 10,000 attacks per month that attempt to crack its database, which have so far remained unsuccessful due to its arrangements.

NADRA officials insisted that MasterCard would not have access to its secure database. They said the sender of the money would log in to the NADRA website and feed the receiver’s CNIC number. Then NADRA would send this information to MasterCard for verification.

The officials said that end-to-end solutions will be of NADRA and MasterCard has only been engaged to meet know your customer (KYC) requirements of the global bodies.



The sources said that the issue of data replication may also arise in case of domestic disbursements.

In 2014, Russia had also raised concerns about the security of the Russian banking system due to locations of the processing centres of Mastercard and Visa outside its territory. After that, Mastercard had announced to shift its servers to Russia.

MasterCard Pakistan Country Manager Aurangzaib Khan was not available for comments despite repeated attempts.

Published in The Express Tribune, January 26^th, 2017.

Like Business on Facebook, follow @TribuneBiz on Twitter to stay informed and join in the conversation.