SBP ‘looking into’ NADRA-MasterCard agreement

Published: January 26, 2017
Email
Spokesman says information sought from the two parties; concerns come amid security of national database. PHOTO: FILE

Spokesman says information sought from the two parties; concerns come amid security of national database. PHOTO: FILE

ISLAMABAD: The State Bank of Pakistan has decided to look into the agreement between MasterCard – an online payment processing company – and National Database and Registration Authority (NADRA) amid concerns over the mandate of NADRA and security of the national database.

“We are looking into this (agreement) and getting more information from the two parties about this arrangement,” said Abid Qamar, chief spokesman for the central bank, while talking to The Express Tribune.

Foreign exchange: SBP’s reserves increase 0.6%, amount to $18.299b  

NADRA’s decision to enter into a strategic agreement with MasterCard has raised the stakes, as the database authority has preferred a company that does not have its servers in Pakistan. It also did not take the requisite regulatory approvals before venturing into an area that does not fall in its jurisdiction, according to sources in the SBP and NADRA.

On January 18, MasterCard “announced strategic collaboration with Pakistan’s NADRA technologies”. The announcement was made during MasterCard’s participation in the World Economic Forum Annual Meeting in Davos, Switzerland.

The announcement that the agreement was signed in Switzerland also raised many eyebrows. Even after one week, NADRA has not yet issued an official communiqué.

MasterCard said that the “the move will allow Pakistani citizens to carry out financial transactions and receive government disbursements by utilising the unique 13-digit identification number of their identity card.” Citizens will also be able to use their CNIC to send and receive domestic and international remittances, it added.

The press release suggested that the arrangement was not only restricted to foreign remittances but will also involve government-to-people payments (like BISP disbursements) and people-to-government payments (fees).

Contradiction

However, NADRA does not have the mandate to render payment services and venturing into any such area would require prior approval of the central bank, said the sources. The payment service falls under Payment Service and Electronic Funds Transfer Act of 2007.

Foreign exchange: SBP’s reserves increase 0.28%, stand at $18.361b 

Sources said that despite signing the agreement, NADRA has not yet approached the central bank. They said prima facie, it does not have a mandate to render this service.

Unlike the MasterCard press release, it will be a tripartite arrangement among NADRA, MasterCard and Faysal Bank, said a NADRA official while speaking on condition of anonymity. He said that the purpose of involving Faysal Bank was to meet the regulatory requirements of the SBP.

However, the MasterCard press release was silent about the role of any other player in this arrangement.

“To encourage financial inclusion in the country, we shall welcome any arrangement in compliance with the legal and regulatory requirements for financial transactions,” said the SBP spokesman while responding to a question on Faysal Bank’s likely role in the deal.

Sources said that NADRA has also not obtained the necessary authorisation from Pakistan Remittance Initiative and without its authorisation it cannot receive remittances from abroad.

The spokesman of NADRA, Faiq Ali, declined to comment. NADRA chairman was also not available.

Possible problems

The payment processing centres or the servers of Mastercard are in foreign jurisdictions, some not friendly to Pakistan, which may create issues like replication of the users’ data, said sources and industry people.

NADRA hosts sensitive data on the total population and according to insiders there are roughly 10,000 attacks per month that attempt to crack its database, which have so far remained unsuccessful due to its arrangements.

NADRA officials insisted that MasterCard would not have access to its secure database. They said the sender of the money would log in to the NADRA website and feed the receiver’s CNIC number. Then NADRA would send this information to MasterCard for verification.

The officials said that end-to-end solutions will be of NADRA and MasterCard has only been engaged to meet know your customer (KYC) requirements of the global bodies.

Sales tax: ‘Deduction at source unjustified’

The sources said that the issue of data replication may also arise in case of domestic disbursements.

In 2014, Russia had also raised concerns about the security of the Russian banking system due to locations of the processing centres of Mastercard and Visa outside its territory. After that, Mastercard had announced to shift its servers to Russia.

MasterCard Pakistan Country Manager Aurangzaib Khan was not available for comments despite repeated attempts.

Published in The Express Tribune, January 26th, 2017.

Like Business on Facebook, follow @TribuneBiz on Twitter to stay informed and join in the conversation.

Facebook Conversations

Reader Comments (5)

  • A
    Jan 26, 2017 - 12:57PM

    Firstly, the point where NADRA will send citizens’ data to Master Card for verification would be a direct violation of sharing sensitive information with an entity other than permitted in NADRA’s mandate.

    Secondly, if the end-to-end systems will solely be of NADRA, this is a second violation where NADRA assumes the role of a Payment Service Provider/Payment Service Operator, which fall under SBP’s Rules for PSO/PSP 2014. NADRA will have to under these rules seek permission from the SBP for International Routing of Remittances from SBP Payment Systems Department. This permission is completely unrelated to Faysal Bank, and they will not have any say in this.

    If SBP approves of this or shuts a blind eye to it, then they would tarnish their PSO/PSP rules.Recommend

  • curious2
    Jan 26, 2017 - 1:52PM

    You want E Commerce you need credit cards – you want credit cards then you might as well get the best which means VISA/Mastercard. Recommend

  • Khan
    Jan 26, 2017 - 8:11PM

    @curious2:
    Incase you missed the points .. 1) Mastercard servers that will store sensitive data are located in foreign countries outside Pakistan 2) NADRA does not has mandate to offer such services under the Law.
    Solution: bring these servers to Pakistan that will store local data only 2) if NADRA is still interested in offering such solutions they must ask the government to make changes in law to permit them.Recommend

  • Educated one?
    Jan 27, 2017 - 9:22AM

    Seems like you all have seen the agreement and the exact nature of what constitutes it. Typical pakistani behavior. Showing off your two pence wisdom when you dont even know jack all. Wait and watch my friends. It can be good or bad but time can only tell. Patience. Recommend

  • Farman Khan
    Jan 28, 2017 - 10:24PM

    Despite of all above facts, if somehow NADRA fulfill SBP’s all requirements and Govt. Legislations by involving any local registered Bank like Faisal Bank. And MasterCard put it’s servers in Pakistan like they did in Russia back in 2014.

    In the best of national interest this agreement must be made b/w NADRA and PayPak (local payment scheme). While PayPak needs to focus on its international remitance acceptance.

    SBP should use it’s power in this case and force NADRA to go with PayPak. Recommend

More in Business