The Income Tax Ordinance 2001 has been amended to allow the State Bank of Pakistan to set up, run and maintain a secure, centralized virtual repository of banking data, one that will hold information, records and financial transactions belonging to individuals as currently maintained by scheduled banks.
Under the amendment, a new section numbered 165AB has been added to the ordinance, and it states that despite existing banking confidentiality laws, every banking company along with every electronic money institution will be required to electronically upload prescribed information to this central data hub whenever an account holder’s deposits or withdrawals exceed one hundred million rupees during a given reporting period. The stated purpose behind the requirement is to allow algorithmic cross matching between banking records and tax data, a mechanism intended to flag inconsistencies between what individuals report to tax authorities and what actually moves through their bank accounts. Officials have indicated that transactions above this threshold will now face closer examination as a matter of routine practice rather than exception.
According to the text of the amendment, the information being uploaded and digitally processed will not be visible to any income tax authority while the cross matching itself is taking place, meaning the initial stage of comparing bank data against tax filings happens without direct human access to individual account details. It is only when the automated system identifies a significant mismatch that the relevant case file gets forwarded into the Board’s Compliance Risk Management system, after which the National Faceless Centre takes over for any further proceedings that may follow. This structure appears designed to limit the extent to which raw account information is exposed to tax officials during the matching process itself, while still allowing the system to escalate genuine discrepancies once they are detected.
The amendment also lays out definitions for several terms that will shape how the new provision functions in practice, including what constitutes a reporting period, what is meant by a specified date, how an account is defined for these purposes, the concept of peak credits, the scope and role of the central data hub, and the broader framework used for compliance risk management. Alongside these definitions, the amendment includes confidentiality safeguards intended to address concerns that may arise from banks and electronic money institutions being asked to share sensitive customer information despite long standing secrecy protections under banking law. Taken together, the changes give the State Bank of Pakistan a more direct role in aggregating and centralizing financial data that was previously held separately across individual banking institutions, positioning it as the custodian of a system meant to serve as the backbone for tax authorities’ efforts to match declared income against actual bank activity. The move fits into a wider pattern of amendments introduced through the Finance Act 2026, which has already brought several changes to how large value transactions are tracked and reported within the formal banking sector, and it follows earlier reporting that transactions crossing the same Rs100 million threshold over a six month period would be subject to detailed scrutiny going forward.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
