Banks and electronic money institutions operating in Pakistan will now be required to electronically upload account information to a newly created Central Data Hub whenever deposits or withdrawals during a reporting period exceed one hundred million rupees, under a fresh directive issued by the Federal Board of Revenue.
The instructions were laid out in Circular No. 02 of 2026-27, issued by FBR, which explains a set of amendments introduced into the Income Tax Ordinance 2001 through the Finance Act 2026. According to the circular, a new section numbered 165AB has been inserted into the ordinance, and this section requires every banking company along with every electronic money institution to submit prescribed account holder information to the Central Data Hub whenever the value of deposits or withdrawals crosses the one hundred million rupee threshold within a given reporting period. Notably, the requirement applies regardless of existing banking confidentiality laws, meaning financial institutions cannot decline to share the relevant data on the grounds of client privacy protections that would otherwise apply. The stated purpose of collecting this information is to allow algorithmic cross matching between tax records and banking data, a process intended to help authorities identify discrepancies between declared income and actual financial activity without requiring manual intervention at the initial stage.
A related report published earlier by Business Recorder, which can be read in detail through this link, had already indicated that transactions exceeding one hundred million rupees over a six month window were expected to face detailed scrutiny, and the latest circular formalizes the mechanism through which such scrutiny will actually take place. Importantly, the circular clarifies that the uploaded information will not be accessible to any income tax officer during the cross matching stage itself, meaning the initial comparison between bank data and tax filings will occur in a manner that keeps individual account details shielded from direct human review. Only in cases where the automated system detects a significant mismatch between the two data sets will the relevant details be forwarded into the Board’s Compliance Risk Management system, after which the matter would be taken up further by the National Faceless Centre for any additional proceedings that may be warranted.
The circular also goes on to define several key terms that will govern how the new provision is applied in practice, including what qualifies as a reporting period, what is meant by a specified date, how accounts are defined for the purpose of this section, the concept of peak credits within an account, the scope of the Central Data Hub itself, and the overall framework of compliance risk management. Alongside these definitions, the FBR has included confidentiality safeguards meant to govern how the uploaded data is stored, processed and eventually acted upon, addressing concerns that may arise from banks and electronic money institutions being asked to share sensitive account information despite existing secrecy provisions under banking law. The move reflects a broader effort by tax authorities to widen the documentation net around high value banking transactions as part of measures introduced through the latest finance legislation.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
