Digital Lending and Fintech Loans in Pakistan
Reviewed by the Commoner Law editorial team. Sources: pakistancode.gov.pk, Punjab/Sindh/KP/Balochistan provincial codes, Supreme Court of Pakistan, FBR, EOBI, SBP, NEPRA, OGRA, PMDC, FIA, and provincial Healthcare Commissions. Provincial variations cite Punjab/Sindh/KP/Balochistan Acts and ICT-specific ordinances. Written in plain English with everyday Urdu legal terms (FIR, qabza, khula, NTN, CNIC) for a general audience — this is educational content, not legal advice. Our editorial standards
What is this right?
If a loan app on your phone is threatening to message your contact list, it is almost certainly illegal. Licensed SBP and SECP lenders are barred from harvesting contacts, public-shaming, or blasting WhatsApp groups with morphed photos. The apps that do are usually Chinese-origin, unlicensed, and being progressively blocked under PTA's emergency action powers since 2023.
Digital lending exploded in Pakistan after 2020. Tasdeeq, Easypaisa Loans, JazzCash Loans, SadaPay credit, and a long tail of short-term "qarz" and "zaroori" apps all entered the market at once. SBP has progressively regulated them.
Legitimate digital lenders are SBP-licensed:
- Microfinance banks: Khushhali Microfinance Bank, Mobilink Microfinance Bank, U Microfinance Bank, etc.
- Fintech subsidiaries: Easypaisa (Telenor), JazzCash (Mobilink), HBL Konnect, SadaPay (now licensed).
- NBFCs: licensed by SECP for non-deposit-taking lending.
SBP rules for digital lenders:
- Maximum APR cap (varies by year; was 60% as of 2024).
- Mandatory KFD (Key Facts Document) before disbursement.
- 14-day cooling-off.
- No harvesting of contacts beyond stated use.
- No public shaming or contact-list message blasting.
- Recovery only through nominated co-signer or court process.
Illegal lending apps — many Chinese-origin apps that bypass licensing — typically:
- Lend small amounts (Rs 5,000–25,000) at extortionate rates (50% per week common).
- Harvest contacts, photos, and gallery on installation.
- Threaten to message all contacts with shaming messages on default.
- Use morphed photos and abuse to coerce repayment.
These are illegal. Report to SBP, SECP, FIA Cyber Crime, and PTA. Many have already been blocked.
When does it apply?
- You've taken a digital loan and the lender is harassing or charging beyond agreed terms.
- You're being threatened with public shaming, contact-list messaging, or morphed photos.
- You suspect the app is unlicensed.
What to do if a digital lender is harassing you
- Verify licensing: SBP maintains a list of licensed microfinance banks and fintechs. SECP for NBFCs. Apps not on these lists are illegal.
- For threats and harassment: file at FIA Cyber Crime + PTA Complaint Management. PECA sections 14, 17, 24 apply.
- For contact harvesting: complaint to PTA. Apps abusing contact-list permissions are blocked under recent enforcement.
- For licensed lender abuse: SBP BC&CPD complaint → Banking Mohtasib chain.
- If your photos were morphed: this is criminal under PECA + PPC §§ 506, 509. FIA can prosecute.
What should you NOT do?
- Don't grant contact and gallery permissions to lending apps. Most legitimate ones don't need them.
- Don't pay extortionate rates "to clear and exit." File complaint instead.
- Don't accept threatening messages quietly. Document and report. PTA has been blocking abusive apps after FIA referrals.
Frequently asked questions
Are loan apps legal in Pakistan?
Only those licensed by SBP (microfinance banks, fintechs) or SECP (NBFCs). The list is on SBP and SECP websites. Apps not licensed are illegal and being progressively blocked by PTA.
Can a lender contact my friends and family?
No. SBP rules and PTA regulations bar contact-list harvesting and harassment. PECA section 24 makes cyber-harassment of women specifically aggravated.
What can I do if my photos were morphed?
Criminal complaint to FIA Cyber Crime under PECA sections 21, 24 and PPC §§ 506, 509. FIA has prosecuted several cases; takedown orders to platforms are part of the relief.
When does digital lending and fintech loans apply?
You've taken a digital loan and the lender is harassing or charging beyond agreed terms.You're being threatened with public shaming, contact-list messaging, or morphed photos.You suspect the app is unlicensed.
A loan app is threatening me with my contact list — what do I do in Pakistan?
Verify licensing: SBP maintains a list of licensed microfinance banks and fintechs. SECP for NBFCs. Apps not on these lists are illegal.For threats and harassment: file at FIA Cyber Crime + PTA Complaint Management. PECA sections 14, 17, 24 apply.For contact harvesting: complaint to PTA. Apps abusing contact-list permissions are blocked under recent enforcement.For licensed lender abuse: SBP BC&CPD complaint → Banking Mohtasib chain.If your photos were morphed: this is criminal under PECA + PPC §§ 506, 509. FIA can prosecute.
What mistakes should I avoid with digital lending and fintech loans?
Don't grant contact and gallery permissions to lending apps. Most legitimate ones don't need them.Don't pay extortionate rates "to clear and exit." File complaint instead.Don't accept threatening messages quietly. Document and report. PTA has been blocking abusive apps after FIA referrals.