Govt Issues Cyber Alert Against KYC Scams

The Cabinet Division has issued an advisory to strengthen Know Your Client (KYC) processes across critical sectors, particularly telecommunication, internet, and banking, in an effort to mitigate cybersecurity threats and improve compliance.

The advisory, titled “Strengthening KYC Processes for Cybersecurity Compliance and Threat Mitigation” (Advisory No. 20), highlights vulnerabilities in Application Program Interface (API) services provided by Critical Information Infrastructure (CII) sectors and emphasizes the joint responsibility of API providers and clients in ensuring cybersecurity.

KYC processes, as described in the advisory, are vital for verifying the identity, background, and risk levels of clients before establishing business relationships. Enhancing KYC practices is deemed critical for safeguarding client information, preventing cyber threats, and maintaining compliance with national regulations.

By adopting robust KYC mechanisms, internet service providers (ISPs) and regulatory bodies can foster a secure and trustworthy digital ecosystem in Pakistan.

The guidelines in the advisory emphasize mandatory client verification through verified identity documents and secure digital systems, such as biometric and real-time facial recognition technologies.

High-risk users, such as those engaging in frequent international traffic or using high data volumes, are required to undergo regular re-verification and enhanced due diligence. Additionally, the advisory mandates encryption of client data, restricted access with multi-factor authentication, and continuous monitoring of user behavior to flag suspicious activities.

The advisory also underscores the need for collaboration with cyber threat intelligence sources to proactively detect emerging threats such as phishing and malware attacks. Measures like employee and client awareness programs, incident response planning, and regular third-party security audits are recommended to protect KYC-related data. Transparency in data collection, consent-based processes, and minimization of data collection are identified as key factors in building customer trust and ensuring compliance with privacy regulations.

In addressing national security concerns, the advisory calls for strict enforcement of KYC policies to prevent anonymous access to internet services, which could be exploited for cyberattacks or disinformation campaigns. It also suggests collaboration with the Pakistan Telecommunication Authority (PTA) for lawful internet shutdowns or monitoring during security threats, while maintaining transparency.