ISLAMABAD, Oct. 21 (Focus Pakistan) — New SECP audit rules draw a hard line at Rs1 billion in assets: Pakistani non-bank lenders that cross it lose access to 11 audit firms still available to their smaller rivals.
SECP set that threshold in Circular No. 24 of 2026. The circular throws out the auditor framework SECP itself introduced in April.
According to the news SECP audit rule, Non-deposit-taking lending NBFCs with Rs1 billion or more in assets must pick an auditor from a list of 20 firms. Anything smaller can choose from those 20 or from 11 others the regulator keeps in a supplementary tier.
So a small lender has 31 doors. A big one has 20.
Size, not apps, now decides
April’s Circular No. 7 treated lenders that operate through mobile apps as their own category. October drops the idea. What matters now is the balance sheet, not whether loans reach borrowers through a phone screen or a branch counter.
Also Read: SBP Slaps 5% Cap on Islamic Banks’ Tawarruq Financing, Tightens Shariah Rules
That changes the earlier framework. Under SECP’s 2024 auditor circular, non-deposit-taking NBFCs lending through mobile applications sat in the second tier, next to smaller modarabas and investment schemes. A large app lender could shop across the wider list. Past Rs1 billion, it can’t anymore.
Digital lenders know this regulator’s attention well. Late in 2022, Circular No. 15 laid down conduct rules for app-based lending amid complaints of mis-selling, leaked borrower data and heavy-handed recovery calls. In 2023, SECP told NBFCs that any tie-up with an unapproved app could cost them a fine of up to Rs50 million, or their licence.
Amended NBFC rules now also make lending companies run a public website that shows, among other things, their financial statements. Anyone can read those numbers. Whether anyone should trust them depends on who audited them.
What stays the same
The circular sets no loan caps. It doesn’t touch interest rates. Borrowers won’t notice anything at the app counter.
Its reach starts with financial years that begin on or after Jan. 1, 2027. The circular does not expressly require companies to terminate existing engagements immediately. A lender checks the list when its next appointment comes due.
The real squeeze falls on companies hovering just under the line. A lender at Rs900 million today could lend its way past Rs1 billion within a year, and discover its auditor no longer qualifies.
The numbers SECP kept to itself
SECP hasn’t said how many lending NBFCs hold more than Rs1 billion in assets. Nor does it say how many already use one of the 11 firms the new rule shuts out of larger mandates. Compliance costs? No estimate. Higher audit fees? The circular doesn’t go there.
It doesn’t accuse any auditor of slipping, either. SECP simply wants a tighter roster of reviewers once a lender reaches a certain size.
For the supplementary tier, that carries a cost. The 11 firms could lose eligibility for appointments at clients that cross the threshold.
For lenders, the rule boils down to one line. Lend more, and SECP gets more particular about who checks your books.
