Pakistan’s AML/CFT regime rests on three laws. The Anti-Money Laundering Act, 2010 (AMLA) criminalises money laundering, sets out what reporting entities must do, and provides for the Financial Monitoring Unit (FMU), Pakistan’s financial intelligence unit. Terrorist financing is an offence under the Anti-Terrorism Act, 1997, and UN Security Council sanctions take effect through the United Nations (Security Council) Act, 1948.

How the regime is organised

• Policy and coordination. The National Anti-Money Laundering and Counter Financing of Terrorism Authority, set up by law in August 2023, coordinates AML, CFT and targeted financial sanctions policy across government. The National Executive Committee under section 5 of the AMLA, chaired by the Finance Minister, continues where its role does not overlap with the Authority’s.
• Financial intelligence. The FMU receives suspicious transaction reports (STRs) and currency transaction reports (CTRs) through its goAML system, analyses them, and passes intelligence to investigating agencies.
• Supervision. The AMLA names five regulators: the State Bank of Pakistan (SBP), the Securities and Exchange Commission of Pakistan (SECP), the Federal Board of Revenue (FBR), the National Savings Supervisory Board and the Pakistan Post Supervisory Board. Its self-regulatory bodies are the Institute of Chartered Accountants of Pakistan (ICAP) and the Institute of Cost and Management Accountants of Pakistan (ICMAP) for accountants, and the Pakistan Bar Council, the provincial bar councils and the Islamabad Bar Council for lawyers.
• Virtual assets. The Pakistan Virtual Assets Regulatory Authority (PVARA) licenses and supervises virtual asset service providers. It was created by the Virtual Assets Ordinance, 2025 in July 2025, and the Virtual Assets Act, 2026, which replaced the ordinance, became law in March 2026. PVARA opened licensing on 22 August 2026 with 11 licence categories. Providers already operating before March 2026 had until 5 September 2026 to apply for a no-objection certificate or stop operating.

Key milestones

1. June 2018

   The FATF places Pakistan under increased monitoring (the “grey list”) with a 27-item action plan to address strategic deficiencies.

2. October 2019

   The Asia/Pacific Group on Money Laundering (APG) publishes Pakistan’s mutual evaluation report, adopted in August 2019.

3. 2020

   A major legislative overhaul: amendments to the Anti-Terrorism Act and the UN Security Council Act in July, then the AML (Second Amendment) Act in September, which raised penalties and expanded supervision. The SBP and SECP issue new AML/CFT regulations.

4. June 2021

   The FATF identifies further deficiencies and agrees a second, seven-item action plan focused mainly on money laundering.

5. October 2022

   After completing all 34 items across both action plans, and an FATF on-site visit in late August and early September 2022, Pakistan is removed from increased monitoring.

6. 2023

   Pakistan completes its National Risk Assessment 2023, the SECP amends its AML/CFT regulations in response, and the National AML/CFT Authority Act becomes law.

7. July 2025

   The Virtual Assets Ordinance, 2025 establishes PVARA.

8. 2026

   The Virtual Assets Act, 2026 becomes law in March, PVARA opens licensing in August, and the FBR widens its DNFBP rules to cover all dealers in precious metals and stones.

What has changed most for firms

• Tougher penalties. The 2020 amendments raised the fines for money laundering to up to Rs25 million for individuals and Rs100 million for legal persons. The offence carries one to ten years’ rigorous imprisonment.
• DNFBPs are now supervised. Real estate agents, dealers in precious metals and stones, accountants and lawyers have AML/CFT obligations and named supervisors.
• Prompt, electronic reporting. STRs must be filed with the FMU “promptly”, replacing the earlier seven-working-day window, and cash transactions of Rs2 million or more are reported as CTRs through goAML.
• Risk awareness. The National Risk Assessment 2023 rated corruption and bribery, illegal hawala and hundi, tax crimes, smuggling and cash smuggling as very high money laundering threats. Firms’ own risk assessments should reflect these findings.

The framework has three layers: primary laws passed by Parliament, regulations issued by each supervisor for the sectors it oversees, and guidance from supervisors and the FMU.

Primary laws

Sector regulations

Key guidance

• FMU guidance on filing STRs and CTRs through goAML, including red flag indicators
• FMU AML/CFT Guidelines for DNFBPs
• Supervisors’ guidance on implementing UN Security Council sanctions
• The National Risk Assessment 2023, which sets the national risk picture firms are expected to reflect

Responsibility is split three ways. Sector supervisors check that firms comply, the FMU receives and analyses reports, and a small group of ministries runs sanctions and proscription. Knowing who does what tells you who you answer to, where your reports go and which lists you must screen against.

Supervisors by sector

The Financial Monitoring Unit (FMU)

• Status. Pakistan’s financial intelligence unit, established in October 2007 and now governed by section 6 of the AMLA. It is housed in the State Bank of Pakistan building in Karachi and headed by a Director General appointed by the Federal Government in consultation with the SBP.
• Reports it receives. STRs, which must be filed “promptly”, and CTRs for cash transactions of Rs2 million or more, which must be filed immediately and no later than seven working days after the transaction.
• How reports are filed. Electronically through goAML, the financial intelligence software developed by the UN Office on Drugs and Crime (UNODC). The FMU adopted goAML in January 2019, and since 1 January 2020 reports can only be filed electronically.
• What it does with them. Analyses reports, passes intelligence to investigating agencies, maintains a national database, exchanges information with foreign financial intelligence units, and works with supervisors on reporting rules.
• Guidance. The FMU publishes guidance for reporting entities, including the AML/CFT Guidelines for DNFBPs issued in January 2020.

Who investigates

The AMLA names six investigating or prosecuting agencies, and the Federal Government can notify others:

• National Accountability Bureau (NAB)
• Federal Investigation Agency (FIA)
• Anti-Narcotics Force (ANF)
• FBR Directorate General of Intelligence and Investigation (Customs)
• FBR Directorate General of Intelligence and Investigation (Inland Revenue)
• Provincial Counter Terrorism Departments (CTDs), which also investigate terrorist financing

Targeted financial sanctions and proscription

• Freeze without delay. The SBP explains that MOFA guidance generally interprets this as within 24 hours. For potential matches, the immediate temporary-freeze requirement below applies.
• Potential matches. SBP-regulated firms must place an immediate temporary freeze and notify the SBP, which refers the case to the Ministry of Interior for verification.
• No set-off. Firms cannot exercise rights of set-off against frozen accounts. Where an exemption allows limited withdrawals, only the stipulated monthly amount may be released.

AML/CFT obligations under the AMLA apply to reporting entities: financial institutions, designated non-financial businesses and professions (DNFBPs), and any other person the Federal Government notifies in the official Gazette. Coverage follows the activity a business carries out, not just its licence or name.

Financial institutions

The AMLA defines a financial institution by what it does. Any business that carries out the listed activities is covered, including:

• Taking deposits and other repayable funds from the public, and lending in any form, including financial leasing
• Money or value transfer, and issuing and managing means of payment such as cards, cheques, bank drafts and electronic money
• Financial guarantees and commitments
• Trading in foreign exchange, money market instruments, securities and commodity futures, and money and currency changing
• Portfolio management, fund administration and safekeeping of securities
• Insurance business

In practice this covers banks, development finance institutions, microfinance banks and exchange companies (supervised by the SBP); securities brokers, insurers and non-bank finance companies (SECP); and the financial services of National Savings and Pakistan Post.

DNFBPs and when they are covered

The FBR’s AML/CFT Regulations for DNFBPs, 2020 (SRO 924(I)/2020) came into force on 29 September 2020. They require DNFBPs to register with the FBR, assess their risks, carry out customer due diligence, appoint a compliance officer and screen against sanctions lists. In August 2026 the FBR amended them (SRO 1439(I)/2026). “Jewellers” became dealers in precious metals and stones, now including bullion dealers. Real estate agents now include title transferring authorities. Records involved in litigation must be kept until the case is resolved, and DNFBPs must respond promptly to requests from the FBR, law enforcement agencies and the FMU.

Virtual asset service providers (VASPs)

• Licensing. Firms offering virtual asset services in or from Pakistan must be licensed by PVARA under the Virtual Assets Act, 2026. Firms already operating before 5 March 2026 had to apply for a no-objection certificate by 5 September 2026 or stop operating.
• AML/CFT duties. The Pakistan Virtual Asset Services Regulations, 2026 (SRO 1419(I)/2026, issued 21 August 2026) require licensees to comply with AML/CFT/CPF obligations under the AMLA, including reporting obligations, and to keep records for at least seven years. Screening, transaction monitoring and Travel Rule controls are treated as critical functions. Rules for each activity are in the companion Activity Specific Regulations (SRO 1420(I)/2026).
• Banking access. Under SBP BPRD Circular Letter No. 10 of 2026 (14 April 2026), banks may open full accounts only for PVARA-licensed VASPs, and limited-purpose accounts for firms holding a PVARA no-objection certificate so they can complete licensing. Customer money must be kept in separate rupee client money accounts that pay no interest and allow no cash deposits or withdrawals. Banks must verify the licence with PVARA, risk-rate the VASP, monitor the relationship and report suspicious transactions to the FMU. Banks themselves may not invest in, trade or hold virtual assets.

Quick check: is your business covered?

1. Do you carry out any of the financial activities listed above as a business? If so, you are a financial institution.
2. Are you in a DNFBP category, and do you carry out the trigger activity, such as a Rs2 million cash sale or a property transaction for a client? If so, DNFBP obligations apply.
3. Do you provide virtual asset services in or from Pakistan? If so, you need a PVARA licence and must meet AMLA obligations.

If any answer is yes, register with your supervisor and on goAML before you need to file a report.

These are the core obligations that apply to every reporting entity under the AMLA. Each supervisor’s regulations add sector-specific detail, so always read them alongside your supervisor’s rules.

Key numbers and qualifications

Read these summaries with the detailed duties below and the rules for your sector. The linked provisions explain their scope.

What you must do

Pakistan is assessed against the FATF Standards by the Asia/Pacific Group on Money Laundering (APG). Its last full mutual evaluation was in 2019, and it has since reported its progress through follow-up reports.

Current status

The 2019 mutual evaluation

• Process. Conducted by the APG, with an on-site visit from 8 to 19 October 2018. The report was adopted in August 2019 and published in October 2019.
• Effectiveness. Ten of the eleven Immediate Outcomes were rated low. Only international cooperation (Immediate Outcome 2) was rated moderate.
• Technical compliance. Only 10 of the 40 Recommendations were rated compliant or largely compliant: one compliant (R.9) and nine largely compliant. Twenty-six were partially compliant and four non-compliant (R.22, R.25, R.28 and R.38).
• Main gaps. The report highlighted weak understanding of money laundering and terrorist financing risk, and weaknesses in supervision of financial institutions and DNFBPs.
• Result. Pakistan was placed in the APG’s enhanced follow-up process.

Progress since 2019

1. September 2020: first follow-up report

   R.29 (financial intelligence units) was upgraded to compliant, taking Pakistan to 11 of 40 rated compliant or largely compliant. It stayed in enhanced (expedited) follow-up.

2. June 2021: second follow-up report

   Based on data to October 2020, the APG re-rated 22 Recommendations. Twenty-one improved, while R.37 (mutual legal assistance) was downgraded to non-compliant. Pakistan reached 31 of 40 and moved to enhanced follow-up.

3. August 2021: third follow-up report

   R.10 (customer due diligence) was upgraded to compliant, and R.18 (internal controls), R.26 (supervision of financial institutions) and R.34 (guidance and feedback) to largely compliant. Pakistan reached 35 of 40.

4. August 2022: fourth follow-up report

   R.28 (regulation and supervision of DNFBPs) and R.37 (mutual legal assistance) were upgraded to largely compliant, R.33 (statistics) to compliant and R.38 (freezing and confiscation requests) to partially compliant. Pakistan reached 38 of 40. Only R.15 (new technologies, including virtual assets) and R.38 remain partially compliant.

5. October 2022

   The FATF removed Pakistan from increased monitoring after it completed both action plans.

6. 2024-25

   Pakistan’s latest follow-up report was adopted by the APG without re-ratings.

Grey list history

The FATF named Pakistan in its public statements on AML/CFT deficiencies from February 2008 until February 2015, including two years (2012 to 2014) on its stricter list of jurisdictions that had not made sufficient progress. Pakistan was placed under increased monitoring again from June 2018 to October 2022.

What comes next

• The APG’s fifth-round schedule, published in August 2026, lists Pakistan in its 2030 group, with its technical compliance questionnaire due by 31 March 2029.
• Under the APG’s transitional procedures, an evaluation formally begins when the technical compliance questionnaire is due, and follow-up reporting stops 24 months before that. On this timetable, Pakistan’s follow-up reporting should end around 2027.
• Because effectiveness ratings have not been reassessed since 2019, the next evaluation will be the first full test of whether the post-2019 reforms work in practice.

Pakistan’s National Risk Assessment 2023 (NRA), coordinated by the National FATF Secretariat through an NRA Core Committee, rates threats and vulnerabilities on a four-level scale: very high, high, medium and low. The published version is a summary of the full assessment. Your own risk assessment should reflect these findings.

Money laundering threats

Most vulnerable sectors

Of the non-profit organisations assessed, 6.75% were rated high risk for terrorist financing, 43.64% medium and 49.61% low.

Terrorist financing

• Organisations. The NRA assessed 87 terrorist organisations, 78 of them proscribed, and found 41 active in Pakistan to varying degrees. It rated four as very high risk, eight high, seven medium and 68 low.
• Sources of funds. Donations and extortion are rated very high; narcotics trafficking and cash smuggling are rated high.
• Channels. Cash and cash couriers, and illegal money or value transfer services, are rated very high. Banking and branchless banking are rated high, and virtual currency medium.

Common typologies

• Hawala and hundi. Value moved outside the banking system through informal brokers, often settled through trade or cash.
• Trade-based money laundering. Over- or under-invoicing and misdescribed goods, often through shell companies. In August 2025 the SBP revised its framework for banks (EPD Circular Letter No. 08 of 2025), pointing to warning signs such as companies at residential or mass-registration addresses and owners with little knowledge of the business. In July 2026 it told banks to connect to the Pakistan Single Window price verification portal.
• Real estate. Proceeds of corruption, tax evasion and other crime placed in property, often through cash payments and nominees.
• Cash smuggling. Physical movement of cash across borders, linked to both money laundering and terrorist financing.
• Misuse of companies. Private limited and foreign companies used to hide the real owner, which is why both are rated very high.

Red flags for front-line staff

These are drawn from the FMU’s sector red flag indicators. One red flag on its own is not proof of wrongdoing, but several together call for closer review and, where suspicion remains, an STR.

Eight scenarios for a self-check. Choose your answer mentally or note it down, then reveal the explanation. Count your own correct answers; no score or learning progress is saved.