Section 154A of the Income Tax Ordinance 2001 (as amended February 2026) extends the 0.25% final tax rate for IT service exporters through Tax Year 2029.<br /> PECA 2016 extends to all Pakistanis worldwide and covers extraterritorial offenses affecting Pakistani persons or systems, per the Act's summary.<br /> SRO 590(I)/2017 (FBR, July 1, 2017) grants complete exemption from sales tax on the export of IT services and ITeS.<br /> The Special Technology Zones Authority Act 2021 offers a 10-year tax exemption package to qualifying technology zone enterprises.<br /> The World Bank's 5G Readiness Plan (Final Draft, August 26, 2021) concluded Pakistan was not yet 5G ready, citing insufficient affordability indicators.<br /> The State Bank of Pakistan's 2023 Regulations for Electronic Money Institutions replace earlier directives and introduce updated licensing requirements under Section 4.
Three files in the pipeline deserve close monitoring over the next six to twelve months. The Personal Data Protection Bill 2023 (draft) remains unpassed; member companies building compliance sequences around PECA 2025 and the 2021 PTA content rules are doing so without clarity on how the bill's data-controller obligations and breach-notification duties will interact with existing incident-reporting duties — a conflict the association's policy team has yet to resolve publicly. The e-Commerce Policy 2.0 Draft (2025–30), currently in stakeholder consultation, would replace the 2019 framework and introduces new domestic platform regulation alongside cross-border trade measures; its final form will shape how IT services are classified for provincial tax purposes. The World Bank/ MoITT 5G Readiness Plan, last assessed in August 2021, concluded Pakistan was not 5G-ready; members should track whether any updated spectrum allocation or auction timeline supersedes the document's conclusions, as no post-2021 revision is present in the current library.
A P@SHA member company providing software services to overseas clients encountered a recurring problem when settling cloud-infrastructure invoices to a US provider: their foreign-currency debit card was blocked twice within a single quarter. Each time, the bank demanded a fresh No Transaction Slip — NTS — along with a certified invoice before releasing payment. The result was a failed $4,800 invoice and operational disruption to a live client engagement. The company's internal review concluded the bank was applying SBP forex compliance rules more restrictively than the regulations required, particularly around what constitutes a permissible IT service payment. P@SHA escalated the pattern through its regulatory dialogue mechanism. What unblocked the situation was a practical workaround: the company pre-cleared the US cloud vendor with the bank as a standing foreign payment, preventing repeated AML triggers. The underlying issue — inconsistent application of FCY card usage rules for cloud services — remains a systemic concern for the sector.
Three threads drove member discussion this month. On the final tax regime (FTR), participants confirmed the Finance Act 2026-27 extended the 0.25% rate to 2029 but noted that some banks are independently requesting fresh NTS on 0.25% receipts, a gap from FBR that members want addressed with a plain-English clarification note. On data protection and cybersecurity compliance, members debated sequencing between PECA 2016, the 2021 PTA content rules, the PECA Amendment 2025, and the Personal Data Protection Bill 2023 draft — with consensus forming around building a single audit trail that satisfies breach-notification and CERT-incident duties simultaneously, but no agreement on which regime takes precedence on cross-border transactions. On Special Technology Zones, members queried whether the capital-goods import exemption under SRO 744(I)/2023 delivers meaningful savings at the counter for server and networking equipment, with one participant flagging that the exemption is tightly scoped to a list of goods and STZ residents only — and advising a review of PSEB's per-zone utilization data before committing a build-in-zone decision.
July 2026 sees P@SHA's Finance Bill commentary land alongside the extension of the 0.25% FTR to 2029. June 2023 had marked the last major STZ regulatory milestone with SRO 744(I)/2023 inserting customs rules for technology zones. The PECA Amendment 2025 was enacted earlier in 2026, installing the Social Media Protection and Regulatory Authority and mandatory platform enlistment obligations. The Digital Nation Pakistan Act 2025 — establishing the National Digital Commission — and the National AI Policy 2025 were both approved in 2025, consolidating the government's digital governance architecture. The Personal Data Protection Bill 2023 (draft) and e-Commerce Policy 2.0 (draft, 2025–30) remain in consultation, with no passage dates yet confirmed.
P@SHA's Commentary on the Federal Budget 2026-27, published July 2026, welcomes the Finance Act's extension of the preferential 0.25% final tax rate for IT service exporters through Tax Year 2029 under Section 154A of the Income Tax Ordinance 2001. The commentary notes this provides medium-term certainty for export contracts and pricing models, a priority flagged in P@SHA's pre-budget submission. However, the association flags a practical gap: FBR has yet to publish a plain-English clarification on which categories of receipts — particularly managed services billed through intermediaries — fall under the Section 154A carve-out versus the older Section 152(6)/153 logic. Forum threads confirm members are already receiving bank letters demanding fresh NTS on 0.25% receipts, suggesting inconsistent application at the field level. The commentary also records new compliance obligations introduced by the Finance Act but does not enumerate them in the document summary available to this briefing.
The Prevention of Electronic Crimes (Amendment) Act 2025 represents the most substantive overhaul of Pakistan's cybersecurity law since PECA 2016. The amendment, identified as XL of 2016 in amendment documentation, introduces three structural changes. Chapter 1A (Sections 2A–2P) establishes the Social Media Protection and Regulatory Authority as a dedicated body. Chapter 1B (Section 2Q) mandates mandatory enlistment for social media platforms operating in Pakistan. A dedicated prosecution mechanism is also created under the amended Act. P@SHA's policy library contains the original PECA 2016 and the 2021 PTA content rules (S.R.O. 1343(I)/2021) that already governed takedown procedure; the 2025 amendment layers a new institutional and enforcement layer on top. Member forum discussion confirms SMEs are actively mapping their compliance obligations against both the existing PTA content rules and the forthcoming Personal Data Protection Bill 2023 draft — suggesting practical overlap between the three regimes is already a live concern, even before the PECA amendment's enforcement machinery is operationalised.
The National AI Policy 2025, approved by the Ministry of IT & Telecom, establishes Pakistan's comprehensive framework for AI adoption, governance, and development across government and private sectors. It addresses AI ethics and responsible use, workforce skill development, data governance, and infrastructure development. The policy succeeds the 2022 Consultation Draft V1, which was the first public consultation version released for stakeholder feedback. PSEB's Annual Report 2025 confirms the policy's role within the broader digital legislative cluster, alongside the Digital Nation Pakistan Act 2025 establishing the National Digital Commission. Member forum discussion indicates that implementation is currently concentrated in two areas: model-governance and audit-trail obligations driven by enterprise buyer requirements for AI-use attestations, and early alignment with the policy's human-oversight duties. The data-quality expectations embedded in the policy are identified as a friction point — the standards assume a data maturity most SMEs do not yet possess. No clause-by-clause implementation guidance from MoITT has been published as of this briefing.