Digital contracting in Egypt: the FRA rules for concluding contracts electronically
Digital contracting in Egypt is the electronic conclusion of contracts on non-banking financial products under Law No. 5 of 2022 and FRA Decision 140 of 2023. The contract binds through a verified digital identity, evidenced consent, and storage of the full pre-conclusion sequence in a digital register whose contents hold the evidentiary force of official documents. Decision 186 of 2024, as amended, requires an enquiry into the correctness of customer data; Decision 133 of 2026 brought consumer finance and microfinance into that enquiry and binds a one-time passcode (OTP) to it for those two sectors.
Legal basis: Law 5 of 2022 and FRA Decision 140 of 2023
Law No. 5 of 2022 regulates the use of financial technology in non-banking financial activities. The FRA board issued its executive framework on 21 June 2023: Decision 139 of 2023 on technology infrastructure and security, Decision 140 of 2023 on digital identity, digital contracts (ضوابط العقود الرقمية) and the digital register, and Decision 141 of 2023 on the outsourcing register. Decision 68 of 2025 amends Decisions 140 and 141.
Decision 140 names four fintech fields: electronic identification, verification and authentication; electronic customer onboarding; concluding contracts on non-banking financial products electronically (إبرام العقود); and recording, storage and retrieval from digital registers.
Binding force of a digital contract
Decision 140 of 2023 places three obligations on the service provider before a digital contract is concluded. Data stored in the digital register holds the evidentiary force of official documents from the date of storage.
| Obligation | Content |
|---|---|
| Identity verification | The counterparty holds a digital identity identified, verified and authenticated under the same decision. |
| Consent verification | Capacity, will, offer and acceptance are recorded, with proof that the customer reviewed every contract term. |
| Storage in the digital register | The contract and every prior stage, timestamped, are stored under encryption approved by the Authority. |
Risk tiers for digital contracts
Decision 140 of 2023 sets a tiered regime, and the institution's own risk assessment classifies each product transaction.
Low- and medium-risk contracts are concluded under appropriate encryption, and no payment method or payment account is a prerequisite to concluding them. A verified payment method is a prerequisite to executing financial transactions, not to contracting; the controls were amended to this effect.
High-risk transactions require a PKI electronic signature, coupled with a public and private key pair, issued by an authorised certification service provider. VLens operates under FRA outsourcing registration; signature certificates are issued by authorised certification service providers.
Digital register: structure and technical requirements
Each digital platform holds a digital register, which may be divided into sub-registers for digital identity operations, customer onboarding, electronic contracting and product transactions.
Decision 140 of 2023 sets the register's technical requirements.
- Retention for at least five years after the validity of the digital asset ends, and longer where litigation or arbitration has been notified.
- Logging in the syslog format of IETF RFC 5424, unless the Authority approves an alternative.
- Digital forensic analysis, proof of chain of custody, and prevention of modification and repudiation.
- Centralised or distributed implementation, with blockchain and distributed-ledger models expressly permitted.
Customer data enquiry under Decision 186 of 2024 and the OTP under Decision 133 of 2026
Decision 186 of 2024, dated 28 August 2024, is the original instrument on the enquiry into the correctness of customer data (الاستعلام عن صحة بيانات العملاء); Decisions 30 of 2025 and 133 of 2026 amend it. It obliges fintech-licensed companies, outsourcing service providers and insurance companies to verify national ID data with the Civil Status Organization and mobile-number ownership with NTRA, without an accompanying OTP: the fintech journey already sends two passcodes, at registration and at contract conclusion, and insurance companies are outside the OTP requirement.
Decision 133 of 2026, issued by the FRA board in July 2026, adds two things. It brings consumer finance companies, microfinance companies and the associations and NGOs licensed for microfinance into the enquiry obligation. For those two sectors alone, it requires a passcode bound to the enquiry and kept in an immutable record, proving the customer's presence at the moment of the enquiry, at a new contract and at renewal of an existing one. A financial transaction requires the OTP only, with no new enquiry. The OTP's reference ID is passed inside the enquiry (PII) API call.
Chairman's Decision 2735 of 2026, dated 26 August 2026, requires the addressed entities to apply Decision 133 within two months of its entry into force and to notify the Authority.
Contracting flow step by step
The flow applies the identity controls of Annex 1 to Decision 140 of 2023, then the digital contract controls. In a multi-party contract, such as borrower and guarantor, each party passes the same steps.
- Identification: live capture of the national ID, with character recognition (OCR) of its data before the enquiry call, so the data is sound before the enquiry cost is incurred.
- OTP: for consumer finance and microfinance under Decision 133 of 2026, a passcode whose reference ID is passed inside the enquiry call.
- Verification: the document checked against Civil Status Organization records, and the mobile number confirmed as issued by a licensed operator and linked to the same national ID.
- Authentication: a selfie compared with the ID photo, with automatic liveness through random prompts.
- Consent: verification of the customer's consent to the contract terms.
- Conclusion: storage of the contract in the digital register.
VLens registration and digital contracts platform
Decision 141 of 2023 reserves outsourcing services to parties entered on the outsourcing register (سجل مقدمي خدمات التعهيد). FRA Decision 1224 of 2024, dated 26 May 2024, registered VLens across all four fields, including the electronic conclusion of contracts; VLens was the first provider registered across all four. Chairman's Decision 2379 of 2026, dated 4 August 2026, renewed the registration, valid until 25 May 2027.
The annex to Decision 1224 of 2024 requires VLens, as registered provider, to maintain an automated link with the Authority and to give the Authority the capability to monitor in real time the contracts between the non-banking financial service provider and the citizen who created the digital identity.
The platform verifies identity through direct, real-time integrations with the Civil Status Organization and NTRA, concludes the contract on that verified identity, and holds the contract and its pre-conclusion trail encrypted and hosted in Egypt. It processes 900,000 to 1.1 million API requests a day for 48+ enterprise clients across lending, capital markets and insurance.
Frequently asked questions
Is a contract concluded electronically legally binding in Egypt?
Yes, for non-banking financial products concluded under Law 5 of 2022 and FRA Decision 140 of 2023, once identity and consent are verified and the contract is stored in the digital register.
What role does a payment method play in low- and medium-risk contracts?
No payment method or payment account is a prerequisite to concluding a low- or medium-risk contract. The verified payment method becomes a prerequisite at the stage of executing financial transactions, under the controls as amended.
When does a digital contract need a PKI electronic signature?
In the high-risk tier of Decision 140 of 2023, as classified by the institution's own risk assessment. An authorised certification service provider issues the signature.
Which companies does the OTP duty under Decision 133 of 2026 bind?
Consumer finance companies, microfinance companies and the associations and NGOs licensed for microfinance, which Decision 133 brought into the enquiry obligation of Decision 186 of 2024. For them alone, an OTP bound to the enquiry is required at a new contract and at renewal; a financial transaction requires the OTP only, with no new enquiry.
Which providers may supply digital contracting to FRA-licensed companies?
Companies entered on the outsourcing register under Decision 141 of 2023 for the contracting field, on entries that run one year and are renewable. The licensed company must obtain the Authority's prior approval to operate through an outsourcing entity, under Article 7 of Decision 58 of 2022.
API documentation
The digital contracting and identity verification APIs are documented at docs.vlenseg.com.
API documentationContact us