eKYC in Egypt: Haweya, the NTRA Digital Identity and the FRA Track

eKYC in Egypt runs in three directions: the Central Bank's Haweya platform for banks, the NTRA digital identity piloted with mobile operators, and the Financial Regulatory Authority track already in production with financial institutions.

eKYC in Egypt now runs in three directions. Banks follow the Central Bank of Egypt (CBE) rules issued in August 2026 and the Digital Financial Identity platform run by Haweya. The National Telecom Regulatory Authority (NTRA) is piloting a digital identity («الهوية الرقمية») with mobile operators. Non-bank financial companies (consumer finance, microfinance, insurance and fintech-licensed companies) follow the Financial Regulatory Authority (FRA) track built on Decision 140 of 2023, the direction already in production with financial institutions.

The three eKYC directions in Egypt at a glance

The FRA writes the rules for non-bank finance; VLens is registered to deliver them.

The CBE eKYC rules of August 2026

On 23 August 2026 the CBE published the Regulations Governing the Services of the Digital Financial Identity Platform for Identifying Bank Customers and Verifying Their Identities Electronically, approved by its Board of Directors. They apply to all banks operating in Egypt, to CBE-licensed entities eligible to join the approved platform and to CBE-authorised banking agents, and they cover natural persons.

The rules cover electronic identification, verification and updating of customer data, electronic authentication of transactions and of acceptance of terms, and sharing a customer's digital financial identity between participants. The main requirements:

• reading national ID data through integration with the Civil Status Organization systems;
• a live image of the customer matched to the document holder, with controls against deepfakes and manipulated biometric data;
• one unique identity number per customer, created from a national ID card or a passport;
• authentication by a device-bound certificate, OTP, a Global PIN or biometrics;
• sharing the identity with another bank or agent only with the customer's prior consent;
• a SOC 2 Type 1 report before launch, SOC 2 Type 2 within six months, and a privacy impact assessment.

Banks may use the platform in place of a handwritten signature for non-financial transactions; financial transactions need a further CBE approval. The rules defer to the eKYC procedures of the Egyptian Money Laundering and Terrorist Financing Combating Unit, and they contain no customer tiers or transaction limits.

Haweya, the Digital Financial Identity platform

The CBE rules name the Digital Financial Identity Company, "Haweya" («هوية»), as the company that manages and provides the approved platform. Haweya runs the platform from inside Egypt, issues its technical integration rules with CBE approval, integrates with the Civil Status Organization and screens customers against negative lists. Participating banks, CBE-authorised agents and CBE-licensed entities use it, and an identity created at one bank can be reused by another with the customer's consent.

The platform serves the banking sector. The rules address banks and CBE-licensed entities, and they do not name companies supervised by the FRA.

The NTRA digital identity («الهوية الرقمية»)

In late August 2026 the NTRA launched a pilot biometric verification system, widely reported as Egypt's digital identity. The Ministries of Communications and Interior provided its rules, infrastructure and an integration platform linked to the Civil Status Sector. Mobile operators run it inside their own apps for SIM purchase, line-ownership transfer, mobile wallets and e-signature, for Egyptians and resident foreigners.

A separate Ministry of Interior app, MOIEG-PASS, has been in pilot since February 2026: users scan their national ID card and complete facial recognition to reach Ministry of Interior e-services. Neither programme has been announced for KYC by banks, fintechs or non-bank financial companies.

The FRA track: in production with financial institutions

Law No. 5 of 2022 regulates financial technology in non-banking financial activities. FRA Board Decision 140 of 2023 defines the digital identity, the digital contract and the digital register, and names four fields of fintech use: electronic identification, verification and authentication; electronic know-your-customer; concluding contracts electronically; and electronic recording in digital registers. Decision 141 of 2023 created the fintech outsourcing register, and only registered companies may provide these services to FRA-supervised companies.

Decision 186 of 2024, amended by Decisions 30 of 2025 and 133 of 2026, requires an enquiry into the customer's data at contracting: the national ID with the Civil Status Organization and phone ownership with the NTRA, through the FRA's electronic linkage system. Decision 133 of 2026 extended the duty to consumer finance and microfinance and added an OTP bound to the enquiry. The eKYC requirements page sets out each step. This is the direction financial institutions already run in production every day.

VLens: an independent third party for FRA-supervised companies

VLens is an independent third party with no conflict of interest. It runs no lending or banking business and has no stake in the decisions its clients make about their customers. VLens is entered on the FRA fintech outsourcing register across all four fields under Decision 1224 of 2024, renewed by Chairman's Decision 2379 of 2026 and valid until 25 May 2027, and was the first provider registered across all four fields. It is not affiliated with the CBE, Haweya, the Ministry of Interior or the NTRA.

One VLens flow covers the FRA steps: Arabic OCR of the national ID card, liveness detection and a face match to the card photo, the Civil Status and NTRA enquiries, the OTP bound to the enquiry, concluding the contract electronically, and an immutable digital record of every step.

As a private-sector partner, VLens adapts to each client's requirements: the steps in the flow, the risk thresholds and the customer journey are configured per product, integration runs through one API and SDKs, and the relationship is set by a commercial contract with a service-level agreement. That flexibility never compromises security or governance: every step follows the FRA rules and is kept in an immutable digital record.

Frequently asked questions