Electronic Contracts in Egypt: Law 15/2004 vs Law 5/2022

Law No. 15 of 2004 governs electronic signatures and the certification service providers ITIDA licenses to issue e-signature certificates. Law No. 5 of 2022, with Financial Regulatory Authority Decisions 139, 140 and 141 of 2023, governs digital identity, digital contracts and the digital register for non-banking financial products. The regimes meet at the PKI certificate required for a high-risk transaction.

Law 15 of 2004 and Law 5 of 2022: the dividing line

Allocation between the two regimes turns on the subject matter of the contract and the licence under which the contracting party operates; the technology used is immaterial.

• Contract on a non-banking financial product between an FRA licensee and its customer: Law No. 5 of 2022 and the FRA decisions issued under it.
• Any other contract, such as a supply agreement, an employment contract or a commercial lease: Law No. 15 of 2004.

Law 15 of 2004: electronic signatures and certification service providers

Law No. 15 of 2004 on E-Signature and the Establishment of the Information Technology Industry Development Authority is Egypt's general electronic signature statute. It gives electronic signatures and writings evidentiary standing before the courts and makes ITIDA the licensing and supervisory authority for certification service providers.

Recognition is conditional: the signature is uniquely linked to the signatory and under the signatory's exclusive control, the signatory is identifiable from it, and any later alteration of the signed data is detectable. A certificate from a licensed provider gives a signature automatic standing; a signature created outside that chain bears the burden of proving itself.

Law 5 of 2022 and FRA Decisions 139, 140 and 141 of 2023

Law No. 5 of 2022 regulates the use of financial technology in non-banking financial activities. It defines four building blocks: digital identity, the digital contract, the digital register and the digital platform.

The FRA board issued the implementing decisions on 21 June 2023: Decision 139 on technology infrastructure and security, Decision 140 on digital identity, digital contracts and the digital register, and Decision 141 creating the fintech outsourcing register. Decision 68 of 2025 amends Decisions 140 and 141.

Decision 140 names the core fields of fintech use: identification, verification and authentication; customer onboarding; concluding contracts on non-banking financial products electronically; and digital-register recording, storage and retrieval. The regulator's term for the act is إبرام العقود, concluding contracts; توقيع appears in Decision 140 only for the e-signature issued by an ITIDA-authorised certification service provider.

Evidence of a digital contract under Decision 140 of 2023

Section ثالثًا of Decision 140 sets a base obligation for every transaction. The service provider verifies the counterparty's identity under the decision's digital-identity controls; verifies consent, meaning capacity, will, offer and acceptance, with proof that the customer reviewed all the terms; and stores the concluded contract, with every pre-conclusion stage and its timestamp, in the digital register under FRA-approved encryption.

Section رابعًا, item 13 gives the data the evidentiary force of official documents from the date it is stored in the digital register. The register supports forensic analysis, proves chain of custody and prevents modification and repudiation.

Above the base obligation the controls follow the risk tier the licensed entity assigns to the transaction.

• Low or medium risk: appropriate encryption. A verified payment method is a prerequisite to executing financial transactions; concluding the contract requires no payment method or payment account.
• High risk: PKI e-signature issued by an ITIDA-authorised certification service provider, a counterparty separate from the FRA-registered outsourcing provider.

Decision 186 of 2024 and the OTP in financing contracts

Decision 186 of 2024 is the original FRA instrument on the enquiry into the correctness of customer data (الاستعلام عن صحة بيانات العملاء), amended by Decisions 30 of 2025 and 133 of 2026. It obliges fintech-licensed companies, outsourcing service providers and insurance companies to verify national ID data with the Civil Status Organization and mobile-number ownership with NTRA, without an accompanying one-time password (OTP): the fintech journey already sends two OTPs to the customer's phone, at registration and at conclusion of the contract, and insurance companies are outside the OTP requirement.

Decision 133 of 2026 adds two elements: consumer finance companies, microfinance companies and the associations and NGOs licensed for microfinance join the enquiry obligation, and those two sectors alone must bind an OTP to the enquiry, kept in an immutable record, proving the customer's presence at the moment of the enquiry, at conclusion of a new contract and at renewal. The OTP's reference ID is passed inside the enquiry (PII) API call, tying each enquiry to one OTP event. A financial transaction, meaning use of the financing, requires the OTP only, with no new enquiry.

VLens's registration under the FRA regime

Decision 141 of 2023 reserves outsourcing services to parties entered on the fintech outsourcing register. FRA Decision No. 1224 of 2024, dated 26 May 2024, registered VLens across all four outsourcing fields. VLens was the first provider registered across all four. Chairman's Decision No. 2379 of 2026, issued 4 August 2026, renewed the registration until 25 May 2027.

VLens's authority derives from this registration. Certificate issuance under Law 15 of 2004 belongs to certification service providers licensed by ITIDA; VLens holds no ITIDA licence and issues no e-signature certificates.

Frequently asked questions