FRA-Approved eKYC Providers and Digital Contracting in Egypt

Law No. 5 of 2022 regulates financial technology in Egypt's non-banking financial activities, and Financial Regulatory Authority Decisions 139, 140 and 141 of 2023 give it operational content. FRA approval has two limbs: the licensed institution holds the Authority's prior approval, under Article 7 of FRA board Decision 58 of 2022, to conduct its activity using financial technology through an outsourcing entity, and the technology provider holds an entry on the fintech outsourcing register. VLens has held an entry across all four outsourcing fields since 26 May 2024.

The FRA instruments for eKYC and digital contracting

Law No. 5 of 2022 establishes four statutory building blocks: digital identity, the digital contract, the digital register and the digital platform. Decisions 139, 140 and 141 of 2023 took effect on 12 July 2023. Decision 68 of 2025 amends 140 and 141; 139 stands unamended.

The fintech outsourcing register and its four fields

Decision 141 of 2023 creates the fintech outsourcing register (سجل مقدمي خدمات التعهيد) and bars any party not entered on it from performing an outsourcing service. Registration is granted per field.

Decision 140 of 2023 names four fields, introduced with «ومنها» (among them), and allows the Authority to designate others:

• Electronic identification, verification and authentication.
• Electronic customer onboarding.
• Concluding contracts on non-banking financial products electronically (إبرام عقود على منتجات مالية غير مصرفية إلكترونيًا).
• Electronic recording, storage and retrieval from digital registers.

Registration conditions, term and administrative measures

An entry runs for one year and is renewable on the same conditions. A one-month grace period follows expiry, after which the company is treated as unregistered.

• Conditions: an Egyptian joint-stock company, paid-up capital of at least EGP 10 million, a fee of EGP 25,000 per field, technology-risk and professional-liability insurance, and financial statements audited by an auditor in Section 1 of the FRA auditors' register.
• Continuing conditions: notifying the Authority of each outsourcing contract and any material amendment to it, and retaining no customer data after the operation ends.
• Measures: formal notice with a deadline to remedy, summoning the board or general assembly, suspension for up to one year, de-registration with a time-limited bar on re-registration, and permanent de-registration.

VLens's FRA registration

FRA Decision No. 1224 of 2024, dated 26 May 2024, entered VLens on the fintech outsourcing register across all four fields. VLens was the first provider registered across all four. Chairman's Decision No. 2379 of 2026, issued 4 August 2026, renewed the registration; the entry is valid until 25 May 2027.

Supervisory obligations attached to registration

The annex to Decision 1224 of 2024 sets the obligations that run throughout the registration:

• Adherence to the submitted business plan and model.
• A detailed monthly report on execution of the timeline for technology infrastructure, protection, insurance and the working framework.
• Retention of all data needed for the Authority's desk and on-site review.
• An automated link with the Authority under the controls it sets.
• Real-time visibility for the Authority of contracts between the non-banking financial services provider and the citizen creating the digital identity.
• No contracting with an FRA-licensed company that lacks the Authority's prior approval.

Digital identity and digital contracts under Decision 140 of 2023

Decision 140 of 2023 establishes a digital identity through identification, verification and authentication (التحديد والتحقق والمصادقة). Creation or renewal requires at least four possession factors, at least three presence-and-liveness factors, cyber-location, transaction time and three knowledge factors. Annex 1 requires the document's authenticity to be verified through linkage with the competent administrative authorities or through the API of the FRA's unified digital-identity system, and the mobile number to be confirmed, through linkage with the National Telecom Regulatory Authority (NTRA), as issued by a licensed operator and linked to the same national ID. VLens verifies national ID data against the Civil Status Organization record.

For every digital contract the provider verifies identity and consent and stores the concluded contract, with each pre-conclusion stage and its timestamp, in the digital register. Stored data holds the evidentiary force of official documents from the date of storage. Records are retained for at least five years after the digital asset's validity ends.

Customer-data verification under Decision 186 of 2024

Decision 186 of 2024 is the original instrument on the enquiry into the correctness of customer data (الاستعلام عن صحة بيانات العملاء); Decisions 30 of 2025 and 133 of 2026 amend it. As amended by Decision 30 of 2025, it obliges companies licensed to operate using financial technology, outsourcing service providers and insurance companies to verify national ID data with the Civil Status Organization and mobile-number ownership with NTRA, without an accompanying one-time password (OTP): the fintech journey already sends two OTPs, at registration and at conclusion of the contract, and insurance companies are outside the OTP requirement.

Decision 133 of 2026, issued in July 2026, added two things. It brought consumer finance companies, microfinance companies and the associations and NGOs licensed for microfinance into the enquiry obligation, and it requires those two sectors alone to bind an OTP to the enquiry, kept in an immutable record proving the customer's presence at the moment of the enquiry, on conclusion of a new contract and on renewal of an existing one. A financial transaction requires the OTP only, with no new enquiry. Chairman's Decision 2735 of 2026, dated 26 August 2026, requires the addressed entities to apply it within two months of its entry into force and to notify the Authority.

The OTP reference ID is passed inside the enquiry (PII) API call, tying each enquiry to one OTP event. VLens runs optical character recognition (OCR) on the national ID before the enquiry call, so the data submitted is sound before the cost of the enquiry is incurred.

Frequently asked questions