KYC Provider in Egypt: Criteria under the FRA Regime

A KYC provider serving companies licensed by Egypt's Financial Regulatory Authority (FRA) operates as a fintech outsourcing provider entered on the Authority's register. FRA Decisions 140 and 141 of 2023 set the criteria an eKYC provider meets: registration and its validity, the fields covered, verification against government data sources, liveness and the digital register. VLens is an FRA-approved provider registered across all four outsourcing fields.

Registration on the fintech outsourcing register

Decision 141 of 2023, amended by Decision 68 of 2025, creates the register of fintech outsourcing service providers (سجل مقدمي خدمات التعهيد). Parties outside the register may not perform any outsourcing service for an FRA-licensed company.

Registration is granted per field: electronic identification, verification and authentication; electronic know-your-customer (eKYC); concluding contracts on non-banking financial products electronically; and electronic recording, storage and retrieval from digital registers.

Registration runs for one year, renewable on the same conditions.

Verification against government data sources

Annex 1 to Decision 140 of 2023 requires a live capture of the identity document, recognition of its characters and numbers, a selfie for biometric comparison, and proof of authenticity through a link with the competent administrative bodies or the Authority's unified digital-identity interface.

The Civil Status Organization (CSO) is the source for the identity record and the National Telecom Regulatory Authority (NTRA) for mobile-number ownership: the number is confirmed as issued by an NTRA-licensed operator and linked to the same national ID. Each check runs against the source when verification is requested.

Arabic OCR on the national ID and liveness detection

The national ID card carries a fourteen-digit number and Arabic-script names and numerals, which require specialised recognition. OCR supplies the data for the government link, and the CSO record determines validity.

Decision 140 of 2023 requires at least four possession factors and at least three presence and liveness factors, including face biometrics, reaction liveness and geolocation, to create or renew a digital identity. Annex 1 requires automatic liveness through response to random prompts.

The Decision 186 of 2024 enquiry chain

Decision 186 of 2024 is the original instrument on the enquiry into the correctness of customer data (الاستعلام عن صحة بيانات العملاء); Decisions 30 of 2025 and 133 of 2026 are its amendments. Decision 186 obliges fintech-licensed companies, outsourcing service providers and insurance companies to verify national ID data with the CSO and mobile-number ownership with NTRA, without an accompanying OTP: the fintech journey sends two OTPs, at registration and at conclusion of the contract, and insurance companies stand outside the OTP requirement.

Decision 133 of 2026 added two things: consumer finance and microfinance companies and the associations and NGOs licensed for microfinance joined the enquiry obligation, and those two sectors alone must bind an OTP to the enquiry, kept in an immutable record, proving the customer's presence at the moment of the enquiry, made for a new contract or a renewal. A financial transaction requires the OTP only, with no new enquiry. The OTP's reference ID is passed inside the enquiry (PII) API call. VLens runs OCR on the national ID before the enquiry call, so the data is sound before the enquiry cost is incurred.

Digital register and data retention

Decision 140 of 2023 requires each digital platform to maintain a digital register. Records are retained for at least five years after the digital asset's validity ends, logging follows the RFC 5424 syslog format unless the Authority approves an alternative, and the register prevents modification and repudiation. Distributed-ledger implementations are permitted.

Under Decision 141 of 2023, a registered provider may not retain the principal's customer data, or the data of the executed operation, after the operation ends.

VLens registration, hosting and delivery

FRA Decision 1224 of 2024, dated 26 May 2024, registered VLens on the fintech outsourcing register across all four fields, the first provider registered across all four. Chairman's Decision 2379 of 2026, dated 4 August 2026, renewed the registration, valid until 25 May 2027.

VLens has verified more than 4.1 million unique identities and processes 900,000 to 1.1 million API requests a day for 48+ enterprise clients across lending, capital markets and insurance. Data is hosted in Egypt, with asymmetric encryption and distributed-ledger storage. Delivery is through APIs and mobile SDKs.

Frequently asked questions