KYC and eKYC Requirements in Egypt under the FRA Regime

The Financial Regulatory Authority (FRA) sets the KYC requirements for non-banking finance in Egypt. Decision 140 of 2023 defines the electronic know-your-customer (eKYC) process; Decision 186 of 2024, amended by Decisions 30 of 2025 and 133 of 2026, obliges fintech-licensed companies, outsourcing providers, insurance companies and the consumer finance and microfinance sectors to verify customer data at contracting. VLens is an FRA-approved provider registered on the fintech outsourcing register across all four fields.

The FRA framework for electronic know-your-customer

Law No. 5 of 2022 regulates financial technology in non-banking financial activities and defines the digital identity, the digital contract, the digital register and the digital platform.

The FRA board issued three executive decisions on 21 June 2023: Decision 139 of 2023 on technology infrastructure, information systems and security; Decision 140 of 2023 on digital identity, digital contracts, the digital register and the fields of fintech use; and Decision 141 of 2023 creating the fintech outsourcing register. Decision 68 of 2025 amends Decisions 140 and 141.

Decision 140 of 2023 names four core fields of fintech use:

• Electronic identification, verification and authentication
• Electronic know-your-customer (التعرف على العميل إلكترونيًا)
• Concluding contracts on non-banking financial products electronically
• Electronic recording, storage and retrieval from digital registers

The eKYC process in Egypt under Decision 140 of 2023

Decision 140 of 2023 establishes a digital identity through identification, verification and authentication (التحديد والتحقق والمصادقة), fed by knowledge, possession, and presence and liveness factors.

Creating or renewing a digital identity requires at least four possession factors, including the identity document, email inbox, mobile number and device number; at least three presence and liveness factors, including face biometrics, reaction liveness and geolocation; determination of cyber-location and transaction time; and the creation or update of three knowledge factors.

Annex 1 requires a live capture of the identity document, a selfie for biometric comparison, and verification of the document through a link with the competent administrative bodies or through the API of the Authority's unified digital identity system. The annex also requires an SMS reply confirmed inside a set window, confirmation that the mobile number is linked to the same national ID, and automatic liveness by response to random prompts.

The Decision 186 of 2024 chain and the entities it binds

Decision 186 of 2024 is the original instrument on the enquiry into the correctness of customer data (الاستعلام عن صحة بيانات العملاء), made on concluding or renewing the contract. Decisions 30 of 2025 and 133 of 2026 are its amendments.

As amended by Decision 30 of 2025, the decision binds companies licensed to operate using financial technology, outsourcing service providers and insurance companies, which verify national ID data with the Civil Status Organization and mobile-number ownership with NTRA. These entities enquire without an accompanying OTP: the fintech journey already carries two OTPs, at registration and at contract conclusion, and insurance companies are outside the OTP requirement. Decision 133 of 2026 added consumer finance companies, microfinance companies and the associations and NGOs licensed for microfinance.

The OTP duty under Decision 133 of 2026

Only the two sectors added by Decision 133 of 2026, consumer finance and microfinance, send a one-time passcode (OTP) to the enquired-upon number (الرقم المستعلم عنه), on concluding a new financing contract and on renewal, and retain it in an immutable record proving the customer's presence at the moment of the enquiry. The OTP is bound to the enquiry through its reference ID, passed inside the enquiry (PII) API call. A financial transaction requires the OTP only, with no new enquiry.

Chairman's Decision 2735 of 2026, dated 26 August 2026, requires the addressed entities to apply the board decision within two months of its entry into force and to notify the Authority.

The outsourcing register requirement for eKYC providers

Decision 141 of 2023 creates the register of fintech outsourcing service providers (سجل مقدمي خدمات التعهيد) and bars parties outside it from performing any outsourcing service. An FRA-licensed company may outsource eKYC only to a registered provider.

Under Article 7 of FRA Decision 58 of 2022, a registered provider may contract with an FRA-licensed company only after that company has obtained the Authority's prior approval to conduct its activity using fintech, directly or through an outsourcing entity.

Record-keeping in the digital register

Decision 140 of 2023 requires each digital platform to maintain a digital register, divisible into sub-registers for digital identity operations, customer onboarding, electronic contracting and product transactions. Contracts are stored with their pre-conclusion stages and timestamps under encryption approved by the Authority.

Records are retained for at least five years after the digital asset's validity ends, and longer where litigation or arbitration has been notified. Logging follows the RFC 5424 syslog format unless the Authority approves an alternative. The register proves chain of custody and prevents modification and repudiation by the platform operator or the user.

Data stored in the digital register holds the evidentiary force of official documents from the date of storage.

VLens registration and eKYC service

FRA Decision 1224 of 2024, dated 26 May 2024, registered VLens on the fintech outsourcing register across all four fields, the first provider registered across all four. Chairman's Decision 2379 of 2026, dated 4 August 2026, renewed the registration until 25 May 2027.

VLens runs six checks: OTP phone possession; national ID capture with Arabic OCR and anti-forgery screening; liveness with face match to the ID photo; Civil Status Organization record verification; NTRA phone-ownership confirmation; and issuance of a government-verified digital identity. Both government integrations are direct real-time links. OCR on the national ID runs before the enquiry call, so the data is sound before the enquiry cost is incurred.

VLens has verified more than 4.1 million unique identities, adds more than 600,000 a month, and serves 900,000 to 1.1 million API requests a day across 48+ enterprise clients in lending, capital markets and insurance.

Frequently asked questions