SBP transaction monitoring compliance rests on the State Bank of Pakistan's Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing Regulations for SBP-regulated entities, together with the Financial Monitoring Unit's rules on what must be reported and how. Both have moved recently, and the reporting changes in particular affect system configuration.
This article summarises what the SBP regulations expect of monitoring, the FMU's 2025 reporting regulations and automation, and the Rs3 million cash reporting threshold that Pakistan's National Executive Committee approved in October 2026.
What the SBP regulations expect
The SBP's AML/CFT/CPF Regulations apply to banks, development finance institutions, microfinance banks, exchange companies and payment system operators and providers, among others. They define a Transaction Monitoring System and require regulated entities to apply risk-based monitoring, establish criteria in their policies and procedures for managing alerts, and file suspicious transaction reports with the Financial Monitoring Unit. They also require regulated entities to apply their policies to overseas branches and subsidiaries, using the higher of the home and host standards where the host's law permits.
Breaches attract penal and administrative action under the AML/CFT Sanctions Rules, 2020. The regulations were issued in 2020 and have been updated since, so entities should work from the current consolidated version on the SBP website.
The FMU's reporting regulations and goAML automation
On 18 November 2025 the Financial Monitoring Unit circulated its Suspicious Transaction and Currency Transaction Reporting Regulations, 2025, developed under section 6(4)(h) of the AML Act 2010 and approved by the National Executive Committee. On 31 December 2025 it issued a notice on the implementation of automation for terrorist financing-related STRs through goAML. Together they raise the bar for the structure and timing of reports.
The practical consequence is that the monitoring system and the reporting platform must be aligned. If case management captures information in a different structure from goAML's, analysts will rekey data under time pressure, which is when errors and omissions arise.
The October 2026 cash reporting change
In late October 2026 the National Executive Committee on AML/CFT, chaired by the Finance Minister, approved raising the Currency Transaction Report threshold for banks from Rs2 million to Rs3 million of daily cash transactions, according to press reports on 28 and 29 October. The FMU's 2021 and 2025 guidance had set the earlier figure at Rs2 million. The same meeting approved bringing the Pakistan Virtual Assets Regulatory Authority within the AML Act framework.
FMU guidance says the threshold is specified by the National Executive Committee by notification in the Official Gazette, so institutions should change system parameters only once that notification is published and effective. The threshold affects reporting volumes and the way aggregation rules are written, and an error in either direction creates a compliance risk. Commentary has also noted that the committee did not set a limit on repeated cash transactions just below the threshold, which keeps structuring detection important.
What banks should get right
Four areas deserve attention. Calibration: scenarios and thresholds should reflect the bank's own customers and products and be reviewed periodically, with the rationale documented. Alert handling: the criteria for managing alerts should be written down, applied consistently and evidenced. Staffing and technology: the regulations expect adequate resources for monitoring and reporting. And change control: threshold and format changes, such as the new CTR limit, should go through tested release processes.
Banks should also keep in view that SBP's monitoring expectations apply to relationships with licensed virtual asset firms, which can now hold accounts under conditions the SBP has set. Those relationships should receive their own risk assessment and monitoring approach. In practice, SBP transaction monitoring compliance depends on calibration, consistent alert handling and reporting systems that match goAML.
