Standard Operating Procedure: Regulatory Compliance Management (Pakistan)

This Standard Operating Procedure (SOP) outlines the mandatory framework for maintaining organizational compliance within the Pakistani jurisdiction. Given the evolving nature of local regulations—including the Companies Act 2017, SECP directives, FBR taxation laws, and Anti-Money Laundering (AML/CFT) frameworks—this document serves as a baseline for ensuring operational legality, mitigating financial risk, and avoiding regulatory penalties. All compliance officers must adhere to these steps to maintain the company’s "Good Standing" status.

Section 1: Corporate Filings and SECP Compliance

• Annual Statutory Filings: Ensure submission of Form A (Annual Return) and Form B (Accounts) to the Securities and Exchange Commission of Pakistan (SECP) within 30 days of the Annual General Meeting (AGM).
• Change Management: Report any changes in directorship, shareholding patterns, or registered office address via eServices (Form 28, 29, or 3) within 15 days.
• Ultimate Beneficial Ownership (UBO): Maintain an updated register of beneficial owners in compliance with SECP’s latest AML/CFT regulations.
• Board Minutes: Ensure minutes of all board and general meetings are recorded, stamped, and stored in a formal Minute Book.

Section 2: Taxation and FBR Obligations

• Monthly GST Filing: Submit Sales Tax returns via the FBR IRIS portal by the 10th-15th of each month.
• Withholding Tax (WHT): Deduct WHT on services, salaries, and rents as per the Income Tax Ordinance, 2001, and file monthly statements by the 15th.
• Corporate Income Tax: Coordinate with external auditors for the annual tax audit and ensure the filing of the annual Income Tax Return before the statutory deadline (typically September 30th).
• Reconciliation: Perform monthly reconciliations between books of accounts and the FBR Sales Tax portal to avoid discrepancy notices.

Section 3: AML/CFT and Regulatory Reporting

• KYC/CDD: Perform mandatory Know Your Customer (KYC) and Customer Due Diligence (CDD) for all vendors and high-value clients.
• Sanction Screening: Regularly screen all business partners against the UNSC Sanctions List and the NACTA Proscribed Persons list.
• Suspicious Activity Reports (SARs): Implement an internal reporting mechanism for any transactions that appear inconsistent with a client’s stated business profile.
• Training: Conduct biannual AML/CFT sensitization sessions for employees to ensure organizational awareness of red-flag indicators.

Section 4: Labor Laws and Provincial Compliance

• ESSIS/EOBI Registration: Register all employees with the Employees’ Old-Age Benefits Institution (EOBI) and provincial social security institutions (e.g., SESSI in Sindh/PESSI in Punjab).
• Monthly Contributions: Process EOBI and Social Security payments within the first week of the following month.
• Labor Inspections: Maintain an updated "Inspection Book" and keep all employment contracts, leave records, and payroll data readily available for Department of Labor inspections.

---

Pro Tips & Pitfalls

• Pro Tip: Automate Calendars. Use a master compliance calendar that alerts you 10 days before any filing deadline. Missing a deadline for a tax filing often leads to immediate automated penalties (FBR Default Surcharges).
• Pro Tip: Maintain a Digital Trail. Keep a cloud-based repository of all "received" acknowledgments from government portals. Do not rely solely on email confirmations.
• Pitfall: The "Placeholder" Trap. Do not treat compliance as a "check-the-box" activity. Auditors in Pakistan are increasingly using data analytics to cross-reference bank statements with tax returns; inconsistent data is a major trigger for formal audits.
• Pitfall: Ignoring Provincial Differences. Compliance requirements can vary significantly between provinces (e.g., Sindh Revenue Board vs. Punjab Revenue Authority). Always verify your specific provincial sales tax registration requirements.

---

Frequently Asked Questions (FAQ)

Q1: What is the most common reason for a company to face an FBR audit? A1: The most common trigger is a mismatch between declared sales in the Sales Tax Return and the revenue reported in the Income Tax Return, or sudden fluctuations in input tax claims.

Q2: How often should we update our AML/CFT policy? A2: Policies should be reviewed annually or whenever the FATF (Financial Action Task Force) or the State Bank of Pakistan updates their guidelines regarding the national risk assessment.

Q3: Is digital documentation accepted by government inspectors? A3: While digital is the standard for filing, physical "Hard Files" containing original stamped documents (especially labor contracts and tax payment challans) are still highly recommended for on-site physical inspections by labor or tax departments.

<script type="application/ld+json"> { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What are the key SECP filing requirements in Pakistan?", "acceptedAnswer": { "@type": "Answer", "text": "Companies must submit Form A (Annual Return) and Form B (Accounts) within 30 days of the AGM and report changes in directorship or shareholding via eServices within 15 days." } }, { "@type": "Question", "name": "When should FBR Sales Tax returns be filed?", "acceptedAnswer": { "@type": "Answer", "text": "Monthly Sales Tax returns must be submitted through the FBR IRIS portal by the 10th to the 15th of each month." } }, { "@type": "Question", "name": "What is required for AML/CFT compliance in Pakistan?", "acceptedAnswer": { "@type": "Answer", "text": "Businesses must conduct KYC/CDD on all vendors, screen partners against UNSC and NACTA lists, and maintain an internal Suspicious Activity Reporting (SAR) mechanism." } } ] } </script> <script type="application/ld+json"> { "@context": "https://schema.org", "@type": "SoftwareApplication", "name": "Regulatory Compliance Management System", "applicationCategory": "BusinessApplication", "operatingSystem": "Web", "description": "An SOP-based framework for managing SECP, FBR, and AML/CFT compliance requirements within the Pakistani legal jurisdiction.", "provider": { "@type": "Organization", "name": "Compliance Management Services" } } </script>