It is the question every fraud and compliance team in Pakistan has been asked by their board since 2023: is our fraud system actually compliant with SBP BPRD Circular No. 04? The honest answer for most banks is “partly, and only after a long customisation project”. That gap is the reason we built eSentinel the way we did.
This is a short, practical read on what the circular asks for, which parts of it a global fraud platform genuinely struggles to deliver, and how eSentinel maps to each requirement without a bespoke build.
What Circular 04 of 2023 changed
BPRD Circular No. 04 of 2023, Measures to Enhance Security of Digital Banking Products and Services, moved digital banking fraud control out of the “good practice” column and into supervisory expectation. Four shifts matter most when you are choosing a system:
- Scope became enterprise-wide. Fraud management is expected across users, accounts, products and channels, not just the card portfolio. A system that scores card authorisations well but cannot see internet banking, mobile, agent or branch-originated activity leaves a visible gap.
- Detection became prevention. Scoring a transaction after it has settled is no longer the bar. The expectation is intervention at authorisation time, while the transaction can still be declined or held.
- Dispute handling got a clock. Fraudulent transaction disputes are expected to be raised and marked through the 1LINK FTDH mechanism inside a 30-minute window, with a time-stamped audit trail to evidence it.
- Liability attached. The circular sits alongside a liability framework. Where the bank cannot evidence that it acted within the required windows and controls, the loss does not stay with the customer.
The practical consequence: compliance is no longer a policy document, it is a system capability. Either your platform blocks in real time across domestic rails and marks disputes inside 30 minutes, or it does not.
The part a global platform cannot ship in the box
This is where procurement conversations usually turn. Platforms like FICO Falcon, SAS Fraud Management, NICE Actimize, ACI and BPC SmartVista are serious products with excellent analytics. None of that is in dispute. The difficulty is that RAAST, IBFT and 1LINK FTDH are Pakistan-specific rails, and a global vendor has no commercial reason to carry them natively.
So the scoring engine arrives strong and the local plumbing arrives empty. Message formats, dispute workflow, the FTDH handshake, the SBP-specific rule logic and the reporting all become a bank-funded integration project measured in quarters. Meanwhile the compliance clock is already running, and every month of integration is a month of unevidenced exposure.
eSentinel was built from the Pakistani rails outward rather than from a global core inward. The local behaviour is the product, not an adapter bolted onto it.
How eSentinel maps to the circular
| What the circular asks for | How eSentinel delivers it |
|---|---|
| Enterprise fraud management across users, accounts, products and channels | A single engine covering financial and non-financial events across 14 channels, including cards, IBFT, fund transfers, RAAST, internet and mobile banking, acquiring, ecommerce and QR merchants. |
| Real-time prevention, not post-event detection | Real-time pre-authorisation blocking: every transaction is scored in milliseconds and declined, held or cleared before it authorises. |
| Rule sets aligned to SBP requirements | Ships with rule sets configured for Circular 4 on day one, so the bank tunes thresholds rather than writing the logic from scratch. |
| 1LINK FTDH dispute handling inside the 30-minute window | Native FTDH integration that raises and marks disputes automatically, with a complete time-stamped audit trail for evidence. |
| Evidence and auditability of controls | Full audit trail across rules, scores, analyst actions and dispute events, exportable for internal audit and SBP inspection. |
| Interoperability with core and switch | ISO 8583 and ISO 20022 native, integrating with ISS, Paysys, OBDX, AML, acquiring and ecommerce platforms. |
Capability summary reflects Ciphertronix’s implementation experience in the Pakistani banking context. Banks should read it alongside their own compliance assessment of the circular.
Why the 30-minute window is the real test
Of everything in the circular, the FTDH window is the requirement that most often exposes a system. Thirty minutes is shorter than a manual process can reliably absorb. If a disputed transaction has to travel from a call centre note to an email to a fraud analyst to a separate FTDH portal, the window closes during the handoffs, and it closes most often at night and at weekends when staffing is thinnest.
eSentinel treats dispute marking as an automated system event rather than a human task. When a transaction is confirmed fraudulent, the FTDH submission is raised from the same platform that scored it, timestamped at every step. The bank is not depending on an analyst being awake to stay compliant.
Three modes, because one is never enough
Compliance needs more than a single enforcement point, so eSentinel runs three modes side by side:
- Real-time pre-authorisation blocking stops the transaction before it completes. This is the mode the circular’s prevention expectation is really about.
- Near-real-time post-fact detection catches patterns that only become visible once a sequence of transactions has formed, such as velocity and structuring behaviour.
- Offline batch analysis re-examines history to surface slow-moving fraud and to retune models and thresholds against what actually happened.
Alerts are closed with the customer in the loop through robocall, WhatsApp, SMS and in-app confirmation, which is what keeps false positives from turning into blocked salaries and branch queues.
Where PCI fits
These two standards are often conflated, so it is worth separating them. PCI SSF applies to the software itself, and eSentinel is built to that standard as a product. PCI DSS 4.0 applies to the bank’s own cardholder data environment. eSentinel is designed to deploy inside that environment without widening or weakening its scope, so if your estate is already PCI DSS 4.0 compliant, integration is fast, low-risk and audit-ready rather than a new assessment burden.
Already proven in production
eSentinel is not a reference architecture waiting for its first deployment. It runs live fraud prevention at Bank AL Habib, Bank Alfalah, MCB Islamic, Bank of Khyber and The Bank of Punjab, alongside payment and fintech operators including Keenu, Wemsol and Foree Pay. Typical go-live is around one month, with local 24/7 support in the same time zone as the fraud that is being stopped.
Preparing for your next assessment
If your team is scoping Circular 4 readiness, the useful questions to put to any vendor are narrow ones: does it block before authorisation or score after settlement, does it carry RAAST and IBFT natively or through a custom adapter, does it mark FTDH disputes automatically inside 30 minutes, and can it evidence all of it to an inspector. We are happy to walk through eSentinel against that list with your fraud, IT and compliance teams on the same call.
Reach us at ciphertronix.com, email info@ciphertronix.com, or WhatsApp +44 7466 971690.