State Bank of Pakistan · ETGRMF · Digital banking security · Outsourcing & cloud · Card security
Every SBP requirement that applies to you, assessed and evidenced in one workspace.
ETGRMF, the digital banking security measures, the outsourcing and cloud frameworks, payment card security, digital bank licensing and customer onboarding - broken into individual requirements you can assess, attach evidence to and report on.
Built for banks, microfinance banks, digital banks, EMIs and payment system operators and providers regulated by the State Bank of Pakistan.
Kim's SBP Regulatory Compliance Tool
No charge for 5 days. Cancel before the trial ends and nothing is taken. Already have an account? Sign in.
What changes
One workspace instead of a folder of circulars
Before
- SBP circulars kept as PDFs, with requirements tracked in a separate spreadsheet for each one
- No single view of what applies to a bank, a microfinance bank or a payment provider
- Evidence scattered across email threads and shared drives
- Status unknown the day before an inspection or an internal audit
- ETGRMF, the 2023 digital banking measures and Cyber Shield tracked in three different places
- A board paper rebuilt by hand every quarter
After
- Every requirement in one workspace, citing the circular and clause it came from
- The view filtered to what applies to your entity type
- Evidence attached to the requirement it proves
- A live view of status by instrument and by category
- ETGRMF, digital banking security, outsourcing and card security side by side
- A board-ready PDF and an evidence pack in two clicks
Who it is for
Built for the teams that carry the obligation
Banks
ETGRMF, the digital banking security measures and the outsourcing and cloud frameworks in one place, with an owner and evidence for each requirement.
Microfinance banks
The same instruments filtered to what applies to you, including the 2023 digital banking security measures, which SBP addressed to banks and MFBs.
Digital banks
The Licensing and Regulatory Framework for Digital Banks alongside the technology, outsourcing and onboarding requirements it relies on.
EMIs, PSOs and PSPs
The cloud outsourcing framework, which SBP addressed to EMIs, payment system operators and providers as well as banks.
Consultancies and advisers
A separate workspace per client, each billed and isolated on its own, and reports that carry your client's branding rather than ours.
Audit firms
Read-only seats for reviewers, an evidence pack as a ZIP with a manifest, and a PDF that states scope and period per instrument.
Why it is different
Not another control spreadsheet with a login
- Built from SBP's own circulars: every requirement cites the instrument and clause it came from, so nobody has to take our word for it.
- Applicability by entity type, so a microfinance bank is not asked to assess requirements written for a payment system operator.
- Cyber Shield tracked as direction of travel, kept apart from mandatory requirements so the two are never confused in a board paper.
- Evidence attached to the requirement it proves, held in a private bucket and served through short-lived signed links.
- Multi-tenant SaaS with database-enforced isolation, mandatory two-factor authentication, and no card data on our servers.
- White-label reporting: your logo, your header and footer, on every page.
- Built by a practitioner who ran these programmes, not a generic SaaS company that added a compliance module.
Who built it
Founder-led, practitioner-built
“I built this after years of running the same controls through a different spreadsheet for every framework, rulebook and standard. It is designed, maintained and supported by me, from the Kingdom of Bahrain.”
— Kim · kim_abdalian@yahoo.com
Pricing
Priced per seat, with nothing held back
$500
per seat / year
- No minimum — buy a single seat at $500 / year
- Add or remove seats one at a time, pro-rated
- Seats reassignable for the whole term
- 5-day free trial, cancel any time
- Every feature included — no tiers, no add-ons
What it replaces
- A spreadsheet per circular, each tracked a different way
- Re-reading every circular to work out what applies to your entity type
- Chasing owners by email for the status of each requirement
- The scramble to assemble an evidence pack before an inspection or audit
Security & architecture
Built to be looked at by the people you answer to
Tenant isolation in the database
Every row carries an org id and PostgreSQL Row-Level Security enforces it. A query that forgets the filter returns nothing, not someone else's data.
Evidence in a private bucket
Never public. Files are served through signed URLs that expire in 60 seconds.
Encrypted in transit and at rest
TLS 1.2 or better on the wire, AES-256 at rest.
Two-factor authentication, mandatory
Every account, no exception, with a 30-minute idle timeout and 90-day password rotation.
Backed up daily, with point-in-time recovery
So a bad afternoon is recoverable, not a rebuild.
Hosted in the EU
Frankfurt (eu-central-1). Evidence and assessment data stay in the region.
Sessions end on their own
A 30-minute idle timeout, shared across open tabs, so an unattended screen does not stay signed in.
No card data on our servers
Payments are taken by Lemon Squeezy as Merchant of Record, which also handles global VAT and sales tax.
Questions
Asked before you have to ask them
Is this an official State Bank of Pakistan product?
No. It is an independent product, not affiliated with, endorsed by or approved by the State Bank of Pakistan. Requirements are drawn from SBP's published circulars and cite them, and the official texts on sbp.org.pk always prevail.
Which SBP instruments are covered?
ETGRMF (BPRD Circular 05 of 2017), the digital banking security measures (BPRD Circular 04 of 2023), the cloud outsourcing framework (BPRD Circular 01 of 2023), the outsourcing risk framework (BPRD Circular 06 of 2019), the Payment Card Security Regulations (PSD Circular 05 of 2016), the Licensing and Regulatory Framework for Digital Banks (BPRD Circular 01 of 2022), the Consolidated Customer Onboarding Framework (BPRD Circular 01 of 2025) and the Cyber Shield strategy (CRMD Circular Letter 01 of 2026).
Will AML/CFT, the FE Manual and the Prudential Regulations be added?
They are planned for a later release. We would rather add them from the official texts, checked, than rush them in.
How is evidence stored?
In a private bucket, never public. A file is served through a signed URL that expires in 60 seconds, so a copied link is useless a minute later.
Can we export everything?
Yes, and without asking us. A board-ready PDF, a CSV of any selection of instruments, and an evidence pack as a ZIP with every attached file foldered by instrument and requirement plus a manifest. There is no lock-in: your assessment data leaves in open formats whenever you want it.
What happens when SBP amends an instrument?
The library is reference data maintained centrally and shipped to every workspace. Your statuses, notes and evidence are yours and are never touched by an update.
How does tenant isolation work?
Every row carries an org id and PostgreSQL Row-Level Security enforces it in the database, not in application code. A query that forgets the filter returns nothing rather than someone else's data.
What if someone leaves?
Seats are reassignable for the whole term. Remove a member and the seat frees immediately for the next person, at no extra cost.
Start with the instrument that worries you most. The rest follows.
5 days free with every feature on. Work one instrument end to end and see where you stand.
Prefer to talk first? kim_abdalian@yahoo.com · WhatsApp +973‑3671‑9993
Made in Bahrain · Serving the GCC and beyond · Founder-led, practitioner-built
Covering: ETGRMF (BPRD Circular 05 of 2017) · Digital Banking Security Measures (BPRD Circular 04 of 2023) · Cloud Outsourcing Framework (BPRD Circular 01 of 2023) · Outsourcing Risk Management (BPRD Circular 06 of 2019) · Payment Card Security Regulations (PSD Circular 05 of 2016) · Digital Banks Licensing Framework (BPRD Circular 01 of 2022) · Customer Onboarding Framework (BPRD Circular 01 of 2025) · Cyber Shield Strategy (CRMD Circular Letter 01 of 2026).
© 2026 Kim. All rights reserved.
Independent product of Kim. Not affiliated with, endorsed by or approved by the State Bank of Pakistan. Requirements are drawn from SBP's published circulars and cite them; the official texts on sbp.org.pk always prevail.
“Kim's SBP Regulatory Compliance Tool” and its structure, control taxonomy, category framework, and library of requirements are the proprietary intellectual property of Kim. Unauthorized copying, reproduction, distribution, sublicensing, or resale — in whole or in part — is strictly prohibited without prior written consent. Access is licensed, not sold, subject to the accompanying End User Licence Agreement.
Contact Kim · kim_abdalian@yahoo.com · +973‑3671‑9993
Pricing · Terms of Service · Privacy Policy · Refund Policy · Security Policy