Egypt’s regulator warns of action over customer data verification breaches

Egypt’s Financial Regulatory Authority (FRA) will take legal action against non-bank financial firms that fail to comply with customer data verification rules, its chairman Islam Ezzam said on Monday.

The rules require companies operating in non-bank financial activities, particularly those using financial technology, to verify customers’ national ID details and mobile phone ownership and check whether they appear on money-laundering or asset-freeze lists, the FRA said in a statement.

The requirements are governed by FRA Board Decision No. 186 of 2024 and subsequent amendments, including Decision No. 133 of 2026 issued in July.

Consumer finance companies, along with firms, associations, and institutions financing micro, small and medium-sized enterprises (MSMEs), must send customers a one-time password (OTP) to the verified mobile number when contracts are signed and again when financing is disbursed or used, the regulator said.

Companies must retain the OTP as evidence that the customer’s identity and mobile number were verified.

Ezzam said companies and institutions that fail to comply with the rules could face legal action.

The framework is intended to help the regulator detect potentially fraudulent activity at an early stage, including attempts to obtain consumer or productive financing using false information or another person’s identity.

It is also designed to protect legitimate customers from fraudulent activity that could affect their credit records or financial rights, Ezzam said.

The OTP verification system is already used by entities operating through financial technology. Other regulated financing companies and institutions must implement the system by January 2027, according to the FRA.

The system will allow lenders to cross-check customers’ personal data and strengthen identity verification procedures, Ezzam said.

The FRA will continue updating its regulatory and supervisory framework to keep pace with market developments and new technologies while protecting the stability of Egypt’s non-bank financial sector and its users, he added.

The warning came a day after Ezzam imposed penalties on a consumer finance company over allegations that a private international school used parents’ data to obtain financing. The company was penalised for breaching FRA rules on customer data verification and financing procedures.