How FBR’s Digital Tax System Uses Banking Data to Detect Undeclared Income

Pakistan’s tax system has long struggled with one fundamental problem: too much of the economy operates beyond the reach of traditional enforcement. For decades, authorities relied on tax returns, audits, amnesty schemes and manual investigations to identify undeclared income, often with limited success.

That approach is gradually giving way to something very different. Rather than depending on voluntary disclosures or field investigations, the Federal Board of Revenue (FBR) is building a digital compliance ecosystem where financial data is automatically analysed, cross-matched and flagged through technology.

At the heart of Pakistan’s digital tax system transformation is Section 165AB of the Income Tax Ordinance, introduced through the Finance Act 2026-27. While the provision itself is no longer new, it represents one of Pakistan’s most significant steps toward data-driven tax administration, signalling how digital infrastructure is beginning to reshape tax enforcement.

What Section 165AB Does

The newly inserted Section 165AB of the Income Tax Ordinance creates a mandatory reporting obligation for all banking companies and Electronic Money Institutions operating in Pakistan. The trigger is straightforward: if the combined deposits or withdrawals across all of an account holder’s bank accounts exceed Rs100 million during any six-month reporting period, that account holder’s financial information must be uploaded to the Central Data Hub.

The information banks are required to report is comprehensive. It includes opening and closing balances for the period, total credits received, the peak credit balance recorded during the period, and complete details of deposits and withdrawals. This is not a summary; it is a transaction-level picture of high-value account activity across the entire banking system.

The reporting cycle runs twice annually. The first period covers July 1 to December 31, with data due at the Central Data Hub by January 31. The second covers January 1 to June 30, with data due by July 31. Banks and EMIs have no discretion in the matter; reporting is mandatory, not voluntary.

How the Cross-Matching System Works

The law’s most technically significant feature is what happens to the data after it arrives at the Central Data Hub. Rather than handing it directly to income tax officials for investigation, the system runs it through automated digital cross-matching, comparing the banking data against existing tax records to identify discrepancies between declared income and actual financial activity.

At this initial stage, income tax authorities do not have direct access to the raw banking data. The process is automated and algorithmic. The system identifies whether an account holder’s banking activity is broadly consistent with their declared tax position or whether there is a significant gap that cannot be explained by the information already on record.

If the automated cross-matching identifies a significant discrepancy, the case is transferred to FBR’s Compliance Risk Management system, where the National Faceless Centre takes over for further action under applicable law. The faceless model, in which tax proceedings are conducted remotely and digitally without direct physical interaction between taxpayers and officials, is designed to reduce the corruption and discretionary harassment that have historically undermined Pakistan’s tax enforcement credibility.

The Confidentiality Provision

The law includes an explicit confidentiality requirement for banking data received under Section 165AB. Information obtained from banks cannot be disclosed or used in a manner that contradicts the privacy requirements provided under applicable laws. The data is legally restricted to its stated purpose, automated cross-matching for tax compliance, and cannot be used for other purposes or shared beyond the defined system.

This provision matters for two reasons. First, it addresses the legitimate concern that a mandatory bank reporting regime could be misused for political targeting, commercial intelligence gathering, or purposes beyond tax compliance. Second, it establishes a legal accountability framework: if banking data obtained under Section 165AB is disclosed or misused, there is a clear legal prohibition that has been violated.

Whether the confidentiality provision will be enforced in practice is a separate question from whether it exists in law. Pakistan’s track record on data confidentiality in government systems has not always matched the language of the legislation governing those systems.

Who Is Affected

The Rs100 million threshold, roughly $350,000 at current exchange rates, targets a specific segment of Pakistan’s financial activity. This is not a law aimed at ordinary depositors or typical salaried employees. It targets high-value account holders whose banking activity suggests income, business turnover, or wealth that may not be fully reflected in their tax declarations.

The inclusion of Electronic Money Institutions alongside traditional banking companies is significant. Pakistan’s digital financial services sector has grown rapidly, and EMIs, digital wallets, mobile money operators, and fintech payment platforms have become significant channels for high-value transactions. Excluding them from the reporting requirement would have created an obvious avoidance channel. Section 165AB closes that gap by treating EMIs identically to banks for reporting purposes.

For Pakistan’s business community, the law raises immediate questions about how aggregation works across multiple accounts. The threshold applies to the combined total across all of an account holder’s accounts, meaning the Rs100 million trigger cannot be avoided by distributing transactions across multiple banks or multiple accounts within the same bank.

The Broader Context: FBR’s Data-Driven Enforcement Push

Section 165AB is part of a broader shift in how FBR is approaching tax enforcement, moving from a model based on manual investigation and human discretion toward one based on automated data analysis and algorithmic identification of non-compliance.

The Central Data Hub at the centre of this system is part of FBR’s larger data infrastructure build-out, which aims to integrate information from multiple sources, including banking data, property registries, motor vehicle records, utility connections, and import/export data, to construct a comprehensive picture of economic activity that can be compared against declared income.

The automated cross-matching approach has a practical advantage beyond efficiency: it reduces the opportunity for the selective enforcement and corruption that have historically plagued Pakistan’s tax collection machinery. When the system identifies discrepancies algorithmically rather than through an official’s judgement, the trigger for investigation is less susceptible to manipulation in either direction.

The National Faceless Centre, which handles cases escalated from the cross-matching system, represents the enforcement end of this digital compliance model. Cases that reach the Centre are processed remotely, with taxpayers responding through digital channels rather than appearing in person before officials, a design intended to reduce both the burden on taxpayers and the opportunity for discretionary corruption.

What It Means for Pakistan’s Tax Landscape

Pakistan’s tax-to-GDP ratio has been one of the lowest in the world for its economic size, a problem that successive governments have acknowledged and failed to meaningfully address through conventional enforcement approaches. The structural challenge is that a large proportion of Pakistan’s economic activity, high-value business transactions, property deals, and commodity trading occurs through channels that have been invisible to the tax system because they leave no mandatory paper trail.

Section 165AB creates a mandatory paper trail for high-value banking activity that did not exist before. Combined with the existing requirement for banks to report certain transaction types and the broader FBR data integration agenda, it represents a meaningful expansion of the information available to tax authorities about economic activity that has previously gone undeclared or under-declared.

Whether that expanded information translates into expanded revenue collection depends on the quality of the Central Data Hub’s cross-matching algorithms, the capacity of the National Faceless Centre to process escalated cases efficiently, and the credibility of the enforcement consequences for accounts where discrepancies are found.

The Bottom Line

Section 165AB is the most technically sophisticated tax enforcement mechanism Pakistan has introduced in recent memory. By building the compliance trigger into the banking system itself, rather than relying on taxpayer self-disclosure or official investigation, it creates an automated accountability layer that operates at scale without requiring proportionally larger human resources. The question is whether FBR’s implementation matches the ambition of the legislation, because a well-drafted law that is poorly executed solves nothing, and Pakistan has seen enough of those to be appropriately sceptical until the results speak for themselves.

ALSO READ: FBR Expects Digitalisation to Improve Tax Collection