PTA Proposes Stricter VPN Rules, Higher Fees Under Draft IDCS License

The Pakistan Telecommunication Authority (PTA) has unveiled a draft Class License for Intranet Data Communication Services (IDCS) that proposes a more stringent regulatory framework for Virtual Private Network (VPN) services, alongside significantly higher license fees and expanded compliance obligations.

The draft signals a shift towards tighter monitoring and formalization of VPN operations, aiming to bring both corporate and public VPN services under structured regulatory oversight.

A key feature of the proposal is Article 4A, which categorizes VPN offerings into Corporate VPN Services and Public VPN Services, each subject to distinct compliance requirements. Corporate VPNs would be limited to registered businesses and multinational companies, which must maintain detailed records of clients, authorized connection points, and designated representatives.

Public VPN services, targeting individual users, would face stricter Know Your Customer (KYC) checks, including CNIC/NICOP verification for Pakistani nationals, passport and visa validation for foreign users, and biometric verification where required.

Enhanced Compliance and Monitoring

All VPN providers would be required to deploy lawful interception (LI)-capable systems, ensure encryption does not block lawful access, and retain detailed connection logs—including timestamps, IP addresses, and data volumes—for at least two years.

Additionally, all international VPN traffic must be routed exclusively through licensed Long Distance and International (LDI) operators, such as PTCL or NTC, with unlicensed or grey-channel routing strictly prohibited. VPN services must also prevent access to blocked content, anonymous communications, or circumvention of lawful surveillance.

Revised Fees and License Terms

The draft proposes a significant increase in license fees:

• Initial License Fee (ILF): Raised from Rs300,000 to Rs1 million
• Annual License Fee (ALF): Greater of 100,000 or 0.5% of annual gross revenue
• Application Processing Fee (APF): Increased from Rs5,500 to Rs20,000

The license term would be reduced from 15 to 10 years, with renewal subject to government policy at the time of expiry. Renewal applications must be submitted at least 30 months before the end of the license term.

Licensees under the draft would not be allowed to provide internet services, commercial voice, wholesale bandwidth, or broadcasting, or operate a public switched telecommunications network. Connectivity must be sourced from Local Access Providers (LAPs) or LDI licensees, and deployment of last-mile infrastructure would require documented failure to secure facilities for three months plus prior PTA approval.

The draft also removes the option of provincial licensing, restricting operations to a nationwide basis, and reinforces prohibitions on cross-subsidization and undue preference between multiple licenses.

Stakeholder Consultation

PTA has invited industry stakeholders to provide feedback on the proposed framework, fee structure, VPN compliance requirements, and tenure changes before finalizing the licensing regime. Observers expect discussions to focus on the commercial and operational impacts of the new regulations.

This move represents one of the most comprehensive regulatory updates for VPN services in Pakistan, signaling the authority’s intent to formalize and tighten control over both corporate and public virtual network operations.

Also read:

PTA Licenses Nine VPN Providers as Registration Crosses 30,000 Users