On 23 August 2026, The Central Bank of Egypt (the “CBE”) issued a circular (the “Circular”) regulating the rules governing the digital know your customer (the “eKYC”) services for banks operating in Egypt. The Circular is issued to fill a regulatory gap for the emerging need of eKYC, which is essential for the operation of digital banks in Egypt. The process and operation of the eKYC services are handled by the Digital Financial Identity Company (“Haweya”) where a single CBE approved system allows banks to verify their customers’ identities online (the “Approved System”). The customer identity data is verified through the Approved System leading to the issuance of a digital financial identity (the “DFI”).

The Circular is subject to further procedures for the identification process to be issued by the unit of combating money laundering and terrorist financing (the “EMLCU”) at the CBE.

Scope of Application

The Circular applies to all banks operating in Egypt and licensed entities e.g. payment services providers, payment services facilitators and aggregators or operators etc. that wish to use the eKYC services (the “Participating Banks”). Participating Banks may use a banking agent according to the following conditions: (i) a banking agent must be an established Egyptian legal entity, (ii) must have a contract with a Participating Bank to identify customers and verify their identities electronically on its behalf, and (iii) obtain the necessary CBE approvals. , ("Banking Agent"). The eKYC verification obligations fall on the Participating Banks using the Approved System. The Participating Banks need to ensure that any Banking Agent contract complies with the conditions identifed in the Circular. The scope of the Circular is aimed at natural persons, and does not apply to juridical entities.

Key Requirements

Governance: the Participating Bank must adopt a board-approved policy on its internal eKYC process, to be reviewed and updated annually according to the requirements of the Circular. The relevant department of the Participating Bank must make all services available without preference between electronically and traditionally identified customers, while preserving the option of a branch KYC verification.

Identification and verification: customers’ identities must be verified using the means available within the Approved System, including, without limitation, biometrics. Haweya must make available a digital certificate linked to the customer’s mobile device (the “DFI Certificate”), one-time passwords, a six (6) digit global PIN, and must authenticate national ID data via the Egypt Civil Registry. The Participating Bank assumes obligations of AML/CFT compliance in relation to the list of terrorists and persons prohibited from dealing within the Egyptian banking system (the “Negative List”), while Haweya initially screens the customers in the Approved System against the applicable Negative List.

Authentication: When the Approved System fails to authenticate a customer’s eKYC, the customer is referred to a branch of the Participating Banks or their Banking Agent. The Approved System may authenticate non-financial transactions in place of a handwritten signature; however, financial transactions require a further CBE approval.

Security and cybersecurity: Participating Banks must comply with the CBE cybersecurity framework, which includes without limitation: (i) running a security operations centre with 24/7 monitoring; (ii) conduct penetrating testing at least annually and running vulnerability assessments at least quarterly; and (iii) maintain tamper-resistant audit trails.
Systems of the Participating Banks availing the Approved System may not be connected to the internet or any non-approved network without prior CBE approval. 

Implications

The Circular applies equally to digital banks. However, since they are prohibited from establishing branches under the CBE’s 12 July 2023 Circular, customers requiring in-person verification would need to be directed to authorised Banking Agents. The Circular refers only to branches or Banking Agents, and does not address whether a digital bank’s head office may serve the same purpose.

Conclusion

The Circular establishes a centralised framework for the eKYC of bank customers, combining the Approved System operated by Haweya, prescribed verification and authentication mechanisms, a detailed cybersecurity control set, and an approval process gated by substantive pre-launch evidence.ency across the tax landscape affecting real estate properties.

The contributors to this article are Hossam Gramon, Partner and Head of Banking and Project Finance, Alaa Ragab, Senior Associate, and Mostafa Serry, Assosciate.