Egypt's FinTech rulebook: what the FRA expects non-bank fintechs to prove

The law applies to anyone who carries on non-bank financial activities using financial technology (issuing law, Art. 1). "Non-bank financial activities" means the markets the FRA supervises: capital markets, insurance, mortgage finance, leasing, factoring, MSME finance and consumer finance (Art. 1). The law operates without prejudice to the Central Bank and Banking Sector Law (issuing law, Art. 1), which is why bank-led and payment products sit outside this guide.

The FRA's own explanation of the 2023 decrees names three groups: companies seeking a new licence to offer a non-bank service through technology; firms already licensed for a non-bank activity that want approval to use FinTech themselves or through an outsourcer; and companies that want to provide FinTech outsourcing services to the sector (FRA release). The decrees allow fully digital companies and let existing firms run a hybrid model (FRA release). A fourth group arrived in 2025: providers of technology systems for credit risk assessment, which now need their own registration (Decree 279/2025).

StackWeaver view · Put simply: a BNPL app, digital consumer lender, microfinance app, insurtech or robo-adviser is either a licensee or an approved firm, and the e-KYC, e-signature, contract-register and scoring vendors behind it are regulated suppliers. A vendor that sells to Egyptian non-bank lenders without the right registration is a liability for its clients, not only for itself.

The Financial Regulatory Authority. The FRA licenses and supervises FinTech activity, keeps the outsourcing register (Law 5/2022, Art. 6) and may run a regulatory sandbox for testing applications on real customers (Art. 9), which FRA Board Decree 163 of 2024 put in place (FRA portal). It must answer customer complaints within one month of receiving the required documents (Art. 12).

The decrees. Decree 58 of 2022 set the incorporation, licensing and approval conditions (FRA release). On 11 July 2023 the FRA issued Decrees 139, 140 and 141 (Clyde & Co): Decree 139 on infrastructure, information systems and security (FRA release), Decree 140 on digital identity, contracts and records (FRA release) and Decree 141 on the outsourcing register (FRA release). Decree 268 of 2023 added rules for FinTech start-ups (FRA portal). Later decrees cover customer data verification (Decree 186/2024), cybersecurity (Decree 227/2025), risk-assessment vendors (Decree 279/2025), directors' and officers' liability insurance (Decree 35/2026) and warning and negative lists (Decree 87/2026).

The Money Laundering Combating Unit. The law requires FRA rules for FinTech firms to include AML/CFT controls that follow the Unit's instructions (Art. 7). Customer data is also governed by the Personal Data Protection Law, which applies alongside the FinTech Law's confidentiality duty (Art. 13); our Egypt PDPL guide covers that regime.

Decree 140 builds the onboarding stack around three groups of factors, knowledge, possession, and presence and liveness (FRA release), combined into three trust levels (Decree 140). Even the basic level asks for at least two knowledge factors plus presence and possession factors (Decree 140), so a password and a photo of an ID card do not meet it.

Once a customer signs, the contract and every step before it must be stored in the digital register using encryption the FRA approves (Decree 140), and records must be archived for at least five years after the digital asset expires (Decree 140). The law backs this up by giving data held on these electronic media the evidential force of official documents (Law 5/2022, Art. 11).

The compliance section of the decree adds a recurring deliverable that teams often miss: a semi-annual report on "review results and error rates" (Decree 140), approved by the provider's board and sent to the FRA within four weeks of the period end (Decree 140).

StackWeaver view · The error-rate report is the closest thing Egypt has to a control-effectiveness test for onboarding. Treat it like an internal audit: define the sample, record every mismatch between the digital identity and the source data, and keep the working papers. If your e-KYC vendor cannot export what you need for it, that is a procurement problem to fix now.

Decree 139 sets the baseline: frameworks for IT governance, IT service management, cybersecurity management and technology risk management (Clyde & Co), plus a dedicated 24/7 customer service centre (Clyde & Co). A FinTech licence itself depends on having the required infrastructure, information systems and security means (Law 5/2022, Art. 4).

Decree 227 of 2025 raises the bar for firms the FRA designates. They must take the measures needed to strengthen cybersecurity and protect systems and sensitive data (Art. 1), prepare an information security manual approved by the board and send it to the FRA (Art. 1), and hold cyber risk insurance renewed every year (Art. 1). Article 2 adds an annual penetration test and annual information security reports for the FRA (Art. 2), and the contract with the tester must require the results to reach the FRA. Meeting the decree is a condition of keeping the licence (Art. 3).

Decree 186 of 2024 makes insurers, FinTech licensees and registered outsourcers verify customers' national ID data and mobile number ownership (Decree 186) and check money laundering and asset-freeze lists when they contract or renew (Decree 186). Consumer finance and microfinance lenders must also send a verification code to the verified number (Decree 186).

The rule stopped being theoretical in August 2026. Around EGP 321 million of consumer finance had been registered in the names of 819 parents without their knowledge or request (Ahram Online). The FRA began criminal proceedings, revoked a chief executive's licence and banned new contracts for a month at the lender involved (Daily News Egypt), finding breaches of its decisions on customer data inquiries, governance, credit controls and anti-money laundering (Daily News Egypt). It then warned every regulated entity to follow the identity and data-accuracy rules in Decree 186 (Daily News Egypt).

Existing licensees may deliver services through a registered outsourcer under an agreement that sets out both parties' rights and obligations (Law 5/2022, Art. 5). Only registered providers may offer FinTech outsourcing services (Decree 141). The consolidated decree requires paid-up capital of at least EGP 10 million (Decree 141) and an undertaking to insure against technology and professional liability risks (Decree 141). Registration is mandatory (Clyde & Co) and the first registration lasts a year (Clyde & Co).

Decree 279 of 2025 applies the same logic to credit scoring. Lenders may use only registered risk-assessment providers (Decree 279), must notify the FRA and send it the contract before signing (Decree 279), and need FRA approval before using their own in-house scoring systems (Decree 279). Providers must disclose the methodology behind their algorithms (Decree 279), hold capital of at least EGP 10 million (Decree 279) and report to the FRA every quarter (Decree 279).

StackWeaver view · Decree 279 is the first Egyptian rule that asks a lender to explain its scoring model to the regulator before use. Model documentation, assumption logs and validation results are now licensing evidence, not just good practice.

The FRA Board's administrative toolkit ranges from a warning to a ban on operating or signing new contracts for up to six months (Law 5/2022, Art. 14) and, at the top, revoking the licence (Art. 14). The August 2026 case used the contract ban and licence revocation for an individual, under the Consumer Finance Law (Daily News Egypt).

The criminal penalties in the FinTech Law:

• Operating without a licence or approval: at least six months in prison and a fine of EGP 200,000 to EGP 1 million, or either (Law 5/2022, penalties).
• Breaching customer confidentiality: at least three months and a fine of EGP 200,000 to EGP 1 million, or either (penalties), with fines multiplied by the number of victims (penalties).
• Personal liability for the person who actually manages the company where the breach came from a failure of their duties (penalties), and a possible ban from the activity of up to five years (penalties).
• Prosecution needs a written request from the FRA Chairman (penalties), which keeps the regulator in control of when a case becomes criminal.

StackWeaver view · The confidentiality fine is the one to model. Because it multiplies per victim, a single leaked customer file is a manageable incident, but a leaked database is an existential one. Consent records and a disclosure log are the cheapest insurance against that exposure.

We cite the official Arabic texts the FRA publishes on fra.gov.eg: Law No. 5 of 2022 as printed in the Official Gazette, and the FRA Board decrees in their consolidated or gazetted form. Those PDFs are scans or use legacy font encodings, so their quotes are recorded from an Arabic OCR and checked line by line; our build checks that each source is still online. The FRA's July 2023 release and its legislation portal, Clyde & Co's July 2023 briefing and Daily News Egypt's August 2026 report are matched automatically. Ahram Online blocks automated checks, so that one figure is checked by hand. Where a secondary summary disagreed with the official text, we followed the official text.

Every statement of law is recorded in a public claims ledger with its source, section, retrieval date and the exact supporting words. Facts are labelled “Sourced”; opinions and recommendations are labelled “StackWeaver view”, as our editorial policy explains. AI tools helped research, OCR and draft this guide; the StackWeaver compliance research team is accountable for it.

Spotted an error? Email [email protected]. More countries are in the Africa Fintech Regulatory Atlas.