In February 2026, the Securities and Exchange Commission of Pakistan (SECP) approved a sweeping regulatory initiative requiring all unlisted companies to digitize their share ownership structures. Formally promulgated through SRO 328(I)/2026, this mandate represents the second phase of Pakistan's share digitization reform. The directive shifts companies from physical share certificates to electronic book-entry form maintained through the Central Depository System (CDC). For boards of directors and company secretaries, understanding this requirement is no longer optional.
What SRO 328(I)/2026 Actually Requires
SRO 328(I)/2026 is not merely a suggestion. It is a binding regulatory directive issued under the authority of the Securities Act, 2015. The order mandates that all unlisted companies convert their existing physical share certificates into electronic book-entry form maintained through the CDC. This is not a voluntary measure or a best practice recommendation. The SECP has set a 30-day compliance window from the date of notification, meaning companies have a fixed timeline to initiate this conversion process.
The scope of this mandate covers all forms of share-based transactions and corporate actions. Before any company can execute transfers, allotments, rights issues, bonus issues, share buybacks, or document any change in shareholding patterns, the underlying shares must exist in book-entry form within the CDC system. The order is absolute in its application. No exceptions are carved out for closely held companies, family businesses, or enterprises with minimal share trading activity.
This requirement reflects a broader principle in modern securities regulation: the elimination of paper-based ownership records in favor of electronic systems that cannot be physically lost, damaged, counterfeited, or subject to the document handling risks inherent in physical storage. The SECP's reasoning rests on three decades of international experience showing that book-entry systems dramatically reduce litigation over share transfers and eliminate an entire category of corporate fraud linked to forged or altered certificates.
Understanding Book-Entry Form and the CDC System
Book-entry form means that share ownership is recorded electronically in a computerized database rather than evidenced by a physical document. When shares are held in book-entry form, the CDC maintains the ownership record. The company itself no longer maintains a physical registry of paper share certificates. Instead, the company maintains an electronic registry that references the CDC system where the actual ownership records are kept.
The CDC operates as a specialized financial institution licensed by the SECP. It maintains the electronic clearing and settlement infrastructure for securities traded on Pakistani exchanges and, increasingly, for unlisted securities held by companies converting to digitized ownership. When your company converts to book-entry form, the CDC becomes the custodian of the ownership record, though the company retains responsibility for corporate governance decisions regarding those shares (dividend declarations, voting rights, etc.).
From a practical standpoint, the shift means that a shareholder no longer receives a physical certificate to frame on an office wall or lock in a safe deposit box. Instead, the shareholder receives a statement from the CDC confirming their beneficial ownership. The shareholder's legal rights remain identical to what they possessed under the certificate-based system, but the evidence of ownership is electronic rather than physical. A shareholder can still sell, transfer, pledge, or bequeath shares. The only change is the manner in which ownership is recorded and evidenced.
The 30-Day Compliance Mandate
The order grants companies 30 days from the notification date to complete the conversion. While 30 days appears brief, the compliance process requires coordination between three entities: the company, the CDC, and potentially the company's existing share registry manager if one exists. Most listed companies have used share registry managers for years, but many unlisted companies maintain their own registries in-house.
The 30-day window is a hard deadline, not a soft guidance. The SECP has not indicated that extensions will be granted on a routine basis. Once the 30-day period expires, companies that have not converted to book-entry form may face administrative enforcement action under Section 32 of the Securities Act, 2015. While the SECP has not published specific enforcement guidelines, the statutory framework authorizes financial penalties and suspension of the company's right to issue shares, declare dividends, or conduct capital restructuring.
Practically speaking, companies should begin the conversion process immediately. This involves several steps: engaging the CDC to establish an account and obtain a depository identification code, providing the CDC with a certified list of current shareholders and their shareholdings, obtaining shareholder consent (a requirement under Companies Ordinance, 1984 principles), and ensuring that the company's memorandum and articles of association are compatible with book-entry settlement.
When Book-Entry Conversion Becomes Mandatory
The order specifies that no transaction can occur before conversion is complete. The phrase "before any transaction" is broad and unambiguous. It encompasses share transfers (whether by sale, gift, inheritance, or court order), allotment of new shares (whether for cash or against asset revaluations), declaration and distribution of bonus shares, issuance of rights shares in capital raises, share buyback programs, and any corporate action that alters the shareholding structure.
This creates a practical consequence: any unlisted company contemplating a capital raise, a merger, a shareholder buyout, or a dividend distribution must have completed the book-entry conversion beforehand. A company cannot allocate new shares to investors or transfer shares to departing shareholders without first moving its existing shares into the CDC system. Similarly, if a shareholder wishes to pledge shares as security for a loan, the lending bank will likely require that the shares be held in book-entry form, as modern financial institutions increasingly refuse to accept physical certificates as security.
For closely held companies where ownership rarely changes, this requirement might seem academic. But it is not. The moment a shareholder decides to sell, the moment the company decides to bring in new capital, or the moment a shareholder's estate needs to transfer shares after death, the company must already be converted to book-entry form. The regulatory structure does not permit a company to delay conversion until a transaction is imminent.
Fee Relief and Financial Incentives
The SECP has recognized the cost burden of digitization, particularly for smaller and medium-sized enterprises. Companies with paid-up capital not exceeding Rs. 25 million receive substantial fee relief. For these qualifying companies, the annual fee to the CDC is waived for the first year following conversion. Additionally, the security deposit fee, the initial conversion deposit, and the processing fee are entirely waived.
For companies with paid-up capital exceeding Rs. 25 million, normal CDC fees apply. These fees vary based on the number of shareholding accounts maintained and the transaction volume. A company considering the cost of compliance should obtain a fee quote from the CDC prior to commencing the conversion process. Most CDC fee schedules are published on their website and are not negotiable, but knowing the exact cost in advance prevents budgeting surprises.
The fee waiver for smaller companies substantially reduces the financial barrier to compliance. A company with paid-up capital of Rs. 20 million that might have anticipated paying approximately Rs. 100,000 to Rs. 150,000 in conversion and annual fees instead pays nothing in the first year. This incentive structure suggests that the SECP is attempting to achieve rapid, uniform adoption rather than carving out exemptions for smaller entities. The SECP's message is clear: compliance is mandatory for all, but the financial burden on smaller companies is being subsidized by the government through the regulator.
The Risk Profile of Physical Certificates
The policy driver behind this mandate is the elimination of risks associated with physical share certificates. When shares are evidenced by printed documents, several categories of risk emerge. First, certificates can be lost, destroyed by fire, theft, or water damage. Second, certificates can be counterfeited or fraudulently altered. Third, disputes over the authenticity of a certificate, the identity of the bearer, or the legitimacy of a transfer can spawn years of litigation with no conclusive documentary evidence available to resolve the dispute. Fourth, physical storage creates chain-of-custody problems, particularly when shares are pledged as security, transferred through inheritance, or sold through intermediaries.
In contested cases, courts have occasionally had to determine whether a share certificate was genuine, whether the signature of the company secretary was authentic, or whether alterations had been made to the face of the certificate. These are fact-finding exercises that consume judicial resources and delay justice. A tamper-proof electronic record maintained within a secured database and backed by regulatory oversight eliminates these evidentiary problems entirely.
The international experience over three decades demonstrates that book-entry systems reduce fraudulent transfer litigation by approximately 90 percent and eliminate certificate-based counterfeiting entirely. The SECP's move to universal digitization is grounded in this empirical evidence, not in mere administrative preference.
Shareholder Consent and Governance Considerations
While SRO 328(I)/2026 is a mandatory regulatory order, most legal interpretations suggest that companies should obtain shareholder approval before implementing the conversion. The rationale is that the conversion changes the nature of the evidence of ownership and alters the mechanics of share transfer. While the legal rights of shareholders do not change, prudent corporate governance practice favors seeking approval from the shareholders who are affected.
This approval can be obtained through a board resolution (if the company's articles of association permit the board to approve this change) or through a shareholder resolution at a general meeting. In most cases, the shareholders of an unlisted company will readily approve the conversion, as the change carries no downside to them. The approval process, however, adds time to the overall compliance timeline and should be factored into a company's implementation schedule.
From a corporate governance perspective, this is also an opportunity to audit the company's existing shareholder registry, reconcile it with share certificates issued, and ensure that all prior transfers and allotments have been properly recorded. Many family businesses and long-established companies operate with handwritten shareholder registers maintained by an elderly company secretary. The conversion process forces a comprehensive audit of the shareholding structure and often surfaces discrepancies that should have been corrected years ago.
Implementation Roadmap and Practical Steps
A company seeking to comply should follow this sequence: First, identify and engage the CDC as the depository. The CDC has an established process for account opening and provides a standardized format for shareholder data submission. Second, obtain a list of all current shareholders and their shareholdings. This list should include shareholder names, addresses, identification numbers, and the number of shares held by each shareholder. Third, ensure that the company's memorandum and articles of association are compatible with book-entry settlement. In most cases, no amendment is needed, but some older articles may require revision to clarify that shares may be held in book-entry form.
Fourth, obtain shareholder approval through an appropriate corporate mechanism. Fifth, furnish the shareholder data to the CDC and commence the technical conversion process. The CDC typically requires 7 to 14 days to load shareholder data and establish the electronic registry. Sixth, obtain confirmation from the CDC that the book-entry registry has been established and all shareholders have been registered. Finally, the company should issue confirmation letters to all shareholders notifying them of the new arrangement and providing them with CDC account details and statements.
Throughout this process, the company should maintain clear contemporaneous documentation of each step, as the SECP may request evidence of timely compliance if questions arise. The company secretary should prepare a compliance certificate documenting the completion date and signing it in the official record.
The Broader Context: Phase Two of Digitization Reforms
SRO 328(I)/2026 is explicitly designated as the second phase of Pakistan's share digitization initiative. Phase One involved the digitization of listed companies' shares, a process largely completed in prior years. Phase Two extends digitization to the broader universe of unlisted companies, including private enterprises, family businesses, and smaller publicly traded entities that elect not to list on an exchange.
This phased approach reflects the SECP's recognition that listed companies, being subject to more intensive regulatory oversight, could more readily absorb the compliance burden. Unlisted companies, while numerous, operate with fewer compliance resources. By introducing digitization for unlisted companies in a second phase, the SECP permitted the infrastructure and procedures to mature before extending them more broadly.
The digitization mandate also aligns with the SECP's broader corporate governance reform agenda, as evidenced by other concurrent initiatives. In March 2026, the SECP issued show cause notices to 41 state-owned enterprises (SOEs) regarding corporate governance deficiencies, a coordinated enforcement action signaling heightened regulatory expectations across the corporate landscape. The digitization mandate for unlisted companies should be understood as part of this larger pattern of regulatory modernization and stricter governance standards.
Impact on Different Categories of Companies
The mandate applies uniformly to all unlisted companies, but the operational impact varies. For a professionally managed company with a share registry manager, CDC engagement, and a stable shareholder base, the conversion is a straightforward administrative exercise. For a family business where shares have rarely been formally transferred and shareholder records are maintained informally, the mandate forces a thorough audit and formalization of the ownership structure.
For a company anticipating near-term capital raises, mergers, or external investment, the mandate is actually beneficial, as institutional investors increasingly require that target companies operate book-entry share systems before acquisition. The SECP has effectively established a baseline standard that all companies must meet, removing the discretion of individual companies and ending the era when digitization was an optional competitive advantage available only to sophisticated companies willing to invest in it voluntarily.
For a dormant company with no recent activity and minimal shareholder changes, the mandate still applies. Even if the company conducts no share transactions in the foreseeable future, the requirement to convert remains binding. The rationale is that regulatory standards apply uniformly regardless of company size or activity level, eliminating the need for case-by-case exemptions that would undermine the integrity of the regulatory framework.
Risks of Non-Compliance
While the SECP has not detailed specific enforcement penalties in the notification, the Securities Act, 2015 authorizes the regulator to impose financial penalties up to Rs. 10 million for violations of SEC regulations. More immediate practically, a company that has not converted to book-entry form cannot legally execute share transactions. This means that a company seeking to raise capital, issue employee share schemes, or effect a share restructuring will be blocked from doing so until conversion is completed.
Additionally, if a company is the subject of SECP investigation or inspection and non-compliance with the digitization mandate is discovered, this will be treated as a corporate governance failure that could affect the company's regulatory reputation and credibility. For companies with ambitions to access regulated markets, obtain credit from financial institutions, or attract institutional investment, digitization compliance has become a threshold requirement.
Looking Forward
The digitization mandate reflects a global trend toward elimination of paper-based ownership records across all asset classes. Over the past decade, countries ranging from the United Kingdom to Singapore to Australia have implemented mandatory digitization of shares across all or most of their corporate sectors. Pakistan is now joining this international movement. The shift is permanent, and no subsequent government or regulatory administration has reversed digitization mandates once implemented.
For companies, the practical implication is straightforward: compliance is not optional, delay is not advisable, and the conversion process should be initiated immediately. The infrastructure is in place, the fee relief is available (for qualifying companies), and the timeline is fixed. Management and boards should treat this as a priority compliance matter, not a peripheral administrative task to be delegated to the company secretary with an indefinite implementation timeline.
The SECP's approach reflects modern regulatory practice: set clear standards, provide reasonable transition periods, offer financial assistance where appropriate, and then enforce compliance uniformly. The 30-day window provides sufficient time for well-managed companies while creating urgency for those that have not begun the process. Companies that have not commenced conversion should do so immediately.
Practical Checklist for Compliance
- Identify the current shareholding structure and obtain a certified list of all shareholders and their holdings.
- Open a depository account with the CDC and obtain a depository identification code.
- Review the company's memorandum and articles of association to confirm compatibility with book-entry settlement.
- Obtain shareholder approval through a board resolution or shareholder meeting, as appropriate.
- Submit shareholding data to the CDC in the required format and initiate the technical conversion process.
- Confirm completion of book-entry registration with the CDC and obtain verification documentation.
- Notify all shareholders of the conversion and provide them with CDC account statements.
- Maintain contemporaneous documentation of the conversion process and execution timeline for SECP compliance verification.