PTA drafts passport checks for foreign SIMs and travel eSIMs

PTA drafts passport checks for foreign SIMs and travel eSIMs

9 October 2026: The Pakistan Telecommunication Authority has published draft International Roaming (Inbound) Regulations, 2026, which would require mobile operators to verify the identity of anyone using a foreign SIM or eSIM on a Pakistani network and would put travel eSIM sellers under a registration regime for the first time. Written comments are due before 10 November 2026, and the rules take effect only when they are notified in the gazette.

Not yet independently verified. The draft is a consultation text, not a notified regulation: thresholds, fees and the KYC procedure may change before it takes effect. The PDF itself carries no issue date, so 9 October 2026 comes from the file name on the PTA site. We will update this when it can be confirmed, and remove this note.

Who must collect the identity data

Today an inbound roamer can use Pakistani networks without any local identity check. The consultation paper says that gap is being used for spoofed calls, SMS phishing, extortion, e-commerce fraud and social media accounts that cannot be traced to a person. It names Turkey, Saudi Arabia, Australia, Slovakia and India as places that have already taken some steps.

Under the draft, licensed operators (the visited networks) must run a know-your-customer process for inbound roamers. At minimum it captures the passport or travel document number and nationality, the IMSI and phone number of the roaming SIM or eSIM, the arrival date and expected length of stay where available, and the home operator. The data can be gathered through a welcome SMS carrying a verification link, a portal approved by the regulator, coordination with immigration and border authorities including the Federal Investigation Agency arrival database, or through registered travel SIM aggregators. Data-only eSIM profiles cannot receive an SMS, so for them the regulator would prescribe another method. Operators must keep the records for at least 12 months after the roamer stops roaming.

Travel eSIM sellers need a licence-style registration

The paper names Airalo, Holafly, Nomad, Saily, Ubigi, GigSky and Eskimo as platforms whose eSIMs can be activated in Pakistan without verification, and lists BICS, 1GLOBAL, Transatel and Telna as IMSI aggregators operating without authorisation. Draft regulation 11 bars anyone from running a travel SIM or eSIM aggregation business in Pakistan without prior registration. Applicants would disclose their home operators or underlying network providers, their distribution channels and a local contact person, and pay an annual fee and a security deposit, with amounts still to be set.

Registered aggregators would also have to report to the regulator through a portal or API, near real time or periodically, on SIMs issued and activated, the KYC particulars captured and usage summaries. They must cooperate with operators on blocking, and may lose their registration for breaches.

Limits on permanent roaming, IoT SIMs and VoWiFi

Permanent roaming is defined as 90 days or more, accumulated, within any 180-day period for the same IMSI or number, or for the same device identified by its IMEI. Operators would raise alerts as users approach the threshold, ask the home operator to confirm genuine roaming within seven days (72 hours where fraud is suspected), and may suspend service if no satisfactory answer comes. The regulator may exempt categories such as diplomats, airline crew, maritime personnel and bona fide enterprise users.

M2M and IoT SIMs may not be used to roam for personal or consumer services. Operators must screen and block them by IMSI range, though the regulator can authorise specific connected-vehicle, logistics, telemetry or industrial IoT uses case by case. Operators that want to support Voice over Wi-Fi for inbound roamers need prior approval after a technical and security assessment, and that traffic must be routed through licensed Pakistani infrastructure and meet the same KYC and lawful interception rules.

Timelines and what operators would have to build

Operators must keep roaming usage records (IMSI, number, IMEI, home operator, first and last activity) for at least 12 months, send monthly exception reports, and report any blocking action to the regulator within 72 hours. The regulator would run a central database of blocked roamers shared across operators. Roaming systems must be aligned with current GSMA and ITU standards within 180 days of notification.

Comments go to the Director General (Strategy and Development) at snd.consultation@pta.gov.pk, in the format given in the paper's Annex B. The PTA says late comments may not be considered.

Related on TrustList:

• Rwanda switches off 3G on 30 June 2027: USSD services, payment terminals, meters and trackers must move to 4G

Sources

• Pakistan Telecommunication Authority: Consultation Paper, Draft International Roaming (Inbound) Regulations, 2026, 9 October 2026
• Pakistan Telecommunication Authority: consultation papers listing, 12 October 2026
• ProPakistani: PTA to Regulate Foreign SIMs, 12 October 2026