No jargon. No assumptions. From what an API is, to where investor data lives, to how a CNIC becomes a verified investment account in under 3 minutes.
Before diving into mechanics, you need a mental model. Think of Nabdx as a translation layer — governments speak one language, banks speak another, investors don't speak any of them. Nabdx is the interpreter, the record-keeper, and the compliance officer all in one.
The key insight: Nabdx doesn't replace anything the government does. Governments already have the data. AMCs already need the data. Nobody had built a clean, compliant, fast pipe between them. That's the gap Nabdx fills — and why SECP Circular 03/2026 just opened the legal door for you to exist.
This is the most important concept to understand. An API is simply a door that one computer opens so another computer can walk through and ask for data. Here's how it works in your world.
Pakistan's government databases are more mature than most people realize. Here's exactly what each one holds, what API access looks like, and what Nabdx does with it.
Reality check: NADRA Verisys already works commercially — banks use it today. The SECP and SBP pieces require relationship-building and formal agreements. This is why your regulatory approval path runs in parallel with the technical build. You can't code your way into government databases — you have to negotiate your way in.
Here is exactly what happens, at every layer of the system, from the moment an investor taps "Open Account" to the moment their Sehl Account is active. This is the core product flow.
This is one of the most important architectural decisions you'll make. Where does investor data live? Who stores what? How is it protected? Here's the answer — layer by layer.
Critical principle: Nabdx is NOT a data warehouse for investor financial records. You are a verification middleware. The AMC stores the full investor account and transaction data in their own systems. Nabdx only stores what's needed for compliance proof and deduplication. Less data held = less liability.
Every technology Nabdx needs to build — from the server that handles API calls, to the database that stores audit records, to the dashboard your AMC clients use. You don't need to understand every tool, but you need to know they exist and why.
Every layer is independent. The architecture is modular by design — each component can be upgraded, replaced, or scaled without touching the rest of the system. This means Nabdx can start lean and grow without rebuilding from scratch.
This is the legal and operational question you must have crystal clear — because AMCs will ask it, SECP will ask it, and investors' lawyers will ask it if something ever goes wrong. Here is the definitive answer.
| Area | Who's Responsible | What That Means Practically |
|---|---|---|
| Conducting identity verification | Nabdx |
Nabdx calls NADRA, receives result, stores reference. AMC doesn't need to verify identity independently per Circular condition (4). |
| AML / CTR / STR generation | Nabdx assists AMC owns |
Nabdx flags transactions and provides AML alerts. But per condition (7), the AMC cannot delegate this obligation away — they must act on alerts and file CTR/STRs themselves. Nabdx is the early warning system, not the compliance officer. |
| Ongoing investor monitoring | Nabdx provides feed AMC acts |
Nabdx provides a continuous AML monitoring feed (daily re-screening of existing investors against updated watchlists). The AMC receives alerts and takes action. Responsibility for action is the AMC's. |
| Storing investor financial records | AMC only |
Portfolio, transactions, bank accounts, correspondence — all AMC's database. Nabdx never touches this. AMC is fully liable for their own data security here. |
| Storing verification audit records | Nabdx |
NADRA reference numbers, verification logs, AML results — Nabdx's Audit Vault. SECP inspects Nabdx for these, not the AMC directly. Nabdx provides AMC access to their own records too. |
| SECP regulatory compliance for onboarding | Nabdx ensures AMC is legally liable |
Nabdx builds the compliant system. But the legal obligation under the Securities and Companies ordinance rests with the AMC — they are licensed. Nabdx is their tool. Contracts must clearly define this boundary. |
| NADRA API relationship | Nabdx |
Nabdx holds the NADRA MoU, pays the per-query fees, manages the API credentials. AMCs don't need their own NADRA relationship — that's Nabdx's entire value proposition. |
| Focal person & SECP contact availability | AMC Nabdx (for its institution) |
Per condition (5): AMCs must maintain up-to-date focal persons available to SECP. Nabdx's compliance console helps AMCs manage this, but it's the AMC's obligation. Nabdx also maintains its own focal persons as a notified 3rd party. |
| Data encryption in transit | Nabdx |
Nabdx ensures all data between AMC ↔ Nabdx ↔ NADRA is TLS 1.3 encrypted. AMC must also secure their own internal data handling — Nabdx's contract specifies this requirement. |
| If a fraudster gets onboarded | Depends on where failure was | If NADRA confirmed identity correctly and AML came back clean: liability rests with NADRA's data quality and/or the fraudster. If Nabdx's AML screening missed a flagged name: Nabdx may share liability. This is why errors & omissions insurance is essential for Nabdx from day one. |
Most important legal protection for Nabdx: Every client that integrates must sign a detailed Service Agreement that defines exactly where Nabdx's obligation ends and the client's begins. The boundary around AML duties — particularly the non-abdication principle under condition (7) of the Circular — must be clearly defined and legally stress-tested. Professional liability coverage is essential from day one.
Nabdx's strategic position is designed deliberately: Nabdx provides the infrastructure but holds a compliance assistance role — not a compliance guarantee role. That's exactly where a profitable middleware company should sit: generating revenue on every onboarding event, while regulatory accountability for financial crime prevention appropriately rests with the licensed institution.