Financial Control Authority: OTP code to be used within two months in the consumer finance and project finance customer identity verification system
Cairo — Nadeh Imam Dr. Islam Azam, Chairman of the General Authority for Financial Supervision (GAFI), issued a decision mandating companies and entities licensed to engage in consumer financing and financing of medium, small, and micro enterprises to implement GAFI Board of Directors Decision No. 133 of 2026, issued last July, within two months. This decision requires these entities to send an One-Time Password (OTP) to customers at the time of contracting for financing and to use and verify the OTP with the company.
The decision, numbered 2735 of 2026, was published in the Official Gazette (Al-Waqa’i Al-Masriyya) and on the Authority’s website.
According to a statement issued by GAFI, this move aligns with the Authority’s commitment to the swift implementation of all regulatory rules to strengthen customer data verification procedures in the sectors of consumer financing and financing of medium, small, and micro enterprises.
The decision obligates consumer financing companies and entities engaged in financing medium, small, and micro enterprises to complete the necessary technical and regulatory measures to implement the new requirements stipulated in Decision No. 133 of 2026 regarding the sending of OTPs, within a maximum period of two months.
These rules mandate all consumer financing companies, as well as companies, associations, and institutions financing medium, small, and micro enterprises, to send an OTP to all their customers when concluding contracts, using the specific mobile phone number registered for each customer. The OTP must also be sent and verified when customers utilize the financing.
The Chairman of GAFI clarified that adding OTP verification to the customer identification system contributes to the early detection of any negative practices or fraud attempts when seeking financing for consumer or productive purposes. It also addresses cases of identity impersonation or the submission of incorrect personal data, thereby protecting the rights of bona fide individuals and preventing adverse impacts on their creditworthiness.
Azam emphasized that the regulatory rules established by the Authority to verify customer data in all non-banking financial activities require all companies under GAFI’s supervision that operate using financial technology (FinTech) and FinTech-related outsourcing service companies to verify customer data using national ID numbers and mobile phone ownership. They must also check whether customers are listed in anti-money laundering and restricted transaction lists, in accordance with GAFI Board of Directors Decision No. 186 of 2024 and its amendments, most recently amended by Decision No. 133 of 2026 issued last July.
