Skip to main content
Central Bank of Egypt

CBE authentication and app-security requirements.

How financial institutions in Egypt meet them with Fortanixor — banks, exchange houses, payment providers, microfinance and fintechs supervised by the Central Bank of Egypt.

Regulation refs: Rules Regulating the Provision of Banking Services over the Internet (2014); Rules Regulating Payment Services Using the Mobile Phone, third edition (2021); Instructions on Protecting the Rights of Bank Customers (2019) and Complaints Handling Instructions (2024); Central Bank and Banking Sector Law No. 194 of 2020; Digital Financial Identity (eKYC) Regulations (2026)

Egypt's Central Bank wrote its position on SMS codes into the rules years before most of the region. The Rules Regulating the Provision of Banking Services over the Internet require banks to re-authenticate with two means together for high-risk activities — transfers to third parties, registering new beneficiaries, changing the customer's contact details — and the clause's own example of acceptable means pairs a digital signature or a token-generated one-time password with the words 'while not permitting passwords to be issued automatically and directly via SMS or e-mail'. The third edition of the mobile payment rules, issued in May 2021, repeats the same requirement word for word for mobile wallets and adds that high-risk activities may only be executed through an electronic application.

The consequence sits in the customer protection instructions. Clause 5-4 makes the bank or payment service provider bear full responsibility for any loss a customer suffers through fraud or hacking, for whatever reason, unless the customer was at fault. That turns the quality of the authentication record into a commercial question: a FIDO2 passkey produces a signature from a key that never leaves the customer's device, which is the kind of evidence of non-repudiation the internet banking rules ask the authentication means to strengthen. Every CBE instruction cited on this page is published in Arabic only; the English wording here is our own translation, and the Arabic text governs.

What Central Bank of Egypt requires

01 / 06

Two means together for high-risk activities, without SMS or e-mail OTP

Banks must re-authenticate using two means together when a customer transfers funds to third parties, registers a new beneficiary or changes contact details. The clause's example of acceptable means is a digital signature or a token-generated one-time password, 'while not permitting passwords to be issued automatically and directly via SMS or e-mail'. The mobile payment rules impose the same requirement for wallets and allow high-risk activities only through an electronic application. The authentication means must strengthen non-repudiation, data integrity, confidentiality and authenticity of identity.

Internet Banking Rules (Book 12, Ch. 2), clauses 3-2-1 and 3-2-2; Mobile Payment Rules (Book 11, Ch. 2), clause 3-4-5-1

02 / 06

Authentication that holds when the device is compromised

Banks must assess carefully whether their authentication means stays secure even if the customer's computer is exposed to Trojans or keystroke-logging spyware. For mobile payments the test extends to theft or loss of the phone itself, as well as malware and spyware.

Internet Banking Rules, clause 3-2-4; Mobile Payment Rules, clause 3-4-3

04 / 06

Account confidentiality, including data held by third parties

All data on customers, their accounts and their transactions is confidential and may not be accessed or disclosed, directly or indirectly, without the account holder's written permission or a judicial or arbitral judgment; the prohibition outlives the banking relationship. The customer protection instructions add that the bank must protect customer data whether it is held by the bank or by any third party it deals with.

Law No. 194 of 2020, Article 140; Customer Rights Instructions, clauses 4-5-1 and 4-5-2

05 / 06

Identity verified before disclosure, and recorded lines announced

Banks may not disclose any information about customers or their accounts until the customer's identity has been verified. Telephone complaints are taken through the contact centre with the complainant notified in advance that the complaint will be recorded, and the contact centre is subject to continuous monitoring.

Customer Rights Instructions, clauses 4-5-3 and 4-3-5-3; Complaints Handling Instructions (Book 14, Ch. 2), clauses 6-1-2 and 7-3

06 / 06

Tamper-protected audit trails and fraud reporting

Banks must keep audit trails for every internet banking transaction, protected against manipulation, to support fraud investigation and dispute resolution, and must report to the CBE any fraud attack aimed at leaking customer identity or credentials, including phishing. Instructions issued in April 2026, with a six-month compliance window, also require every bank to run a dedicated fraud management department that monitors digital channels and reports fraud cases to the CBE.

Internet Banking Rules, clauses 3-7-3 and 3-9-4; Fraud Management Department Instructions (Book 16, Ch. 1), items 4 and 14

Control mapping

How Fortanixor maps to CBE requirements.
RequirementFramework referenceHow Fortanixor addresses itProduct
Re-authentication with two means together for third-party transfers, new beneficiaries and contact-detail changesInternet Banking Rules, clause 3-2-2A FIDO2 passkey ceremony is two means in one gesture — possession of the device holding the private key, and the biometric or PIN that unlocks it in the secure element — and the credential is a digital signature, which is the first example the clause gives. Nothing is issued by SMS or e-mail. A FortVoice command that would move money to a third party is confirmed on the phone with the same ceremony before it executes.FortAuthFortVoice
High-risk mobile payment activities only through an application, with two means and no automatically issued SMS or e-mail codesMobile Payment Rules, clause 3-4-5-1The passkey lives in the wallet or banking application and is exercised there, so the high-risk step happens inside the application the rule requires, and the second means is the on-device biometric rather than a code pushed to the same handset.FortAuth
Authentication means that strengthen non-repudiation, data integrity, confidentiality and authenticity of identityInternet Banking Rules, clause 3-2-2; Mobile Payment Rules, clause 3-4-5-1Each authorisation is a signature from a key that exists only on the customer's device, and with Secure Payment Confirmation the amount and payee are bound into the signed data. That is evidence of who approved which instruction — the non-repudiation the clause names — rather than a record that a code was sent to a number.FortAuth
Authentication that stays secure even if the customer's computer or phone is compromised, stolen or lostInternet Banking Rules, clause 3-2-4; Mobile Payment Rules, clause 3-4-3There is no secret to key-log: the private key cannot be exported from the secure element, and a passkey is bound to the bank's real domain, so a phishing page cannot harvest a usable credential. A stolen or lost phone still requires the owner's biometric or PIN before the key can be used.FortAuth
Encryption keys stored securely on the device; the app must not store or reuse login credentialsDigital Financial Identity Regulations, Section 4, Fourth, item 2(b) and 2(f)For banks on the Digital Financial Identity platform, this is a description of a passkey: the key pair is generated and held in the device's secure hardware, and the app keeps no password or reusable credential — every sign-in is a fresh challenge verified at the back end.FortAuth
Full bank liability for customer losses from fraud or hacking, unless the customer was at faultCustomer Rights Instructions, clause 5-4The liability turns on showing what the customer did. A per-ceremony record — device, authenticator, result and, for payments, the signed amount and payee — gives the bank a basis for establishing customer fault, or for knowing quickly that there was none, that an SMS delivery receipt cannot.FortAuth
No disclosure of customer or account information until the customer's identity is verifiedCustomer Rights Instructions, clause 4-5-3FortAgent verifies the caller through FortAuth on their own device before any account detail is read out or any action taken, so disclosure follows a cryptographic verification rather than knowledge-based questions — the internet banking rules' own example of extra phone checks is approximate balances and recent transactions, which a fraudster can research.FortAgentFortAuth
Telephone complaints taken through the contact centre with the complainant notified in advance that the call is recordedComplaints Handling Instructions, clause 6-1-2; Customer Rights Instructions, clause 4-3-5-3FortAgent opens every call with a configurable disclosure that the call is recorded and that the caller is speaking to an AI agent, and hands off to a person at any point. Every call is transcribed and quality-scored, which supports the continuous contact-centre monitoring in clause 7-3.FortAgent
Tamper-protected audit trails for every transaction, retained to support fraud investigation and complaintsInternet Banking Rules, clause 3-7-3Every authentication ceremony is logged with its result and failure reason, and every agent call with its transcript, score and summary; both export into the bank's own log and retention estate, where its existing tamper controls and retention policy apply.FortAuthFortAgent
Customer account data confidential, including where held by a third party the bank deals withLaw No. 194 of 2020, Article 140; Customer Rights Instructions, clause 4-5-2An on-premise or in-region deployment keeps authentication data, speech and call records inside the bank's own estate rather than with another third party. FortVoice processes speech in the bank's own environment rather than sending audio to a global endpoint, so a spoken instruction naming an account and amount does not leave it.FortVoiceFortAgent
What this mapping does not claim

Where a requirement belongs to the bank’s own operations, or where the regulator has published no rule to map to, we say so rather than stretch a row to cover it. This is the boundary of the table above, not a gap in it.

  • Prior CBE approval before outsourcing internet banking or mobile payment services or applicationsInternet Banking Rules, clause 2-2-2-3: pending detailed outsourcing rules, banks must not conclude any agreement outsourcing internet banking services or their applications without the CBE's prior approval; offshore outsourcing must also preserve Egyptian law and the jurisdiction of Egyptian courts. Whether a deployment needs that approval, and obtaining it, is the bank's filing. An on-premise deployment inside the bank's own estate is the shape least likely to raise the question.
  • Data residency for customer or transaction dataNot established. None of the CBE instruments read contains a general in-country hosting rule; the internet banking rules allow outsourcing outside Egypt subject to prior approval and Egyptian jurisdiction, and the digital bank and payment service provider licensing rules require applicants to disclose where cloud-hosted data is stored and processed. The CBE's Financial Cybersecurity Framework is circulated to the sector rather than published and was not read; it may contain hosting rules. No residency claim is made for Egypt.
  • Password, PIN and hardware-token specifications, transfer limits and back-office checksInternet Banking Rules, clauses 3-3 and 3-4-4 to 3-4-5; Mobile Payment Rules, clauses 3-5 and 3-6-6. Where a bank keeps passwords or token OTPs alongside passkeys, those specifications still apply to them; limits and back-office verification of cross-border transfers and credit requests are the bank's processing controls.
  • The fraud management department and the wider anti-fraud programmeFraud Management Department Instructions (Book 16, Ch. 1, approved 31 March 2026). An organisational requirement reporting to the bank's risk function. Our products supply authentication signals, device and session data and call records that feed fraud monitoring; they are not the programme.
  • A specific AI-disclosure or AI-governance obligation for customer-facing automationNot established. All CBE instruments read were searched for artificial intelligence, chatbot and automated-agent terms with no match. FortAgent discloses to callers regardless; we do not claim the CBE requires it.
  • Personal Data Protection Law No. 151 of 2020Needs verification. Secondary sources report that the law's issuing provisions exclude personal data held by the CBE and entities under its supervision, other than money transfer and exchange companies, leaving banks to the banking law's confidentiality regime. No regulator-hosted text was found, so this was not read and no mapping is made to it.
Sources

Every clause cited on this page was read in the document below, on the regulator’s own site.

This mapping is provided for guidance and must be validated by the bank's compliance function against the current version of each framework.

Deployment options in Egypt

Served from our UAE and Pakistan offices with in-region deployment: on-premise, in-region cloud, or hybrid.

Deployment shapes

On-premiseIn-region cloudHybrid

Runs on

Amazon Web ServicesMicrosoft AzureGoogle Cloud

Deployed into your own account and your own region on any of the three, or on-premise where the data must not leave your estate at all.

CBE questions, answered.

For high-risk activities, read plainly, no. Clause 3-2-2 of the Internet Banking Rules requires two means together for third-party transfers, new beneficiaries and contact-detail changes, and its example of acceptable means excludes passwords 'issued automatically and directly via SMS or e-mail'; clause 3-4-5-1 of the mobile payment rules says the same for wallets. The rules do not ban SMS codes everywhere — low-risk transactions in the mobile rules are re-authenticated by PIN, and SMS remains the named channel for transaction notifications. The rules are published in Arabic only, so have your compliance function confirm the reading against the Arabic text.

Clause 3-2-1 of the Internet Banking Rules lists the three elements as something the customer knows, something in their possession — with a digital signature as the first example — and a biometric characteristic such as fingerprints. A FIDO2 passkey combines possession of a device-bound signing key with the biometric or PIN that unlocks it, so it supplies two of the three in one gesture, and the signature strengthens the non-repudiation clause 3-2-2 asks for. The CBE does not name passkeys, so this is a mapping rather than a mandate. The Digital Financial Identity Regulations note that the CBE also issues electronic authentication levels; we could not find those published.

Yes as a deployment matter: all three products run on-premise, in in-region cloud, or hybrid, so authentication data, speech and call records can stay in country. On the regulatory side we make no residency claim. The instruments we read do not impose a general in-country hosting rule — they require prior CBE approval before outsourcing internet banking, Egyptian jurisdiction if it is outsourced abroad, and disclosure of cloud data locations in digital bank and PSP licence applications. The CBE's Financial Cybersecurity Framework is not published and may say more.

It cites the CBE's own clause numbering, links to the Regulations Book chapter on cbe.org.eg, and separates what the product does from what stays with the bank. The downloadable CBE mapping covers clauses 3-2 and 3-7 of the Internet Banking Rules, 3-4 of the mobile payment rules, 4-5 and 5-4 of the customer protection instructions, 6-1-2 of the complaints instructions and Article 140 of Law No. 194 of 2020. It names what is outside our scope — outsourcing approval, the fraud department, password and limit controls — and states that every Arabic-only clause is quoted in our own translation.

Get the CBE control mapping

The full control-by-control mapping for FortAuth, FortVoice and FortAgent, as a document your compliance function can review.

Other markets