A fork in the digital road

Pakistan stands at a pivotal moment in its economic evolution, one where ambition and prudence must advance in lockstep. The government's recent establishment of the Pakistan Crypto Council (PCC) marks a bold step towards modernising the country's financial architecture.

However, as the digital tide rises, so too does the risk of systemic disruption. The challenge now is to harness the promise of digital finance without sleepwalking into a cybersecurity crisis.

The PCC's composition, which brings together regulators, legal experts, industry leaders, and academics, demonstrates Islamabad’s increasing appreciation for the transformative potential of digital finance. From central bank digital currencies (CBDCs) to blockchain-based land registries, this technology holds the promise of addressing some of Pakistan’s deepest economic wounds: informality, corruption, inefficiency, and exclusion.

With a large unbanked population and rapid digital adoption, decentralised finance could be the breakthrough needed to unlock true financial inclusion. For a nation brimming with youthful energy, the idea of leapfrogging legacy financial systems in favour of more agile, tech-enabled alternatives is understandably appealing. However, technology, despite its potential, is not a panacea.

A recent World Bank report, ‘Cybersecurity Economics for Emerging Markets’, provides a sobering counterpoint. Drawing on data from 190 countries, it outlines a 21 per cent annual increase in cyberattacks from 2014 to 2023. Upper-middle-income countries, like Pakistan, have experienced the most significant rise in digital ambition. The conclusion is clear: developing nations are now firmly in the crosshairs, often lacking the institutions, expertise, or policy infrastructure to mount a meaningful defence.

As Pakistan builds out its digital financial infrastructure, its vulnerability to cyber threats will grow in lockstep. The digitisation of public services, banking, and even elections brings undeniable efficiencies and new exposure. The 2022 ransomware attack in Costa Rica, which paralysed over 20 government departments and forced a national emergency declaration, offers a cautionary tale. The economic cost was estimated at 2.4 per cent of GDP. For Pakistan, which is already grappling with fiscal constraints and macroeconomic uncertainty, a similar incident would be nothing short of catastrophic.

Cyberattacks are no longer isolated disruptions. They are systemic shocks with the power to ripple through supply chains, financial markets, and public confidence. A single breach in a government database or a major bank could be enough to stall investor interest and derail reform efforts for years.

Yet, Pakistan’s cybersecurity readiness remains alarmingly limited. The World Bank indicates that most developing nations fall behind in crucial areas, including regulatory frameworks, research funding, public awareness, and industry development. Pakistan has made some progress, with institutions such as the National Response Centre for Cyber Crime (NR3C) and the Pakistan Computer Emergency Response Team (PakCERT) leading the way. Nevertheless, cybersecurity expenditure remains minimal in comparison to global standards. The disparity between ambition and preparedness is widening and poses significant risks.

In this context, the creation of the PCC must be viewed as timely and essential. However, the council must not be allowed to operate in isolation. Innovation and security cannot be treated as parallel tracks. Digital finance is fundamentally a matter of trust, and that trust hinges not just on ease of use or product design but also on the security of users’ data, assets, and identities.

If Pakistan hopes to see meaningful adoption of digital finance, it must embed cybersecurity into every layer of policy, from sandbox frameworks for fintech startups to the design of CBDCs and beyond. Too often in emerging markets, digital innovation is treated as a standalone goal, with risk relegated to an afterthought. That is a luxury Pakistan cannot afford.

The structural weaknesses in the cybersecurity ecosystem must also be acknowledged. Market failures abound, from information asymmetries and poor incentives for investment to the widespread externalisation of third-party risks. For a country where SMEs form the backbone of the economy, affordable and accessible cyber protection is not simply good governance; it is vital to national economic resilience.

Equally urgent is the need to invest in talent. The global shortfall in cybersecurity professionals exceeded four million in 2023. In Pakistan, the skills gap is particularly pronounced outside military or intelligence circles. If the country is serious about digital finance, it must also be serious about building domestic cyber expertise through academic partnerships, R&D incentives, and global collaboration.

If managed effectively, the returns could be substantial. According to the World Bank, if a developing country can reduce its incidence of major cyber incidents from the top quartile to the bottom over a decade, its GDP per capita could increase by as much as 1.5 per cent. For Pakistan, with one of the youngest populations in South Asia and a rapidly digitising economy, this is a reward worth striving for.

In the end, Pakistan finds itself at a fork in the digital road. One path leads to a future characterised by inclusion, efficiency, and innovation, underpinned by resilience and trust. The other, though quicker, is more precarious and risks constructing a digital economy on unstable ground, vulnerable to the very shocks that have humbled far wealthier nations.

The choice facing policymakers is clear. The digital rupee could emerge as a symbol of empowerment and modernisation, or it could become an unprotected vault in an impending cyberstorm.

The writer is a senior lecturer in finance, leading International and Transnational Education at Birmingham City University’s College of Accountancy, Finance and Economics.