Compliance

Compliance Overview

WAB2C is committed to maintaining the highest standards of regulatory compliance and ethical business practices. As a WhatsApp Business Solution Provider serving Pakistani businesses, we adhere to local regulations, international standards, and Meta's policies to ensure our platform is secure, reliable, and trustworthy.

Our compliance program is designed to:

Protect customer data and privacy
Ensure lawful business communications
Maintain Meta/WhatsApp platform integrity
Support our customers' compliance obligations

Pakistani Regulations

Prevention of Electronic Crimes Act (PECA) 2016

WAB2C fully complies with PECA 2016, Pakistan's primary cybercrime legislation:

• Section 3: Unauthorized access prevention measures
• Section 4: Unauthorized copying of data protection
• Section 6: System interference prevention
• Section 20: Offensive content monitoring and prevention
• Section 21: Terrorism-related content prohibition
• Cooperation with FIA on lawful requests

Pakistan Telecommunication Authority (PTA)

We operate in compliance with PTA regulations:

• Registered as a technology services provider
• Compliance with telecommunications licensing requirements
• Adherence to content moderation guidelines
• Cooperation with lawful interception requests

Securities and Exchange Commission of Pakistan (SECP)

Corporate compliance with SECP requirements:

• Registered as a Private Limited Company
• Annual returns and financial reporting
• Corporate governance compliance
• Director and shareholder documentation

Federal Board of Revenue (FBR)

Tax compliance:

• Registered for Sales Tax on Services
• Monthly sales tax returns
• Annual income tax returns
• Withholding tax compliance
• Proper invoicing with NTN display

Personal Data Protection Bill (Draft)

While Pakistan's comprehensive data protection law is pending, we proactively align with its draft provisions:

• Lawful basis for data processing
• Data subject rights implementation
• Data breach notification procedures
• Cross-border data transfer safeguards

Meta/WhatsApp Compliance

Official Business Solution Provider (BSP)

WAB2C is an official Meta Business Solution Provider, authorized to provide WhatsApp Business API services. This status requires ongoing compliance with Meta's rigorous standards.

WhatsApp Business Policy Compliance

We ensure all platform usage adheres to:

WhatsApp Business Terms of Service: Core terms governing business messaging
WhatsApp Commerce Policy: Rules for product catalogs and transactions
Business Messaging Guidelines: Best practices for customer communication
Template Message Policy: Approval requirements for template messages
Opt-in Requirements: User consent before business messaging

Prohibited Content Enforcement

We actively monitor and prevent:

✗ Spam and unsolicited messages

✗ Adult or sexual content

✗ Illegal products or services

✗ Misleading or deceptive content

✗ Hate speech or discrimination

✗ Violence or dangerous content

Data Protection

GDPR Alignment

While not directly subject to GDPR, we align our data protection practices with EU standards for customers who process EU resident data:

Data Processing Agreements (DPAs) available
Standard Contractual Clauses (SCCs) for international transfers
Data subject rights support (access, rectification, erasure, portability)
Data breach notification within 72 hours
Data Protection Impact Assessments (DPIAs) for high-risk processing

Data Handling Principles

Lawfulness

We only process data with valid legal basis (consent, contract, legitimate interest).

Purpose Limitation

Data is collected for specified, explicit purposes only.

Data Minimization

We collect only what is necessary for the stated purpose.

Accuracy

We ensure data is accurate and up-to-date.

Storage Limitation

Data is retained only as long as necessary.

Security

Appropriate technical and organizational measures protect data.

Industry Standards

Standard	Status	Description
ISO 27001	In Progress	Information Security Management System certification (Target: Q2 2025)
SOC 2 Type II	Infrastructure	Our cloud infrastructure providers maintain SOC 2 Type II certification
PCI DSS	Compliant	Payment card data handled by PCI DSS compliant processors
OWASP Top 10	Protected	Application protected against all OWASP Top 10 vulnerabilities

Certifications

Meta Business Solution Provider

Official partner authorized to provide WhatsApp Business API services

Active

SECP Company Registration

Registered Private Limited Company in Pakistan

Active

Messaging Compliance

Opt-in Requirements

We enforce strict opt-in requirements for all business messaging:

Explicit consent required before sending marketing messages
Clear opt-out mechanism in every message
Opt-out requests honored within 24 hours
Consent records maintained for audit purposes

Anti-Spam Measures

Rate limiting on message sending
Quality score monitoring per business account
Automated detection of spam patterns
Account suspension for policy violations

Financial Compliance

Anti-Money Laundering (AML)

Business verification for all customers
Transaction monitoring for suspicious activity
Suspicious activity reporting (SAR) procedures

Payment Processing

PCI DSS compliant payment processors
No storage of card numbers on our systems
Proper invoicing with GST/NTN details

Audit & Reports

We maintain comprehensive audit trails and provide compliance documentation upon request:

Available Documents

• Data Processing Agreement (DPA)
• Standard Contractual Clauses (SCCs)
• Sub-processor list
• Security whitepaper
• Penetration test summary

Regular Assessments

• Annual security audits
• Quarterly penetration testing
• Monthly vulnerability scans
• Continuous compliance monitoring
• Annual policy reviews

Enterprise customers may request access to compliance documentation by contacting our compliance team.

Compliance Program

Our compliance program includes:

Dedicated Compliance Team: Responsible for policy development, monitoring, and enforcement.
Policy Framework: Comprehensive policies covering security, privacy, acceptable use, and incident response.
Employee Training: Mandatory compliance training for all employees, refreshed annually.
Continuous Monitoring: Automated tools monitor for compliance violations.
Vendor Management: Due diligence and ongoing monitoring of third-party vendors.
Regular Audits: Internal and external audits to verify compliance effectiveness.
Incident Management: Structured process for identifying, responding to, and learning from compliance incidents.

Contact Compliance Team

For compliance-related inquiries, concerns, or to report a potential violation:

Compliance Department

Email: compliance@wab2c.com

Phone: +92 21 111 922 922

Response Time: Within 48 business hours

Whistleblower Hotline

Report concerns anonymously

Email: ethics@wab2c.com

All reports are investigated confidentially

Last Updated: December 11, 2025

This compliance page is reviewed and updated quarterly. For the most current information, please contact our compliance team.

Meta BSP

SECP Registered

PECA Compliant

GDPR Aligned