iFynx Studio

Posted on Oct 9 Originally published at ifynx.com

Egypt’s Haweya Digital Financial Identity Is a Device-Bound Credential, Not Just eKYC: A Product Spec for the CBE’s 23 August 2026 Rules

#fintech #product #ux #startup

The short answer

On 23 August 2026 the Central Bank of Egypt (CBE) sent banks the rules for its Digital Financial Identity (DFI) system, operated by the CBE-backed company Haweya. The rules do more than allow remote account opening: they give every retail customer one identity, bound by a digital certificate to one phone and one bank app, unlocked with a six-digit "Global PIN", reusable at other banks with consent, and usable today in place of a handwritten signature for non-financial actions only. For product teams in Egyptian banks and fintechs, that makes the DFI a credential with a lifecycle (create, reuse, re-bind, suspend, revoke), not a one-time KYC screen.

Key facts, with dates and primary sources

17 June 2026: The CBE Board of Directors approves the "rules governing the services of the Digital Financial Identity system for identifying bank customers and verifying their identities electronically within the Arab Republic of Egypt". (Circular text, Arabic)
23 August 2026: The circular is issued to bank chairs and the CBE announces it publicly. The covering letter says the CBE's Anti-Money Laundering and Combating Terrorist Financing Unit will separately issue the electronic KYC procedures themselves. (CBE announcement, English; Arabic)
Scope: all banks operating in Egypt, licensed entities that may join the system, and CBE-authorised banking agents. The services are for natural persons only. (Circular, introduction and section 1)
Authentication factors Haweya must provide: the DFI Certificate (to check that a transaction comes from the same app and phone that created the identity), an SMS one-time password, the six-digit Global PIN, and biometrics such as face image and fingerprint. (Circular, section 5, item 7-2)
Signature scope: banks may rely on the system to authenticate non-financial transactions as an alternative to a handwritten signature; using it for financial transactions needs an additional CBE approval. (Circular, section 4, part three)
Before launch: each bank needs CBE approval, a three-year plan (target customer numbers, products, marketing), penetration tests showing no high or medium vulnerabilities, a SOC 2 Type 1 report (Type 2 within six months of launch) and a privacy impact assessment. (Circular, section 7)
22 September 2026: Haweya's chief executive Tamer Gadalla says the first operating phase will run with five banks and expand to all banks in Egypt within 18 months; the cost is paid by the bank, not the customer; and updating customer data currently drives roughly 15 to 18 million branch visits a year. (FintechGate report, Arabic)

Why this needs a product read now

The legal coverage so far, from firms such as Baker McKenzie and Adsero, explains who is covered and what the governance and cybersecurity duties are. That is the right starting point for compliance. It leaves open the questions that land on a digital team's board the week a bank signs with Haweya: what does the customer actually see, where can the journey fail, and what has to exist in the app before the CBE will let it go live?

The circular is surprisingly specific about this. It is written in Arabic, runs to about twenty pages, and many of its clauses read like acceptance criteria. This field note maps them to screens, states, data fields and metrics. It is not legal advice; every point cites the section so your compliance team can check it against the original.

Five ideas that change how you design onboarding in Egypt

1. One identity per person, reusable across banks. Haweya must make sure each customer gets a single, unique DFI number that is never duplicated, even if the person registers with different documents such as a national ID card and a passport (section 5, item 5). A bank must collect the customer's electronic consent either to create a DFI or to use one "previously created by another bank or entity" (section 4, part one, item 3), and Haweya shares the identity with other participating banks only with the customer's prior consent, which must be retained (section 5, item 7-3). In product terms you need two front doors: "create your financial identity" and "use the financial identity you already have". The second should be much shorter, and it is where switching banks in Egypt gets easier.

2. The identity is bound to a phone and an app. The DFI Certificate is a digital certificate "linked to the bank's app and to the customer's mobile phone" (definitions), created and bound after verification (section 4, part two, item 2-2). Its job is to check that transactions come from "the same app and phone through which that identity was created" (section 5, item 7-2a). This is the most important design consequence in the whole text: a new phone, a factory reset or a reinstalled app is now an identity event, not just a login event. The circular requires banks to be able to cancel or suspend the certificate immediately at the customer's request or after any event that could expose their data (section 4, part one, item 13), and to tell customers to report a lost phone straight away (section 6). It does not spell out the step-by-step procedure for moving to a new phone; expect that in Haweya's technical connection rules, and design the re-binding journey as a first-class flow rather than a support ticket.

3. A Global PIN that belongs to the identity. The six-digit Global PIN is created by the customer while creating the DFI and is one of the authentication factors (definitions). When a banking agent helps with an exception case, the PIN must be created through the participating bank's mobile app, and the agent's own devices may not be used to create it (section 4, part two, item 3-2). Because the PIN is attached to the identity rather than to your app's passcode, your PIN screen must look and read differently from your app login, or customers will mix them up, and phishers will exploit the confusion.

4. Humans are the exception path, by design. Agents may only step in for cases the system cannot process automatically, "such as strong similarity in data or biometric features, like twins" (section 4, part two, item 3-1). Where remote identification fails or documents cannot be read, the customer is directed to the bank's branches or to banking agents, and the bank must use its website and official social channels to show which branches and agents have tablets for this (section 4, part two, item 4). Adsero notes that digital banks, which may not open branches under a CBE circular of 12 July 2023, would have to route these customers to authorised agents. So "finish in person" is not a dead end; it is a regulated screen that needs a real locator.

5. Signature today means non-financial. The definition of electronic authentication says it "stands in for the customer's signature". But section 4, part three limits default use to non-financial transactions; signing payments or transfers through the system requires a further CBE approval and compliance with the authentication levels the CBE issues. Note how the English summaries differ: Baker McKenzie lists authentication of payment and transfer orders among the services covered, while Adsero stresses that financial transactions need a further approval. Both are right. The scope clause lists what the system can do; the authentication clause gates what a bank may switch on. Read the gate, not the scope, before you write marketing copy.

The customer journey the rules imply

Putting the circular together with Haweya's public description of the flow, a first-time remote journey looks like this:

The customer starts in a participating bank's app, which the circular calls an approved electronic identification application connected to the DFI system's APIs (definitions); Gadalla has said Haweya's verification screens appear inside that bank journey.
The app checks the phone number is really in the customer's hands with an SMS OTP (section 4, part two, item 2-1).
The customer photographs the national ID. Gadalla says the system reads the card's 2D barcode and encrypted elements and may ask extra questions, such as the mother's name. The circular also requires support for reading the chip on official documents remotely (section 5, item 10-2).
A live selfie with liveness detection is matched to the document holder (section 5, item 10-3), with anti-deepfake and forged-biometric controls (section 5, items 17-2 and 17-3). Data is checked against the Civil Status Authority (section 5, item 4).
Haweya screens the person against the negative lists and passes the result to the bank, which makes the final decision (section 5, item 7-5).
The customer sets the Global PIN, the DFI Certificate is bound to the phone and app, and the bank notifies the customer through more than one channel (section 4, part one, item 7).
The customer accepts the bank's terms electronically and can receive a copy of everything they agreed to by registered email or another electronic channel (section 4, part one, items 9 and 11-1).

Every arrow in that list is a place where people drop out. The ones that matter most in Egypt are the ID photo on a low-end camera, liveness in poor light, and the moment the app says the phone is not supported.

Eight product surfaces the rules create

Identity status as a visible object. Show "Financial identity: active on this phone" in settings, with the date it was created and the bank that created it. Customers need a mental model for something that now follows them between banks.
Device eligibility screen. The bank's app must detect rooted or jailbroken phones and must not install on old or out-of-support operating systems (section 4, part four, item 2). Say clearly why the phone is blocked and offer the in-person route, instead of a generic crash-like error.
Re-bind and lost-phone flows. A "lost my phone" action that suspends the certificate immediately (section 4, part one, item 13), and a "new phone" journey that re-establishes the binding.
Failure reasons in plain language. Haweya must send the bank and agent success or failure notices "with the related reasons" (section 5, item 12). Map every reason code to human copy and a next step: retake photo, try better light, visit a branch with a tablet.
Parity, not a second-class tier. Senior management must make all services available with no preference or difference between electronically identified customers and those identified traditionally, and allow a customer to give a signature at a branch if they wish (section 2, part two, item 2). Avoid "lite" labels that make digital customers feel provisional.
Channel-of-origin data. Systems must distinguish customers identified electronically, in branches, or through agents (section 4, part one, item 4). Add the field to your customer model now; risk, analytics and audit will all need it.
Terms as a product surface. Terms must explain how to activate, stop and restart the service, how long stopping takes and the ways to request it, every fee including for stopping and restarting, the complaint route with a maximum response time and escalation, and the customer's duty to protect the bound device (section 4, part one, items 11-1 to 11-5). They must also include a clause about the timing of authentications by Haweya and the bank (item 6).
Service status. Services must run around the clock and customers must be told in advance of a stoppage (section 3, item 3-1); planned outages must be reported to the CBE at least 48 hours ahead (section 4, part six, item 5). That is an in-app status banner, not just an email.

The quiet winner: data updates, not new accounts

Most launch talk is about opening accounts without a branch visit. Gadalla's figure points somewhere else: 15 to 18 million branch visits a year happen only to update customer data. The circular explicitly lets banks use the system to update data for existing customers, including those originally identified in a branch (section 4, part one, item 2), and Haweya lists "continuous verification (re-onboarding)" as one of its services. Gadalla describes the flow: the bank sends a notice in the app or by SMS, the customer verifies with their digital identity, and the updated data moves into the bank's record.

For an incumbent bank with millions of existing customers, a well-designed "update your details" journey could deliver more value in year one than any acquisition funnel. Treat it as a launch feature: prefill what the bank already has, ask only for what changed, and show when the update has reached the customer's record.

Microcopy that respects the rule and the reader

On the PIN screen: "Create your 6-digit Global PIN. It protects your financial identity at every participating bank. No bank employee or agent will ever ask you for it."
On the device screen: "This phone can't hold your financial identity because its system is out of date or modified. You can update the phone, or finish at a branch or agent with a tablet. See locations."
On the reuse screen: "You already have a financial identity. Use it with this bank? We'll only receive what you agree to share."
On signing: if your bank has not received the extra approval for financial transactions, do not say "sign transfers with your identity". Say "Accept terms and update your details with your financial identity."

Write these in Arabic first, in a register that Egyptian customers trust, then adapt to English. The rules themselves are Arabic; your copy should start where the authority starts.

Fraud and support patterns built into the text

Banks must watch for repeated failed registrations and repeated wrong authentications in a short period, "especially if those transactions approach the maximum allowed limit", and contact the customer immediately (section 4, part five, item 1). Haweya must keep a central record of failed registration attempts (section 5, item 19). Customer awareness must cover how to recognise the official app and the rule that bank staff and agents may not ask for secret data (section 6). Design a calm "we're checking it's you" state for these moments, with a verified call-back channel, and put the "we will never ask for your PIN" line inside the flow where scammers will try to strike, not only in a help article.

Metrics that tell you whether the journey works

DFI creation completion rate, split by first-time versus reuse of an existing identity
Automatic pass rate versus referral to branch or agent, with the top failure reasons
Median time from app open to bound certificate
Share of attempts blocked by device eligibility, by device model and OS version
Re-bind requests and certificate suspensions per thousand active identities
Data updates completed digitally versus in branch, month on month

A two-sprint checklist

Add identity status, channel of origin and certificate state to the customer data model.
Build both front doors: create a new identity and reuse an existing one, each with its own consent copy.
Design the device eligibility screen and the in-person locator for branches and agents with tablets.
Write the Global PIN screens so they cannot be confused with the app passcode.
Implement suspend-now and lost-phone flows, then a new-phone re-binding journey.
Map Haweya failure reasons to human copy and next actions.
Rewrite terms to cover activation, stopping, restarting, fees, complaint times and device duties, and email a copy after acceptance.
Ship a digital "update your details" journey for existing customers.
Prepare the launch pack the CBE expects: workflow, three-year plan with target numbers, penetration test with no high or medium findings, SOC 2 Type 1 and the privacy impact assessment.

Risks and trade-offs

Agent scarcity. If agents are limited to rare exceptions, few will invest in tablets. Customers who fail remote checks may face long trips. Track exception volume by governorate before you promise "no branch needed".
Old devices. The ban on outdated operating systems protects customers but can exclude the very people financial inclusion aims at. Make the alternative route visible and fast.
Dependency on one platform. Haweya runs the single approved system from inside Egypt. Plan for its outages in your status messaging and support scripts.
Consent fatigue. Reuse across banks only works if consent screens are short and specific. Long legal walls will push people back to branches.
Pending procedures. The AML/CFT Unit's eKYC procedures were still to come when the circular was issued. Keep document requirements configurable rather than hard-coded.

What this means for fintechs and payment companies

The rules already name licensed entities that may join the system, and Gadalla says the next expansion phase will include companies supervised by the CBE, such as lenders and other financial service providers. Payment and lending apps should prepare now: design for an identity the customer already owns, keep your own login separate from it, and plan the consent you will ask for. This is the kind of cross-institution journey iFynx designs with fintech and banking teams in the region: one clear flow across several owners.

Frequently asked questions

What is Egypt's Digital Financial Identity (DFI)?

It is a digital copy of a customer's identity data, verified through a single CBE-approved system run by the Digital Financial Identity Company (Haweya). Each retail customer gets one unique identity that banks can use to identify them remotely, authenticate them and update their data, under rules the CBE issued on 23 August 2026.

Can I open a bank account in Egypt without visiting a branch?

That is the aim of the system. Once a participating bank has CBE approval and goes live, a customer can verify their national ID, pass a live selfie check and create a financial identity inside the bank's app. If the system cannot verify them automatically, they are referred to a branch or a banking agent with a tablet.

Can the digital financial identity replace my signature on transfers?

Not by default. The rules let banks use it instead of a handwritten signature for non-financial actions such as accepting terms. Using it to authenticate financial transactions requires an additional approval from the Central Bank of Egypt.

What happens if I change or lose my phone?

The identity's certificate is bound to your phone and the bank's app, so you should report a lost phone to your bank immediately. Banks must be able to suspend or cancel the certificate at once on your request. A new phone needs the identity to be bound again under the bank's and Haweya's procedures.

Which banks offer it, and is there a fee for customers?

Haweya said in September 2026 that the first phase would start with five banks and expand to all banks in Egypt within 18 months. It also said the bank pays for the service, not the customer. Check your own bank's app and terms for its launch date and any service fees.

Sources

Closing craft note

The CBE did not write an eKYC checklist. It described a credential that lives on a phone, travels between banks with consent, and must be suspended, re-bound and explained over years. Banks that treat it as a faster account-opening form will ship a nice first week and a support queue. Teams that design the whole lifecycle, from first selfie to lost phone, will turn Egypt's new identity layer into something customers actually trust.

Originally published on iFynx.

DEV Community