The National Bank’s Satellite Backup Now Runs Through the UAE.

The satellite link that backs up more than 400 branches of the National Bank of Pakistan no longer runs on a Pakistani satellite, and its ground infrastructure is no longer in Pakistan.

Pak Datacom (PDL) has moved that connectivity from PakSat, with VSAT hubs in Karachi and Islamabad, to Yahsat — a UAE-based operator — with the hubs relocated to the United Arab Emirates.

Former PDL chief executive Brig (Retd) Syed Zulfiqar Ali has written to the IT ministry secretary objecting. His argument is short: the satellite is now UAE-owned, the hub is also located in the UAE, and the National Bank maintains all government accounts.

What was actually moved

This is backup connectivity, not the primary network — a distinction that matters and is often lost in this kind of story.

Bank branches run on terrestrial links: fibre, microwave, leased lines. Satellite is what carries the traffic when the terrestrial path fails — a fibre cut, a flood, a regional outage, a branch in a location fibre has not reached. For a bank with national coverage obligations, that fallback is not optional.

Which means the satellite path carries live transaction traffic precisely when the country’s ordinary infrastructure is already under stress. It is the wrong link to think of as peripheral.

The same arrangement reportedly touches networks serving OGDCL and AGPR — the state oil and gas exploration company and the office that handles federal government accounting.

The company sits inside government

Pak Datacom is listed on the Pakistan Stock Exchange and employs around 160 people. The Telecom Foundation holds 55 percent; the public holds the remaining 45.

The Telecom Foundation operates as a trust under the direct control of the Ministry of Information Technology and Telecommunication. Zarar Hasham is both Chairman of the Telecom Foundation and Secretary of MoITT.

So this is not a private firm making a commercial procurement decision at arm’s length from the state. It is a majority state-controlled company, overseen by the IT ministry, moving government banking infrastructure onto a foreign operator — with the ministry’s own secretary chairing the controlling shareholder.

What encryption does and does not cover

PDL’s position is that the traffic runs over virtual private networks on the Yahsat infrastructure. That is the standard answer, and it is a reasonable one as far as it goes.

A properly implemented VPN means the operator carrying the traffic cannot read the contents. Modern banking traffic is encrypted end to end regardless. If the concern were somebody reading transaction data off the satellite, encryption largely answers it.

Encryption does not answer the other two concerns.

Metadata. Even with contents encrypted, whoever runs the hub sees which branches are transmitting, when, how much and in what pattern. Traffic analysis across 400 branches over time reveals a great deal about the operations of an institution without a single message being decrypted.

Availability. This is the substantive one. Encryption protects confidentiality; it does nothing for continuity. If the hub is in another jurisdiction, the ability to keep the link running is subject to that jurisdiction’s decisions — its regulator, its courts, its foreign policy, and the commercial health of the operator. A backup network whose continuity depends on a foreign government’s goodwill is not fully a backup.

The awkward question about PakSat

The objection is that this should sit on an indigenous PakSat-based system with dedicated hubs in Karachi. The obvious follow-up is why it did not.

Nothing published so far explains the move. Commercially, there are only a few plausible reasons: PakSat capacity was unavailable or unsuitable on the required beams, Yahsat quoted materially lower rates, or the service quality on the existing arrangement was not meeting the bank’s requirements.

Each of those is a different problem, and each points somewhere uncomfortable. If it was capacity, Pakistan’s own satellite programme cannot serve a flagship domestic requirement. If it was price, sovereign capability is losing on cost to a regional competitor — which is a subsidy question, not a security one. If it was service quality, the domestic operator was not delivering.

You cannot fix any of them by objecting to the outcome. Telling a state bank to use a domestic satellite that is more expensive, less available or less reliable is a decision someone has to fund and own.

Why this belongs in the digital sovereignty conversation

Pakistan has spent the past two years talking a great deal about sovereign digital infrastructure — local AI compute, domestic cloud, national payment rails, data residency for regulated sectors. The argument in every case is the same: critical systems processing sensitive national data should sit inside the country.

The satellite layer rarely features in those discussions, because it is invisible until something breaks. It is also the layer that carries traffic when everything else has already failed — which makes it the one place where foreign dependency is least tolerable, not most.

The right response to this is not outrage. It is disclosure: what PakSat could and could not offer, what each option cost, what the bank’s own risk assessment concluded, and whether the IT ministry reviewed a decision taken by a company it controls. None of that has been made public.

Until it is, the country is left with a state-controlled firm having quietly moved the government’s banking fallback offshore, and a former chief executive having to write a letter to find out why.

Related: Pakistan Just Got Its First NVIDIA H200 GPU Cluster. Here’s Why That Matters.