P@SHA Warns NCCIA Raids on Legitimate IT Firms Put Pakistan’s $4.6bn Export Industry at Risk

The Pakistan Software Houses Association (P@SHA) has urged the National Cyber Crime Investigation Agency (NCCIA) to stop raiding legitimate software and IT companies, warning that the raids — part of a crackdown on scam centres — are damaging the one industry Pakistan can least afford to scare away. In a statement issued on Monday, the association said enforcement teams must learn to tell a real IT company from a scam operation: every raid on the wrong office costs the country export earnings, client trust and skilled people.

The warning lands as Pakistan’s IT sector carries real weight. IT exports hit a record $4.6 billion in FY2025-26, up from $3.8 billion the year before, and the government has set an ICT export target of $10 billion by FY2028-29. That growth is built on trust, and trust does not survive headlines about raided offices and seized servers.

1What P@SHA Said

According to Dawn, P@SHA raised “serious concerns about an increasing number of raids” by the NCCIA on legitimate software and IT-enabled services companies. The statement, issued on Monday 9 November 2026, asked the agency to distinguish legitimate call centres and IT companies from scam centres — and made the point that it considers call centres legitimate businesses, not a polite name for scams.

P@SHA Chairman Dr Shoaib Ahmed Khan put the stakes in one sentence: “Every single dollar is earned on trust. A foreign client who hears that his vendor’s office was raided and its servers taken away does not wait for the forensic report.”

That is the heart of the issue. When the target turns out to be a registered software house serving foreign clients, the damage is done the moment the door is forced open — long before any investigation clears the company. The client abroad does not wait for the exoneration. They move the contract elsewhere.

2The Complaints Behind the Statement

P@SHA says member companies describe a pattern: enforcement teams entered offices without showing a warrant, held and questioned staff for hours, and took laptops, servers and phones into custody — even when nothing unlawful was found.

“Such actions halt client delivery, put confidential foreign client data at risk, and create fear among employees and investors,” Dr Khan said, according to Dawn.

Three harms sit inside that one sentence: halted delivery means missed deadlines and lost contracts; foreign client data in enforcement hands is a data-protection problem; and fear among employees and investors pushes the people the industry needs most to look for safer places.

Dr Khan also reminded the authorities that the IT industry is an entire ecosystem: Pakistan produces more than 70,000 computing graduates every year, and the Ministry of IT, PSEB, Ignite, the State Bank and the HEC are all working towards the export targets. “Indiscriminate raids undo that collective effort and push skilled young people to leave the country,” he said.

3The Numbers Behind the Warning

The figures P@SHA cited explain why the association spoke publicly:

• IT exports reached a record $4.6 billion in FY2025-26, up from $3.8 billion in FY2024-25 — growth of roughly 20 percent in a single year.
• IT is the only industry in Pakistan growing consistently at around 20 percent every year, according to P@SHA.
• The government has set an ICT export target of $10 billion by FY2028-29 under the Uraan Pakistan programme, alongside a broader national goal of $15 billion.
• Pakistan produces more than 70,000 computing graduates a year.

That export growth is not an abstract statistic. It is the revenue of thousands of software houses, agencies, call centres and freelancers — and the backdrop to the government’s other big technology bets, from the plan to train one million AI professionals by 2030 (see our coverage of the one million AI professionals plan) to 500,000 Chromebooks being manufactured locally.

4What P@SHA Is Asking the NCCIA to Do

The association was careful to say it is not defending scam centres: the industry “fully supported every lawful, evidence-based operation against scam centres”. The complaint is about how the operations are carried out — and about who gets caught in them.

P@SHA’s central argument is that the NCCIA itself has acknowledged the problem: some fraud operators register their businesses as IT companies. That, the association says, is exactly why enforcement must differentiate carefully “instead of treating every office with laptops and a night shift as a suspect”. Night shifts are normal in Pakistan’s IT industry — they exist because clients are in the US, UK and Gulf. The association made two specific suggestions:

1. Verify before raiding. The NCCIA should check a company’s status with PSEB and P@SHA through a designated focal person before any raid — a quick check that would separate registered, legitimate companies from unregistered fronts.
2. No media trials. The agency should not conduct any media trial of IT-related companies — because a televised raid is a verdict in the eyes of a foreign client, whatever the courts later decide.

Both are practical, low-cost asks. A verification call takes minutes. A raid takes a company’s reputation with it.

5What This Means for Pakistani Businesses

This story matters beyond the software houses named in it: the same logic applies to any Pakistani business selling services abroad — agencies, call centres, BPO operations and freelancers. (See our 2026 digital marketing pricing guide.)

Trust is the product. For a services exporter, the deliverable is not a physical good a buyer can inspect. It is a promise: your data is safe with us, your deadlines will be met, your business will not appear in a news story about a raid. One misdirected raid can cost a company a client it spent years winning, and the industry a reputation it spent a decade building. The risk is not theoretical: the complaints P@SHA collected describe staff held for hours, servers and laptops seized, client delivery halted. Even a company cleared the same week has still missed its deadlines. That is why the association’s demand is for verification before the raid, not an apology after it.

Registration is becoming a shield, not just paperwork. A PSEB-registered, P@SHA-member company is a known entity verifiable in a phone call. Businesses that treated registration as optional paperwork should reconsider. The crackdown itself is legitimate: nobody in the industry is asking the NCCIA to stop pursuing scam centres, and lawful, evidence-based operations against real scams have its full support. The dispute is about accuracy, not enforcement.

6What Your Company Should Do Now

Whether you run a software house, an agency, a call centre or a freelance practice, there are practical steps worth taking this week:

• Get your registration in order. Make sure your PSEB registration is current, and join P@SHA if you are eligible — being a known, verifiable entity is the best protection against being mistaken for a front.
• Keep paperwork you can show in five minutes, and protect client data like it is your own. Registration certificates, tax records and client contracts should be filed and accessible; encrypt drives and keep off-site backups of code and client data, so you can keep delivering from a backup if equipment is ever seized.
• Have a lawyer’s number saved before you need it, and a plan for keeping work moving if your office were inaccessible for 48 hours. The first hour of any enforcement visit is the one that matters.
• Talk to your clients before they hear it from the news. A short, factual note — that P@SHA has raised the issue publicly and legitimate companies are verifiable through PSEB — reassures far more than silence.

None of this is a substitute for the systemic fix P@SHA is asking for. But it is what a business can control while the fix is negotiated.

7The Bigger Picture

Pakistan’s IT sector has spent years becoming the economy’s most reliable growth story: record exports, a young workforce, and a government target that doubles today’s numbers within three years. The P@SHA statement is a warning that growth like that is fragile — not because the talent is missing, but because the environment around it can turn hostile faster than any marketing campaign can repair. The fix is small: a verification call before a raid, and no media trials. The NCCIA can keep pursuing scam centres with the industry’s full support — it only needs to stop treating every office with laptops and a night shift as a suspect. For the legitimate companies earning Pakistan’s foreign exchange one project at a time, that small fix is worth more than any subsidy. Trust, once lost, is the most expensive thing in the world to buy back.

Source: Dawn, “P@SHA raises concern over raids”, 10 November 2026. Corroborated by ProPakistani, 9 November 2026.