Pakistan's Domestic Routing Mandate Closes the Network Layer

@kawishwaqar|May 8, 2026 (3m ago)11 views

PTA gazetted the Local Peering and Internet Exchange Points Regulations, 2026 (S.R.O. 661(I)/2026) in late April. Effect was immediate. The directive at the centre of it is one sentence:

Local internet traffic shall not be routed on upstream bandwidth or international gateways.

Until this rule, a packet between two Karachi networks could leave Pakistan, hit a peering point in Singapore or Marseille, and come back. That was the operational default for years because international transit was cheaper and more reliable than the absent or under-built local peering fabric. The rule shuts that door.

Disclosure: I work at Jazz as Principal Evangelist Cloud & AI. This article is written as personal industry analysis. Views are my own.

What the regulation actually says

• Local traffic must be exchanged via direct peering or licensed IXPs
• Operators may set up IXPs jointly on a cost-sharing basis
• Third-party IXP management is allowed with prior PTA approval
• IXPs must run on fibre, operate at Layer 2, and use BGP for routing
• CDN deployments require PTA notification
• Licensees must retain traffic records for at least 12 months and produce them on demand
• IXP terms must be "fair and non-discriminatory"
• PTA can inspect, demand traffic data, and disrupt non-compliant flows

The teeth are the last point. If domestic traffic leaves the country when it should not, PTA can interrupt it.

Why this matters beyond network engineering

I have been writing for the last six months about Pakistan's regulatory direction on cloud, data, and AI. The pattern is consistent enough that it deserves a name. Call it a sovereignty stack.

1. 2023
   Data layer
   SBP's Cloud Regulatory Framework draws the line on where regulated banking data can sit
2. 2022 – 2026
   Compute layer
   The Cloud First Policy 2022 and Garaj's local IaaS deployment anchor regulated workloads inside the country, validated this year by Raqami running its full banking stack on local cloud
3. 2025
   Application layer
   The National AI Policy 2025 instructs industry to leverage public cloud and open-source AI infrastructure, with sectoral roadmaps and a national AI compute grid
4. Apr 2026
   Network layer (today)
   PTA closes off the path that allowed all of the above to be silently undermined by a packet route

The stack only works if every layer holds. A bank can run on local cloud, and a regulator can mandate domestic data residency, but if the traffic between the bank's mobile app user in Lahore and the bank's regional API gateway in Karachi physically crosses two foreign IXPs, the sovereignty claim is partial. The PTA rule closes that gap.

What changes for cloud providers

• Local cloud providers (Garaj, PTCL Cloud, Cybernet, Multinet). Improvement on two fronts. Customer traffic to their workloads no longer rides foreign transit, which improves latency for Pakistani end users. They also become natural anchor tenants for new IXPs because their inbound traffic is overwhelmingly Pakistani.
• Hyperscalers (AWS, Azure, GCP). No regional presence in Pakistan today. A Pakistani customer reaching an AWS Mumbai or Azure Singapore endpoint is, by construction, international traffic. That stays legal because the workload itself sits abroad. The constraint kicks in for any local-to-local traffic that today gets routed through a hyperscaler edge or CDN PoP outside the country.
• CDN providers. The most operationally affected. Cloudflare, Akamai, Fastly, and CloudFront rely on Anycast routing that frequently puts Pakistani users on the closest non-Pakistani PoP. The regulation mandates PTA notification of CDN deployments and effectively requires Pakistani-origin domestic traffic to terminate on Pakistani-located edges. Expect more local PoPs.

What changes for AI workloads

This is the part I think will be under-discussed.

• Foundation model APIs. Calls from a Pakistani app to OpenAI, Anthropic, or Bedrock are international by construction. The model lives abroad. The traffic must leave the country to reach inference, and that remains legitimate cross-border traffic.
• RAG and retrieval pipelines. A common architecture today involves a vector database in a US or EU region, fronted by a hyperscaler API endpoint. If the vector database holds Pakistani customer data and serves a Pakistani app, the stack now sits at the intersection of two pressures: SBP and Personal Data Protection rules on data residency, and the new PTA rule on local-origin traffic that touches a foreign-located edge.
• Local inference. The economics improve materially. If you run inference on a domestic GPU instance, on Garaj, a CoE-AI compute node, or a local neocloud, the entire request and response stays in-country. Lower latency, lower bandwidth cost, simpler compliance. The regulation does not directly mandate this. It tilts the cost curve in that direction.
• Open-weight models on local infrastructure. This is the architecture that aligns most cleanly with the new regulatory surface. Llama, Qwen, Mistral, and similar deployed on a Pakistani GPU host. The data never leaves. The model is auditable. The compliance story writes itself.

What changes for data centre demand

• More IXPs needed. PTA can mandate IXP setup in regions it identifies. New IXPs require carrier-neutral colocation, which requires data centre capacity in cities that may not have it today.
• More CDN edge presence. Cloudflare, Akamai, and Google pushing PoPs into Pakistan rather than transiting through it means rack space leased from local data centre operators.
• More hosting close to peering. Operators will want their AI inference, web hosting, and edge compute near the new IXPs. That concentrates demand into a small number of carrier-neutral facilities.

The economic case for building data centres in Pakistan was already getting better. This rule strengthens it. The constraint to watch is the one I have flagged before: GPU import duties at 48 percent, and uneven power tariffs for HPC and data centre operations. The National AI Policy 2025 did not address those.

What to watch over the next two quarters

• Whether PTA publishes the list of designated regions for new IXPs, and how quickly operators co-fund them
• Whether Cloudflare, Google, and Meta deploy meaningful Pakistani PoPs in response, or push back on the rule
• Whether the first enforcement action, an actual traffic disruption, tests the regulation's teeth
• Whether sovereignty-stack alignment becomes formal coordination across PTA, SBP, NEPRA, and MoITT, or stays as parallel-track regulation

Where this fits

Part of an ongoing series on Pakistan's cloud, AI, and digital infrastructure from a practitioner's perspective. Previous posts: Pakistan's National AI Policy 2025, Picking Battles in the AI Stack, Pakistan's 5G Moment Is Also a Sovereign Cloud Moment, and Beyond Hyperscalers.

• Website: https://waqaruddin.com
• Medium: https://medium.waqaruddin.com/