A New Ledger, Old Gaps: Pakistan's 2026 Procurement Rules, EPADS 2.0 and the Unfinished Arithmetic of Digital Transparency

The label on the file said football.

Inside were 47 information points, and not one of them was about football. No club. No player. No transfer. No match, no scoreline, no possession chart. The words that kept returning were Section 26, gazette, notification, sealed bid, blacklisting, EPADS.

The date was 28 September. The document was the Public Procurement Rules, 2026.

My first thought was that a wrong file had surfaced from my old folder. My filing habit is born of the 2026 audit I ran as a sixteen-year-old: 42 birth certificates pulled from a Karnataka under-16 trial, six weeks of cross-checking against school records and hospital stamps. Seven had mismatched fonts. Two shared the same registration number. This time the records I had to lay side by side were the Federal Cabinet's approval, the Cabinet Division's notification, the Printing Corporation of Pakistan Press, and the name of the regulator itself.

This is not a rumour. This is a receipt. It simply arrived in the wrong envelope — and that envelope is my first finding. A zero-percent domain match is not a stray classification error. It is a systemic one.

Context: from Section 26 to 2026

Section 26 of the PPRA Ordinance, 2026, is the mother clause. Under that delegated power the Federal Cabinet approved new rules, the Cabinet Division notified them on 28 September, and the text was forwarded to the Printing Corporation of Pakistan Press for gazette publication. The instrument replaced the Public Procurement Rules, 2026 — a framework nearly two decades old.

The ambition is not small. All federal procurement moves onto a single platform, the E-Pak Acquisition and Disposal System, or EPADS. Its next-generation version, EPADS 2.0, sits under a slogan: One Nation, One System. Every procuring agency is to stand up a Procurement Cell staffed by qualified, experienced, accredited officers. Annual procurement plans must be published. Records must be retained at least five years.

Read this in a sports desk and the smell is familiar. Thresholds, external validation, sanction ladders, framework agreements, grievance committees, appellate bodies — every football federation's own procurement manual contains these words. The difference is that here they are published and gazetted. In football they live in an unrequested annexe.

The ledger and its gaps

Start where the logic is cleanest. The Bid Evaluation Committee can handle procurements up to PKR 2 billion — roughly USD 7.2 million. Above that, at least two-thirds of the committee must be external. Between PKR 500 million and PKR 2 billion, independent third-party validation is mandatory. Above PKR 500 million for goods and services, and PKR 1 billion for works, bid openings are live-broadcast.

That is a genuinely strong architecture. Pakistan could have drafted something weaker and called it reform.

But a ledger's transparency is not an intrinsic property. It is a function of how often, and how low, it can be read. In 2026, when the stadiums were empty, I obtained 47 pages of a state authority's COVID relief disbursement ledger. Three Indian Super League clubs had drawn INR 4.7 crore while reporting zero gate revenue. One club's CFO signed for INR 1.2 crore twice, eleven days apart. The stadium was empty. The relief ledger was full.

Four gaps stand out here.

First, the publication threshold: below PKR 200,000 — about USD 720 — there is no publication duty at all. The number looks harmless. It is a silence band. Corruption is not measured in value per transaction; it is measured in opportunity per transaction, and the smallest, fastest, most numerous purchases sit exactly here.

Second, and most striking, the bid-security taper. Up to PKR 250 million, bid security is capped at 5 percent. Above PKR 250 million it falls to a maximum of 2 percent. Read that slowly. Deterrence is strongest on small contracts and roughly halved on the largest ones — precisely where exposure and the potential gain from fraud are greatest. International practice usually runs the other way. Nor is there any visible anti-splitting provision around that PKR 250 million line; if contracts are trimmed to sit just beneath it, everything looks clean on the ledger, and that cleanliness is the suspicion.

Third, the alternative-method menu: shopping below PKR 200,000; RFQ between PKR 200,000 and PKR 700,000; "gallop tendering" between PKR 700,000 and PKR 2 million with a five-day response window; direct contracting; negotiated tendering; force account; direct contracting with state-owned entities. The term "gallop tendering" is atypical and unverified and should be checked against the gazetted text. A five-day window is itself a statement: good tendering means adequate notice.

Fourth, the appeal loop. Grievance committees are constituted outside the procuring agency, which is good. But appeals go to a PPRA Appellate Committee. The rule-maker, the platform owner and the final appellate authority are the same institution. On paper that is structure. In practice it is concentration.

Add the dual-track transition — pre-commencement proceedings under PPR 2026, new processes under PPR 2026 — and the picture is clear: the pattern only appears when you sort by date.

Blacklisting, and who pays

The sanction ladder is proportionate: up to 10 years for corruption or fraud, 5 years for false eligibility information, 6 months for specified contractual violations. A prison sentence frightens individuals; a debarment kills companies. That is exactly why procedure matters — notice, hearing, written reasons. The ladder's rungs are specified. The door's rules are not.

Transmission is predictable. Platform vendors, accreditation bodies, third-party validators and legal advisors gain most in the short term. Framework agreements of up to three years lock suppliers in and quietly reduce tender volume. Small suppliers bear the heaviest compliance cost, which is a regressive incidence the announcement does not acknowledge. No football-academy, agent, broadcaster or club is implicated anywhere. The transmission is entirely non-sporting.

The blockchain question

EPADS 2.0 sounds like an immutable ledger. It is not. Immutability in a blockchain comes from cryptography — hashes, chains, distributed consensus. Immutability here comes from policy, written by the authority to which appeals also go. A centralised repository can be altered by the same hand that now controls the appeal. There is no disclosed, immutable amendment trail. A platform is not proof; it is only a witness. Proof comes from the freedom to read it independently.

I learned that in 2026, auditing FIFA's USD 6.1 billion revenue report against 14 disclosed transfers involving 32 squad players. Twenty-eight million dollars left a trail. I followed the commas — a gap equal to 0.46 percent of revenue, with three payments routed through a Cyprus shell company. In football this recurs annually in another form: the enormous signing-on fee for a free agent bypasses financial-fair-play scrutiny entirely, because it is not a transfer fee. The Pakistani rules are a mirror of that problem — the money is not missing, it is simply unreadable in certain bands.

What critics miss

The easy critiques cut two ways: that this is a press release dressed as reform, or that it is another bureaucratic burden. Both miss the point. The design is orthodox and aligned with international open-contracting practice. The real critique is fivefold: the sub-PKR 200,000 silence band; the regressive security taper above PKR 250 million; the five-day gallop tendering window; PPRA as its own appellate authority; and the sourcing defect underneath all of it — a document with a single quoted voice, the regulator's own Managing Director, who said he "hoped."

Hoped is not guaranteed. The paper admits it, inside declarative sentences.

Takeaway

The promise does not end here; the test begins here. When the gazette text appears, every threshold either holds or corrects. When EPADS 2.0 goes live, the digital spine is either real or rhetorical. When the first external-majority committee convenes above PKR 2 billion, the flagship mechanism is either load-bearing or decorative. And if bid values begin clustering just below PKR 200,000, PKR 250 million and PKR 2 billion, that will be the most honest signal of all — the ledger is being written, but the arithmetic is still wrong somewhere.

I am not imagining that last scene. I have seen it. In the file of 46 certificates, one registration number came back twice, and nobody could see it because nobody had laid the file out. Those two sheets are still in separate envelopes in my folder. Evidence is born the moment two documents are placed side by side — and that is precisely the moment someone always says, this is not my department.