Written by Malik Abbas, CEO of CoinConnect
TL;DR
- A foreign crypto exchange cannot hold a Pakistani license directly — Regulation 5 requires a company incorporated in Pakistan under the Companies Act, 2017.
- The path runs in a clear order: scope check → NOC → incorporate → inject capital → build the board → choose your route → file Form II → stand up AML → launch.
- You must appoint at least one resident key individual with real decision-making authority (Regulation 10(4)), and your directors and owners must pass the fit-and-proper test (Regulation 8).
- A complete license application is decided within 90 days (extendable 60), but the clock only starts once PVARA confirms your file is complete.
- Plan the realistic end-to-end timeline in quarters, not weeks — and de-risk it by entering through a restricted license before scaling.
Table of Contents
- How does a foreign crypto exchange enter Pakistan? (quick answer)
- Before you start: what makes this different for a foreign entrant
- Step 1 — Confirm you are inside the perimeter
- Step 2 — Secure the NOC (Preliminary Approval)
- Step 3 — Incorporate a Pakistani company
- Step 4 — Inject capital and solve banking
- Step 5 — Build the board and appoint key individuals
- Step 6 — Choose your entry route
- Step 7 — Prepare and submit the license application (Form II)
- Step 8 — Stand up AML/CFT and the Travel Rule
- Step 9 — Evaluation, grant and launch
- The realistic timeline
- FAQ
How does a foreign crypto exchange enter Pakistan? (quick answer)
A foreign crypto exchange enters Pakistan by incorporating a local company, obtaining a PVARA No-Objection Certificate, injecting the required paid-up capital, appointing a resident key individual and fit-and-proper directors, then applying for a VASP license under the Virtual Asset Services Regulations, 2026. An offshore entity cannot hold the license directly; it must operate through a Pakistani subsidiary.
That is the shape of the journey. The rest of this guide is the detailed map — nine steps, in the order you should actually take them. It builds on our breakdowns of PVARA capital requirements, the sandbox and reduced-capital route, and which PVARA route to choose.
Conversions use an indicative rate of PKR 278 = USD 1 (June 2026).
Before you start: what makes this different for a foreign entrant
If you have entered a regulated market before, most of this will feel familiar — but three features are specific to Pakistan and catch foreign operators out.
First, you must localize. There is no "passport" or offshore recognition route. The license sits in a Pakistani company, with Pakistani capital, a Pakistani bank account, and a resident decision-maker.
Second, banking is the real bottleneck, not the regulator. Injecting and verifying capital requires a Pakistani account that will accept a virtual asset business — and not every bank will.
Third, coordination is multi-regulator. PVARA leads, but SECP governs incorporation, the State Bank of Pakistan sits behind banking and payments, and the Financial Monitoring Unit (FMU) runs AML reporting. A clean entry sequences all four.
Pakistan is an emerging crypto market with a large, under-served user base — but it rewards operators who respect the local structure rather than fight it.
Step 1 — Confirm you are inside the perimeter
Do not spend a rupee until you confirm you actually need a license. The regulations apply to anyone carrying on a virtual asset service "in" or "from" Pakistan (Regulation 3(1)), and Regulation 3(4) treats an activity as carried on in Pakistan where it "targets, solicits, promotes to, or has a material connection to Persons in Pakistan."
There is, however, a safe harbor. Regulation 3(5) provides that mere website accessibility does not, by itself, pull you in — provided you do not market, onboard, support PKR rails, or otherwise target Pakistani users. We cover this perimeter test in depth in our PVARA routes guide.
The decision: if Pakistan is a real market for you — you want to onboard residents, support PKR, or market locally — you are inside, and you proceed to Step 2. If not, document your safe-harbor position carefully and stop here.
Step 2 — Secure the NOC (Preliminary Approval)
The first formal move is the No-Objection Certificate under Regulation 6 — preliminary approval to set up a company and proceed. It is the lowest-risk way to confirm PVARA has no objection before you commit to incorporation and a full application.
Be clear about what it is not. Regulation 6(5)(a) states the NOC:
"does not constitute a License or authorization to carry on any Virtual Asset Service."
PVARA must decide a complete NOC application within 60 days (Regulation 6(4)). Once granted, it is valid for three months, extendable once by up to a further three (Regulation 6(6)) — so move promptly to Step 3 while it is live.
Step 3 — Incorporate a Pakistani company
This is the step that makes a foreign exchange a Pakistani licensee. Regulation 5(1)(a) requires the applicant to be:
"a company incorporated under the Companies Act, 2017 or any other law for the time being in force in Pakistan governing the incorporation of companies … for the purpose of providing Virtual Asset Services."
In practice this means registering a company with the Securities and Exchange Commission of Pakistan (SECP) — typically a private limited company. This is also where you fix your shareholding and control structure, because both will be scrutinized under the fit-and-proper test in Step 5.
The mechanics — name reservation, memorandum and articles, beneficial-ownership filings — are covered in our guide to SECP setup for foreign crypto exchanges and our corporate setup service.
Step 4 — Inject capital and solve banking
With the company formed, you fund it. Under Regulation 31(1), a licensee must "at all times, maintain minimum paid-up capital in accordance with Schedule-I," and the application requires evidence of capital "injected and maintained in the Applicant's bank account(s) in Pakistan."
Two things make this step the real test of the whole entry:
- The capital is share capital, not a fee. It stays your company's money — but it must genuinely be there, and stay there. The figure depends on your category, from PKR 25 million ($90,000) for advisory up to PKR 1 billion ($3.6 million) for an exchange — see the full capital requirements breakdown.
- Banking is the bottleneck. You need a Pakistani bank that will open and hold an account for a virtual asset business. This is solvable but not automatic; start it early, in parallel with incorporation. Our note on which banks open accounts for crypto VASPs maps the current landscape.
Solve banking late and your timeline slips regardless of how clean the rest of your file is.
Step 5 — Build the board and appoint key individuals
PVARA licenses people as much as companies. Two requirements dominate this step.
A resident decision-maker. Regulation 10(4) requires the license to:
"maintain a registered office in Pakistan and shall ensure that it has one key individual, to be resident in Pakistan and is vested with operational and decision making authority and accountable to the Authority for regulatory compliance."
This cannot be a figurehead. It must be a real, resident decision-maker — a point we cover in detail in our guide to the resident director requirement.
Fit-and-proper directors and owners. Under Regulation 8, PVARA assesses the fitness of controllers, directors and the CEO. Regulation 8(2) requires the Authority to have regard to:
"(a) integrity, honesty and reputation; (b) competence, capability and relevant experience; (c) financial soundness; and (d) conflicts of interest and independence."
Schedule III adds concrete bars — the CEO needs senior financial/technology experience including at least two years in blockchain or virtual assets, and directors need five years of senior experience. Your Ultimate Beneficial Owners are screened too. We break down the screening in our fit-and-proper / Form A3 walkthrough.
Note one relief: for a restricted license, Regulation 20(4) lets PVARA permit a smaller proportion of independent directors — easing the day-one board burden if you enter lean.
Step 6 — Choose your entry route
Before you file, decide what you are filing for. As covered in our routes comparison, you can pursue:
- a regulatory sandbox test, for novel models needing clarity;
- a restricted (limited-scope) license under Regulation 7(5), to operate at limited scale on reduced capital; or
- a full license under Regulation 7, to operate at scale.
For most foreign exchanges entering an unproven market, the honest recommendation is to enter restricted and graduate, rather than commit the full PKR 1 billion before you have proven Pakistani demand. Your conduct on the restricted license then counts in your favor at the full-license stage under Regulation 7(6).
Step 7 — Prepare and submit the license application (Form II)
Now you file. Under Regulation 7(1), you apply on Form II with the prescribed documents and the processing fee. Expect to submit your business plan, governance and risk framework, AML/CFT program, technology and cybersecurity policies, capital and liquidity attestation, and fit-and-proper documentation for every controller, director and key individual.
The single most important word in this step is complete. Regulation 7(2) provides:
"An application shall be treated as complete only when the Authority has confirmed, in writing, that all required information and documents have been received in a satisfactory form. Where the Authority requests further information, the time for deciding the application shall be suspended until the requested information is provided."
In other words, the 90-day decision clock does not start when you hit "submit." It starts when PVARA confirms your file is complete. Incomplete filings do not just risk rejection — they freeze the timeline. This is why preparation, not submission, is where applications are won. Our PVARA licensing service exists to get the file complete on the first pass.
Step 8 — Stand up AML/CFT and the Travel Rule
A virtual asset license in Pakistan is inseparable from financial-crime compliance. Regulation 10(1)(e) requires every licensee to "comply with AML/CFT/CPF obligations under applicable law," and your AML framework is assessed as part of the application, not bolted on afterward.
Practically, this means:
- registering with the Financial Monitoring Unit (FMU) on its goAML platform for suspicious-transaction reporting;
- implementing the FATF Travel Rule for virtual asset transfers;
- standing up KYC/CDD, sanctions screening, and transaction monitoring; and
- appointing a resident, fit-and-proper compliance officer (Regulation 23 requires the Compliance Officer to "be a resident in Pakistan").
We cover the operational detail in our guide to FMU goAML registration and the FATF Travel Rule.
Step 9 — Evaluation, grant and launch
Once your application is complete, PVARA evaluates it. Under Regulation 7(3) it must decide "a complete application within ninety (90) days," extendable by up to 60 days under Regulation 7(4) for complex or novel cases. PVARA may interview your CEO and request further information along the way.
At the end, Regulation 9(1) requires PVARA to either grant the license — "subject to such conditions, limitations, and requirements as the Authority considers necessary" — or refuse it with written reasons. On grant, you may launch within the scope of your license, and your ongoing obligations begin immediately: maintaining capital "at all times," reporting, safeguarding customer assets, and the rest. The realities of this operating phase are mapped in our post-NOC operational playbook and the common Phase 2 compliance failures.
The Realistic Timeline
Foreign entrants consistently underestimate this, so here is an honest view. The regulatory decision windows are fixed — 60 days for the NOC, 90 (plus up to 60) for a complete license — but the preparation between steps is what determines your real timeline.
| Phase | Realistic duration |
|---|---|
| Scope check + NOC | 1–2 months |
| Incorporation (SECP) | 3–6 weeks |
| Capital injection + banking | 4–10 weeks (banking is the variable) |
| Board, key individuals, fit-and-proper packs | 4–8 weeks (often parallel) |
| Application prep to "complete" status | 4–8 weeks |
| PVARA evaluation | 90 days (+ up to 60) |
End to end, plan for roughly 6–12 months to a full license, depending on banking and applicant readiness — shorter to enter via a restricted license or sandbox. Run the independent steps in parallel and the calendar compresses; run them sequentially and it stretches.
Frequently asked questions
No. Regulation 5(1) requires the licensee to be a company incorporated in Pakistan under the Companies Act, 2017. A foreign exchange must establish a Pakistani subsidiary; an offshore entity cannot hold the license directly.
Confirm you are inside the regulatory perimeter (Regulation 3), then secure a No-Objection Certificate under Regulation 6 before incorporating. The NOC is preliminary approval to proceed — it does not authorize you to serve customers yet.
Yes. Regulation 10(4) requires at least one resident key individual with real operational and decision-making authority, accountable to PVARA. The compliance officer must also be resident in Pakistan under Regulation 23.
A complete license application is decided within 90 days (extendable by 60). Including incorporation, capital, banking and preparation, a realistic end-to-end timeline is roughly 6–12 months, with banking the most common variable.
Banking. Capital must be injected and verified in a Pakistani bank account, and not every bank will open one for a virtual asset business. Start banking in parallel with incorporation, not after it.
It depends on the license category — from PKR 25 million ($90,000) for advisory to PKR 1 billion ($3.6 million) for an exchange. A restricted license under Regulation 7(5) can carry reduced capital in exchange for caps and product limits.
Yes, and for an unproven market it is usually the wiser path. A restricted license or sandbox lets you operate on reduced capital under caps, and your record there counts in your favor when you apply for the full license.
Planning your entry into Pakistan? CoinConnect runs the full foreign-entrant sequence — NOC, SECP incorporation, banking, fit-and-proper packs and a complete Form II — so your application lands complete on the first pass. Book a free 30-minute discovery call →
Last reviewed: June 2026. Based on the draft Pakistan Virtual Asset Services Regulations, 2026, published for public consultation. Provisions are subject to change pending finalization.
External sources: PVARA · SECP · State Bank of Pakistan · FATF – Pakistan