Written by Malik Abbas, CEO of CoinConnect
TL;DR
- The PVARA Lending & Borrowing license authorizes operating, arranging or facilitating crypto lending, borrowing, margin lending and credit arrangements — at PKR 500 million (~$1.8 million) capital.
- It is a higher-capital tier because lending creates direct customer-loss and liquidity-mismatch risk.
- The defining rule is asset sufficiency: a lender must hold enough assets to meet its obligations to customers when due, and cannot run a structural maturity mismatch.
- Re-using customer assets (lending them on, rehypothecation, staking) needs explicit prior consent and full disclosure — and you cannot dress lending up as "custody" or "safekeeping."
- Collateral, margin and liquidation must be governed by clear, non-discriminatory policies consistent with what customers were told.
Table of Contents
- What is the PVARA Lending & Borrowing license?
- Capital and eligibility requirements
- The perimeter — what it covers and what it does not
- Asset sufficiency: the rule that defines the category
- Withdrawal rights and the "not custody" rule
- Re-use of customer assets
- Collateral management
- Counterparty due diligence and credit assessment
- Liquidation, close-out and default management
- Product governance and target market
- Risk management and stress-testing in depth
- Disclosures, agreements and reporting
- A worked example: a collateralized lending product
- Common mistakes
- FAQ
What is the PVARA Lending & Borrowing license?
A PVARA Lending & Borrowing license authorizes a company to operate, arrange, facilitate or administer lending, borrowing, credit, margin or financing arrangements involving virtual assets in Pakistan. Defined in Regulation 4(1)(f) of the Virtual Asset Services Regulations, 2026, it requires PKR 500 million in minimum paid-up capital and carries some of the framework's most demanding prudential rules, because lending puts customer assets at direct risk.
This is the deep dive on the lending and borrowing category. For the full set of ten, see our PVARA license categories overview; for the big picture, the complete licensing guide.
Conversions use an indicative rate of PKR 278 = USD 1 (June 2026).
Capital and eligibility requirements
The lending and borrowing license sits in the upper tier of the Schedule I capital table: PKR 500 million (~$1.8 million) minimum paid-up capital, held "at all times" under Regulation 31(1). This is share capital inside your Pakistani company, not a fee — see the full capital breakdown.
On top of capital, applicants must satisfy the general eligibility bars: a Pakistani company (Regulation 5), a resident key individual with real authority (Regulation 10(4)), a resident compliance officer (Regulation 23), and fit-and-proper directors, controllers and a qualified CEO (Regulation 8, Schedule III). Because lending models have repeatedly failed globally through liquidity mismatch, expect close scrutiny of your asset-sufficiency, collateral and stress-testing frameworks.
If PKR 500 million is more than you wish to commit before proving demand, a reduced-capital, limited-scope license under Regulation 7(5) may be available, with customer and product caps.
The perimeter — what it covers and what it does not
Under Lending and Borrowing Handbook section 3(2), a licensee may facilitate or enter into collateralized or uncollateralized lending arrangements involving virtual assets, and provide borrowing, lending, margin lending or similar financing linked to virtual assets. The Regulation 4(1)(f) definition reaches "credit, margin, financing, or similar arrangements," including where collateralized or involving rehypothecation to the extent permitted.
The category is broad, but it does not absorb adjacent activities. Margin lending that supports leveraged trading still interacts with the Derivatives & Leverage license, and holding customer assets engages custody safeguarding. Section 11(3) is explicit that a lending authorization "does not disapply or dilute the safeguarding standards applicable to Client Money and Client Virtual Assets under the Regulations."
Asset sufficiency: the rule that defines the category
If there is one rule that defines this license, it is asset sufficiency. Section 8(1) requires a licensee to "at all times maintain sufficient Virtual Assets and/or fiat to meet its contractual obligations to Clients when due," taking into account the maturity profile of arrangements, withdrawal rights, haircuts and margin, potential stressed outflows, and concentration.
And section 8(2) bans the failure mode that destroyed prior crypto lenders: a licensee "shall not operate a Lending and Borrowing business model that results in a structural or persistent mismatch between its obligations to Clients and the assets available to meet those obligations." It must have monitoring capable of identifying emerging shortfalls (section 8(3)) and must notify the Authority "without undue delay" where it is, or is likely to be, unable to meet its obligations (section 8(4)). This is the provision that turns "we lend out deposits and hope" into a supervised, measurable discipline.
Withdrawal rights and the "not custody" rule
Customers must know exactly when they can get their assets back. Section 9(1) requires the client agreement to document whether assets are redeemable on demand, subject to notice, or locked up, plus any minimum/maximum amounts, early-withdrawal penalties, and the circumstances in which withdrawals may be "delayed, gated, suspended or otherwise restricted."
Crucially, a lender cannot market its product as something safer than it is. Section 8(5) prohibits representing a lending arrangement "as withdrawable on demand, or as low-risk or equivalent to custody, unless that representation is accurate," and section 11(4) bars describing the arrangement as "custody" or "safekeeping" where assets are in fact exposed to lending counterparty risk. The client agreement must state clearly "that the relevant arrangement is not equivalent to custody or safekeeping" (section 7(3)(f)). This is the rule that protects customers from believing a yield product is a deposit.
Re-use of customer assets
Re-use — lending on, pledging, rehypothecation, staking or other deployment of customer assets — is the engine of most lending models and the source of most of their risk, so it is tightly controlled. Section 11(1) prohibits re-use "for the Licensee's own benefit or for third parties" unless it is permitted by law, the customer has given "explicit, prior, informed consent" within clearly defined limits, and the scope, risks, withdrawal implications and counterparties are set out in the client agreement.
Where re-use is permitted, section 11(2) requires the licensee to keep prior written consent, records of which assets are re-used and with whom, "additional risk management and, where required, capital or liquidity buffers," and clear documentation of the resulting customer exposure to counterparty, liquidity and market risk. Consent must be specific and informed — not buried in boilerplate.
Collateral Management
For collateralized lending, the collateral framework is central. Section 10 requires written policies on the acceptance, valuation, monitoring and liquidation of collateral, addressing eligible collateral types and concentration limits, valuation methodologies and haircuts, initial and variation margin triggers, liquidation processes and priority of proceeds, and governance over exceptions.
Section 10(4) defines what good collateral looks like: assets that are "liquid, readily realizable and capable of valuation using observable market data," which may include cash, high-quality short-term government securities, high-quality liquid fiat-referenced and asset-referenced tokens, and specified virtual assets with "deep and demonstrable liquidity," subject to haircuts. Where collateral is itself customer assets, section 10(3) requires the arrangement to be consistent with the safeguarding rules and, where relevant, the Custody license.
Counterparty due diligence and credit assessment
Lending to the wrong counterparty is the classic credit failure, so section 12 requires "comprehensive due diligence on Borrowers and lending counterparties on a periodic basis" — identity and beneficial ownership, the economic rationale of the arrangement, financial strength, liquidity and leverage, and market, concentration and country risk. Risk profiles must be updated when a counterparty's risk changes (section 12(2)), and these assessments must feed credit limits, collateral requirements, pricing and tenor limits (section 12(3)). A prudent lender's diligence file is exactly what PVARA will expect to see.
Liquidation, close-out and default management
When a borrower defaults or collateral falls, the licensee must act predictably. Section 14 requires documented policies on margin calls, liquidation events, close-out and enforcement of collateral that are "transparent, non-discriminatory, consistent with Client disclosures and reasonably designed to minimise disorderly liquidation and avoidable harm to Clients."
The procedures must cover triggers for margin calls and liquidation, notice where appropriate, methods for valuing collateral in stressed conditions, the priority and sequence of liquidation, and treatment of shortfalls and excess proceeds (section 14(3)). Section 14(4) bars reliance on "discretionary or opaque liquidation powers" inconsistent with the client agreement — the customer must be able to predict, from the contract, what happens when their position is at risk.
Product governance and target market
Lending products are not one-size-fits-all, and the Handbook requires a product-governance discipline before anything is offered. Section 6(1) prohibits offering a lending arrangement unless the licensee has assessed "the nature, legal character, risks, collateral profile, liquidity profile and operational dependencies" of the product and is satisfied it is consistent with the law, the regulations and its license. Section 6(2) requires identifying the target market for each material product type and ensuring it is "distributed only to those categories of Clients for whom it is appropriate."
There is also an anti-obfuscation rule. Section 6(3) prohibits designing, marketing or distributing a lending arrangement "in a manner that obscures the legal character of the arrangement, the use of Client Assets, the existence of lock-ups or notice periods, or the order in which losses may be borne." And products must be kept under review: section 6(4) requires the licensee to "suspend, restrict or withdraw" a product where it is no longer appropriate or presents material unmanaged risk. This converts product design from a marketing exercise into a governed, ongoing responsibility.
Risk management and stress-testing in depth
Because lending books fail in stress, the Handbook makes stress-testing explicit. Section 13(1) requires a risk-management framework covering credit risk (borrower default and counterparty failure), market risk (price volatility of lent assets and collateral), liquidity risk (ability to meet withdrawals and obligations), operational and technology risk, and "legal and enforceability risk, including Collateral realization and close-out risk."
Section 13(3) then requires periodic stress tests tailored to the portfolio, including "sharp market declines in Collateral and lent asset values," "concentrated Borrower defaults," "spikes in withdrawal demands," and combined scenarios of market, liquidity and counterparty stress. Results must be reported to the governing body and "used to adjust limits, Collateral requirements and contingency plans" (section 13(4)). In practice this is the discipline that would have flagged the liquidity time bombs inside several collapsed crypto lenders — a lender that cannot model concentrated defaults and a withdrawal run at the same time is not ready to operate.
Disclosures, agreements and reporting
Disclosure is heavy in this category because the risks are easy to hide. Section 7 requires clear disclosure of the nature and terms of the arrangement; whether it is pooled, bilateral, principal or agency-based; interest, fees and how they are calculated; collateral requirements, loan-to-value ratios, margin calls and liquidation triggers; withdrawal rights, notice periods, lock-ups and gates; and the risks of volatility, liquidity mismatch, counterparty default, re-use and liquidation.
Public disclosures under section 16 include the principal risks to customer assets, the use-of-funds policy (whether assets are on-lent and to what categories of counterparties), collateral policies, and material counterparty concentrations in aggregated form. Customers must receive at least monthly statements (section 15) showing holdings, transactions, interest, collateral and any liquidations or defaults. Record-keeping under section 17 must capture agreements, consents, collateral movements, margin calls and defaults.
A worked example: a collateralized lending product
Consider a firm offering crypto-backed loans: customers post BTC as collateral and borrow stablecoins. This is squarely a lending and borrowing activity (PKR 500 million).
The build must address each handbook pillar: a collateral policy with eligible assets, haircuts and loan-to-value limits; a margin and liquidation framework with clear, contract-disclosed triggers; asset-sufficiency monitoring so the firm can always meet drawdowns and returns; and counterparty due diligence on borrowers. If the firm also funds the loans by on-lending other customers' deposited assets, that re-use needs explicit consent, additional buffers, and disclosure that those depositors bear counterparty risk — and it must never be marketed as "custody." If the collateral is held by the firm, custody safeguarding is engaged; if the borrowed stablecoins are moved cross-border, the Transfer & Settlement license may also apply.
The lean path: scope the exact product, hold the categories its features require, and consider entering on a restricted license to prove the book before committing full capital.
Common Mistakes
- Running a maturity mismatch. A structural gap between obligations and available assets is prohibited (section 8(2)).
- Marketing yield products as deposits. Calling a lending arrangement "custody," "safekeeping" or "low-risk" when assets bear counterparty risk is prohibited.
- Re-using assets without specific consent. Re-use needs explicit, informed, limited consent plus buffers and disclosure.
- Opaque liquidation powers. Liquidation must follow clear, contract-disclosed, non-discriminatory rules.
- Weak collateral discipline. Illiquid collateral, thin haircuts or no concentration limits will fail supervision.
- Forgetting adjacent licenses. Holding collateral engages custody; cross-border movement engages transfer and settlement.
Get asset sufficiency, collateral discipline and honest disclosure right, and the lending license supports a serious credit business; get them wrong and you rebuild the failures that scarred the sector. To scope your product against the right categories, start with our PVARA licensing service.
Frequently asked questions
PKR 500 million (~$1.8 million) in minimum paid-up capital under Schedule I, held at all times. It is share capital inside your Pakistani company, not a fee, and may be reduced under a restricted license (Regulation 7(5)).
Only if accurate. The Handbook prohibits representing a lending arrangement as withdrawable on demand, low-risk or equivalent to custody unless that is true given the legal terms, liquidity profile and use of assets (section 8(5)).
Only with the customer's explicit, prior, informed consent within defined limits, full disclosure of risks and counterparties, and additional risk-management and buffers (section 11). It cannot be described as custody or safekeeping.
Liquid, readily realizable assets capable of prudent valuation — cash, high-quality short-term government securities, high-quality liquid fiat- or asset-referenced tokens, and deep-liquidity virtual assets, subject to haircuts (section 10(4)).
A lender must hold enough virtual assets and/or fiat to meet its obligations to customers when due and must not run a structural or persistent mismatch between obligations and available assets (section 8).
It can. Holding collateral or customer assets engages custody safeguarding; margin lending for leveraged trading interacts with derivatives and leverage; cross-border movement of borrowed assets can engage transfer and settlement.
Yes. Section 13 requires periodic stress tests covering sharp collateral declines, concentrated borrower defaults, withdrawal spikes and combined stress scenarios, with results reported to the board and used to adjust limits, collateral and contingency plans.
At least monthly under section 15, showing holdings, lending and borrowing transactions, interest accrued, collateral posted and required, margin calls, and any liquidations or defaults affecting the customer's positions.
Building a crypto lending business in Pakistan? CoinConnect designs the asset-sufficiency, collateral and liquidation framework PVARA expects, and assembles the lending and borrowing application. Book a free 30-minute discovery call →
A PVARA License You Can't Bank Is Worthless — Here's How CoinConnect Is Different
A crypto business with no PKR rail isn't a business. Yet most firms hand you a license and leave you to discover, months later, that no bank will open your account.
We work the other way around.
Others sell you a permit. We sell you a working account.
Banking is the real bottleneck in Pakistan, so we secure the account commitment before you sink capital into the license — and we deliver the whole stack around it: incorporation, tax, AML build, security audit, fiat rails, and the launch engine of PR, KOL, and community. One team, no hand-offs.
We don't sell you a license. We sell you a live, banked, compliant, growing business in Pakistan — and we don't take our full fee until you have one.
Across every route — NOC, Sandbox, No-Action Relief, or Full License — the dominant cost is recoverable paid-up capital under Schedule I, not a government fee, and the Regulatory Sandbox can reduce it while you test the market. We structure the path that gets you live for the least locked-up capital. (Figures are based on the draft 2026 regulations and confirmed at filing.)
Last reviewed: June 2026. Based on the draft Pakistan Virtual Asset Services Regulations, 2026 and the Lending and Borrowing Handbook, 2026, published for public consultation. Provisions are subject to change pending finalization.
External sources: PVARA · SECP · State Bank of Pakistan