Written by Malik Abbas, CEO of CoinConnect
TL;DR
- A PVARA license is the mandatory authorization any business needs to provide a virtual asset service in or from Pakistan, issued by the Pakistan Virtual Asset Regulatory Authority under the Virtual Assets Act 2026.
- There are 10 license categories, each with its own minimum paid-up capital — from PKR 25 million (~$90,000) for advisory to PKR 1 billion (~$3.6 million) for an exchange.
- Foreign exchanges cannot hold the license offshore — they must incorporate in Pakistan, inject local capital, and appoint a resident decision-maker.
- The path runs NOC → incorporate → capital + banking → fit-and-proper board → license application (Form II) → AML setup → grant, with a 90-day decision on a complete file.
- Cautious entrants can start on reduced capital via the sandbox or a restricted license, then graduate — and these are draft regulations under consultation, so figures may still change.
Table of Contents
- What is a PVARA license?
- The Virtual Assets Act 2026: the law that created PVARA
- The 10 types of PVARA license (which one do you need?)
- PVARA license eligibility — the fit-and-proper test
- The PVARA licensing process: five phases
- PVARA license cost breakdown (2026)
- Required documentation checklist
- Common application mistakes that trigger rejection
- How Pakistan compares with Dubai and Hong Kong
- FAQ
- Where to go next
What is a PVARA license?
A PVARA license is the official authorization issued by the Pakistan Virtual Asset Regulatory Authority that permits a company to provide a virtual asset service in or from Pakistan. Created under the Virtual Assets Act 2026, it is mandatory for exchanges, custodians, brokers, token issuers and similar businesses. Operating without one is a regulatory offense.
That definition is the foundation; the rest of this guide is the detail every compliance officer, general counsel and country manager actually needs before committing resources to Pakistan.
Definition in plain English
Until recently, Pakistan had one of the world's largest crypto-using populations and almost no formal rules governing the businesses that served them. The Virtual Assets Act 2026 changed that. It established PVARA as a dedicated regulator and made a PVARA license Pakistan's first compulsory authorization for virtual asset service providers (VASPs).
The license is not a single, uniform permit. It is granted by category — your license names exactly which virtual asset services you may provide, and on what conditions. A custody license does not let you run an exchange; an advisory license does not let you issue a stablecoin. You are authorized for what you apply and qualify for, and nothing more.
Who needs a PVARA license
You need a PVARA license if you carry on a virtual asset service "in" or "from" Pakistan. Regulation 3(1) of the Virtual Asset Services Regulations, 2026 applies to any person who "carries on, or holds itself out as carrying on, a Virtual Asset Service" in or from the country, and Regulation 3(4) treats activity as carried on in Pakistan where it "targets, solicits, promotes to, or has a material connection to Persons in Pakistan."
There is a safe harbor for firms that are merely accessible but do not target Pakistan — we explain it fully in our PVARA routes guide. But if you intend to onboard Pakistani users, support PKR, or market locally, you are inside the perimeter and you need a license.
Currency conversions in this guide use an indicative rate of PKR 278 = USD 1 (June 2026).
The Virtual Assets Act 2026: the law that created PVARA
To understand the license, you have to understand the law behind it — and its recent evolution.
From Ordinance 2025 to Act 2026
Pakistan's framework arrived in two stages. It began as the Virtual Assets Ordinance 2025, an emergency instrument that first created the regulator and the licensing concept. That ordinance has since been placed on a permanent statutory footing as the Virtual Assets Act 2026. The draft Virtual Asset Services Regulations, 2026 — published for public consultation in mid-June 2026 — are made under that Act and supply the operational detail: categories, capital, process and conduct.
This is why you will still see older references to the "Ordinance 2025" across the web. The current, governing instrument is the Act 2026, and any guide that still treats the ordinance as the live law is out of date. (We are updating our own legacy references accordingly — see the PVARA Guide hub.)
What the Act and regulations actually do
The Act creates PVARA, defines virtual asset services, and sets the primary objectives the regulator must pursue — consumer protection, market integrity, financial stability and AML/CFT outcomes (section 9(1)). The regulations then build the licensing machine on top:
- Scope and categories (Regulations 3–4): who is caught, and the 10 license categories.
- Licensing (Regulations 5–11): eligibility, the NOC, the application, fit-and-proper, grant and ongoing obligations.
- Prudential rules (Regulations 31–36): capital, liquidity, reserves and add-ons.
- Governance, market conduct and technology (Regulations 18–74): how a licensee must actually run.
The Act also reserves specific matters to itself — for example, section 53 prohibits algorithmic tokens, and sections 31–33 govern token issuers and "significant issuers." The regulations repeatedly defer to these sections, which is why precise citation matters.
How PVARA replaced the informal market
Before the Act, foreign exchanges served Pakistani users from offshore, with no local license, no local capital and no local accountability. The Act ends that model. Regulation 5 requires a locally incorporated company, Regulation 31 requires local capital held at all times, and Regulation 10(4) requires a resident decision-maker. The informal, offshore-only approach is no longer lawful for anyone targeting Pakistan — a shift we examine in is crypto legal in Pakistan?.
Key differences from Dubai VARA and Hong Kong SFC
Executives benchmarking jurisdictions should note three contrasts:
- Localization is stricter. Pakistan has no offshore-recognition route; the license lives in a Pakistani company. Dubai's VARA and Hong Kong's SFC also require local presence, but Pakistan's "resident key individual with real decision-making authority" requirement is explicit and firm.
- Capital is broadly comparable at the top end — Pakistan's PKR 1 billion (~$3.6 million) exchange capital sits in the same range as established regimes, though Pakistan adds risk-based add-ons under Regulation 35.
- Maturity differs. VARA and the SFC are settled; Pakistan's rules are new and, at the time of writing, still in draft consultation. That means more flexibility and first-mover advantage — and more change to track.
The 10 types of PVARA license (which one do you need?)
Regulation 4(1) establishes ten license categories. Choosing the right one is the most consequential decision you will make, because it sets your capital, your obligations and your risk. Each category below shows its minimum paid-up capital from Schedule I.
| # | License category | What it covers | Min capital (PKR) | ~USD |
|---|---|---|---|---|
| 1 | Advisory | Personalized recommendations on virtual asset transactions | 25,000,000 | ~$90k |
| 2 | Broker-Dealer | Dealing/arranging trades as principal or agent | 100,000,000 | ~$360k |
| 3 | Exchange | Operating a trading venue, order book or matching system | 1,000,000,000 | ~$3.6M |
| 4 | Custody | Safeguarding customer assets and private keys | 200,000,000 | ~$720k |
| 5 | Transfer & Settlement | Transmitting/settling transfers (payments, remittance rails) | 200,000,000 | ~$720k |
| 6 | Lending & Borrowing | Lending, credit, margin and financing in virtual assets | 500,000,000 | ~$1.8M |
| 7 | Derivatives & Leverage | Derivatives and leveraged virtual asset products | 500,000,000 | ~$1.8M |
| 8 | Management & Investment | Discretionary management, portfolios, staking-as-a-service | 200,000,000 | ~$720k |
| 9 | Issuance — Fiat-Referenced Token (stablecoin) | Issuing fiat-pegged tokens | 1,000,000,000 | ~$3.6M |
| 10 | Issuance — Asset-Referenced Token (e.g. tokenized gold) | Issuing asset-backed tokens | 1,000,000,000 | ~$3.6M |
A few practical reads:
- Exchanges almost always need the Exchange license, often paired with Custody for integrated wallets. Plan for the combined capital and risk treatment under Regulation 31(2).
- Payments and remittance firms are frequently mis-sorted into the exchange tier when their activity is really Transfer & Settlement — a PKR 200 million category, not PKR 1 billion.
- Token issuers split into two issuance categories: fiat-referenced (stablecoins, governed by section 31 of the Act) and asset-referenced (e.g. tokenized gold, section 32). Both require PKR 1 billion plus a separate 100% reserve.
Two special cases sit outside the neat table. Mining is not, by itself, a licensable service — Regulation 4(10) and section 37(2) confirm that "pure Virtual Asset mining, by itself, shall not constitute a Virtual Asset Service requiring a License" — unless it involves customer assets. And derivatives are licensable only where the activity is not already regulated by SECP or SBP, with PVARA required to coordinate under section 5 of the Act.
For the full per-category capital analysis, see our dedicated guide to PVARA capital requirements.
PVARA license eligibility — the fit-and-proper test
A PVARA license is granted to companies and people. Even a perfectly capitalized applicant fails if its controllers, directors or CEO do not pass the fit-and-proper test. This section is the gating criteria — read it to self-qualify before you spend.
Directors and shareholders check
Under Regulation 8, PVARA assesses the fitness and propriety of controllers, directors, sponsors and the CEO. Regulation 8(2) requires the Authority to have regard to:
"(a) integrity, honesty and reputation; (b) competence, capability and relevant experience; (c) financial soundness; and (d) conflicts of interest and independence, where relevant to the role."
Schedule III turns this into hard bars. A person fails on integrity grounds if convicted of an offense involving moral turpitude, fraud or financial misconduct, or if subject to an ongoing investigation into financial crime. On financial soundness, the person must be an active taxpayer and not a loan defaulter on the State Bank's CIB report. These checks reach the Ultimate Beneficial Owners behind corporate shareholders too. We walk through the screening in our fit-and-proper / Form A3 guide.
Competence and the CEO bar
Schedule III sets specific experience thresholds. Directors need "management or business experience of at least five years at a senior level." The CEO must hold a relevant master's degree or recognized professional qualification (CFA, ICAP, ACCA, ICAEW, CPA, GARP) and have senior financial/technology experience including "at least two (2) years of experience in matters relating to blockchain technology, virtual assets, virtual asset services, or related domains." PVARA may interview the CEO to test suitability.
Minimum capital requirements
Eligibility also means capital. Regulation 31(1) requires the licensee to "at all times, maintain minimum paid-up capital in accordance with Schedule-I." This is share capital injected into your Pakistani company and held continuously — not a fee, and not a one-off. Token issuers carry the additional 100% reserve under Regulation 34. See the full capital breakdown.
Operational readiness and technical infrastructure
Finally, you must be able to run the business compliantly from day one. The regulations require, among much else: an independent compliance function and resident compliance officer (Regulation 23); segregation of duties (Regulation 26); a technology governance and cybersecurity framework (Regulations 58–59); secure key and wallet management (Regulation 61); and recovery and wind-down planning (Regulation 51). PVARA assesses these as part of the application — readiness is a gating criterion, not a post-license aspiration.
The PVARA licensing process: five phases
The journey from decision to launch runs in five phases. (For the foreign-entrant version with every sub-step, see our step-by-step entry playbook.)
Phase 1 — Preliminary approval (NOC)
Start with a No-Objection Certificate under Regulation 6 — preliminary approval to incorporate and proceed. PVARA decides a complete NOC application within 60 days (Regulation 6(4)), and the NOC is valid for three months, extendable once. Crucially, Regulation 6(5)(a) confirms it "does not constitute a License or authorization to carry on any Virtual Asset Service." It is permission to prepare, not to operate.
Phase 2 — Incorporation and capital
Incorporate a Pakistani company through SECP (Regulation 5 requires "a company incorporated under the Companies Act, 2017 … for the purpose of providing Virtual Asset Services"), then inject and verify your paid-up capital in a Pakistani bank account. Banking is the most common bottleneck — start it early. See our guides to SECP setup and crypto banking in Pakistan.
Phase 3 — Application submission (Form II)
Apply on Form II under Regulation 7(1) with the full document set. The decisive concept here is completeness. Regulation 7(2) provides:
"An application shall be treated as complete only when the Authority has confirmed, in writing, that all required information and documents have been received in a satisfactory form. Where the Authority requests further information, the time for deciding the application shall be suspended until the requested information is provided."
The decision clock does not start at submission — it starts when PVARA confirms your file is complete. This is why preparation, not filing, wins applications.
Phase 4 — Evaluation and fit-and-proper
PVARA evaluates the complete application within 90 days (Regulation 7(3)), extendable by up to 60 days for complex or novel cases (Regulation 7(4)). During this phase it conducts the fit-and-proper assessment, may interview the CEO, and may request further information (pausing the clock each time).
Phase 5 — Grant, conditions and launch
At the end, Regulation 9(1) requires PVARA to either grant the license "subject to such conditions, limitations, and requirements as the Authority considers necessary" or refuse it with written reasons. On grant, you may operate within your license scope — and your ongoing obligations begin immediately. The operating reality is mapped in our post-NOC operational playbook and the common Phase 2 compliance failures.
A lean alternative: instead of going straight to a full license, novel or cautious entrants can test on reduced capital via the regulatory sandbox or a restricted license under Regulation 7(5), then graduate — explained in full in our sandbox and reduced-capital guide.
PVARA license cost breakdown (2026)
Cost is the question every board asks, so here is the honest, itemized picture.
Application and licensing fees
Regulation 7(1) references a "non-refundable processing fee set out in Schedule II," and Regulation 11 covers processing, licensing, annual supervisory and renewal fees. However, as of June 2026, the draft does not publish the actual fee figures — Schedule II is not yet quantified. Treat any specific fee number you see elsewhere as an estimate, not a published rate. PVARA has, to date, not published a fixed application fee.
Capital deposit (the largest line)
By far the biggest number is paid-up capital — from PKR 25 million ($90,000) to PKR 1 billion ($3.6 million) depending on category. This is not "spent"; it is equity held inside your own company. But it must genuinely be injected, verified in a Pakistani bank account, and maintained "at all times."
Reserves and prudential add-ons
Token issuers must hold a separate 100% segregated reserve (Regulation 34) on top of capital. All licensees must hold liquid financial resources (Regulation 32), and PVARA may impose risk-based capital add-ons under Regulation 35(4), having regard to size, complexity and cross-border exposure.
Indirect costs
Budget realistically for the surrounding professional costs: SECP incorporation, legal and regulatory advisory, independent audit, technology and cybersecurity build, AML/CFT systems (including FMU goAML and Travel Rule tooling), insurance (Regulation 36), and ongoing compliance staffing.
One Pakistan-specific consideration worth flagging: Shariah compatibility. The draft regulations do not impose a Shariah-compliance condition as a license requirement, but Pakistan's broader financial-law environment makes Shariah structuring a practical commercial consideration for some products. Treat it as market diligence, not a cited regulatory gate.
For tax exposure on top of all this, see our guide to crypto tax in Pakistan and our tax and banking service.
Required documentation checklist
Documentation is where applications are most often delayed, because an incomplete file freezes the 90-day clock (Regulation 7(2)). Compiled from the regulations and Form II, a complete application typically requires:
Corporate and ownership
- Certificate of incorporation (SECP) and constitutive documents
- Group structure chart and ownership/voting chain (Regulation 18)
- Ultimate Beneficial Owner disclosures
- Change-of-control and shareholding details
Capital and financial
5. Evidence of paid-up capital injected and held in a Pakistani bank account
6. Capital and liquidity attestation (Regulations 31–32, Schedule I)
7. Reserve arrangements for token issuers (Regulation 34)
8. Audited/financial statements per the Companies Act, 2017
People (fit-and-proper)
9. Fit-and-proper packs for each controller, director and the CEO (Schedule III)
10. Evidence of CEO and director qualifications and experience
11. Appointment of a resident key individual with decision-making authority (Regulation 10(4))
12. Appointment of a resident compliance officer (Regulation 23)
Governance and risk
13. Business plan and detailed activity description
14. Governance, risk management and internal control framework
15. Conflicts-of-interest policy and register (Regulation 27)
16. Recovery and wind-down plan (Regulation 51)
AML/CFT
17. AML/CFT/CPF program and policies
18. FMU goAML registration and Travel Rule arrangements
19. KYC/CDD, sanctions screening and transaction-monitoring procedures
Technology
20. Technology governance and cybersecurity policy (Regulations 58–59)
21. Key and wallet management procedures (Regulation 61)
22. Business continuity and disaster recovery plan (Regulation 65)
Customer-facing
23. Client agreement template and risk disclosures (Regulations 52, 54)
This is the file our PVARA licensing service assembles to "complete" status before submission, so the clock starts on the first pass.
Common application mistakes that trigger rejection
The avoidable failures cluster in predictable places:
- Filing incomplete. The single most common error. An incomplete Form II does not start the clock — it freezes it indefinitely (Regulation 7(2)).
- Misclassifying the activity. Applying for an exchange license when the real activity is Transfer & Settlement or Broker-Dealer — over-capitalizing by millions, or applying for the wrong obligations entirely.
- Weak fit-and-proper packs. Gaps in UBO disclosure, an under-qualified CEO, or an undisclosed regulatory investigation. Schedule III bars are firm.
- Figurehead resident director. Regulation 10(4) requires real decision-making authority and accountability, not a nominee — see our resident director guide.
- Treating capital as a fee. Letting capital fall after injection breaches the "at all times" rule and can trigger suspension (Regulation 13).
- Leaving banking and AML to the end. Both take longer than expected and gate everything else.
- Relying on stale law. Building a plan around the "Ordinance 2025" or an old no-action letter rather than the Act 2026 and its current regulations.
How Pakistan compares with Dubai and Hong Kong
For a final strategic frame: Pakistan's regime is newer, broadly comparable on top-end capital, and stricter on localization than the offshore-friendly past, but it offers something the mature hubs cannot — a large, under-served domestic user base entering formal regulation for the first time, at a far lower operating cost, with first-mover advantage for the firms that license early. Pakistan is an emerging crypto market, and the operators who establish themselves now will define it. The trade-off is regulatory youth: these are draft rules under consultation, so the framework will keep moving where Dubai's VARA and Hong Kong's SFC are settled.
Frequently asked questions
PVARA must decide a complete license application within 90 working days, extendable by up to 60 (Regulation 7). Including incorporation, capital, banking and preparation, a realistic end-to-end timeline is roughly 6–12 months, depending on applicant readiness and banking.
The largest cost is minimum paid-up capital — PKR 25 million ($90,000) to PKR 1 billion ($3.6 million) by category — which is equity held in your own company, not a fee. As of June 2026 PVARA has not published a fixed application fee; Schedule II is not yet quantified. Budget separately for legal, audit, technology and AML costs.
Yes, but not offshore. Regulation 5 requires a company incorporated in Pakistan, with local capital and a resident key individual. A foreign exchange must operate through a Pakistani subsidiary that holds the license and satisfies the fit-and-proper test at director and UBO level.
SECP regulates companies and capital markets generally and handles your incorporation. PVARA is the dedicated regulator for virtual asset service providers under the Virtual Assets Act 2026. Most crypto businesses need both — SECP to incorporate, PVARA to be licensed to operate.
Operating a virtual asset service in or from Pakistan without a license is a regulatory offense. PVARA can impose administrative sanctions under section 59 of the Act — including penalties, cease directions and license bans — and coordinates with SBP and FMU, which can affect banking access.
Ten, under Regulation 4 — advisory, broker-dealer, exchange, custody, transfer and settlement, lending and borrowing, derivatives and leverage, management and investment, and two issuance categories (fiat-referenced and asset-referenced tokens). Your license names exactly which you may provide.
Yes. A regulatory sandbox or a restricted (limited-scope) license under Regulation 7(5) lets you operate on reduced capital under customer and product caps, then graduate to a full license. Your conduct on the restricted route counts in your favor at the full-license stage.
Not yet. The Virtual Asset Services Regulations, 2026 were published in draft for public consultation in June 2026. The categories, capital figures and processes could change before finalization, so always confirm the current position before committing capital.
Where to go next
This guide is the map; each leg has its own detailed route:
- Capital figures, per category → PVARA capital requirements
- Entering lean on reduced capital → PVARA sandbox & reduced capital
- Choosing your entry route → Sandbox vs NOC vs full license
- The foreign-entrant playbook → How a foreign exchange enters Pakistan
- Our four service pillars → CoinConnect services
Ready to start your PVARA license Pakistan application? CoinConnect maps your business model to the right license category and assembles a complete application — so your file lands ready, not returned. Book a free 30-minute discovery call →
Last reviewed: June 2026. Based on the Virtual Assets Act 2026 and the draft Pakistan Virtual Asset Services Regulations, 2026, published for public consultation. Provisions are subject to change pending finalization.
External sources: PVARA · SECP · State Bank of Pakistan · FATF – Pakistan