PVARA Management & Investment Services License: Crypto Asset Management in Pakistan (2026)

Written by Malik Abbas, CEO of CoinConnect

TL;DR

• The PVARA Management & Investment Services license authorizes managing or administering another person's virtual assets — discretionary or non-discretionary portfolio management, and staking on a customer's behalf — at PKR 200 million (~$720,000) capital.
• It is a fiduciary license: a discretionary manager must act in the customer's best interests with due skill, care and diligence, under a documented Mandate.
• Every customer relationship needs a written Mandate, a suitability or appropriateness assessment, and at least quarterly reporting.
• Using customer assets for staking, lending or leverage needs explicit prior consent and, where the activity falls in another category, the relevant additional license.
• Performance fees are allowed but must be fair, disclosed, and must not incentivize conduct against the customer's interests.

Table of Contents

1. What is the PVARA Management & Investment Services license?
2. Capital and eligibility requirements
3. The perimeter — what it covers and what it does not
4. Discretionary versus non-discretionary management
5. The Mandate: the heart of every relationship
6. Suitability, appropriateness and onboarding
7. The fiduciary duty and conflicts of interest
8. Using customer assets, staking and yield
9. Valuation, performance and reporting
10. Fees and performance fees
11. Risk management and due diligence
12. A worked example: a discretionary crypto fund
13. Model portfolios, execution and venue selection
14. Valuation discipline in thin markets
15. Common mistakes
16. FAQ

What is the PVARA Management & Investment Services license?

A PVARA Management & Investment Services license authorizes a company to act in a fiduciary or agency capacity managing or administering another person's virtual assets in Pakistan — including discretionary and non-discretionary portfolio management and staking on a customer's behalf. Defined in Regulation 4(1)(h) of the Virtual Asset Services Regulations, 2026, it requires PKR 200 million in minimum paid-up capital and is the asset-management category of the framework.

This is the deep dive on the management and investment category. For the full set of ten, see our PVARA license categories overview; for the big picture, the complete licensing guide.

Conversions use an indicative rate of PKR 278 = USD 1 (June 2026).

Capital and eligibility requirements

The management and investment license sits in the mid-tier of the Schedule I capital table: PKR 200 million (~$720,000) minimum paid-up capital, held "at all times" under Regulation 31(1). This is share capital inside your Pakistani company, not a fee — see the full capital breakdown.

On top of capital, applicants must satisfy the general eligibility bars: a Pakistani company (Regulation 5), a resident key individual with real authority (Regulation 10(4)), a resident compliance officer (Regulation 23), and fit-and-proper directors, controllers and a qualified CEO (Regulation 8, Schedule III). Because this is a fiduciary activity, PVARA will look closely at the competence and experience of the people making investment decisions.

If PKR 200 million is more than you wish to commit before proving demand, a reduced-capital, limited-scope license under Regulation 7(5) may be available, with customer and product caps.

The perimeter — what it covers and what it does not

Under Management and Investment Services Handbook section 3(2), a licensee may act in a fiduciary or agency capacity managing another person's virtual assets, carry out portfolio management for identified customers, provide discretionary or non-discretionary management, and operate a managed investment arrangement to the extent permitted by law. The Regulation 4(1)(h) definition expressly includes "responsibility for staking on behalf of Customers" where the staking is discretionary or forms part of a broader investment mandate.

What it does not do by itself is just as important. Section 3(3) provides that where a portfolio "includes derivatives, leverage, lending, liquidity provision, or other features requiring another License Category, the Licensee shall hold the relevant License Category." Managing a portfolio does not authorize you to run those underlying activities yourself — if your strategy uses leverage, you also need the Derivatives & Leverage license; if it lends customer assets, the Lending & Borrowing license.

Discretionary versus non-discretionary management

The Handbook draws a clear line between two service models, and the duty changes with it.

Discretionary Management (section 2(d)) is where the licensee makes investment decisions on the customer's behalf "without obtaining a separate instruction for each transaction." Here the fiduciary duty is at its highest: section 4(3) requires the licensee to "act in the best interests of Clients and exercise due skill, care and diligence."

Non-Discretionary Management (section 2(e)) is where the customer retains decision-making authority and the licensee acts on instructions or approvals. The licensee must still act fairly and professionally, but it executes the customer's choices rather than making them.

Your client agreement and Mandate must state clearly which model applies, because it determines who is responsible for each investment decision — and therefore where liability sits when a position moves against the customer.

The Mandate: the heart of every relationship

You cannot manage a customer's assets on a handshake. Section 9(1) prohibits providing management and investment services "unless a documented Mandate has been agreed with that Client." The Mandate is the governing document, and section 9(2) requires it to set out, at minimum: the customer's investment objectives, risk tolerance and time horizon; whether the service is discretionary or non-discretionary; the assets, strategies and protocols in scope; any restrictions on derivatives, leverage, staking, lending or unlisted tokens; concentration, liquidity and counterparty limits; the fee basis; and how the Mandate may be varied or terminated.

The Mandate also constrains the manager. Section 9(4) provides that the licensee "shall not depart materially from a Mandate" unless the departure is necessary to protect the customer in exceptional circumstances, is consistent with the agreement and law, and is documented and communicated. This is what stops a manager from drifting into riskier strategies than the customer signed up for.

Suitability, appropriateness and onboarding

Before taking on a customer, the licensee must assess fit. Section 7(1) requires processes to assess the suitability or appropriateness of the service "having regard to the Client's investment objectives, risk tolerance, financial circumstances, and knowledge and experience relating to Virtual Assets and relevant strategies."

Where a service is not suitable, section 7(2) requires the licensee either to warn the customer clearly or to decline to provide it. Information must be collected, kept up to date, and reviewed periodically — particularly when strategy, risk profile or the customer's circumstances change (section 7(4)). Records of these assessments must be retained (section 7(5)). For a manager serving retail customers in particular, this is a core conduct gate, not a tick-box.

The fiduciary duty and conflicts of interest

This license is built on a "client first" duty. Section 11(1) requires the licensee to "act honestly, fairly and professionally in accordance with the best interests of its Clients," and section 11(3) prohibits misuse of information about customers' portfolios, positions, strategies or orders, and bars proprietary or related-party dealing from improperly benefiting from knowledge of customer positions.

Conflicts are managed under section 12, which lists the conflicts that must be identified, managed and where necessary disclosed: simultaneously managing multiple customer portfolios; managing proprietary or related-party portfolios alongside customer portfolios; receiving fees or rebates from venues, counterparties, issuers or validators; allocating limited opportunities among customers; and holding interests in assets or protocols inside a customer portfolio. Where a material conflict cannot be managed, section 12(4) requires it to be "disclosed to the Client clearly and before the relevant action is taken." Inducements must never impair the duty to act in the customer's best interests.

Using customer assets, staking and yield

A management license is not blanket permission to deploy customer assets. Section 13(4) prohibits using, lending, staking, pledging or otherwise deploying customer assets except as required to implement an agreed Mandate, or where expressly permitted and supported by the customer's consent.

Where deployment — staking, lending, liquidity provision, leverage — requires consent, section 13(2) requires the licensee to obtain "explicit, prior and informed consent" and to disclose the activity, the risks, withdrawal restrictions, and how rewards and losses are allocated. There is a default in the customer's favor: under section 13(5), any rewards attributable to customer assets — gains, interest, airdrops, forks, staking rewards — "shall accrue to the Client unless otherwise agreed in advance." And where staking forms part of a Mandate, the Handbook requires the marketing to fairly describe slashing, lock-up, unbonding and liquidity risks (section 6(3)). If holding the assets amounts to ongoing custody, the Custody license is also engaged.

Valuation, performance and reporting

Customers must be able to see what is happening to their money. Section 15 requires reasonable, consistently applied valuation methodologies, using observable market prices where available and prudent alternatives where not — and prohibits valuation used "in a manner that materially misrepresents Portfolio value, performance, risk or fees."

Reporting is codified. Section 16(2) requires periodic reports "not less frequently than quarterly," covering portfolio performance, fees, composition and valuation, transactions, and material events — with more frequent reporting where the service involves higher-frequency trading, leverage, derivatives, liquidity risk or use of customer assets (section 16(3)). Performance measurement methodologies must be documented, consistently applied, and not presented misleadingly. Marketing cannot claim a service is "risk-free or capital-guaranteed" (section 6(2)).

Fees and performance fees

Fees are tightly governed because they come out of the customer's assets. Section 17(1) provides that no fee may be taken from assets under management unless the client agreement permits it and specifies how it is calculated, accrued and paid. New fees or increases require prior written notice to customers (section 17(2)).

Performance fees are permitted but disciplined. Section 17(4) requires them to be "structured and disclosed in a fair, clear and not misleading manner" and not to "incentivize conduct inconsistent with the best interests of Clients." In practice this means avoiding fee structures that reward a manager for taking outsized risk with someone else's portfolio.

Risk management and due diligence

Section 18 requires a risk-management framework covering market, liquidity, custody, counterparty, valuation, leverage and operational risk, with liquidity and market risk "monitored and tested regularly." Due diligence on the assets, venues, counterparties, validators and protocols used inside customer portfolios must be proportionate to the strategy and documented (section 18(3)), and the framework must be subject to periodic internal or external assurance (section 18(4)). For a manager allocating to DeFi protocols or staking validators, this protocol-level due diligence is a real, recurring obligation — not a one-time check.

A worked example: a discretionary crypto fund

Consider a firm launching a discretionary virtual asset fund for Pakistani professional clients. It needs the management and investment license (PKR 200 million) and must, for each customer, agree a Mandate, run a suitability assessment, and report at least quarterly.

The category stack depends on the strategy. If the fund stakes assets as part of the mandate, that is within this license — but needs explicit consent and fair disclosure of slashing and lock-up risk. If it uses leverage or derivatives, it also needs the Derivatives & Leverage license. If it holds the assets itself rather than placing them with a licensed custodian, it engages custody obligations. And if it lends portfolio assets for yield, that pulls in the Lending & Borrowing license.

The cleanest approach is to define the strategy first, map every feature to its category, and either acquire the additional licenses or constrain the Mandate to what the single license permits. Our foreign-entrant playbook sets out how to sequence a multi-category build.

Model portfolios, execution and venue selection

Managers running the same strategy across many customers typically use a Model Portfolio — defined in section 2(f) as a model, strategy or allocation framework used as the basis for managing one or more customer portfolios. Section 10(3) requires documented rules or methodologies for portfolio allocation, rebalancing, risk monitoring and any deviations from a Model Portfolio or strategy guideline. The discipline this enforces is consistency: customers in the same strategy should be treated alike, and departures must be recorded and justified.

Execution is also governed. Where a manager routes customer orders to a trading venue, broker-dealer or other intermediary, section 10(4) requires "prompt and proper transmission of those instructions" and controls over venue selection, execution quality and allocation fairness. Section 10(5) then sets a hard conflicts rule: the manager "shall not receive any remuneration, discount or other benefit for routing Client Orders to a particular trading platform or service provider unless that arrangement is disclosed in the Client Agreement, managed as a conflict of interest, and consistent with the Licensee's duty to act in the best interests of Clients." A manager that also routes to an affiliated exchange or broker must surface that relationship and prove customers are not disadvantaged — the same anti-self-dealing logic that runs through the broker-dealer rules.

Because the manager depends on the execution quality of the venues and intermediaries it selects, venue due diligence and periodic review become part of the fiduciary duty, not an operational afterthought. Section 11(2) lets the manager weigh price, costs, speed, likelihood of execution and settlement, transaction size, custody arrangements and liquidity when assessing the customer's best interests — but where the service is non-discretionary, it must follow the customer's specific instructions even where the manager would have chosen differently.

Valuation discipline in thin markets

Many virtual assets trade in shallow or fragmented markets, so valuation is a recurring risk, not a back-office formality. Section 15(2) requires the manager to use observable market prices where they are reliable and available. But where prices are "not readily observable, are materially unreliable, or do not reasonably reflect the value" of the asset or position, section 15(3) requires "prudent and consistently applied alternative valuation methodologies," with the basis documented.

The reason this matters is that valuation feeds four things at once: customer reporting, performance figures, fee calculation and risk management. A manager that marks an illiquid position optimistically can simultaneously overstate performance, overcharge a performance fee, and understate portfolio risk — which is exactly why section 15(5) prohibits valuation methodologies used "in a manner that materially misrepresents Portfolio value, performance, risk or fees." For any strategy holding long-tail tokens, a documented, conservative, consistently applied valuation policy is one of the first things a supervisor will test.

Common Mistakes

• Managing without a documented Mandate. Section 9 makes the Mandate a precondition, not paperwork to backfill.
• Drifting from the agreed strategy. Material departures from the Mandate are prohibited except in narrow, documented circumstances.
• Staking or lending customer assets without explicit consent. Consent and fair risk disclosure are mandatory, and other categories may be engaged.
• Skipping suitability assessments. The duty to assess and, where needed, warn or decline is a core conduct gate.
• Misleading performance presentation. Valuation and performance reporting cannot overstate returns or understate risk.
• Performance fees that reward risk-taking. Fee design must not cut against the customer's best interests.

Get the fiduciary framework and the Mandate discipline right, and the management and investment license supports a credible asset-management business; treat it loosely and you will fail conduct supervision. To scope your strategy against the right categories, start with our PVARA licensing service.

Launching a crypto asset-management business in Pakistan? CoinConnect maps your strategy to the right license stack, builds the Mandate and suitability framework, and assembles the application. Book a free 30-minute discovery call →

Why Exchanges Choose CoinConnect to Run Their PVARA Licensing

Most advisors build your application to pass. We build it to survive an attack.

Before PVARA ever opens your file, our review panel has one job: to reject it. We pen-test the application the way a regulator would — probing the AML framework, the corporate structure, the fit-and-proper packs, the custody and security design, and the capital math — and we don't file until the panel is out of objections.

We fail your application in private — so PVARA can't fail it in public.

It isn't easily copied. A red-team that thinks like the approval side needs a bench drawn from banking compliance, corporate law, forensic audit, and exchange operations — people who've sat on the other side of these decisions. Anyone can promise "A-to-Z." Almost no one can staff this.

We'll never promise you a regulator's signature — walk away from anyone who does. We promise something better: by the time your file reaches PVARA, every reason to say no is already dead.

Book a free scoping call: calendly.com/abbasmalikmuntazir/30min · WhatsApp +92-329-9552299 · Telegram @Abbas1101

Last reviewed: June 2026. Based on the draft Pakistan Virtual Asset Services Regulations, 2026 and the Management and Investment Services Handbook, 2026, published for public consultation. Provisions are subject to change pending finalization.

External sources: PVARA · SECP · State Bank of Pakistan