Written by Malik Abbas, CEO of CoinConnect
TL;DR
- There is no single "PVARA license application." There are distinct entry routes, and choosing the wrong one wastes months and capital.
- The NOC (Regulation 6) lets you incorporate and prepare — it authorizes no service. The sandbox lets you test. The restricted license (Regulation 7(5)) lets you operate small on reduced capital. The full license (Regulation 7) lets you operate at scale.
- The no-action letter is a legacy comfort mechanism from PVARA's earlier guidelines — it is not named in the 2026 draft regulations, so treat it with care.
- Existing operators have a separate obligation: Regulation 5A gives them six months to apply or cease.
- Some firms may not need any route at all — the safe harbors in Regulation 3(5) can place a business outside the perimeter entirely.
Table of Contents
- Which PVARA route is right for you? (quick answer)
- First question: do you even need a route?
- The five routes at a glance
- Route 1: The NOC (Preliminary Approval)
- Route 2: The No-Action Letter (legacy — read the caveat)
- Route 3: The Regulatory Sandbox
- Route 4: The Restricted (Limited-Scope) License
- Route 5: The Full License
- The special case: existing operators (Regulation 5A)
- A decision framework: pick your route in five questions
- Common routing mistakes
- FAQ
Which PVARA route is right for you? (quick answer)
The right PVARA route depends on your stage and intent. Choose the NOC to incorporate and prepare, the regulatory sandbox to test a product under supervision, a restricted license under Regulation 7(5) to operate at limited scale on reduced capital, or the full license under Regulation 7 to operate at scale. Most foreign entrants progress through several of these in sequence rather than jumping straight to a full license.
This guide takes each route in turn, shows what it does and does not give you, and ends with a five-question framework to place your own business. It builds on our breakdowns of PVARA capital requirements and the sandbox and reduced-capital route.
Conversions use an indicative rate of PKR 278 = USD 1 (June 2026).
First question: do you even need a route?
Before choosing a door, confirm you need to walk through one at all. The regulations apply to anyone carrying on a virtual asset service "in" or "from" Pakistan (Regulation 3(1)) — but the draft also sets out safe harbors that can place a firm outside the perimeter.
Regulation 3(5) provides that an activity will not, by itself, be treated as carried on into Pakistan:
"solely because a website is accessible in Pakistan, where the Person: (a) does not market or solicit in Pakistan; (b) does not onboard Persons in Pakistan; (c) does not support PKR payment rails or Pakistan-targeted channels; and (d) takes reasonable steps to prevent onboarding where it does not intend to serve Persons in Pakistan."
So a global exchange that does not target Pakistani users, support PKR, or onboard residents may fall within the safe harbor. The moment you market to, onboard, or build PKR rails for Pakistani users, however, Regulation 3(4) pulls you squarely inside the perimeter — and you need a route.
The honest takeaway: if Pakistan is a real market for you, you need a route. If you merely happen to be accessible there, you may not — but document your safe-harbor position carefully, because the Authority can rebut it where it has "reasonable grounds, recorded in writing."
The five routes at a glance
| Route | Regulation | What it authorizes | Capital | Serves real customers? |
|---|---|---|---|---|
| NOC / Preliminary Approval | Reg 6 | Incorporate and prepare | None yet | No |
| No-Action Letter (legacy) | Earlier guidelines; preserved via Reg 5A(4) | Comfort that no enforcement will be taken for a defined activity | N/A | Conditionally |
| Regulatory Sandbox | Reg 7(6), 5A(4) | Supervised testing under caps | Reduced | Yes — tightly limited |
| Restricted License | Reg 7(5) | Operate at limited scale | Reduced, case by case | Yes — within caps |
| Full License | Reg 7, Sch I, Reg 9 | Operate at full scale | Full Schedule I figure | Yes — at scale |
Think of these as a ladder of commitment, from "permission to prepare" up to "permission to operate at scale." Let us climb it.
Route 1: The NOC (Preliminary Approval)
The NOC, or No-Objection Certificate, is the formal starting gate. Under Regulation 6(1), a firm intending to set up a Pakistani company to provide virtual asset services may apply for "a Preliminary Approval / No-Objection Certificate (NOC)."
What it is for: regulatory comfort to incorporate and begin building, before you sink cost into a full application. It is the lowest-risk first move.
What it is not: a license. Regulation 6(5)(a) is explicit that an NOC:
"does not constitute a License or authorization to carry on any Virtual Asset Service."
Timing and validity: PVARA must decide a complete NOC application within 60 days (Regulation 6(4)). Once granted, it is valid for three months, and under Regulation 6(6) may "be extended once for a further period not exceeding three (3) months." That is a finite window — you secure the NOC, then move promptly to incorporate and apply.
Best for: almost everyone serious about Pakistan. The NOC is usually the first rung, taken before the SECP incorporation step, regardless of which operating route you ultimately choose.
Route 2: The No-Action Letter (legacy — read the caveat)
This is the route that requires the most honesty, because the term is widely searched but its status has shifted.
A no-action letter is a written assurance from a regulator that it will not pursue enforcement against a specified party for a specified, defined activity — a comfort instrument used in many jurisdictions, and one that featured in PVARA's earlier sandbox-era guidelines.
The caveat: the 2026 draft Virtual Asset Services Regulations do not name a "no-action letter" mechanism. The defined routes are the NOC, the sandbox, the limited-scope license, and the full license. What the draft does do is preserve earlier instruments. Regulation 5A(4) states that any "guideline, direction, circular, approval, exemption, permission, sandbox arrangement, or other instrument" issued under the previous Virtual Assets Ordinance "shall, to the extent not inconsistent with the Act or these Regulations, continue in full force and effect."
So a no-action comfort granted under the old guidelines may survive — but it is not a forward-looking route you can rely on under the new regulations without checking its current standing directly with PVARA. Do not build a market-entry plan around a no-action letter on the assumption that it remains available. If regulatory comfort is what you need, the NOC is the live, codified equivalent. We track the current position and can confirm it for your specific case through our PVARA licensing service.
Route 3: The Regulatory Sandbox
The sandbox is the lightest live-market route — a supervised environment to test a real product with a limited set of real users.
It already operates in practice (via a Form I pathway preserved under Regulation 5A(4)), and we document the application end to end in our PVARA Sandbox Form I walkthrough.
Its defining feature is the absence of a guarantee. Regulation 7(6) states:
"Participation in a regulatory sandbox does not create an entitlement to a License. The Authority may, however, take into account testing outcomes and compliance history in assessing a subsequent License application."
Best for: novel or unproven models — DeFi, new stablecoin designs, tokenised assets — where you want regulatory clarity and a track record before committing to full compliance infrastructure. The full mechanics, caps and capital treatment are covered in our sandbox and reduced-capital guide.
Route 4: The Restricted (Limited-Scope) License
Where the sandbox is a test, the restricted license is a real, bounded license. Under Regulation 7(5):
"The Authority may grant a limited scope License where necessary to advance the primary objectives of the Act. The Authority shall specify the scope, duration, conditions, and exit criteria in such limited License."
Crucially, Schedule I allows this route to carry reduced minimum paid-up capital in exchange for "customer caps, product restrictions, and enhanced safeguards." It is the route for an operator who knows their model works and wants to enter Pakistan at controlled scale and cost.
Best for: established firms — payments and remittance businesses, exchanges, issuers — testing genuine demand without committing the full Schedule I capital on day one.
Route 5: The Full License
The full license is the destination: authorization to operate a category of virtual asset service at scale. It runs through Regulation 7, with capital set by Schedule I and the grant decision governed by Regulation 9(1), under which PVARA will either "grant a License … subject to such conditions" or "refuse the application, providing written reasons."
Timing: a complete application is decided within 90 days (Regulation 7(3)), extendable by up to 60 days for complex cases (Regulation 7(4)). Note "complete" — the clock starts only when PVARA confirms in writing that your file is satisfactory.
Best for: operators ready to launch at national scale immediately, for whom restricted caps would simply throttle a viable business. The realities that follow approval are mapped in our post-NOC operational playbook and the common Phase 2 compliance failures.
The special case: existing operators (Regulation 5A)
If you are already providing virtual asset services connected to Pakistan, none of the above is optional and the clock is already running. Regulation 5A(1) provides:
"Any Person providing Virtual Asset Services immediately before the commencement of the Act shall, within six (6) months of such commencement, apply to the Authority for a License under the Act or shall cease to provide such services."
The grace is conditional. Under Regulation 5A(2), an existing provider that files a complete application within those six months "may continue to provide its existing Virtual Asset Services pending the determination of the application" — but only if it complies with interim directives and core obligations, particularly customer-asset protection and AML/CFT. PVARA may also impose interim limitations under Regulation 5A(3).
The message for incumbents: a complete, timely application is itself your authorization to keep operating during review. Miss the window, and the route narrows to "cease."
A decision framework: pick your route in five questions
Work through these in order. The first "yes/applicable" usually points to your route.
- Are you actually inside the perimeter? If you do not target, onboard or build PKR rails for Pakistani users, check the Regulation 3(5) safe harbor first — you may need no route. If Pakistan is a real market, continue.
- Are you already operating with a Pakistan nexus? If yes, Regulation 5A applies — your priority is a complete license application within six months. Start now.
- Do you need to serve real customers yet, or just prepare? If you only need to incorporate and build, take the NOC. It is the universal first rung.
- Is your model proven elsewhere, or genuinely novel? Novel and needing regulatory clarity → sandbox. Proven and ready to operate small → restricted license.
- Can you commit full Schedule I capital and launch at scale today? If yes → full license. If not → enter via the restricted route and graduate.
For most foreign entrants the honest answer is a sequence: NOC → incorporate → sandbox or restricted license → full license. Each rung de-risks the next, and your conduct on the lower rungs becomes evidence in your favor higher up.
Common routing mistakes
- Mistaking the NOC for a license. It authorizes preparation, not service. Onboarding users on an NOC is operating unlicensed.
- Relying on a no-action letter under the new regime. It is a legacy instrument, not a codified 2026 route. Confirm its standing or use the NOC instead.
- Jumping straight to a full license when unproven. You commit full capital for a market you have not tested. The restricted route exists precisely to avoid this.
- Existing operators sitting still. The six-month Regulation 5A clock is unforgiving, and an incomplete application does not preserve your right to operate.
- Over-reading the safe harbor. Accessibility is fine; targeting, onboarding or PKR rails are not. Get this assessment wrong and you are operating unlicensed without realizing it.
Choosing the right route is the highest-leverage decision in your entire Pakistan entry — it sets your capital, your timeline and your risk. If you want it mapped against your specific model, start with the complete VASP licensing guide or the PVARA Guide hub.
Frequently asked questions
An NOC (Regulation 6) is preliminary approval to incorporate and prepare — Regulation 6(5)(a) confirms it "does not constitute a Licence or authorisation to carry on any Virtual Asset Service." A license (Regulation 7) authorizes you to actually provide the service. You typically obtain the NOC first, then apply for the license.
The no-action letter is a legacy comfort mechanism from PVARA's earlier guidelines. It is not named as a route in the 2026 draft regulations, though instruments issued under the previous Ordinance may continue under Regulation 5A(4). Confirm its current standing directly before relying on it; the NOC is the live codified equivalent.
An NOC is valid for three months from issuance and, under Regulation 6(6), may be extended once for a further period not exceeding three months. PVARA must decide a complete NOC application within 60 days.
To serve real customers quickly at limited scale, the sandbox or a restricted license under Regulation 7(5) is usually fastest. The NOC is faster still but authorizes only preparation, not service.
Regulation 5A requires existing providers to apply for a license within six months of the Act's commencement or cease. Filing a complete application within that window lets you keep operating during review, subject to interim conditions.
Possibly not. The Regulation 3(5) safe harbour means mere website accessibility — without marketing, onboarding or PKR rails into Pakistan — may fall outside the perimeter. Document your position, as PVARA can rebut it with recorded reasons.
Yes. The routes form a ladder, and Regulation 7(6) lets PVARA weigh your sandbox testing outcomes and compliance history in a later full-license assessment — though participation alone gives no entitlement.
Not sure which PVARA route fits your business? CoinConnect runs a route-selection assessment that places your model against the perimeter, the safe harbors and every entry option — so you commit capital to the right door, not the wrong one. Book a free 30-minute discovery call →
Last reviewed: June 2026. Based on the draft Pakistan Virtual Asset Services Regulations, 2026, published for public consultation. Provisions are subject to change pending finalization.
External sources: PVARA · SECP · State Bank of Pakistan · FATF – Pakistan