PVARA Sandbox Form I — Complete Walkthrough: How to Apply for Pakistan's Virtual Asset Regulatory Sandbox in 2026

​● ~13 min read   ●  ~4,500 words   ●  Author: Malik  Abbas, CEO CoinConnect

The Sandbox is structured as a five-stage pathway from initial contact to exit. Understanding the full sequence before you draft a single page of Form I prevents the most common scoping error — preparing for the application stage without preparing for the testing-phase obligations that follow.

The Application stage is what Form I covers. Everything from Stage 2 onward is governed by the supervisory agreement, the undertaking, and the Authority's discretion as exercised under the Ordinance.

Form I is divided into six sections, A through F. Sections A through E are content sections you must complete; Section F is PVARA's declared evaluation framework — the criteria your A-through-E content will be judged against. Each row in Sections A through E specifies what to describe, the expected format, and whether attachments are mandatory.

The mistake most first-time applicants make is treating Form I as a form to fill in. It is not. It is a set of mini-reports stitched together. Section A alone — the Innovation / VASP Proposition — typically runs to 25-40 pages of substantive content with five attachments. Treat each row as a deliverable in its own right.

This is the heart of the application. PVARA reviewers form their first impression of viability from this section, and a weak Section A is rarely rescued by strong Sections B-E. Five rows must be completed; all five require attachments.

On A1 specifically: PVARA evaluates novelty through a multi-factor lens — novelty of model, harnessing of technology, differentiation, and inclusion impact. A 600-word summary that hits all four factors will outperform a 1,000-word summary that emphasises only one.

On A3 (cybersecurity): the Guidelines and the Annexure A self-assessment together signal that this is a heavily-scrutinised area. Generic mentions of 'industry-standard encryption' will not pass. Reviewers expect named ciphers, named key management approaches (HSM-based, MPC, multi-sig), named audit firms or audit reports, and a specific incident response playbook with stated RTO/RPO targets.

Section B asks: are you actually ready to switch this on? Five sub-sections cover the dimensions of readiness PVARA cares about.

Two practical points on Section B: First, B1's 'yes/no' format is misleading — PVARA wants the yes/no plus the short description, not a checkbox. Second, B5 is the only Section B row requiring attachment, and only when applicable; it triggers if you are issuing or offering a specific virtual asset product as part of the test (a token, a stablecoin, a structured product).
 
Pure service offerings without a product wrapper may legitimately mark B5 as not applicable.

Three rows. All three require attachments. This is the section first-time applicants under-invest in, and it is the section where reviewers most consistently flag weakness.

PVARA's logic on Exit: the Sandbox is a temporary status. Every applicant must be able to articulate, on Day 1, the conditions under which the test will end and what happens to user funds and operations on that day. An applicant who cannot describe their wind-down with the same precision as their go-live is not yet ready for the Sandbox.

Three rows establishing the credibility of the applicant entity and its team.

On D1: list named individuals with roles, qualifications, and relevant prior experience. CVs should be referenced even if not formally attached. On D3: prior independent security audits — even if unrelated to the current product — are a credibility signal worth including.

Three rows. All three require attachments. This section is administrative but unforgiving — incorrect or missing information here will trip the completeness screen.

If the applicant is not a local company, the Guidelines explicitly require that the company be incorporated locally and provide evidence of tax registration with local tax authorities — once Sandbox approval is granted. In practice, this means foreign exchanges should plan their Pakistan entity formation in parallel with Form I drafting, not after.

Section F is not content you write. It is PVARA's declared assessment framework — the criteria your A-through-E content will be measured against. The Guidelines list six criteria:

— Level of Innovation and Market Relevance

— Strength of Technology and Cybersecurity Measures

— Compliance with Regulatory and Legal Requirements

— Operational Capacity and Readiness for Testing

— Safeguards for User Protection and Consumer Trust

— Clarity of Exit and Transition Strategy

Use Section F as a self-edit checklist. Before submission, walk every page of your Form I against these six criteria and ask: which criterion does this page advance? If a page advances none, cut it.

The Self-Assessment is mandatory and submitted alongside Form I. PVARA structures it as eight key questions, each with stated Positive Indicators and Negative Indicators. The Authority uses your self-assessment as a calibration check: applicants who score themselves as strong in areas where the Form I content is weak immediately lose credibility.

Treat the Self-Assessment as a pre-mortem, not a pitch. Where you have a weakness, name it and describe the remediation plan. Reviewers respect honest self-assessment far more than aspirational self-rating.

Question 7 is the one applicants most often misjudge. PVARA is asking: do you actually need a Sandbox, or could you answer your open questions without one? Applicants whose product is ready for full licensing, with no novel regulatory question to resolve, may be redirected toward the NOC and full-license path instead. The Sandbox is not a soft-launch program; it is a regulatory-experimentation program.

On approval, the Participant submits a sworn undertaking in the format prescribed in Annexure B of the Guidelines. This is not a generic boilerplate — it is a specific, irrevocable set of obligations that govern your conduct inside the Sandbox. Founders who view it as 'sign and forget' typically get caught out at the first compliance review.

The undertaking spans more than two dozen distinct obligations. The most operationally significant ones — the obligations that change how your team must work day-to-day — are:

Operational scope: operate strictly within parameters set by the Authority; adhere to all applicable laws, rules, and regulations in Pakistan.

Reporting obligations: submit information and progress reports — signed by a competent authority designated by the CEO — in the agreed format and at agreed timelines during testing.

Access rights: allow PVARA complete access to core reporting, accounting, and significant software systems; maintain proper records reviewable at any time.

Incident notification: notify PVARA within one hour of any material incident, risk event, or compliance breach, including the extent of the breach and the remediation undertaken.

Incident reporting: submit a detailed incident report within 48 hours, outlining the nature and scope of the incident, containment and resolution steps, and measures to prevent recurrence.

Insurance: obtain insurance coverage to indemnify clients against losses incurred as a result of fraud or gross negligence.

Confidentiality and data protection: keep confidential any proprietary or sensitive information shared, except as required by law; comply with applicable data protection laws governing collection, processing, storage, and sharing of consumer data.

Consumer rights: ensure Test Users have the right to access, correct, or request deletion of their personal data at any time.

Tax obligations: fulfil all tax obligations, maintain complete financial records as required by law, and not engage in or facilitate tax evasion. Allow PVARA to validate transactions and trace flow of funds.

Record retention: retain all transaction records and maintain proper books of account for a period of seven years.

Termination consent: acknowledge that PVARA may terminate participation with 15 days' written notice — or immediately on breach of testing plan, expected negative consequences for consumers or financial stability, failure to provide requested information, or public-interest grounds.

Dispute resolution: resolve disputes in good faith; unresolved disputes are referred to a competent court in Pakistan. The Authority's decision is final.

Post-Sandbox commitment: if the product or service is deemed successful, rollout is subject to license or approval by PVARA and compliance with all regulatory requirements.

Indemnity: indemnify and hold PVARA harmless from any claims arising from participation; PVARA may impose terms and limits of liability as it determines appropriate.

The one-hour clause is the one to plan for now
The undertaking requires notification of any material incident, risk event, or compliance breach within ONE HOUR of identification. This is shorter than most jurisdictions globally. Your incident-response runbook, on-call rota, escalation tree, and PVARA contact protocol must all be production-ready before Day 1 of testing — not built reactively after the first incident.

Per the Sandbox Guidelines, Applicants submit:

— Form I in the format specified in the Guidelines, with all required attachments.

— Annexure A self-assessment completed alongside the application.

— Application fee if and as prescribed by the Authority.

PVARA operates the Sandbox on an Agile Approach: applicants may submit at any time during the year. There is no fixed application window. There is also no fixed cohort cycle — each application is processed on its own merits.

Per PVARA's communications, Sandbox applications are submitted directly to sandbox@pvara.gov.pk. Applicants are encouraged to engage early with the Authority before submission to refine their proposal and understand regulatory expectations. Founders should treat early-engagement contact as a meaningful step, not optional courtesy — it is one of the few opportunities to test scoping assumptions before committing them to the formal application.

If your application is incomplete, PVARA returns it with a request for revisions. The Guidelines permit up to TWO resubmissions. After the second incomplete return, you have exhausted your slots. This is the single strongest argument for over-investing in the first submission — burn one slot on a half-complete file and you have one shot left.

9. The 60-Day Assessment Timeline — What Actually Happens

The Sandbox Guidelines specify the assessment timeline precisely:

"The comprehensive evaluation must be completed within sixty (60) working days from the conclusion of the initial screening unless the Authority determines that there is reasonable cause to extend timeline."

In practice, the 60-day clock has three things to know:

— It runs in working days, not calendar days. Sixty working days is approximately 12 weeks or roughly three calendar months once weekends and public holidays are excluded.

— The clock starts at 'conclusion of initial screening,' not at submission. Initial screening is the completeness check. Time spent in resubmission cycles does not count against the 60 days. Plan accordingly.

— PVARA may extend on reasonable cause. Where the Authority requests additional information, awaits input from another regulator, or escalates to specialised review, the timeline can extend. Treat 60 working days as a target, not a guarantee.

After detailed assessment and evaluation, the Authority issues a Letter of Approval (LoA) to successful applicants, subject to the terms and conditions approved. The LoA is what unlocks the Onboarding stage and the right to submit the undertaking and begin testing.


10. Key Evaluation Criteria — How PVARA Decides

PVARA's Key Evaluation Criteria, set out in the Guidelines, cover five domains. Each domain has multiple sub-factors. The Authority does not publish weights — but the structure tells you what reviewers are trained to look for.

Innovation and Market Impact

— Novelty of the model — a product, service, or business model not currently offered in the market.
— Harnessing technology — a new application of existing technology, or a completely new, ground-breaking technology.
— Differentiation — significant departure from or improvement on existing offerings, addressing real market inefficiencies.
— Inclusion — innovation that helps transition a largely informal, high-risk market into a formalised, regulated, safe ecosystem and an important pillar of the economy.

Risk Management and Compliance

— Review of systemic, operational, and ML/TF/PF risks.
— Evaluation of cybersecurity, data protection, and consumer protection frameworks.
— Consultation with Shariah advisors where applicable.

Feasibility and Exit Strategy

— Technical and operational readiness, including team expertise.
— Clear testing parameters.
— Exit plans — winding down if unsuccessful or transitioning to licensing if successful.
— The Authority may impose limits on transaction volumes, user numbers, or exposure on a case-by-case basis.

Financial Strength

Demonstration of financial capacity to undertake the proposed business model. The Guidelines do not prescribe a fixed paid-up capital figure for Sandbox entry — Financial Strength is assessed against the scope of the proposed test, not against a uniform threshold. Applicants proposing custody of customer assets or stablecoin issuance should expect heavier scrutiny than those proposing pure software-layer experiments.

Tax Law Compliance

If the applicant is based in Pakistan, demonstrated compliance with applicable tax laws is a criterion. Foreign applicants will, on approval, be required to incorporate locally and register with tax authorities — at which point this criterion attaches.


Not sure your Sandbox application can pass the screening test?

CoinConnect's PVARA Readiness Diagnostic walks your specific product through every gate, every Form I row, and every Annexure A indicator — and tells you exactly where the application would fail today and what to fix before submission. Fixed fee, two-week turnaround, 20-25 page written report. Book a 30-minute scoping call: calendly.com/abbasmalikmuntazir/30min

11. Testing Phase — Operating Inside the Sandbox

Approval is the start, not the finish. Once the LoA is issued and the undertaking is signed, you enter the Testing / Experimentation phase. The Guidelines set four governing rules for this phase:
— Operate in compliance. The approved Participant operates in the Sandbox environment for the approved period and in compliance with the Ordinance.
— Report on the agreed cadence. Reports are submitted in the content, format, and frequency mutually agreed between the Participant and the Authority before testing commences. Negotiate this carefully — over-broad reporting commitments are difficult to roll back later.
— Request extensions before they are needed. If the Participant encounters unexpected technical or business difficulty beyond their control, an extension request must be submitted at least two weeks prior to the expiry of the relevant time period — not after.
— Notify on impairment. If unforeseen circumstances impair the ability to commence or complete testing, the Authority must be informed promptly and will advise the appropriate course of action.

Operational caps — user numbers, transaction volumes, exposure limits — are imposed in the LoA on a case-by-case basis. Plan your test infrastructure to enforce these caps technically, not just procedurally. Reviewers will ask how the cap is enforced; 'we monitor it manually' is not a satisfactory answer.

12. Completion Report and Exit — Three Possible Outcomes

Within two weeks of the close of the testing period, the Participant must submit a Completion Report to the Authority. The Guidelines specify the report's required contents:
The overall results and statistics of the testing.

An objective assessment of the potential impact of the solution if scaled — including (a) a comparison of results with objectives defined at inception, (b) the scope of scaling out to a larger audience in case of success, and (c) how the Participant will fully comply with relevant legal and regulatory requirements.

The Authority then analyses the testing results and the Completion Report at the Exit Stage and determines the future course of action. Under VAO 2025 §44(3), three outcomes are possible:

Outcome	Trigger	Next Step
1. Transition to full licensing	Test results are successful; product/service meets requirements.	Apply for full VASP license; subject to license/approval by the Authority and compliance with regulatory requirements as issued from time to time.
2. Discontinue the service	Test is unsuccessful or wind-down conditions are triggered.	Cease all Sandbox activities; execute exit plan; return user assets per Section C of Form I.
3. Other steps as directed	Authority determines a hybrid path is appropriate.	Comply with the specific direction issued by the Authority — may include an extended observation period, scope reduction, or interim approval pending regulatory amendments.

The third path — "other steps as directed" — is worth understanding. The undertaking acknowledges that where deployment depends on regulatory changes, the Authority may allow continued provision of the service under specific terms and conditions until necessary regulatory amendments are adopted. This is the closest the Pakistan framework gets to a long-tail bridge for products that work in testing but await rulebook publication.

13. No-Action Relief — What It Is and What It Isn't

Under Section 45 of the Ordinance, the Authority may issue a no-action letter to a Participant, stating that PVARA does not intend to take enforcement action in respect of specified conduct for the duration of the test period.

Two qualifications matter:

It is not legal immunity. The Guidelines are explicit: "the issuance of a no-action letter shall not constitute a legal immunity." Civil claims, third-party actions, and consumer disputes remain available against the Participant. The letter is a statement of regulatory intent, not a shield against private liability.

It can be withdrawn. The Authority reserves the right to withdraw the letter at any time by providing written notice. A no-action letter is not a permanent allocation; it is a revocable accommodation.
Founders considering a Sandbox path partly because of the no-action shield should calibrate expectations accordingly. The letter is useful — it provides regulatory comfort to banking partners, investors, and counterparties — but it does not relieve operational risk.

14. Suspension and Revocation — When PVARA Pulls the Plug

At any stage, where the Authority has possible reasons to believe the Participant has failed to adhere to agreed details or imposed conditions, two enforcement mechanisms are available:

Temporary suspension. The Authority can temporarily suspend the testing and approval until the matter is fully clarified. Operationally, this means a stop-work directive — testing halts, customers may need to be notified depending on scope, and remediation must be evidenced before resumption.

Complete withdrawal with public notice. The Authority can completely withdraw the approval, accompanied by a public notice, where serious discrepancy has been observed related to consumer detriment or any other serious matter. Public notice is the reputational consequence — it is not redacted, and it travels.

In addition, the undertaking allows PVARA to terminate participation with 15 days' written notice for any reason, or immediately for breach of the testing plan, expected negative consequences to consumers or financial stability, failure to provide requested information, or public-interest grounds.

15. Common Mistakes That Get Sandbox Applications Rejected

Drawing strictly from the Guidelines' stated criteria, indicators, and required content, the seven most common failure modes for first-time Form I submissions are:

1. Treating the Sandbox as a soft-launch instead of a regulatory experiment

Applicants whose product is fully ready and raises no novel regulatory question are flagged at Annexure A Question 7. The Sandbox exists to resolve regulatory or market questions through live testing — not to provide a slower path to operations. If your product belongs in the NOC and full-license track, file there; the Sandbox slot is for a different category of applicant.

2. Generic or imported AML/KYC frameworks

Annexure A Question 8 and Section A4 both probe ML/TF preparedness specifically. Frameworks copied from another jurisdiction without adaptation to Pakistan's FATF context, the local AML laws, and PVARA's reporting expectations consistently score in the Negative Indicators column.

3. Vague cybersecurity narrative

Section A3 asks for a threat model, named security controls, key management approach, incident response playbook, and disaster recovery — backed by attachments. 'Industry-standard encryption' as the entire technical answer fails the gate. Reviewers expect named ciphers, named approaches, named auditors, and stated targets.

4. Weak or missing Exit / Wind-down plan

Section C is where reviewers most reliably find applicants under-prepared. A complete C1 should describe trigger conditions, the wind-down sequence (in days), the customer notification path, and the asset-return mechanism. C2 should map the bridge from Sandbox graduation to full license filing — not aspirations, sequence.

5. Fit-and-proper gaps in named individuals

A single director, sponsor shareholder, controller, or key management person with unresolved regulatory history fails the eligibility gate. Pre-flight every named individual against the three negative-history categories — fraud/financial crime/misconduct, prior regulatory breaches or designated-person status, unresolved bankruptcy or insolvency — before drafting Section D.

6. No genuine need-for-Sandbox argument

Annexure A Question 7 is binary in PVARA's eyes: either you require regulatory flexibility to test novel mechanisms, or you do not. Applicants who cannot articulate the specific regulatory or market question their test will answer should expect to be redirected — or rejected — at the substantive evaluation stage.

7. Misalignment between Self-Assessment and Form I content

PVARA reads Annexure A as a calibration document. If your self-assessment scores Strong on cybersecurity but Section A3 contains a one-paragraph narrative with no attachments, the contradiction is visible. Calibrate the self-assessment honestly against the actual content of Form I.

16. Sandbox vs NOC vs Full License — Which Path Is Right?

As of 2026, PVARA's licensing portal is accepting NOC applications. Per PVARA's official communications, full VASP licensing is forthcoming, and the Sandbox runs alongside as an alternative entry point for applicants whose value proposition rests on testing novel products or mechanisms.
In practice, the choice between paths is driven by three factors: novelty of your product, urgency of go-live, and the specific regulatory question you need answered.

Path	Suits You If	Does Not Suit You If
Sandbox (Form I)	Your product is genuinely novel; you need regulatory flexibility to test a mechanism that current rules do not cleanly cover; you can operate within imposed user/volume caps; you accept 1-hour incident notification and intensive reporting.	Your product is conventional spot trading or established custody; you need to operate at scale immediately; you cannot accept user/volume caps.
NOC + Full License	You operate an established, conventional virtual asset business; you have global compliance precedent; you need to scale without operational caps after license grant; you have capital ready.	Your product is novel and the rulebook does not yet cover it; you want to validate market and regulatory fit before committing to full capital.
Both (Sandbox first, then full license)	You want regulator-relationship-building during a structured test phase; you accept 6-12 months of capped operations as a step toward full license; you value the no-action letter as interim regulatory comfort.	You have a 90-day go-live commitment to your board; you cannot afford the dual-track time investment.

For most global exchanges entering Pakistan with a conventional product (spot trading, custody, transfer services), the NOC + Full License path is the default. For Web3 startups, stablecoin issuers, tokenisation platforms, novel custody arrangements, and remittance experiments — the categories PVARA explicitly named when launching the Sandbox in February 2026 — the Sandbox is the more natural fit.

For a deeper comparison and our recommendation framework, see our pillar guide: VASP License Pakistan — The Complete 2026 Guide to PVARA Licensing.

17. Working With CoinConnect on Your Sandbox Application

CoinConnect is Pakistan's PVARA licensing and market-entry consultancy. We work exclusively on virtual asset regulatory matters — every engagement we run is a NOC, a Sandbox application, or a full VASP license filing. We do not split attention across unrelated practice areas.

Three engagement options for Sandbox applicants:

PVARA Readiness Diagnostic —  2 weeks. A 20-25 page written assessment of your product against every Sandbox eligibility gate, every Form I row, every Annexure A indicator, and the undertaking obligations. Tells you exactly where you stand and what to fix before submission. The cheapest insurance in the room before you commit to a full filing.

Sandbox Application Sprint — fixed fee, 8-10 weeks. End-to-end drafting of Form I (all five content sections plus attachments), the Annexure A self-assessment, supporting policy manuals (AML, cybersecurity, exit), and submission support. We handle drafting; your team handles internal sign-off and named-individual evidence.

Sandbox Compliance Retainer — monthly, post-approval. Operational support during the testing phase: PVARA reporting cadence, incident notification protocol implementation, periodic reviews against the undertaking, and Completion Report drafting at exit.

Ready to apply for the PVARA Sandbox?

Book a 30-minute scoping call
No deck, no pitch — nine questions about your product and a clear recommendation on whether the Sandbox is your right path, or whether the NOC route fits better. calendly.com/abbasmalikmuntazir/30min



Read the PVARA Guide: coinconnect.site/pvara-guide
Read the VASP Licensing Guide: coinconnect.site/blog/coinconnect-insights-1/vasp-license-pakistan-3

Author
Malik Abbas, CEO, CoinConnect — Pakistan's PVARA Licensing & Market-Entry Consultancy. Advising global crypto exchanges and Web3 founders on Virtual Assets Ordinance 2025 compliance, NOC applications, Sandbox entry, and full VASP licensing.
Published: May 2026 · Last reviewed: May 2026

Sources
This article is sourced exclusively from:
PVARA Sandbox Guidelines 2026 — Incubation Guidelines for the Regulatory Sandbox, including Form I, Annexure A (Self-Assessment Checklist), and Annexure B (Format of Undertaking).
Virtual Assets Ordinance 2025 — Sections 6, 8, 42, 43, 44, and 45.
Pakistan Virtual Assets Regulatory Authority official website — pvara.gov.pk — including the Licensing portal page and Sandbox launch communications.


Related reading
Pillar Guide: VASP License Pakistan — The Complete 2026 Guide to PVARA Licensing
Pillar Guide: The Complete PVARA Guide — Virtual Assets Ordinance 2025
Cluster: VASP Licensable Activities Pakistan — What Requires a License
Cluster: Why VASP Applications Get Rejected — 7 Common Failure Modes
Cluster: Fit-and-Proper Requirements PVARA — Director and Shareholder Tests