VASP License Pakistan: The Complete 2026 Guide to PVARA Licensing

 ● 12 min read ● ~4,500 words ● Author: Malik Abbas, CEO CoinConnect

• On This Page

What a VASP License Is	Documentation Checklist
Legal Basis: VAO 2025	Realistic Timeline
Who Regulates: PVARA	Cost Breakdown
Who Needs a License	Foreign Exchange Entry
Licensable Activities	After Approval
Sandbox vs NOC vs Full License	Why Applications Fail
Form A1 — The NOC Application	Working With CoinConnect
Eligibility Requirements	FAQ

• 
  
  1. What a VASP License Actually Is
  
  A VASP license — short for Virtual Asset Service Provider license — is the formal authorization issued by the Pakistan Virtual Assets Regulatory Authority (PVARA) that permits a registered entity to legally offer regulated virtual asset services to Pakistani residents. It is the legal gate between operating in Pakistan's crypto market and not operating in it. Before the Virtual Assets Ordinance 2025 took effect, Pakistan had no formal licensing regime for crypto. Exchanges either served Pakistani users in a regulatory grey zone or geoblocked the country entirely. The VAO 2025 and its operating regulator PVARA changed that overnight — moving Pakistan from "unregulated but tolerated" to "regulated, with enforcement teeth. 
  "If you are a foreign exchange currently serving Pakistani users, you now fall into one of three positions: you license, you geoblock, or you accept exposure. There is no fourth option. Key takeaway: A VASP license is not optional infrastructure. Under Section 3(2) of the VAO 2025, "carrying on virtual asset business" is defined by whether you serve Pakistani residents — not by whether you have a physical office here. Jurisdiction reaches offshore exchanges with Pakistani users.
  
  
• 
  

• 2. The Legal Basis: Virtual Assets Ordinance 2025
  
  Pakistan's VASP framework rests on a single foundational statute: the Virtual Assets Ordinance 2025 (VAO 2025), promulgated in Q4 2025 with the NOC framework operational as of March 2026 and full licensing regulations forthcoming. The VAO 2025 does four things in plain terms:

  • Defines what counts as a virtual asset — broadly, any digital representation of value that can be transferred, stored, or traded electronically, excluding fiat-denominated e-money and certain securities already under SECP jurisdiction.
  • Creates PVARA as the sole federal regulator for virtual asset services.
  • Makes unlicensed virtual asset business an offence — with criminal penalties under the Ordinance including fines up to PKR 500 million and imprisonment up to five years for directors of non-compliant entities.
  • Empowers PVARA to issue subordinate regulations — rulebooks covering conduct, capital adequacy, custody, disclosure, marketing, AML, and more. Several of these rulebooks were released between December 2025 and March 2026.

For a section-by-section breakdown of the Ordinance itself, see our complete PVARA guide. This article focuses specifically on the licensing process.

3. Who Regulates What — Understanding the Authority

PVARA is the primary regulator for virtual assets, but it does not operate in isolation. Four federal bodies share jurisdiction over different slivers of your operation.

Authority	What It Covers
PVARA	Virtual asset licensing, conduct, AML rules, Sandbox, Form A1, ongoing supervision of VASPs
State Bank of Pakistan (SBP)	Fiat on/off-ramps, foreign exchange controls, banking access for VASPs, cross-border settlement
SECP	Corporate registration of the VASP entity (the Private Limited Company itself), securities overlap where tokens are securities
FBR (Inland Revenue)	Taxation, Section 285BAA reporting obligations, withholding, documentation
FMU	AML/CFT reporting through the goAML system, STR/CTR obligations under FATF Travel Rule

A typical licensed VASP ends up with touch-points at all five bodies. Founders who enter Pakistan assuming PVARA is the only door to knock on miss the 40% of compliance that lives elsewhere — especially SBP (for fiat flows) and FBR (for tax).For a deeper comparison of regulatory remits, read our cluster piece: PVARA vs SBP vs SECP — Who Regulates What in Pakistan Crypto.

• 
  

• 4. Who Needs a VASP License
  
  Short answer: any entity that carries on virtual asset business reaching Pakistani residents.
  
  Long answer: You need a license if you:

  • Operate a crypto exchange, spot or derivatives, that onboards Pakistani KYC'd users
  • Run an OTC desk or broker matching Pakistani counterparties
  • Offer custody or wallet services to Pakistani residents (hosted wallets, not self-custody software)
  • Issue a token targeted at or marketed to Pakistani investors (ICO, IEO, fundraising)
  • Operate a staking-as-a-service, lending, or yield product with Pakistani users
  • Run a payments or remittance rail using virtual assets, settling with Pakistani customers
  • Provide RWA (real-world-asset) tokenization services touching Pakistani issuers or investors
  • 
    

You likely do not need a license if you:

• • Sell pure non-custodial software (a wallet app where users hold their own keys, no service layer)
  • Provide infrastructure with no end-user relationship (node operators, validators, block explorers)
  • Operate a fully geoblocked platform with no Pakistani onboarding and no Pakistani marketing
    
    

Caution: "We don't market to Pakistan" is not a safe harbour. PVARA's test is whether Pakistani residents can use your service — not whether you intended to serve them. Exchanges with Pakistani users acquired through organic SEO, influencer marketing, or word of mouth have been found to be in scope.



• 5. The Licensable Activities — PVARA's 7-Category Matrix
  
  PVARA classifies virtual asset services into seven distinct activity categories. Your license covers the specific activities you apply for — not crypto businesses generally. Most applicants request authorization for 2-4 activities; some Tier-1 exchanges apply for all seven.

Activity	What It Covers
1. Exchange (Spot)	Matching buyers and sellers of virtual assets; crypto-to-crypto and crypto-to-fiat pairs
2. Exchange (Derivatives)	Futures, perpetuals, options, leveraged products — subject to stricter capital and risk rules
3. Custody	Holding virtual assets on behalf of customers in hot or cold wallets, including hosted wallet services
4. Broker/Dealer	Acting as principal or agent in virtual asset transactions, OTC desks, large-ticket facilitation
5. Issuance	Issuing or offering virtual assets to the public; ICOs, IEOs, token sales originating in Pakistan
6. Transfer Services	Cross-border virtual asset transfers, remittance using crypto rails, payments
7. Advisory / Management	Investment advice, discretionary management of virtual asset portfolios, staking-as-a-service

Miss-classifying your activity is the single most common filing error. A law firm may tell you your spot exchange is Activity 1, but if you offer any leverage — even 2x — you also need Activity 2. If you hold customer funds overnight you additionally need Activity 3. A single commercial product can span three categories, and missing one triggers a rejection. For a deeper dive into each activity's rulebook, read: VASP Licensable Activities Pakistan — What Requires a License.

Not sure which activities apply to your exchange? Our $5K PVARA Readiness Diagnostic maps your current product surface against all 7 activity categories and tells you exactly which licenses you need — before you file. Book a Diagnostic Call


6. Sandbox vs NOC vs Full VASP License — Your Entry Options

PVARA's current framework operates in phases. As of 2026, all entrants must begin with a No Objection Certificate (NOC) before proceeding to full licensing. Understanding these phases is the single most important strategic decision in your application.

The NOC Stage
The NOC is the mandatory first step for all VASP applicants. It is a preliminary clearance that allows you to register on the FMU goAML portal, incorporate a local entity under the Companies Act 2017, and prepare for full licensing. Think of it as your regulatory entry ticket.

Who it suits:
All foreign and domestic exchanges entering Pakistan. No exceptions.

Requirements: 
Submission of Form A1 with business plan, corporate documents, fit-and-proper disclosures, and AML/CFT framework. Decision targeted within 60 calendar days of complete submission.

Duration: 2-3 months from application to NOC issuance.

The Sandbox Track
The Sandbox is a supervised, time-limited regulatory environment where an applicant can operate with live users under a restricted scope while PVARA observes and the applicant proves out compliance infrastructure. Think of it as a "learning permit" for VASPs.

Who it suits: 
First-time applicants, smaller exchanges, new product categories, any entity that wants to prove operational capability before committing to the full license's capital lock-up.

Restrictions: 
User cap (imposed by PVARA on a case-by-case basis during Sandbox phase), transaction volume cap, single-activity authorization only, mandatory monthly PVARA reporting.

Duration: 6-12 months. After successful Sandbox graduation, applicants may apply for full license, with the Authority determining the timeline based on testing results.

The Full License Track

Direct application for a full operating license without Sandbox phase. Higher bar, faster time-to-full-operations.

Who it suits: 
Established Tier-1 exchanges with existing licenses in reputable jurisdictions (UAE VARA, MAS, FCA, SFC), strong compliance track record, full capital ready.

Requirements: 
Full capital in place, audited financials for prior 2 years, demonstrated AML/CFT systems in production elsewhere, senior management with regulatory experience.

Duration: 
Full licensing regulations are forthcoming from PVARA. Realistic end-to-end timeline for first-time Pakistan filers is expected to be 8-14 months once the framework is fully operational.

Our recommendation for 2026 entrants: 
Most mid-tier global exchanges should begin with the NOC and consider the Sandbox path even if they technically qualify for direct full licensing. It gives you 6 months of regulator relationship-building, catches scope issues before they become rejections, and costs half as much upfront.

For a detailed Sandbox playbook, read: PVARA Sandbox Form I — Complete Walkthrough.


7. Form A1 — The NOC Application

Form A1 is the master application form for the NOC, while Form I is used for Sandbox entry. Form A1 is a comprehensive document with operational sections, supporting annexures, and sworn declarations. Every section must be completed; every declaration must be signed by a named director of the applicant entity.

The Core Sections of Form A1

• 1. Corporate identity — SECP registration (if existing), directors, shareholders (including UBOs), group structure, prior regulatory history

  2. Licensable activities requested — which of the 7 activity categories, scope per category, geographic reach

  3. Business plan — 3-year revenue and user projections, product roadmap, target market definition

  4. Capital and financial fitness — source-of-funds documentation, financial projections or audited financials

  5. Operational infrastructure — tech stack, custody arrangements, data centers, fail-over, incident response

  6. Key personnel — fit-and-proper declarations, CVs, certifications, police clearances, proof of residency where required

  7. AML/CFT framework — KYC procedures, transaction monitoring, sanctions screening, Travel Rule compliance, goAML integration

  8. Consumer protection — disclosure, complaints handling, safeguarding of customer assets, insurance/bonding

  9. Market conduct — marketing standards, influencer/KOL policies, prohibited practices, disclaimers

  10. Risk management — cyber, operational, liquidity, market, and custody risk frameworks with documented controls
      
      

The Supporting Annexures

• • Annexure A — Group structure chart and shareholding map

  • Annexure B — Draft Terms of Service and Privacy Policy (Pakistan-specific)

  • Annexure C — Technology architecture diagram and custody design

  • Annexure D — AML/CFT Policy Manual (typically 40-80 pages)

  • Annexure E — Consumer disclosure pack
    
    

Form A1 is not a form you "fill in." It is a set of mini-reports, each of which requires drafting, legal review, compliance input, and executive sign-off. Preparation time for a well-resourced applicant is 8-10 weeks. Rushed applications get rejected at the completeness stage before a reviewer ever reads them.

Note: Sandbox applicants use Form I, which follows a similar structure but with additional focus on testing parameters, exit strategy, and innovation assessment.



8. Eligibility Requirements — Who PVARA Will Actually License

Entity Requirements

• • Pakistan-incorporated — Private Limited Company under the Companies Act 2017, registered with SECP, or a foreign branch office authorized by SECP with PVARA-approved scope

  • Dedicated purpose — the entity's memorandum of association must specifically authorize virtual asset services (generic "technology services" clauses are rejected)

  • Registered office in Pakistan — a real operating address, not a mail-drop or shared workspace
    
    

Capital Requirements

Paid-up capital requirements for full licensing have not yet been published by PVARA. The figures below are indicative estimates based on comparable jurisdictions and may change when PVARA issues its Capital Adequacy Rulebook. Indicative figures as of 2026:



Activity	Minimum Paid-Up Capital (Estimated)
Exchange (Spot)	PKR 50,000,000 (~$180K)
Exchange (Derivatives)	PKR 150,000,000 (~$540K)
Custody	PKR 75,000,000 (~$270K) plus insurance
Broker/Dealer	PKR 30,000,000 (~$110K)
Issuance	PKR 50,000,000 (~$180K) per issuance
Transfer Services	PKR 25,000,000 (~$90K)
Advisory / Management	PKR 15,000,000 (~$55K)

Capital must be paid-up at the Pakistani entity level — not pledged at group level — and evidenced by a Pakistani bank letter at application time.

Fit-and-Proper Requirements

Every director, senior executive, and shareholder with 20%+ equity or voting power (direct or indirect) must pass the fit-and-proper test:

• • No criminal convictions involving dishonesty, fraud, or financial crime

  • No prior regulatory bans or enforcement actions globally

  • No bankruptcy or insolvency history in past 10 years

  • Police clearance certificate from jurisdiction of residence

  • Professional references (for senior management)

  • Proof of relevant experience (for heads of compliance, custody, technology)

Read more: Fit-and-Proper Requirements PVARA — Director and Shareholder Tests.

Operational Readiness

• • Functional AML/CFT systems (transaction monitoring, sanctions screening, KYC)

  • Custody arrangements with either in-house cold storage or a qualified third-party custodian

  • Incident response plan and cyber insurance

  • Consumer disclosure materials reviewed by Pakistani counsel

  • Pakistan-resident Key Individual such as CEO, Director, or MLRO (required for NOC and full license; recommended for Sandbox)
    
    

9. The Documentation Checklist

Every Form A1 application must attach the following, at minimum. Incomplete documentation is the leading cause of rejection at the first review stage.

• 1. Certified copy of SECP Certificate of Incorporation (if existing)

  2. Memorandum and Articles of Association (with virtual-asset-services clause)

  3. Board resolution authorizing the license application

  4. Source-of-funds evidence and financial projections (or audited statements if existing entity)

  5. Three-year business plan with financial projections

  6. Complete shareholder/UBO register with copies of ID for all 20%+ holders

  7. Directors' CVs, police clearances, fit-and-proper declarations

  8. Key personnel CVs and credentials (compliance, custody, tech leads)

  9. Organization chart and group structure

  10. AML/CFT Policy Manual (Annexure D)

  11. Technology architecture document with custody design (Annexure C)

  12. Draft Terms of Service and Privacy Policy (Pakistan-specific)

  13. Cyber insurance policy or binding quote

  14. Custody arrangement documentation (in-house procedures or third-party custodian agreement)

  15. Consumer complaint handling procedure

  16. Marketing compliance policy (if doing any Pakistan-targeted marketing)

  17. PVARA application fee receipt

Every document must be either issued in English or accompanied by a sworn English translation. Documents older than 6 months at submission are rejected as stale.




10. Realistic Timeline — What Actually Happens When
Glossy consultancy pitches promise 3-month licensing. Those timelines are wrong. Here is what actually happens.

Phase	Weeks	What Happens
Phase 1 — Scoping & NOC Preparation	Weeks 1-4	Activity classification, initial corporate structuring, bank account opening planning, and Form A1 drafting
Phase 2 — Form A1 Preparation	Weeks 5-12	Drafting all sections, annexures, AML Policy Manual, business plan, tech architecture doc
Phase 3 — Internal Review & NOC Submission	Weeks 13-16	Legal review, executive sign-off, fit-and-proper documentation collection, NOC application submission
Phase 4 — PVARA NOC Review	Weeks 17-20	PVARA reviews for completeness, may raise supplementary questions (SQs), applicant responds. Decision targeted within 60 calendar days of complete submission
Phase 5 — NOC Issuance & AML Registration	Weeks 21-24	NOC issued, applicant registers with FMU on goAML portal, incorporates local entity under Companies Act 2017
Phase 6 — Substantive License Review	Weeks 25-36	Once full licensing regulations are published, detailed review by PVARA specialists, interviews with senior management, possibly onsite inspection
Phase 7 — Full License	Weeks 37-48	Applicant fulfils pre-operational conditions (final capital, insurance, Key Individual appointed, systems audited), license granted

Total realistic timeline: 9-12 months for a well-prepared applicant moving from NOC through to full license. Sandbox track often compresses the operational phase to 6-8 months for limited-scope go-live.

Warning: Applicants who rush Phase 2 (Form A1 preparation) to "save time" consistently lose 4-8 weeks in Phase 4 responding to completeness queries. It is always faster to take 10 weeks on Form A1 than 6.



11. Cost Breakdown — What a VASP License Actually Costs
Total all-in cost for the NOC and subsequent VASP license in Pakistan ranges from PKR 15 million to PKR 50 million (roughly $55,000 to $180,000 USD) depending on activity mix, scale, and how much you do in-house versus outsource.

Cost Component	PKR Range	USD Range
PVARA application fee (per activity)	1M - 3M	$3.6K - $11K
SECP entity incorporation + annual fees	500K - 1M	$1.8K - $3.6K
Legal counsel (Pakistan law firm)	3M - 8M	$11K - $29K
Regulatory consulting (CoinConnect Sprint)	5M - 7M	$18K - $25K
AML Policy Manual drafting	800K - 2M	$2.9K - $7K
Tech architecture documentation	500K - 1.5M	$1.8K - $5.4K
Fit-and-proper documentation (per director)	200K - 500K	$720 - $1.8K
Cyber insurance annual premium	1M - 4M	$3.6K - $14K
Pakistan-resident compliance hire (annual)	3M - 8M	$11K - $29K
Total (excluding paid-up capital)	15M - 35M	$54K - $126K
Plus: Paid-up capital (varies by activity)	15M - 150M+	$54K - $540K+

The paid-up capital is not a "cost" in the traditional sense — it remains on your balance sheet. But it is cash that must be deposited in a Pakistani bank account before license grant, so it is cash you cannot use elsewhere during the licensing phase.

For a deeper cost analysis, read: VASP License Cost Pakistan — Full Breakdown.

CoinConnect's fixed-fee model: Our Licensing Sprint is $25,000 flat for the end-to-end consulting portion — Form A1 drafting, AML Manual, activity classification, and submission support. Law firms in Karachi typically quote $60-90K for equivalent work. We don't do hourly, don't do scope creep, don't do surprise invoices.

12. Foreign Exchange Entry — How Global Exchanges Actually Enter

No foreign exchange applies to PVARA directly. PVARA licenses Pakistani entities only. Every Binance-equivalent that wants to operate in Pakistan must first stand up a local vehicle.

Three Entry Structures

Option A: Wholly-Owned Pakistani Subsidiary

The cleanest path. You incorporate a Private Limited Company under the Companies Act 2017 with 100% foreign ownership (permitted in the virtual assets sector subject to SBP remittance rules), capitalize it, and apply through it.

Pros: Full control, straightforward tax structure, easiest governance.

Cons: Requires at least one Pakistan-resident director; cross-border capital remittance subject to SBP approval.

Option B: Joint Venture with Pakistani Partner

A JV with a local partner who brings market knowledge, regulatory relationships, or operational presence.

Pros: Faster local credibility, easier banking access, smoother fit-and-proper on resident directors.

Cons: Shared control, IP complications, exit difficulty.

Option C: Foreign Branch Office

Register the foreign parent as a branch office of a foreign exchange under SECP's Foreign Company regime, then apply for a VASP license through the branch.

Pros: No separate entity; easier consolidation.

Cons: Parent's full balance sheet exposed to Pakistani jurisdiction; less common in practice; longer SECP approval cycle. Note: PVARA's Ordinance emphasizes incorporation under the Companies Act 2017, and branch office structures may face additional scrutiny. Most applicants opt for a wholly-owned subsidiary.

For most Tier-2 exchanges, Option A (wholly-owned subsidiary) is the default. For Tier-1 exchanges with complex group structures, a JV or branch may be more practical.

Deeper guide: Foreign Exchange Entry Options Pakistan — 100% Ownership vs JV.

13. After Approval — Ongoing Obligations

Getting the license is the start, not the finish. Once licensed, your VASP has ongoing obligations across reporting, conduct, capital maintenance, and customer protection.

Monthly Obligations

• • Transaction volume reports to PVARA

  • STR/CTR reports to FMU through goAML

  • Customer onboarding and off-boarding reports

  • Capital adequacy attestation


Quarterly Obligations

• • Detailed operational reports to PVARA (risk metrics, incident logs, complaint data)

  • Section 285BAA reporting to FBR on Pakistani user activity

  • Management representation letter


Annual Obligations

• • Audited financial statements

  • External AML/CFT audit

  • Cybersecurity assessment by accredited auditor

  • License renewal and annual fee

  • Board-level risk and compliance review
    
    

Event-Driven Obligations

• • Material incident reporting within 24-72 hours (cyber, financial, operational)

  • Regulatory change of control filings

  • New product / new activity pre-approval

  • Key personnel change notifications
    
    

CoinConnect offers a post-license Compliance Retainer at $10-15K/month covering all periodic reporting, rulebook-change monitoring, quarterly reg reviews, and first-line compliance support. Details: Launch & Growth Services.

14. Why VASP Applications Get Rejected — The 7 Failure Modes

Of first-wave applications in Q1 2026, we estimate 40-60% will be returned for rework or outright rejected. The failure modes are predictable.

1. Activity Miss-Classification

Applying for Activity 1 (Spot Exchange) when the product also involves Activity 2 (Derivatives) or Activity 3 (Custody). Triggers immediate rejection at completeness stage.

2. Inadequate AML Policy Manual

Generic AML policies copied from another jurisdiction, not tailored to Pakistan's FMU goAML integration and Travel Rule implementation. PVARA reviewers read hundreds of these and spot templates instantly.

3. Fit-and-Proper Gaps

One director with a historical regulatory issue, one UBO with unclear source of funds, one shareholder in a sanctioned jurisdiction. Single-person fit-and-proper failure kills the whole application.

4. Capital Documentation Weakness

Paid-up capital evidenced by a group balance sheet rather than a Pakistani bank letter. PVARA requires the capital to be demonstrably at the Pakistani entity level on the date of application.

5. Generic Business Plan

Reusing a business plan from another jurisdiction with Pakistan's name find-and-replaced. Reviewers flag this in 20 minutes. Business plan must reflect actual Pakistan user acquisition strategy, local team, Pakistan-specific financials.

6. No Pakistan-Resident Key Individual

Applying for NOC or full license without a Key Individual (CEO, Director, or MLRO) based in Pakistan. Full license requires at least one Pakistan-resident Key Individual with operational authority; Sandbox is more flexible but still requires a local liaison.

7. Unclear Custody Arrangement

Vague descriptions like "funds are held securely" with no specifics on hot/cold wallet split, custodian identity, insurance coverage, key management, or segregation. Custody is the single section PVARA scrutinizes hardest.

Full failure mode guide: Why VASP Applications Get Rejected — 7 Common Failure Modes.

Ready to license in Pakistan?

Book a 30-minute Diagnostic scoping call. No deck, no pitch — just nine questions about your product and a clear recommendation on your path to license.

Book Scoping Call

Read the PVARA Guide

Malik Abbas

CEO, CoinConnect — Pakistan's PVARA Licensing & Market-Entry Consultancy. Advising global crypto exchanges on Virtual Assets Ordinance 2025 compliance.
Published: April 25, 2026 · Last reviewed: April 25, 2026

Related reading

• • Pillar Guide: The Complete PVARA Guide — Virtual Assets Ordinance 2025
  • Pillar Guide: Crypto Tax Pakistan 2026 — Section 285BAA Complete Guide
  • Cluster: PVARA Sandbox Form I — Complete Walkthrough
  • Cluster: Licensable Activities — What Requires a License
  • Cluster: VASP License Cost Pakistan — Full Breakdown
  • Cluster: 7 Reasons VASP Applications Get Rejected