PVARA
License & Sandbox Guide — Pakistan 2026
Pakistan Virtual Assets Regulatory Framework 2026
A section-by-section guide to the Virtual Assets Act 2026 as passed by the National Assembly, the ten Schedule I service categories and their capital requirements, the No Objection Certificate Regulations 2025 (Forms A1–A8), the Regulatory Sandbox Guidelines 2026, AML/CFT and Travel Rule duties, the Section 54 offence schedule, and the appeals route — written for Virtual Asset Service Providers planning market entry into Pakistan.
PVARA licensing is the approval a business needs to provide any virtual asset service in Pakistan. It is issued by the Pakistan Virtual Assets Regulatory Authority under the Virtual Assets Act 2026. Schedule I of the Act defines ten licensable service categories, and Section 50(1) requires a licensed business to be both incorporated in Pakistan and PVARA-licensed — a foreign licence satisfies neither condition. Entry runs through a No Objection Certificate under the NOC Regulations 2025 (Forms A1–A8), which PVARA must decide within 60 calendar days of a complete submission under Regulation 17.1. An NOC holder that has completed FMU goAML registration may provide four AML-Registered Services before full licensing. Novel products may instead enter the Regulatory Sandbox under Section 35. Operating unlicensed is a criminal offence under Section 54(1), carrying up to five years’ imprisonment, a fine up to PKR 50 million, or both.
Every claim in this guide is cited to a section, regulation or form of the official text. Sources and their status are listed below.
Table of Contents
19 sections · every claim cited to a section, regulation or form of the official text
Virtual Assets Act, 2026
As passed by the National Assembly
74 sections + Schedule I. Successor to the Virtual Assets Ordinance, 2025 (VII of 2025) signed 8 July 2025, saved by Section 74.
NOC Regulations 2025
PVARA/REG/AML-REG/2025-1 · v1.0 Final
Effective 2 December 2025. Parts 1–6 plus Annex A statutory Forms A1–A8. Issued by PVARA Licensing & Supervision Division.
PVARA Sandbox Guidelines 2026
14 clauses + Form I, Annexures A & B
Operationalises the sandbox mandate. Agile intake, 60 working-day evaluation, Letter of Approval, No-Action Relief.
Executive Summary
The Pakistan Virtual Assets Regulatory Authority (PVARA) is established under Section 6 of the Virtual Assets Act 2026 as an autonomous body corporate with perpetual succession, headquartered in Islamabad. The Act began life as the Virtual Assets Ordinance, 2025 (VII of 2025), signed 8 July 2025; Section 74 saves every appointment, notification and approval made under that Ordinance. PVARA licenses, regulates and supervises Virtual Asset Service Providers (VASPs) and Issuers operating in or from Pakistan.
The rulebook is now substantially in place across three official instruments. Schedule I of the Act defines the ten categories of Virtual Asset Services subject to licensing. The No Objection Certificate Regulations 2025 (document code PVARA/REG/AML-REG/2025-1, v1.0 Final, effective 2 December 2025) govern pre-incorporation clearance, AML/CFT minimum standards, fit-and-proper testing and the eight statutory forms A1–A8. The PVARA Sandbox Guidelines 2026 govern supervised live testing.
The single most commercially important fact on this page: under Regulation 2.3 and Regulation 17.1(a)(iii) of the NOC Regulations, an NOC holder that completes FMU goAML registration may lawfully provide four services before it holds a full licence — Exchange, Broker-Dealer, Custody, and Virtual Asset Derivatives Services — subject to PVARA's conditions and until its licence application is finally determined. Every other Virtual Asset Service requires a full licence first. This phased pathway is the fastest legal route into Pakistan today.
A Complete Statutory Framework
Twelve chapters covering licensing, prudential standards, customer-asset segregation, stablecoin issuance, market conduct, AML/CFT, criminal offences and an appellate tribunal.Act, Ch. 1–12
~35M Estimated Crypto Users
Pakistan ranks among the top countries globally in grassroots crypto adoption, with significant untapped market potential.Estimate
Four Services Open Pre-Licence
Exchange, Broker-Dealer, Custody and Derivatives are designated AML-Registered Services and can be provided on an NOC + goAML registration.NOC Reg 2.3
FATF-Aligned by Statute
VASPs are deemed financial institutions under AMLA 2010. Travel Rule, TFS screening, STR/CTR filing via goAML and 7-year records are mandatory.Act s.46–48
Regulatory Timeline
Pakistan moved from having no crypto policy to a full statutory regime in roughly eighteen months. Entries marked Official are drawn from the source documents; entries marked Media Reports are not confirmed by a published PVARA document.
- Feb 2025
Pakistan Crypto Council (PCC) Announced
Finance Ministry announces formation of the PCC to develop a crypto policy framework for Pakistan.
- Mar 14, 2025
PCC Formally Launched
Muhammad Aurangzeb (Finance Minister) as Chairman, Bilal bin Saqib as CEO of the Pakistan Crypto Council.
- Apr 7, 2025
CZ Appointed PCC Strategic Advisor
Binance founder Changpeng Zhao joins as Strategic Advisor to the Pakistan Crypto Council (PCC) — not PVARA directly.
- May 26, 2025
Bilal bin Saqib Elevated
Appointed Special Assistant to the PM on Blockchain & Crypto (Minister of State rank).
- Jul 8, 2025
Virtual Assets Ordinance, 2025 Signed Official
President Zardari signs the Virtual Assets Ordinance, 2025 (VII of 2025), establishing PVARA as a statutory authority. Section 74 of the later Act preserves everything done under it.
- Aug 2025
PVARA Operations Commence
PVARA holds its inaugural board meeting and begins regulatory operations from its Islamabad headquarters.
- Sep 2025
NOC Applications Invited
PVARA invites global crypto firms to apply for No Objection Certificates via pvara.gov.pk.
- Dec 2, 2025
NOC Regulations 2025 Take Effect Official
PVARA Licensing & Supervision Division publishes the No Objection Certificate Regulations 2025 (PVARA/REG/AML-REG/2025-1, v1.0 Final) with Forms A1–A8. Regulation 1.2: they commence upon publication on PVARA's website.
- Dec 2025
First NOCs Reported Media Reports
Major global exchanges (including Binance) are reported in media to have received NOCs. PVARA does not maintain a public NOC holders list, though Section 21(4) requires a public register of full Licensees.
- Apr 14, 2026
SBP Circular No. 10 of 2026 Verify Against Circular
State Bank of Pakistan reported to authorise banks to open accounts for PVARA-licensed VASPs — removing the single biggest operational barrier for crypto firms in Pakistan. Verify wording directly against the official circular.
- 2026
Virtual Assets Act 2026 Passed by the National Assembly Official
The Ordinance is replaced by the Virtual Assets Act, 2026 — 74 sections and Schedule I, extending to the whole of Pakistan and commencing at once (s.1). Section numbering shifts: the sandbox moves from Ordinance ss.42–45 to Act s.35; NOC/licensing from Ordinance ss.15/17 to Act s.19/s.21.
- 2026
Sandbox Guidelines 2026 Published Official
PVARA publishes the Sandbox Guidelines 2026 — agile year-round intake, Form I, Annexure-A self-assessment, Annexure-B undertaking, 60 working-day evaluation, Letter of Approval and No-Action Relief.
Reading section numbers correctly
The NOC Regulations 2025 and Sandbox Guidelines 2026 were both drafted against the Virtual Assets Ordinance, 2025 and cite its numbering (e.g. sandbox at ss.42–45, NOC at s.15, licence at s.17, AML designation at s.38). The Virtual Assets Act 2026 renumbered these provisions — sandbox is now s.35, NOC and licence applications are s.19, grant of licence is s.21, and AMLA application is s.46. Section 74 keeps everything done under the Ordinance valid, so both sets of citations remain live in practice. Advisers who quote only one numbering will misfile.
What is PVARA?
Legal Basis
Pakistan Virtual Assets Regulatory Authority
- Established: Section 6, Virtual Assets Act 2026 (orig. Ordinance VII of 2025, signed 8 Jul 2025)
- Legal form: Body corporate, perpetual succession, common seal, may sue and be sued s.6(2)
- Autonomy: Autonomous in the performance of its functions, subject to the Act s.6(3)
- Headquarters: Islamabad, with offices elsewhere in Pakistan as required s.6(4)
- Extent: Whole of Pakistan; in force at once s.1(2)–(3)
- Rulebook: NOC Regulations 2025, Sandbox Guidelines 2026, plus Regulations under s.68
- Website: pvara.gov.pk
Composition of the Authority s.7(1)
- Chairperson — appointed by the Federal Government
- Secretary, Ministry of Finance
- Secretary, Ministry of Law and Justice
- Governor, State Bank of Pakistan
- Chairperson, Securities & Exchange Commission of Pakistan
- Chairman, National AML-CFT Authority
- Chairperson, Pakistan Digital Authority
- Two independent directors with proven Virtual Asset, digital technology or digital finance expertise
Non-ex-officio members serve three years, renewable once s.7(2). The Authority must meet at least twice a year; quorum is 50% of total membership with the mandatory presence of the Chairperson, the Secretary Finance and the Governor SBP s.8(1)–(2). Decisions carry by majority of members present s.8(4).
Note: FBR and the Financial Monitoring Unit are not Board members. They are statutory information-sharing counterparties under s.17(1).
Leadership Offices
Chairperson — appointed by the Federal Government; must have demonstrable expertise in digital finance or technology and a minimum of three years' relevant professional experience. Removable before term only for gross misconduct or incapacity, after show-cause and a hearing. May resign in writing to the Prime Minister. s.11
Managing Director — appointed by the Authority for three years, extendable. Acts as Secretary to the Authority's proceedings without voting rights unless specifically authorised. The Authority may delegate any of its powers to the MD. s.10, s.12
Objectives, Functions & Powers s.9
Licensing & Supervision
Issue, vary, suspend and revoke licences, approvals and directives; prescribe eligibility, renewal and additional obligations. s.9(1)(a), s.9(2)(c)–(d)
Substance-Over-Form Classification
Classify any asset, service or person by its underlying function or economic effect, irrespective of the nomenclature assigned to it — in consultation with SBP or SECP where their mandates are engaged. s.9(1)(f)
On-Site & Off-Site Supervision
Conduct inspections and off-site monitoring; require licensees to furnish information, documents and data in the prescribed timeframe. s.9(2)(e)–(f)
Rulemaking
Make Regulations, standards, directives, guidelines, handbooks and circulars, in consultation with the Cabinet Division. s.9(2)(a), s.68
Regulatory Sandboxes
Operate sandboxes in a transparent and accountable manner; issue guidance, no-objection statements and no-action communications. s.9(2)(k), s.35
Blockchain & DLT Governance
Promote, govern and regulate adoption of blockchain and DLT across Pakistan, harmonised with other regulators and ministries. s.9(1)(e), s.36
Shariah Advisory Committee
A committee constituted by the Authority for advice on Shariah matters; sandbox evaluation includes consultation with Shariah advisors where applicable. s.3(xxvii)
Fees, Penalties & the PVARA Fund
Levy fees, charges and penalties as prescribed by Rules. The PVARA Fund expressly includes NOC, licensing, supervision and renewal fees, plus charges for sandbox participation. s.9(2)(j), s.14(2)(h),(j)
International Cooperation
Enter mutual-assistance arrangements with foreign regulators, including mutual recognition of regulations and licences, with prior Federal Government approval. s.9(2)(l), s.17(2)
Where PVARA's word is final — and where it isn't
Section 5(3) vests regulation of Virtual Assets, VASPs, tokenization of real-world assets and blockchain technology primarily in PVARA. Section 5(1) makes the Act prevail over inconsistent laws — with one carve-out: the Foreign Exchange Regulation Act, 1947 is expressly excluded from that override. Section 5(2) is the other exception: laws on data protection, data governance, cybersecurity, financial secrecy and cross-border personal-data transfer prevail over the Act and bind PVARA itself.
Statutory Definition — "Virtual Asset" s.3(xxxi)
"A digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, but does not include digital representations of fiat currency, securities or other financial assets regulated under any other law except where represented, issued, or transferred using distributed ledger technology. For the avoidance of doubt, Virtual Assets are not legal tender."
Note the carve-in at the end: a security or financial asset that is represented, issued or transferred using DLT can fall back inside PVARA's perimeter. Read alongside s.9(1)(f), this gives PVARA wide reach over tokenized real-world assets.
Six Definitions That Decide Your Filing
- Controller s.3(v)
- A person who, alone or with associates, holds or may exercise 20% or more of voting power, ownership interest or share capital of a Licensee — or otherwise exercises significant influence or control over its management or policies, directly or indirectly. The influence limb catches structures with no 20% shareholder.
- Key Individual s.3(xv)
- Covers full-time, part-time, acting or outsourced holders of ten roles: director, Managing Director, CFO, COO, head of internal audit, head of compliance, MLRO, head of risk management, head of information security — plus any position PVARA declares to be one by written notice.
- Issuer s.3(xiii)
- The legal person that originates or creates a Virtual Asset and retains primary control over initial supply, reserve assets or on-chain governance. Explanation: marketing, promoting, brokering, listing or providing technical maintenance without control over issuance, supply or reserves does not make you an Issuer.
- Customer Assets s.3(vii)
- Virtual Assets and fiat currency belonging to a customer that a VASP holds, safeguards or otherwise has custody or control over on that customer's behalf. Excludes assets owned by the VASP itself. Drives the segregation duty in s.24.
- Segregated Reserve s.3(xxvi)
- A pool of reserve assets kept separate from the Issuer's own assets, held in the Issuer's name or in a trust or special vehicle for token holders, under an independent custodian or regulated financial institution approved by PVARA — so that the Issuer or its creditors cannot claim the assets.
- Sponsor s.3(xxix)
- A person or group who contributed initial capital to establish the company or holds a controlling shareholding, directly or indirectly. Sponsors are subject to fit-and-proper determination alongside Controllers, the CEO and directors under s.20(1).
Who Must Be Licensed
Before capital, forms or timelines, answer one question: does the Act apply to you at all? Chapter 1 draws the perimeter with unusual precision — a scope rule, a seven-limb exclusion test, an extraterritorial reach clause and a flat prohibition on unlicensed business.
In Scope s.2(1)
Expressly Out of Scope s.2(2)
The Closed-Loop Token Test — All Seven Must Hold s.2(2)(a)
By design, technical architecture, or enforceable system controls, the token must satisfy every one of these. Fail one limb and the Act applies in full. This is the clause that decides whether a loyalty point, game credit or platform voucher is regulated.
The Flat Prohibition s.50(1)
No person shall, by way of business, engage in — or represent themselves as engaging in — any Virtual Asset Service in or from Pakistan unless that person is (a) a company incorporated in Pakistan under the Companies Act 2017 or another Pakistani incorporation law, and (b) holds a valid PVARA licence.
Both limbs are cumulative. A foreign licence, however respected, satisfies neither. Marketing is separately restricted: no person may advertise or market a Virtual Asset unless the Issuer holds a valid licence or registration under the Act s.43(1).
Extraterritorial Reach s.4
For investigation and enforcement, PVARA may exercise its powers extraterritorially to the fullest extent permitted by law. It may enter agreements with foreign regulators and law-enforcement agencies for mutual assistance, information sharing, and recognition and enforcement of regulatory decisions.
Critically, s.4(2) directs PVARA to prescribe by Regulations the conditions under which a service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to persons in Pakistan — the reverse-solicitation test. Enforcement practice is to be aligned with MLATs, FATF and IOSCO frameworks s.4(3).
Serving Pakistani users from offshore is not a loophole
"In or from Pakistan" plus the extraterritorial clause plus PVARA's blocking powers over websites, apps, advertisements, payment links, app stores, search engines, advertising networks, registrars and payment providers s.61(1)–(2) means an offshore platform actively serving Pakistani retail users is exposed on three fronts at once: criminal liability under s.54(1), access blocking under s.61, and an advertising prohibition under s.43. Until the reverse-solicitation Regulations are published, treat active targeting of Pakistani users as in scope.
Pakistan Crypto Market
estimated
Why Pakistan?
Massive Unbanked Population
Only ~21% of adults have formal bank accounts — crypto offers genuine financial inclusion potential, an outcome the Act itself names as an objective in s.9(1)(d).
High Remittance Market
$30B+ annual remittances create a natural use case for the Transfer & Settlement licence category — the lowest-capital route into cross-border payout models.
Young Tech-Savvy Demographics
~60% of the population is under 30, with high smartphone adoption and growing digital literacy.
Statutory Invitation to Invest
Section 9(1)(c) makes it a formal objective of the regulator to "attract investment and encourage companies operating in the fields of Virtual Assets to base their business in Pakistan." Few jurisdictions write that into the licensing statute.
Policy & State Infrastructure
Strategic Digital Wallet Company (SDWC)
Section 38 authorises the Federal Government to establish a wholly owned company for custody, administration and wallet infrastructure enabling the state to manage, transfer and record Virtual Assets in furtherance of strategic reserve objectives. It serves government and designated public bodies only — expressly not private persons. In statute.
Mining Framework
Section 37 lets PVARA issue mining regulations in consultation with government entities and establish a registration or declaration framework for operators exceeding thresholds of scale, energy use or hash rate. In statute.
Bitcoin Mining Electricity Allocation
Surplus electricity announced for Bitcoin mining and AI data centres (2025). Policy stage — verify current status. Announced
SBP Circular No. 10 of 2026
Reported 14 April 2026 — banks authorised to open accounts for PVARA-licensed VASPs. Verify against the official circular before relying on it. Verify
Tokenized Real-World Assets
Section 5(3) puts tokenization of real-world assets expressly within PVARA's primary remit, and s.32(2) permits Asset-Referenced Tokens over commodities, real estate, RWAs and securities. In statute.
Schedule I: The Ten Virtual Asset Services
Section 18 makes every service listed in Schedule I subject to licensing, and lets the Federal Government notify further services into it. These are the statutory definitions — the words that determine which licence you need and whether an exemption applies. Read them carefully: three of the ten contain express carve-outs that can take a business model out of scope entirely.
Advisory Services
Personalised recommendations, on a professional basis, to a customer — on request or at the VASP's initiative — relating to actions or transactions involving Virtual Assets.
Carve-out: "Personalised" means addressed to a specific customer and taking account of their circumstances, objectives, risk profile or financial situation. General market information, research reports and non-individualised suggestions are not personalised recommendations.
Broker-Dealer Services
(a) Arranging or facilitating orders between two parties; (b) soliciting or accepting orders and receiving consideration in fiat or Virtual Assets; (c) trading on own account; (d) market-making using Customer Assets; (e) placement or distribution services for Issuers as intermediary.
Exemption: A person dealing solely on its own account, not executing customer orders and not holding or controlling Customer Assets, is not carrying on broker-dealer services.
Custody & Administration Services
Safekeeping or administration on behalf of customers and pursuant to their instructions of (a) Virtual Assets, or (b) private cryptographic keys or other access means allowing independent transfer or disposal.
Carve-out: Excludes the mere provision of software, hardware or infrastructure where the customer retains exclusive control over their own private keys — the non-custodial wallet exemption.
Exchange Services
(a) Exchanging Virtual Assets for fiat; (b) exchanging one or more types of Virtual Assets; (c) matching orders between buyers and sellers and executing those conversions; or (d) maintaining an order book for those purposes.
The order-book limb is broad — a venue that only maintains the book, without itself executing, is still in scope.
Lending & Borrowing Services
Facilitation, arrangement, intermediation or direct provision as principal of lending or borrowing arrangements involving Virtual Assets, where lenders transfer or make available Virtual Assets subject to a contractual obligation to return equivalent assets, with any agreed interest, fees or rewards, at a specified time or on demand.
Covers both the platform and the principal lender — there is no "we only match" exemption here.
Virtual Asset Derivatives Services
Offering, facilitation, execution, clearing, trading or arranging of transactions in derivatives — including futures, options, swaps, contracts for difference and similar instruments.
One of the four services available pre-licence as an AML-Registered Service under NOC Regulation 2.3.
Management & Investment Services
Acting in a fiduciary or agency capacity to manage or administer another person's Virtual Assets, including (a) portfolio or discretionary investment management, and (b) responsibility for staking on behalf of customers to earn validator or network rewards.
Staking scope: Only caught where staking is performed on a discretionary basis or forms part of a broader investment management mandate.
Transfer & Settlement Services
Transfer, transmission or settlement of Virtual Assets between parties, or from one wallet, address or location to another, on behalf of customers — excluding exchange execution.
The core category for cross-border remittance and stablecoin-payout models targeting Pakistan's $30B+ inbound remittance corridor.
Virtual Assets Issuance Services
Creation, issuance, initial offering, administration and ongoing management of Virtual Assets — including supply control, reserve management (if any), redemption, governance and required disclosures.
Fiat-Referenced and Asset-Referenced Tokens sit inside this category and additionally carry the reserve, redemption and audit duties of ss.31–33. See Section 12.
Mining-Related Services
Activities where mining operations provide services to third parties involving customer virtual assets or funds.
Carve-out: Pure mining for own account is excluded and does not by itself require a licence s.37(2). A separate registration or declaration regime may apply above thresholds of scale, energy use or hash rate s.37(3).
Which of the ten do you actually need?
Most business models touch two or three categories, and a single licence can specify more than one permitted service s.21(3). Getting the mix right decides your capital, your handbook obligations and whether you can start on an NOC.
Initial Virtual Asset Offerings
An IVAO — raising funds by publicly offering Virtual Assets in exchange for funds, other Virtual Assets or anything of commercial value s.3(xiv) — is separately gated. Only legal entities registered in Pakistan and meeting prescribed eligibility may conduct one s.30(1), and a public offering requires a published whitepaper s.42(1).
Licences & Capital
Section 25 requires every Licensee to maintain, at all times, minimum paid-up capital, liquid assets and financial resources not less than the prescribed amounts — and lets PVARA set higher requirements based on category, size, complexity or risk profile. The category-by-category figures below are drawn from the Draft Pakistan Virtual Asset Services Regulations 2026 and remain in draft; the statutory duty to hold capital comes from the Act itself.
| Licence Category | Min. Paid-Up Capital (PKR) | Approx. USD | Pre-Licence via NOC? |
|---|---|---|---|
| Advisory Services | PKR 25 million | ~$89,000 | No — full licence |
| Broker-Dealer Services | PKR 100 million | ~$357,000 | Yes — AML-Registered |
| Custody & Administration | PKR 200 million | ~$714,000 | Yes — AML-Registered |
| Management & Investment | PKR 200 million | ~$714,000 | No — full licence |
| Transfer & Settlement | PKR 200 million | ~$714,000 | No — full licence |
| Lending & Borrowing | PKR 500 million | ~$1.79 million | No — full licence |
| Virtual Asset Derivatives | PKR 500 million | ~$1.79 million | Yes — AML-Registered |
| Exchange Services | PKR 1 billion | ~$3.57 million | Yes — AML-Registered |
| Issuance — Fiat-Referenced Token | PKR 1 billion + 100% HQLA reserves | ~$3.57 million | No — full licence |
| Issuance — Asset-Referenced Token | PKR 1 billion + full asset backing | ~$3.57 million | No — full licence |
| Mining-Related Services | Not separately specified in the draft — a registration or declaration framework may apply above thresholds s.37(3) | No | |
Swipe the table sideways to see USD equivalents and pre-licence status
What the Act actually requires on capital
Fees — read this before you budget
Paid-up capital is not a payment to PVARA. It is share capital held in your own company and recoverable on an orderly wind-down. Fees are a separate matter — and the Act plainly contemplates them:
A published fee schedule had not been located at the time of writing. Treat fees as pending, not absent, and confirm with PVARA before budgeting.
Draft status, and how to use these numbers
The per-category figures come from the Draft Pakistan Virtual Asset Services Regulations 2026 and are not yet final. Schedule I of the Act defines the ten service categories but sets no capital amounts — those come from Regulations under s.25. Use the table for planning and modelling; confirm the operative figure at filing. The Regulatory Sandbox and the s.25(4) low-risk exemption are the two routes to testing a model without locking up full category capital.
Terms of a Licence Once Granted s.21–s.23
The licence names your services
It must specify which Virtual Asset Services you may undertake, and remains in force unless suspended or revoked s.21(3)
You appear on a public register
PVARA must maintain and publish an up-to-date register of Licensees showing name, licence number, permitted services and current status s.21(4)
Refusals come with written reasons
Both NOC refusals and licence refusals must state reasons in writing s.19(3), s.21(1)(b)
Ongoing obligations bite continuously
Capital, compliance with directives, periodic returns and audited accounts, prior approval for material change in control or business, risk/compliance/cyber systems, and supervision fees s.22(a)–(f)
Five grounds for suspension or revocation
Contravention of the Act or licence terms; insolvency or loss of fit-and-proper status; ceasing the licensed service; public interest; or a licence obtained by fraud, misrepresentation or concealment — always after written notice and a hearing s.23(1)
Revocation triggers wind-up
On revocation you must immediately cease providing services, and PVARA may notify SECP to initiate winding-up or dissolution under the Companies Act 2017 s.23(2)
Entry Routes & Licensing Process
Four ways into Pakistan — and one order of operations
Your options are a No Objection Certificate under s.19(1), the Regulatory Sandbox under s.35, a No-Action Letter for novel or pilot models under s.35(3), and the full VASP Licence under s.21. The order is not optional: s.19(1) requires you to obtain an NOC from PVARA before commencing the process of incorporation. You cannot go to SECP first.
Phase 1: No Objection Certificate from PVARA
Available Now — Mandatory First Step s.19(1)–(3)
Any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services must first apply to PVARA for an NOC — before starting incorporation. The application is made on Form A1 with all supporting documentation NOC Reg 15.1. PVARA may grant it subject to conditions, or refuse with written reasons.
WHAT THE NOC UNLOCKS (Reg 17.1(a))
Register the foreign entity already providing AML-Registered Services in Pakistan on the FMU goAML portal
Incorporate a local entity in Pakistan for the purpose of applying for a full VASP licence
Provide four AML-Registered Services — Exchange, Broker-Dealer, Custody, Derivatives — on completion of goAML registration, ahead of a full licence
Obligation attached: submit the licensing application within three months of promulgation of the VASP licensing regulations
WHAT THE NOC STILL DOES NOT PERMIT
The six non-AML-Registered services — Advisory, Lending & Borrowing, Management & Investment, Transfer & Settlement, Issuance, Mining-related
Any service before goAML registration is actually completed
Operating outside the specific conditions PVARA imposes on the NOC
Marketing a Virtual Asset whose Issuer is unlicensed s.43(1)
Decision deadline: PVARA must issue or refuse within 60 calendar days following assessment NOC Reg 17.1. Apply at pvara.gov.pk. Full requirements in Section 09.
Phase 2: SECP Incorporation, goAML & Local Presence
Immediately After NOC Issuance NOC Reg 15.3
Regulation 15.3 sets three post-NOC duties in sequence: register the foreign entity on goAML, incorporate the local company, and file the licensing application within three months of the VASP licensing regulations being promulgated. Once the local entity is licensed, the local entity assumes the goAML reporting-entity role and must keep active reporting credentials at all times NOC Reg 11.5.
SECP Incorporation
Local company under the Companies Act 2017 — required by s.50(1)(a)
FMU goAML Registration
Foreign chapter registers first as reporting entity; local entity takes over post-licence NOC Reg 11.4–11.5
Registered Office in Pakistan
Mandatory for every Licensee s.20(6)
Resident Key Individual
At least one Key Individual ordinarily resident in Pakistan vested with operational and decision-making authority s.20(6)
Technical Readiness to File
Demonstrate capability to file STRs and CTRs immediately upon goAML registration NOC Reg 11.6
FBR Tax Registration
Licensees must comply with the Income Tax Act 2001 and FBR rules s.66; see Tax & Banking
Phase 3: Full VASP Licence
Application under s.19(4) · Grant under s.21
Following incorporation, the licence application goes to PVARA in the prescribed form with the prescribed non-refundable fee and supporting documents s.19(4). PVARA may grant subject to conditions, refuse with written reasons, or issue a provisional or limited-scope licence on a case-by-case basis s.21(1)–(2). Only after grant may a VASP conduct full commercial operations in its licensed categories.
Minimum Financial Resources
Paid-up capital, liquid assets and financial resources for your category, held at all times s.25
Customer Asset Segregation
Segregated accounts, fiduciary duty, no rehypothecation without explicit consent s.24
Cryptographic Proof-of-Reserves
Furnished at prescribed intervals, reconciled against customer liabilities s.27(1)
Annual Statutory Audit
By a Chartered Accountancy firm approved by the Cabinet Division, verifying customer-asset segregation s.27(2)
Custody & Key Management
Secure custody, disaster recovery, business continuity, and PVARA's technical key-management standards s.26
Real-Time Supervisory Access
Secure reporting channels and, where required, automated interfaces giving PVARA and notified agencies access to prescribed data s.48
After grant: the ongoing obligations in s.22 apply continuously — periodic returns, audited statements, prior approval for any material change in control or business, and supervision and renewal fees.
Alternative Route: Sandbox or No-Action Letter
For novel models that cannot yet meet full licensing s.35
Where the model is genuinely novel, or where live testing is needed to answer a regulatory question, the Sandbox is the better first door. PVARA may issue guidance, no-objection statements or no-action communications under s.35(3), and eligibility, procedures, supervisory arrangements, risk limits, duration and exit are all set by the Sandbox Guidelines 2026. Applications are accepted year-round. Full detail in Section 17.
Transitional Route: Already Operating in Pakistan
Six-month window s.70
Any person providing Virtual Asset Services immediately before commencement of the Act has six months to apply for a licence, or must cease providing those services. A person who files a complete application within that window may continue existing services — provided they fully comply with any interim directives issued by PVARA and continue to adhere to the Act's core obligations, particularly on customer asset protection and AML/CFT/CPF. The concession attaches to existing services only; it is not a licence to expand.
NOC Regulations 2025
IN FORCEPVARA/REG/AML-REG/2025-1 · v1.0 Final · Effective 2 December 2025
This is the instrument that actually governs market entry today. Issued by PVARA's Licensing & Supervision Division, it runs to six Parts plus Annex A containing eight statutory forms. Regulation 1.2 provides that it comes into force upon publication on PVARA's official website, and Regulation 2.1 applies it to all VASPs seeking an NOC.
Its stated objectives (Reg 3.1) are to set AML/CFT minimum standards; ensure fitness and propriety of Controllers and Key Individuals; require systems to prevent, detect and report ML/TF; mandate risk-based, proportionate control frameworks; integrate every VASP with the FMU goAML system; prevent unregistered and non-compliant VASPs from operating in Pakistan; and facilitate the phased pathway under which AML-Registered Services may be provided ahead of full licensing.
The Four AML-Registered Services Reg 2.3
For the purposes of goAML registration and following receipt of an NOC, these four services are designated non-financial businesses and professions. An applicant granted AML Registration may provide them prior to obtaining a licence, subject to PVARA's conditions and until the licence application is finally determined. Every other Virtual Asset Service requires a full licence first, unless otherwise agreed with PVARA.
Exchange Services
Spot conversion, order matching, order book
Broker-Dealer Services
Order arrangement, own-account trading, distribution
Custody Services
Safekeeping of assets and private keys
Virtual Asset Derivatives Services
Futures, options, swaps, CFDs
Part 2 — Governance & the Eight Mandatory Key Individuals Reg 4–6
Roles You Must Fill Reg 5.1
Only one combination is allowed: Compliance Officer and MLRO may be combined where justified by the applicant's size and complexity Reg 5.2. Form A1 §3.2 requires these details for both the global entity and the proposed local Pakistani entity.
Board Duties & Disqualifications Reg 4.2, 6.3
THE APPLICANT BOARD MUST OVERSEE:
NO ONE MAY SERVE AS A KEY INDIVIDUAL WHO:
PVARA may interview Key Individuals to satisfy itself of competence, independence, knowledge and suitability Reg 6.2, 16.2. Each must file Form A3 Reg 6.4.
Part 4 — The AML/CFT Framework You Must Have Built Reg 8–14
Nine Mandatory Framework Components Reg 8.2
Documentation Standards Reg 8A.1
A quietly decisive clause — non-compliant submissions get returned. Every document filed with PVARA must:
CDD, EDD & Sanctions Reg 9–12
You cannot outsource your way out of AML Reg 14
AML-critical functions — CDD, EDD, sanctions/TFS screening, transaction monitoring, STR/CTR reporting and MLRO responsibilities — may not be outsourced unless the applicant conducts due diligence on the provider, maintains effective oversight, retains audit and inspection rights, and ensures the legal enforceability of audit and supervisory rights including across borders. No arrangement may impair your ability to meet AMLA or PVARA obligations (Reg 14.2). Disclose every arrangement on Form A5, signed by the Compliance Officer, with a per-service register covering data shared, SLAs, audit rights, sub-outsourcing, termination rights, risk rating and monitoring frequency.
Annex A — The Eight Statutory Forms
Form A1 — NOC Application
Ten sections: applicant details and group structure chart; services sought and full business-model narrative; governance and Key Individuals; Controllers, ownership and UBO; AML/CFT documentation checklist; technology and systems; goAML STR/CTR workflow; financial resources and capital evidence; other Pakistani and foreign licences; declaration.
Signed by two authorised signatories — typically CEO plus one other Key Individual
Form A2 — Controller & UBO Disclosure
Completed by every Controller (20%+) and every Beneficial Owner, for the applicant and the proposed local entity. Covers identity, PEP status, nature of control, shareholding chart, professional background, regulatory and criminal record, financial soundness, and full Source of Wealth / Source of Funds narratives with documentary evidence.
If funds originate offshore: jurisdiction, bank and transfer pathway must be given
Form A3 — Fit & Proper Questionnaire
Twelve sections per Key Individual: personal info, ten-year employment history with reasons for leaving, qualifications and AML training, regulatory record, criminal record, financial soundness, conflicts of interest, integrity and professional conduct, health and capacity, two independent professional references, and other time commitments.
References must not be relatives, subordinates or conflicted persons. Employment gaps of 3+ months must be explained.
Form A4 — AML/CFT Framework Statement
Signed by CEO and MLRO jointly. Certifies eleven documents are submitted in final Board-approved form; confirms compliance with AMLA 2010, the NOC Regulations and goAML requirements; attaches the Board resolution; and confirms operational readiness of onboarding, screening, monitoring, blockchain analytics, case management and retention systems.
Must certify the framework is tailored to your business model and not a template
Form A5 — Outsourcing Declaration
Compliance Officer declaration plus a line-by-line register for each AML-relevant outsourced service: provider name, country, function, AML relevance, data shared, SLA summary, audit rights, sub-outsourcing permission, termination rights, risk rating and monitoring frequency.
Contracts must include audit and inspection rights for the Applicant and PVARA
Form A6 — Annual AML/CFT Return
Filed once per calendar year by NOC holders. Eight sections: entity profile and Key Individuals in post; MLRO annual statement and governance changes; risk assessment update and emerging typologies; CDD metrics; transaction monitoring metrics; STR/CTR counts and suspicion categories; independent audit findings and remediation status; joint CEO and MLRO declaration.
Metrics include customers refused at onboarding and exited on AML grounds
Form A7 — Internal SAR (ISAR)
Minimum content for internal escalation: reporter details; customer name, wallet addresses and account numbers; transaction dates, amounts, type and on-chain / off-chain details; suspicion narrative with observed behaviour and red flags; and the MLRO determination — file STR, do not file, or seek further information.
VASPs may use their own ISAR format provided it carries at least this content
Form A8 — Key Individual Change
One form per individual, filed on any new appointment, replacement, role modification, resignation or removal. Requires Form A3, signed CV, CNIC/passport, Board approval resolution, police clearance for new appointments, and employment contract where applicable — plus an acknowledgment signed by the Key Individual personally.
Triggered by any change affecting an existing Key Individual, not only new hires
Eight forms, one rejected page
Incomplete NOC applications "may be delayed or returned" (Form A1 preamble). The failure points we see most: Form A3 references from subordinates, missing Board resolutions behind Form A4, unindexed PDFs breaching Reg 8A.1, and ownership charts that stop before the ultimate natural person.
Assessment, Decision & Revocation Reg 16–19
What PVARA Assesses Reg 16.1
All of this is re-evaluated at the licensing stage — the NOC assessment is not a one-time clearance. PVARA may also conduct inspections or request further information Reg 16.3.
Five Grounds for Revocation Reg 19.1
Revocation is applied proportionately, taking into account the severity and impact of the breach Reg 19.2. Note the fifth ground: an NOC is a bridge with a time limit, not a destination.
Ongoing Obligations of an NOC Holder Reg 18.1
Requirements
Corporate Requirements (SECP & PVARA)
Fit & Proper — Who and How s.20
AML/CFT & the Travel Rule s.46–49
Technology, Cyber & Data s.34, s.39–40
The requirement most applicants underestimate
It is not capital. It is operational readiness. Form A4 requires the CEO and MLRO to jointly certify that onboarding and KYC tools, sanctions and TFS screening, transaction monitoring software, blockchain analytics, case management, and data retention systems are "implemented, tested and operational" — not planned, not procured. Regulation 16.1(b) makes operational readiness an assessment criterion in its own right, and Regulation 11.6 requires demonstrable technical capability to file STRs and CTRs immediately on goAML registration. Build the stack before you file, not after.
Customer Assets & Prudential Rules
Chapter 4 is the part of the Act that most directly answers the question a Pakistani retail user will ask you: "what happens to my coins if you go under?" The answers are unusually strong by regional standards — statutory segregation, bankruptcy remoteness, a codified fiduciary duty, and a rehypothecation ban.
Segregation of Customer Assets
A Licensee must hold Customer Assets — Virtual Assets and fiat — in segregated accounts separate from its own assets at all times, in the manner prescribed by Regulations.s.24(1)
Bankruptcy Remoteness
Notwithstanding any other law, Customer Assets held by a Licensee shall not form part of the Licensee's estate in the event of insolvency or liquidation.s.24(2)
Statutory Fiduciary Duty
A Licensee owes a fiduciary duty to its customers and must at all times act honestly, fairly and in their best interests when dealing with Customer Assets.s.24(3)
No Rehypothecation Without Consent
A Licensee shall not rehypothecate, lend, pledge or otherwise encumber Customer Assets — Virtual Assets or fiat — without the customer's explicit, informed and revocable written consent.s.24(4)
Custody Standards & Key Management s.26
Proof-of-Reserves & Audit s.27, s.29
Why s.24(2) is a commercial asset, not just a compliance cost
Bankruptcy-remoteness written into primary legislation — with an express override of any inconsistent insolvency law — is a marketing fact, not a footnote. Combined with the s.24(3) fiduciary duty and the s.24(4) rehypothecation ban, a PVARA-licensed venue can make a stronger customer-protection claim to Pakistani users than an offshore platform serving the same market from a jurisdiction with none of these. Firms that build disclosure around this get to convert regulation into trust.
Stablecoins & Token Issuance
Chapter 5 governs anyone who wants to issue a token in or from Pakistan — a PKR or USD stablecoin, a tokenized-gold instrument, or a public token sale. Three regimes apply: Initial Virtual Asset Offerings (s.30), Fiat-Referenced Tokens (s.31), and Asset-Referenced Tokens (s.32), with an enhanced tier for Significant Issuers (s.33).
Fiat-Referenced Tokens (FRT) s.31
A Virtual Asset that purports to maintain a stable value relative to a single Official Currency of any country and is redeemable at par value by its issuer s.3(ix). Every FRT issuer must comply with:
PVARA may differentiate requirements by size, scope, complexity or risk — including expedited approval, stress testing and ongoing supervision — and must consult the State Bank of Pakistan on reserve arrangements s.31(2).
Asset-Referenced Tokens (ART) s.32
A Virtual Asset representing ownership rights, claims or economic interests — including entitlements to income or returns — in one or more underlying assets, or designed to hold stable value by reference to them s.3(i).
Initial Virtual Asset Offerings s.30, s.42
Algorithmic Tokens & Significant Issuers
Prohibition on algorithmic tokens s.53: No person shall issue, offer or market a Virtual Asset whose primary mechanism for maintaining value is algorithmic and not fully or adequately collateralised — unless specifically permitted by Regulations and subject to the safeguards prescribed there. This is a default prohibition with a narrow regulatory door, not a licensing condition.
Significant Issuers s.33: An Issuer is deemed Significant where it meets thresholds prescribed by Regulations having regard to size, scale, systemic importance, market impact, number of holders and cross-border activity. Significant Issuers must be registered with PVARA and comply with enhanced reporting, disclosure, governance and risk management requirements. Plan for this tier before you cross into it — the thresholds are set by Regulation, not by negotiation.
Conduct, Prohibitions & Penalties
Criminal Offences — the Full Section 54 Schedule
| Offence | Imprisonment | Fine | Section |
|---|---|---|---|
| Wilfully providing an unlicensed Virtual Asset Service | Up to 5 years | Up to PKR 50 million | s.54(1) |
| Conducting an Initial Virtual Asset Offering in contravention of the Act | Up to 3 years | Up to PKR 25 million | s.54(2) |
| Market manipulation or insider trading — natural person | Up to 3 years | Up to PKR 25 million | s.54(3)(a) |
| Market manipulation or insider trading — legal person | — | 3× profit gained or loss avoided; if indeterminable, up to 15% of total annual turnover in the preceding financial year | s.54(3)(b) |
| Knowingly making a false or misleading statement in any application, return or document submitted to PVARA | Up to 3 years | Up to PKR 20 million | s.54(4) |
| Obstructing an officer of the Authority in the exercise of powers | Up to 2 years | Up to PKR 10 million | s.54(5) |
| Wilfully failing to comply with any order or decision of the Authority | Up to 1 year | Up to PKR 25 million (plus administrative penalties) | s.54(6) |
| Wilfully refusing to provide information required by an Authorized Officer | Up to 1 year | Up to PKR 1 million | s.57(3) |
| Administrative penalty for any contravention of the Act | — | Up to PKR 25 million | s.59(4) |
Swipe the table sideways to see fines and section references
Fines are stated as maxima. Where an offence is committed by a body corporate with the consent, connivance or neglect of any director, manager, secretary or similar officer, that person is deemed to have committed the offence personally s.55. Offences are investigated, tried and punished under the Code of Criminal Procedure 1898 and the Qanun-e-Shahadat Order 1984, and the Federal Government may designate Special Courts s.54(7)–(8). No court may take cognizance except on a written report by an authorised officer of PVARA s.57(4).
Prohibited Activities Chapter 9, ss.50–53
Market Conduct Duties Chapter 7, ss.41–45
Integrity & fair dealing
Conduct business honestly, fairly and professionally, in customers' best interests and in a manner upholding market integrity s.41(1)
Conflicts of interest
Identify, manage and disclose conflicts; never place your own interests above your customers' s.44
Complaint handling
Establish and maintain internal complaint-handling procedures per Regulations s.45(1)
Independent dispute resolution
PVARA may establish or recognise an independent scheme for claims below a prescribed monetary threshold s.45(2)
Enforcement Powers
Administrative Sanctions s.59
Emergency & Access-Blocking Powers s.60–61
Sandbox Suspension & Revocation
Separately from the Act's enforcement regime, PVARA may temporarily suspend sandbox testing and approval where it has reason to believe a participant has failed to adhere to agreed details or imposed conditions, until the matter is fully clarified — and may completely withdraw approval with a public notice where a serious discrepancy relating to consumer detriment or any other serious matter is observed. Under Annexure-B, PVARA may also terminate participation on 15 days' written notice, or immediately for breach of the testing plan, expected negative consequences for consumers or financial stability, failure to provide requested information, or public interest.
Appeals & the Virtual Assets Appellate Tribunal
Chapter 11 creates a specialist forum with exclusive jurisdiction: no ordinary court may take cognizance of a legal dispute under the Act or its Rules and Regulations to which the Tribunal's jurisdiction extends. If PVARA refuses your NOC, refuses or revokes your licence, or imposes a sanction, this is the route.
Composition & Qualification s.62
Powers & Procedure s.64
Procedural protections worth knowing before you need them
The Act builds in due process at several points. A licence cannot be varied, suspended or revoked without written notice and an opportunity of being heard (s.23(1)). Refusals of an NOC or a licence must carry written reasons (s.19(3), s.21(1)(b)). Access-blocking orders must state reasons and statutory basis, and carry a 10-day representation right with a 15-day response deadline (s.61(3),(5)). Criminal prosecution requires a written report by an authorised PVARA officer before any court takes cognizance (s.57(4)), prosecutions are conducted by a special public prosecutor (s.58(1)), and hearings may not be adjourned more than fourteen days at a time without recorded sufficient cause (s.58(4)). Document every interaction with the regulator from day one — these protections are only as good as your record of what was said and when.
Key Bodies & People
Bilal bin Saqib
CEO, Pakistan Crypto Council
Special Assistant to the PM on Blockchain & Crypto | Senior crypto-policy figure
Muhammad Aurangzeb
Finance Minister
Chairman, Pakistan Crypto Council. Also sits on PVARA via the Secretary, Ministry of Finance seat under s.7(1)(b)
Changpeng Zhao (CZ)
Strategic Advisor — PCC
Binance Founder | Advisor to the Pakistan Crypto Council (PCC), not to PVARA
The Pakistan Crypto Council is not PVARA
The PCC is a policy and promotion body. PVARA is the statutory regulator created by Section 6 of the Act, with its own Board composition fixed by Section 7(1). Advisors and officers of the PCC hold no licensing authority. Applications, forms and correspondence go to PVARA — a warm introduction at the PCC does not shorten the s.19 process or the 60-day clock under NOC Regulation 17.1.
Regulatory Bodies & Who Does What
Primary licensing, sandbox and supervision authority for all Virtual Asset Service Providers and Issuers. Autonomous body corporate, HQ Islamabad. s.6, s.9
Company incorporation under the Companies Act 2017 and securities oversight. Its Chairperson sits on the PVARA Board; PVARA notifies SECP to initiate winding-up on licence revocation. s.7(1)(e), s.23(2)
Financial Monitoring Unit — receives STRs and CTRs via the mandatory goAML portal. A statutory information-sharing counterparty, not a PVARA Board member. s.17(1), s.46(2)(a)
State Bank of Pakistan. Governor sits on the PVARA Board and their presence is mandatory for quorum. Consulted on FRT and ART reserve arrangements. s.7(1)(d), s.8(2), s.31(2)
National AML-CFT Authority. Its Chairman sits on the PVARA Board, and PVARA must coordinate with it and the FMU to combat ML/TF involving Virtual Assets. s.7(1)(f), s.9(1)(g)
Pakistan Digital Authority — its Chairperson holds a seat on the PVARA Board. s.7(1)(g)
Federal Board of Revenue. Every licensed VASP must comply with the Income Tax Act 2001 and FBR rules; FBR is a statutory information-sharing counterparty but holds no Board seat. s.66, s.17(1)
Federal Investigation Agency — named in s.17(1) among the agencies with which PVARA must share supervisory and enforcement information in a timely and secure manner.
Specialist appellate forum with exclusive jurisdiction over disputes under the Act. Three members; 30-day filing window; 3-month decision deadline. s.62–65
Banking access — SBP Circular No. 10 of 2026
The State Bank of Pakistan is reported to have authorised commercial banks to open and maintain accounts for PVARA-licensed VASPs on 14 April 2026. If accurate, this removes what had been the single biggest operational barrier for crypto companies in Pakistan — a licence with no bank account is a licence you cannot use. Verify the exact scope and conditions against the official circular before relying on it, particularly whether it extends to NOC holders providing AML-Registered Services or only to fully licensed VASPs. See our Tax & Banking services for bank account facilitation.
Current Market Status
Reported NOC Activity Per Media Reports
World's largest crypto exchange — reported in media to have received a PVARA No Objection Certificate.
Major Asian exchange — reported in media as progressing through the PVARA process.
How to verify: PVARA does not maintain a public NOC holders list, so all NOC reporting is media-sourced and unverified. What will be verifiable is the register of full Licensees — Section 21(4) requires PVARA to maintain and publish an up-to-date register on its official website showing each Licensee's name, licence number, permitted services and current regulatory status. Until a firm appears there, treat any "licensed in Pakistan" claim with caution.
Where the first-mover advantage actually sits
Not in being first to announce. In being first through Regulation 15.3: NOC issued → goAML registration completed → local entity incorporated → licensing application filed within three months of the VASP licensing regulations being promulgated. Firms that complete goAML registration early can lawfully run Exchange, Broker-Dealer, Custody and Derivatives services while competitors are still assembling Form A1 attachments — and Regulation 19.1(e) makes clear that an NOC holder who does not progress toward a full licence can have that NOC revoked. The advantage goes to whoever moves through the pipeline fastest, not whoever enters it first.
Regulatory Sandbox 2026
LIVEOfficial PVARA Sandbox Guidelines 2026 · Act s.35
PVARA's Regulatory Sandbox is a controlled environment for testing innovative Virtual Asset products and services under supervision, without a full licence from day one. The Guidelines operationalise the mandate at Section 35 of the Virtual Assets Act 2026 (drafted against Ordinance ss.42–45) and set out procedures for intake, assessment, onboarding, supervision, monitoring and exit — balancing innovation against investor protection, financial stability, market integrity and risk management.
The Seven Stated Objectives
No-Action Relief
PVARA may issue a no-action letter to a participant, stating that it does not intend to take enforcement action in respect of specified conduct for the duration of the test period. The statutory basis is s.35(3), which lets PVARA issue guidance, no-objection statements or no-action communications in accordance with Regulations.
Key Sandbox Definitions
Agile Approach — a process under which applicants may submit applications at any time during the year. There are no fixed intake windows or cohorts.
Participant — an applicant approved to operate within the Sandbox under a supervisory agreement with the Authority.
Exit — the process at the conclusion of testing through which a participant either transitions to full licensing, discontinues the service, or takes other steps as directed by the Authority.
The sandbox is not a shortcut around the licence
Under the Annexure-B undertaking, a participant expressly agrees that if the product or service is deemed successful, its rollout shall be subject to licence or approval by the Authority and compliance with regulatory requirements. It also agrees that PVARA is under no obligation to amend the regulatory framework or introduce new provisions to accommodate the product, and that any determination on regulatory change remains at PVARA's sole discretion. Enter the sandbox to answer a regulatory question — not to avoid one.
All applicants must satisfy each of the following before PVARA will consider a sandbox application. Note that the fit-and-proper test here reaches directors, sponsor shareholders, controllers and key management.
Fit & Proper
No director, sponsor shareholder, controller or key manager found liable for fraud, financial crime or misconduct; prior regulatory or licensing breaches including proscribed and designated persons; or bankruptcy or insolvency proceedings unless adequately resolved.
Clearly Defined Testing Plan
Objectives, duration, KPIs and target users. Vague pilots do not pass screening — PVARA needs to know what success looks like before it grants a Letter of Approval.
Governance & Internal Control
Complete governance structure with a clearly identifiable Ultimate Beneficial Owner; enterprise risk assessment; KYC and screening covering both originator and beneficiary; complaint handling; segregation of client money and virtual assets; liability management; suspicious-transaction flagging and reporting.
Consumer Protection
Data security, dispute resolution, safeguarding of consumer assets, fraud liability management, and complete risk disclosure to clients.
Technology Risk & Cybersecurity
System controls, cybersecurity and protection of the private key. Compliance with cross-border supervision and information-sharing protocols where applicable.
Exit Plan & Scalability
A sandbox exit plan specifying transition to full authorisation or orderly wind-down, plus demonstrated readiness for scalability across technical, financial and human resources.
Regulatory & Risk Assessment
A comprehensive submitted assessment addressing cybersecurity, data privacy and operational risks, plus market risk and systemic risks.
The Purpose Test
Confirm compliance with the applicable legal framework and that the product or service is not designed for speculation, anonymity, or illicit activity. This is an express eligibility condition — privacy-maximalist and pure-speculation models are screened out at the door.
Foreign Applicants
Where the applicant is not a local company, it will be required to have the company incorporated and to evidence tax registration with local tax authorities as and when sandbox approval is granted (Form I §E). Budget the incorporation timeline into your test-start date, not after it.
Agile Approach: applications are accepted across the year. No fixed intake windows, no cohorts — submit when you are ready.
Submit Form I
Five parts: (A) innovation and VASP proposition — a 500–1,000 word innovation summary, blockchain/technology stack, cybersecurity strategy, regulatory and legal environment, risk management table; (B) readiness for testing; (C) exit strategy and scaling; (D) applicants' background; (E) applicant particulars and technical details including your Schedule I application category.
Submit the Annexure-A Self-Assessment
A structured checklist scored against positive and negative indicators across eight dimensions: scope, business scalability, technology and security, genuine innovation, consumer and investor benefit, readiness, genuine need for the sandbox, and ML/TF compliance preparedness. Filed with the application, not after.
Initial Screening
Applications are reviewed for all required documents and mandatory information. Incomplete applications are returned with a request for revisions, with up to two resubmissions permitted. Use them carefully — there is no third.
Assessment Phase — 60 Working Days
Comprehensive evaluation must be completed within sixty working days from the conclusion of initial screening, unless PVARA determines there is reasonable cause to extend. Where the applicant is already regulated elsewhere, input from the relevant regulator may be sought, and PVARA may request further information at any point.
Letter of Approval & Annexure-B Undertaking
Successful applicants receive a Letter of Approval (LoA) subject to terms and conditions approved by the Authority. On approval, the participant must submit the formal Annexure-B undertaking. A No-Action Letter may be issued for the testing period.
Testing Phase
Operate for the approved period, submitting reports whose contents, format and frequency are agreed with PVARA before testing commences. If an unexpected technical or business difficulty arises beyond your control, an extension request must be submitted at least two weeks before expiry. Any unforeseen circumstance impairing your ability to commence or complete testing must be notified promptly.
Completion Report — Within Two Weeks
Submit within two weeks of the close of the testing period: overall results and statistics; an objective assessment of potential impact including a comparison of results against the objectives defined at inception; the scope for scaling out to a larger audience if successful; and how you will fully comply with relevant legal and regulatory requirements.
Exit Stage
PVARA analyses the testing results together with your completion report and determines the future course of action — transition to full licensing, discontinuation, or other directed steps.
Form I — Submission Checklist (Twelve Items)
Innovation & Market Impact
- Novelty: a product, service or business model not currently offered in the market
- Harnessing technology: a new application of existing technology, or a completely new one
- Differentiation: a significant departure from or improvement on existing offerings, addressing market inefficiencies
- Inclusion: transitions a largely informal, high-risk market into a formalised, regulated ecosystem
Risk Management & Compliance
- Review of systemic, operational and ML/TF/PF risks
- Evaluation of cybersecurity, data protection and consumer protection frameworks
- Consultation with Shariah advisors where applicable
- Strong KYC/AML processes integrated into platform design, aligned with FATF and Pakistan's AML laws
Feasibility & Exit Strategy
- Technical and operational readiness, including team expertise
- Clear testing parameters
- Exit plans — winding down if unsuccessful, transitioning to licensing if successful
- PVARA may impose limits on transaction volumes, user numbers or exposure case by case
Financial Strength
- Demonstrated financial capacity to undertake the proposed business model
- Budget and funding commitments for the test phase
- KPIs and KRIs clearly defined
- Insurance coverage to indemnify clients against losses from fraud or gross negligence
Tax Law Compliance
- Demonstrated compliance with applicable tax laws in Pakistan, if based in Pakistan
- Complete financial records as required by law
- No engagement in or facilitation of tax evasion
- International applicants: incorporate locally and register with tax authorities on approval
Consumer & Investor Benefit
- Increases transparency, lowers costs or improves efficiency for users
- Enhances financial inclusion or access to digital financial services
- Identifies and proposes mitigation for ML/TF, volatility, fraud and cyber risks
- Benefits to users, markets and the national exchequer
Annexure-A negative indicators — what gets you rejected
The self-assessment scores against explicit negatives: not related to Virtual Asset Services; weak or stagnant user adoption; reliance on niche or unsustainable demand such as speculative hype only; no security audits or reliance on unverified smart contracts; no safeguards for custody of consumer funds in a cyber intrusion; numerous similar models already existing in Pakistan or only minor tweaks to an existing product; limited transparency or cost inefficiency; no clear risk mitigation for hacks, price manipulation or data privacy; concept only on paper; and — decisively — live testing not being necessary to answer a regulatory or market question. If your model does not need regulatory flexibility, the sandbox is the wrong door.
On approval, the participant executes a formal undertaking in favour of PVARA (Annexure-B), given unconditionally and irrevocably and signed by authorised signatories with power of attorney, before two witnesses. These are the obligations that bind you during testing — read them before you apply, not after you are approved.
Operating Discipline
Operate strictly within the parameters set by PVARA; adhere to all applicable Pakistani laws, rules and regulations; maintain consumer protection, ML/TF/PF, data security and risk management measures; and ensure retention and confidentiality of consumer data.
Reporting & Access
Submit progress reports signed by a competent authority designated by the CEO, in the agreed format and timelines. Allow PVARA complete access to core reporting, accounting and significant software. Maintain proper records for review at any time. Allow PVARA to validate transactions and trace the flow of funds.
Incident Response Clock
Notify PVARA within one hour of any material incident, risk event or compliance breach, detailing the extent of the breach and remediation undertaken — then submit a detailed incident report within 48 hours covering nature and scope, containment and resolution steps, and measures to prevent recurrence. Build the escalation runbook before you go live.
Insurance & Indemnity
Obtain insurance coverage to indemnify clients against losses incurred as a result of fraud or gross negligence. Indemnify and hold PVARA harmless from any claims arising from participation. PVARA may impose terms on limits of liability at any appropriate time.
Test User Rights
Afford all test users the highest standard of protection, fairness and transparency. Never engage in any practice resulting in consumer harm, financial loss, misleading information or unfair treatment. Keep personal and financial data secure and confidential. Test users have the right to access, correct or request deletion of their personal data at any time.
Termination Triggers
PVARA may terminate on 15 days' written notice, or immediately for: breach of the testing plan; deployment expected to have negative consequences for consumers or overall financial stability; failure to provide requested information; or public interest.
Exit & Commercialisation
Abide by and execute the exit strategy per PVARA's decision. Accept that commercial rollout requires a licence or approval. Where deployment depends on regulatory change, PVARA may allow continued provision under specific terms until amendments are adopted — but is under no obligation to amend the framework, and that determination is at its sole discretion.
Records, Tax & Disputes
Retain all transaction records and proper books of account for seven years. Fulfil all tax obligations and never facilitate tax evasion. Consent to PVARA disclosing or publishing non-identifying information about your participation. Attempt in good faith to resolve disputes; unresolved disputes go to a competent court in Pakistan. The decision of the Authority is final.
Ready to Apply for the PVARA Regulatory Sandbox?
Applications are open year-round — but you only get two resubmissions if the pack comes back incomplete. We prepare Form I, the Annexure-A self-assessment and the Annexure-B undertaking, and pre-test the whole file against the screening criteria before it goes in.
PVARA FAQ
The twelve questions we are asked most often by exchanges, payment firms and token issuers looking at Pakistan — answered directly from the Act, the NOC Regulations and the Sandbox Guidelines, with the section reference in each answer.
What is PVARA and what law created it?
How many VASP licence categories are there in Pakistan?
Can a VASP operate in Pakistan with only a PVARA NOC, before getting a full licence?
How long does PVARA take to decide an NOC application?
What is the penalty for operating an unlicensed crypto exchange in Pakistan?
Is a local Pakistani company required for a PVARA licence?
Are existing crypto businesses in Pakistan grandfathered?
Does PVARA regulate NFTs and in-game tokens?
Are algorithmic stablecoins allowed in Pakistan?
What is the PVARA Regulatory Sandbox and who can apply?
How long must a Pakistani VASP keep AML records?
Can I appeal a PVARA decision?
Next Steps
Ready to Enter Pakistan's Crypto Market?
Route & Category Assessment
We map the right entry route — NOC, Sandbox, No-Action Letter or full licence — identify which of the ten Schedule I categories you actually need, and model the capital and timeline for each.
Application Build & Pre-Test
Full preparation of Form A1 with Forms A2–A5, or the Sandbox Form I with Annexures A and B — pre-tested against the Reg 8A.1 documentation standards and the assessment criteria before filing.
Local Setup & Ongoing Compliance
SECP incorporation, goAML registration, AML framework and FBR registration, banking access, and the s.22 ongoing obligations including the Form A6 annual return.
Sources & Disclaimer
This guide is for informational purposes only and does not constitute legal, financial or regulatory advice. It is based on three official documents: the Virtual Assets Act, 2026 as passed by the National Assembly of Pakistan (74 sections and Schedule I, successor to the Virtual Assets Ordinance, 2025 (VII of 2025)); the PVARA No Objection Certificate Regulations 2025 (document code PVARA/REG/AML-REG/2025-1, version 1.0 Final, effective 2 December 2025, issued by the PVARA Licensing & Supervision Division, including Annex A Forms A1–A8); and the PVARA Sandbox Guidelines 2026 (including Form I, Annexure-A and Annexure-B). Section references are given throughout so every claim can be independently verified against the source text.
Important qualifications. The NOC Regulations 2025 and Sandbox Guidelines 2026 were drafted against the Virtual Assets Ordinance, 2025 and cite its section numbering, which the Act 2026 subsequently changed; both remain operative by virtue of Section 74. Per-category minimum paid-up capital figures are drawn from the Draft Pakistan Virtual Asset Services Regulations 2026 and remain in draft — the Act itself sets no amounts, and figures must be confirmed at filing. No published PVARA fee schedule had been located at the time of writing, but Sections 14(2)(h), 19(2) and 19(4)(a) expressly contemplate NOC, licensing, supervision and renewal fees; treat fees as pending rather than absent. NOC recipient information is based on media reports only — PVARA does not maintain a public NOC holders list, though Section 21(4) requires a public register of full Licensees. References to SBP Circular No. 10 of 2026 are reported and should be verified against the official circular. User and market statistics are estimates. Readers should consult qualified professionals and verify current requirements directly with PVARA before making any business decisions.
Official Sources: pvara.gov.pk · secp.gov.pk · sbp.org.pk · fbr.gov.pk · fmu.gov.pk
© 2026 CoinConnect | Published: March 2026 | Last Updated: 8 August 2026 | v3.0
Continuing analysis on the CoinConnect blog
This guide tracks the instruments themselves. Ongoing commentary, worked examples and updates as PVARA issues new regulations are published on blog.coinconnect.site, the official CoinConnect blog.
PVARA
License & Sandbox Guide — Pakistan 2026
Pakistan Virtual Assets Regulatory Framework 2026
A section-by-section guide to the Virtual Assets Act 2026 as passed by the National Assembly, the ten Schedule I service categories and their capital requirements, the No Objection Certificate Regulations 2025 (Forms A1–A8), the Regulatory Sandbox Guidelines 2026, AML/CFT and Travel Rule duties, the Section 54 offence schedule, and the appeals route — written for Virtual Asset Service Providers planning market entry into Pakistan.
PVARA licensing is the approval a business needs to provide any virtual asset service in Pakistan. It is issued by the Pakistan Virtual Assets Regulatory Authority under the Virtual Assets Act 2026. Schedule I of the Act defines ten licensable service categories, and Section 50(1) requires a licensed business to be both incorporated in Pakistan and PVARA-licensed — a foreign licence satisfies neither condition. Entry runs through a No Objection Certificate under the NOC Regulations 2025 (Forms A1–A8), which PVARA must decide within 60 calendar days of a complete submission under Regulation 17.1. An NOC holder that has completed FMU goAML registration may provide four AML-Registered Services before full licensing. Novel products may instead enter the Regulatory Sandbox under Section 35. Operating unlicensed is a criminal offence under Section 54(1), carrying up to five years’ imprisonment, a fine up to PKR 50 million, or both.
Every claim in this guide is cited to a section, regulation or form of the official text. Sources and their status are listed below.
Table of Contents
19 sections · every claim cited to a section, regulation or form of the official text
Virtual Assets Act, 2026
As passed by the National Assembly
74 sections + Schedule I. Successor to the Virtual Assets Ordinance, 2025 (VII of 2025) signed 8 July 2025, saved by Section 74.
NOC Regulations 2025
PVARA/REG/AML-REG/2025-1 · v1.0 Final
Effective 2 December 2025. Parts 1–6 plus Annex A statutory Forms A1–A8. Issued by PVARA Licensing & Supervision Division.
PVARA Sandbox Guidelines 2026
14 clauses + Form I, Annexures A & B
Operationalises the sandbox mandate. Agile intake, 60 working-day evaluation, Letter of Approval, No-Action Relief.
Executive Summary
The Pakistan Virtual Assets Regulatory Authority (PVARA) is established under Section 6 of the Virtual Assets Act 2026 as an autonomous body corporate with perpetual succession, headquartered in Islamabad. The Act began life as the Virtual Assets Ordinance, 2025 (VII of 2025), signed 8 July 2025; Section 74 saves every appointment, notification and approval made under that Ordinance. PVARA licenses, regulates and supervises Virtual Asset Service Providers (VASPs) and Issuers operating in or from Pakistan.
The rulebook is now substantially in place across three official instruments. Schedule I of the Act defines the ten categories of Virtual Asset Services subject to licensing. The No Objection Certificate Regulations 2025 (document code PVARA/REG/AML-REG/2025-1, v1.0 Final, effective 2 December 2025) govern pre-incorporation clearance, AML/CFT minimum standards, fit-and-proper testing and the eight statutory forms A1–A8. The PVARA Sandbox Guidelines 2026 govern supervised live testing.
The single most commercially important fact on this page: under Regulation 2.3 and Regulation 17.1(a)(iii) of the NOC Regulations, an NOC holder that completes FMU goAML registration may lawfully provide four services before it holds a full licence — Exchange, Broker-Dealer, Custody, and Virtual Asset Derivatives Services — subject to PVARA's conditions and until its licence application is finally determined. Every other Virtual Asset Service requires a full licence first. This phased pathway is the fastest legal route into Pakistan today.
A Complete Statutory Framework
Twelve chapters covering licensing, prudential standards, customer-asset segregation, stablecoin issuance, market conduct, AML/CFT, criminal offences and an appellate tribunal.Act, Ch. 1–12
~35M Estimated Crypto Users
Pakistan ranks among the top countries globally in grassroots crypto adoption, with significant untapped market potential.Estimate
Four Services Open Pre-Licence
Exchange, Broker-Dealer, Custody and Derivatives are designated AML-Registered Services and can be provided on an NOC + goAML registration.NOC Reg 2.3
FATF-Aligned by Statute
VASPs are deemed financial institutions under AMLA 2010. Travel Rule, TFS screening, STR/CTR filing via goAML and 7-year records are mandatory.Act s.46–48
Regulatory Timeline
Pakistan moved from having no crypto policy to a full statutory regime in roughly eighteen months. Entries marked Official are drawn from the source documents; entries marked Media Reports are not confirmed by a published PVARA document.
- Feb 2025
Pakistan Crypto Council (PCC) Announced
Finance Ministry announces formation of the PCC to develop a crypto policy framework for Pakistan.
- Mar 14, 2025
PCC Formally Launched
Muhammad Aurangzeb (Finance Minister) as Chairman, Bilal bin Saqib as CEO of the Pakistan Crypto Council.
- Apr 7, 2025
CZ Appointed PCC Strategic Advisor
Binance founder Changpeng Zhao joins as Strategic Advisor to the Pakistan Crypto Council (PCC) — not PVARA directly.
- May 26, 2025
Bilal bin Saqib Elevated
Appointed Special Assistant to the PM on Blockchain & Crypto (Minister of State rank).
- Jul 8, 2025
Virtual Assets Ordinance, 2025 Signed Official
President Zardari signs the Virtual Assets Ordinance, 2025 (VII of 2025), establishing PVARA as a statutory authority. Section 74 of the later Act preserves everything done under it.
- Aug 2025
PVARA Operations Commence
PVARA holds its inaugural board meeting and begins regulatory operations from its Islamabad headquarters.
- Sep 2025
NOC Applications Invited
PVARA invites global crypto firms to apply for No Objection Certificates via pvara.gov.pk.
- Dec 2, 2025
NOC Regulations 2025 Take Effect Official
PVARA Licensing & Supervision Division publishes the No Objection Certificate Regulations 2025 (PVARA/REG/AML-REG/2025-1, v1.0 Final) with Forms A1–A8. Regulation 1.2: they commence upon publication on PVARA's website.
- Dec 2025
First NOCs Reported Media Reports
Major global exchanges (including Binance) are reported in media to have received NOCs. PVARA does not maintain a public NOC holders list, though Section 21(4) requires a public register of full Licensees.
- Apr 14, 2026
SBP Circular No. 10 of 2026 Verify Against Circular
State Bank of Pakistan reported to authorise banks to open accounts for PVARA-licensed VASPs — removing the single biggest operational barrier for crypto firms in Pakistan. Verify wording directly against the official circular.
- 2026
Virtual Assets Act 2026 Passed by the National Assembly Official
The Ordinance is replaced by the Virtual Assets Act, 2026 — 74 sections and Schedule I, extending to the whole of Pakistan and commencing at once (s.1). Section numbering shifts: the sandbox moves from Ordinance ss.42–45 to Act s.35; NOC/licensing from Ordinance ss.15/17 to Act s.19/s.21.
- 2026
Sandbox Guidelines 2026 Published Official
PVARA publishes the Sandbox Guidelines 2026 — agile year-round intake, Form I, Annexure-A self-assessment, Annexure-B undertaking, 60 working-day evaluation, Letter of Approval and No-Action Relief.
Reading section numbers correctly
The NOC Regulations 2025 and Sandbox Guidelines 2026 were both drafted against the Virtual Assets Ordinance, 2025 and cite its numbering (e.g. sandbox at ss.42–45, NOC at s.15, licence at s.17, AML designation at s.38). The Virtual Assets Act 2026 renumbered these provisions — sandbox is now s.35, NOC and licence applications are s.19, grant of licence is s.21, and AMLA application is s.46. Section 74 keeps everything done under the Ordinance valid, so both sets of citations remain live in practice. Advisers who quote only one numbering will misfile.
What is PVARA?
Legal Basis
Pakistan Virtual Assets Regulatory Authority
- Established: Section 6, Virtual Assets Act 2026 (orig. Ordinance VII of 2025, signed 8 Jul 2025)
- Legal form: Body corporate, perpetual succession, common seal, may sue and be sued s.6(2)
- Autonomy: Autonomous in the performance of its functions, subject to the Act s.6(3)
- Headquarters: Islamabad, with offices elsewhere in Pakistan as required s.6(4)
- Extent: Whole of Pakistan; in force at once s.1(2)–(3)
- Rulebook: NOC Regulations 2025, Sandbox Guidelines 2026, plus Regulations under s.68
- Website: pvara.gov.pk
Composition of the Authority s.7(1)
- Chairperson — appointed by the Federal Government
- Secretary, Ministry of Finance
- Secretary, Ministry of Law and Justice
- Governor, State Bank of Pakistan
- Chairperson, Securities & Exchange Commission of Pakistan
- Chairman, National AML-CFT Authority
- Chairperson, Pakistan Digital Authority
- Two independent directors with proven Virtual Asset, digital technology or digital finance expertise
Non-ex-officio members serve three years, renewable once s.7(2). The Authority must meet at least twice a year; quorum is 50% of total membership with the mandatory presence of the Chairperson, the Secretary Finance and the Governor SBP s.8(1)–(2). Decisions carry by majority of members present s.8(4).
Note: FBR and the Financial Monitoring Unit are not Board members. They are statutory information-sharing counterparties under s.17(1).
Leadership Offices
Chairperson — appointed by the Federal Government; must have demonstrable expertise in digital finance or technology and a minimum of three years' relevant professional experience. Removable before term only for gross misconduct or incapacity, after show-cause and a hearing. May resign in writing to the Prime Minister. s.11
Managing Director — appointed by the Authority for three years, extendable. Acts as Secretary to the Authority's proceedings without voting rights unless specifically authorised. The Authority may delegate any of its powers to the MD. s.10, s.12
Objectives, Functions & Powers s.9
Licensing & Supervision
Issue, vary, suspend and revoke licences, approvals and directives; prescribe eligibility, renewal and additional obligations. s.9(1)(a), s.9(2)(c)–(d)
Substance-Over-Form Classification
Classify any asset, service or person by its underlying function or economic effect, irrespective of the nomenclature assigned to it — in consultation with SBP or SECP where their mandates are engaged. s.9(1)(f)
On-Site & Off-Site Supervision
Conduct inspections and off-site monitoring; require licensees to furnish information, documents and data in the prescribed timeframe. s.9(2)(e)–(f)
Rulemaking
Make Regulations, standards, directives, guidelines, handbooks and circulars, in consultation with the Cabinet Division. s.9(2)(a), s.68
Regulatory Sandboxes
Operate sandboxes in a transparent and accountable manner; issue guidance, no-objection statements and no-action communications. s.9(2)(k), s.35
Blockchain & DLT Governance
Promote, govern and regulate adoption of blockchain and DLT across Pakistan, harmonised with other regulators and ministries. s.9(1)(e), s.36
Shariah Advisory Committee
A committee constituted by the Authority for advice on Shariah matters; sandbox evaluation includes consultation with Shariah advisors where applicable. s.3(xxvii)
Fees, Penalties & the PVARA Fund
Levy fees, charges and penalties as prescribed by Rules. The PVARA Fund expressly includes NOC, licensing, supervision and renewal fees, plus charges for sandbox participation. s.9(2)(j), s.14(2)(h),(j)
International Cooperation
Enter mutual-assistance arrangements with foreign regulators, including mutual recognition of regulations and licences, with prior Federal Government approval. s.9(2)(l), s.17(2)
Where PVARA's word is final — and where it isn't
Section 5(3) vests regulation of Virtual Assets, VASPs, tokenization of real-world assets and blockchain technology primarily in PVARA. Section 5(1) makes the Act prevail over inconsistent laws — with one carve-out: the Foreign Exchange Regulation Act, 1947 is expressly excluded from that override. Section 5(2) is the other exception: laws on data protection, data governance, cybersecurity, financial secrecy and cross-border personal-data transfer prevail over the Act and bind PVARA itself.
Statutory Definition — "Virtual Asset" s.3(xxxi)
"A digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, but does not include digital representations of fiat currency, securities or other financial assets regulated under any other law except where represented, issued, or transferred using distributed ledger technology. For the avoidance of doubt, Virtual Assets are not legal tender."
Note the carve-in at the end: a security or financial asset that is represented, issued or transferred using DLT can fall back inside PVARA's perimeter. Read alongside s.9(1)(f), this gives PVARA wide reach over tokenized real-world assets.
Six Definitions That Decide Your Filing
- Controller s.3(v)
- A person who, alone or with associates, holds or may exercise 20% or more of voting power, ownership interest or share capital of a Licensee — or otherwise exercises significant influence or control over its management or policies, directly or indirectly. The influence limb catches structures with no 20% shareholder.
- Key Individual s.3(xv)
- Covers full-time, part-time, acting or outsourced holders of ten roles: director, Managing Director, CFO, COO, head of internal audit, head of compliance, MLRO, head of risk management, head of information security — plus any position PVARA declares to be one by written notice.
- Issuer s.3(xiii)
- The legal person that originates or creates a Virtual Asset and retains primary control over initial supply, reserve assets or on-chain governance. Explanation: marketing, promoting, brokering, listing or providing technical maintenance without control over issuance, supply or reserves does not make you an Issuer.
- Customer Assets s.3(vii)
- Virtual Assets and fiat currency belonging to a customer that a VASP holds, safeguards or otherwise has custody or control over on that customer's behalf. Excludes assets owned by the VASP itself. Drives the segregation duty in s.24.
- Segregated Reserve s.3(xxvi)
- A pool of reserve assets kept separate from the Issuer's own assets, held in the Issuer's name or in a trust or special vehicle for token holders, under an independent custodian or regulated financial institution approved by PVARA — so that the Issuer or its creditors cannot claim the assets.
- Sponsor s.3(xxix)
- A person or group who contributed initial capital to establish the company or holds a controlling shareholding, directly or indirectly. Sponsors are subject to fit-and-proper determination alongside Controllers, the CEO and directors under s.20(1).
Who Must Be Licensed
Before capital, forms or timelines, answer one question: does the Act apply to you at all? Chapter 1 draws the perimeter with unusual precision — a scope rule, a seven-limb exclusion test, an extraterritorial reach clause and a flat prohibition on unlicensed business.
In Scope s.2(1)
Expressly Out of Scope s.2(2)
The Closed-Loop Token Test — All Seven Must Hold s.2(2)(a)
By design, technical architecture, or enforceable system controls, the token must satisfy every one of these. Fail one limb and the Act applies in full. This is the clause that decides whether a loyalty point, game credit or platform voucher is regulated.
The Flat Prohibition s.50(1)
No person shall, by way of business, engage in — or represent themselves as engaging in — any Virtual Asset Service in or from Pakistan unless that person is (a) a company incorporated in Pakistan under the Companies Act 2017 or another Pakistani incorporation law, and (b) holds a valid PVARA licence.
Both limbs are cumulative. A foreign licence, however respected, satisfies neither. Marketing is separately restricted: no person may advertise or market a Virtual Asset unless the Issuer holds a valid licence or registration under the Act s.43(1).
Extraterritorial Reach s.4
For investigation and enforcement, PVARA may exercise its powers extraterritorially to the fullest extent permitted by law. It may enter agreements with foreign regulators and law-enforcement agencies for mutual assistance, information sharing, and recognition and enforcement of regulatory decisions.
Critically, s.4(2) directs PVARA to prescribe by Regulations the conditions under which a service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to persons in Pakistan — the reverse-solicitation test. Enforcement practice is to be aligned with MLATs, FATF and IOSCO frameworks s.4(3).
Serving Pakistani users from offshore is not a loophole
"In or from Pakistan" plus the extraterritorial clause plus PVARA's blocking powers over websites, apps, advertisements, payment links, app stores, search engines, advertising networks, registrars and payment providers s.61(1)–(2) means an offshore platform actively serving Pakistani retail users is exposed on three fronts at once: criminal liability under s.54(1), access blocking under s.61, and an advertising prohibition under s.43. Until the reverse-solicitation Regulations are published, treat active targeting of Pakistani users as in scope.
Pakistan Crypto Market
estimated
Why Pakistan?
Massive Unbanked Population
Only ~21% of adults have formal bank accounts — crypto offers genuine financial inclusion potential, an outcome the Act itself names as an objective in s.9(1)(d).
High Remittance Market
$30B+ annual remittances create a natural use case for the Transfer & Settlement licence category — the lowest-capital route into cross-border payout models.
Young Tech-Savvy Demographics
~60% of the population is under 30, with high smartphone adoption and growing digital literacy.
Statutory Invitation to Invest
Section 9(1)(c) makes it a formal objective of the regulator to "attract investment and encourage companies operating in the fields of Virtual Assets to base their business in Pakistan." Few jurisdictions write that into the licensing statute.
Policy & State Infrastructure
Strategic Digital Wallet Company (SDWC)
Section 38 authorises the Federal Government to establish a wholly owned company for custody, administration and wallet infrastructure enabling the state to manage, transfer and record Virtual Assets in furtherance of strategic reserve objectives. It serves government and designated public bodies only — expressly not private persons. In statute.
Mining Framework
Section 37 lets PVARA issue mining regulations in consultation with government entities and establish a registration or declaration framework for operators exceeding thresholds of scale, energy use or hash rate. In statute.
Bitcoin Mining Electricity Allocation
Surplus electricity announced for Bitcoin mining and AI data centres (2025). Policy stage — verify current status. Announced
SBP Circular No. 10 of 2026
Reported 14 April 2026 — banks authorised to open accounts for PVARA-licensed VASPs. Verify against the official circular before relying on it. Verify
Tokenized Real-World Assets
Section 5(3) puts tokenization of real-world assets expressly within PVARA's primary remit, and s.32(2) permits Asset-Referenced Tokens over commodities, real estate, RWAs and securities. In statute.
Schedule I: The Ten Virtual Asset Services
Section 18 makes every service listed in Schedule I subject to licensing, and lets the Federal Government notify further services into it. These are the statutory definitions — the words that determine which licence you need and whether an exemption applies. Read them carefully: three of the ten contain express carve-outs that can take a business model out of scope entirely.
Advisory Services
Personalised recommendations, on a professional basis, to a customer — on request or at the VASP's initiative — relating to actions or transactions involving Virtual Assets.
Carve-out: "Personalised" means addressed to a specific customer and taking account of their circumstances, objectives, risk profile or financial situation. General market information, research reports and non-individualised suggestions are not personalised recommendations.
Broker-Dealer Services
(a) Arranging or facilitating orders between two parties; (b) soliciting or accepting orders and receiving consideration in fiat or Virtual Assets; (c) trading on own account; (d) market-making using Customer Assets; (e) placement or distribution services for Issuers as intermediary.
Exemption: A person dealing solely on its own account, not executing customer orders and not holding or controlling Customer Assets, is not carrying on broker-dealer services.
Custody & Administration Services
Safekeeping or administration on behalf of customers and pursuant to their instructions of (a) Virtual Assets, or (b) private cryptographic keys or other access means allowing independent transfer or disposal.
Carve-out: Excludes the mere provision of software, hardware or infrastructure where the customer retains exclusive control over their own private keys — the non-custodial wallet exemption.
Exchange Services
(a) Exchanging Virtual Assets for fiat; (b) exchanging one or more types of Virtual Assets; (c) matching orders between buyers and sellers and executing those conversions; or (d) maintaining an order book for those purposes.
The order-book limb is broad — a venue that only maintains the book, without itself executing, is still in scope.
Lending & Borrowing Services
Facilitation, arrangement, intermediation or direct provision as principal of lending or borrowing arrangements involving Virtual Assets, where lenders transfer or make available Virtual Assets subject to a contractual obligation to return equivalent assets, with any agreed interest, fees or rewards, at a specified time or on demand.
Covers both the platform and the principal lender — there is no "we only match" exemption here.
Virtual Asset Derivatives Services
Offering, facilitation, execution, clearing, trading or arranging of transactions in derivatives — including futures, options, swaps, contracts for difference and similar instruments.
One of the four services available pre-licence as an AML-Registered Service under NOC Regulation 2.3.
Management & Investment Services
Acting in a fiduciary or agency capacity to manage or administer another person's Virtual Assets, including (a) portfolio or discretionary investment management, and (b) responsibility for staking on behalf of customers to earn validator or network rewards.
Staking scope: Only caught where staking is performed on a discretionary basis or forms part of a broader investment management mandate.
Transfer & Settlement Services
Transfer, transmission or settlement of Virtual Assets between parties, or from one wallet, address or location to another, on behalf of customers — excluding exchange execution.
The core category for cross-border remittance and stablecoin-payout models targeting Pakistan's $30B+ inbound remittance corridor.
Virtual Assets Issuance Services
Creation, issuance, initial offering, administration and ongoing management of Virtual Assets — including supply control, reserve management (if any), redemption, governance and required disclosures.
Fiat-Referenced and Asset-Referenced Tokens sit inside this category and additionally carry the reserve, redemption and audit duties of ss.31–33. See Section 12.
Mining-Related Services
Activities where mining operations provide services to third parties involving customer virtual assets or funds.
Carve-out: Pure mining for own account is excluded and does not by itself require a licence s.37(2). A separate registration or declaration regime may apply above thresholds of scale, energy use or hash rate s.37(3).
Which of the ten do you actually need?
Most business models touch two or three categories, and a single licence can specify more than one permitted service s.21(3). Getting the mix right decides your capital, your handbook obligations and whether you can start on an NOC.
Initial Virtual Asset Offerings
An IVAO — raising funds by publicly offering Virtual Assets in exchange for funds, other Virtual Assets or anything of commercial value s.3(xiv) — is separately gated. Only legal entities registered in Pakistan and meeting prescribed eligibility may conduct one s.30(1), and a public offering requires a published whitepaper s.42(1).
Licences & Capital
Section 25 requires every Licensee to maintain, at all times, minimum paid-up capital, liquid assets and financial resources not less than the prescribed amounts — and lets PVARA set higher requirements based on category, size, complexity or risk profile. The category-by-category figures below are drawn from the Draft Pakistan Virtual Asset Services Regulations 2026 and remain in draft; the statutory duty to hold capital comes from the Act itself.
| Licence Category | Min. Paid-Up Capital (PKR) | Approx. USD | Pre-Licence via NOC? |
|---|---|---|---|
| Advisory Services | PKR 25 million | ~$89,000 | No — full licence |
| Broker-Dealer Services | PKR 100 million | ~$357,000 | Yes — AML-Registered |
| Custody & Administration | PKR 200 million | ~$714,000 | Yes — AML-Registered |
| Management & Investment | PKR 200 million | ~$714,000 | No — full licence |
| Transfer & Settlement | PKR 200 million | ~$714,000 | No — full licence |
| Lending & Borrowing | PKR 500 million | ~$1.79 million | No — full licence |
| Virtual Asset Derivatives | PKR 500 million | ~$1.79 million | Yes — AML-Registered |
| Exchange Services | PKR 1 billion | ~$3.57 million | Yes — AML-Registered |
| Issuance — Fiat-Referenced Token | PKR 1 billion + 100% HQLA reserves | ~$3.57 million | No — full licence |
| Issuance — Asset-Referenced Token | PKR 1 billion + full asset backing | ~$3.57 million | No — full licence |
| Mining-Related Services | Not separately specified in the draft — a registration or declaration framework may apply above thresholds s.37(3) | No | |
Swipe the table sideways to see USD equivalents and pre-licence status
What the Act actually requires on capital
Fees — read this before you budget
Paid-up capital is not a payment to PVARA. It is share capital held in your own company and recoverable on an orderly wind-down. Fees are a separate matter — and the Act plainly contemplates them:
A published fee schedule had not been located at the time of writing. Treat fees as pending, not absent, and confirm with PVARA before budgeting.
Draft status, and how to use these numbers
The per-category figures come from the Draft Pakistan Virtual Asset Services Regulations 2026 and are not yet final. Schedule I of the Act defines the ten service categories but sets no capital amounts — those come from Regulations under s.25. Use the table for planning and modelling; confirm the operative figure at filing. The Regulatory Sandbox and the s.25(4) low-risk exemption are the two routes to testing a model without locking up full category capital.
Terms of a Licence Once Granted s.21–s.23
The licence names your services
It must specify which Virtual Asset Services you may undertake, and remains in force unless suspended or revoked s.21(3)
You appear on a public register
PVARA must maintain and publish an up-to-date register of Licensees showing name, licence number, permitted services and current status s.21(4)
Refusals come with written reasons
Both NOC refusals and licence refusals must state reasons in writing s.19(3), s.21(1)(b)
Ongoing obligations bite continuously
Capital, compliance with directives, periodic returns and audited accounts, prior approval for material change in control or business, risk/compliance/cyber systems, and supervision fees s.22(a)–(f)
Five grounds for suspension or revocation
Contravention of the Act or licence terms; insolvency or loss of fit-and-proper status; ceasing the licensed service; public interest; or a licence obtained by fraud, misrepresentation or concealment — always after written notice and a hearing s.23(1)
Revocation triggers wind-up
On revocation you must immediately cease providing services, and PVARA may notify SECP to initiate winding-up or dissolution under the Companies Act 2017 s.23(2)
Entry Routes & Licensing Process
Four ways into Pakistan — and one order of operations
Your options are a No Objection Certificate under s.19(1), the Regulatory Sandbox under s.35, a No-Action Letter for novel or pilot models under s.35(3), and the full VASP Licence under s.21. The order is not optional: s.19(1) requires you to obtain an NOC from PVARA before commencing the process of incorporation. You cannot go to SECP first.
Phase 1: No Objection Certificate from PVARA
Available Now — Mandatory First Step s.19(1)–(3)
Any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services must first apply to PVARA for an NOC — before starting incorporation. The application is made on Form A1 with all supporting documentation NOC Reg 15.1. PVARA may grant it subject to conditions, or refuse with written reasons.
WHAT THE NOC UNLOCKS (Reg 17.1(a))
Register the foreign entity already providing AML-Registered Services in Pakistan on the FMU goAML portal
Incorporate a local entity in Pakistan for the purpose of applying for a full VASP licence
Provide four AML-Registered Services — Exchange, Broker-Dealer, Custody, Derivatives — on completion of goAML registration, ahead of a full licence
Obligation attached: submit the licensing application within three months of promulgation of the VASP licensing regulations
WHAT THE NOC STILL DOES NOT PERMIT
The six non-AML-Registered services — Advisory, Lending & Borrowing, Management & Investment, Transfer & Settlement, Issuance, Mining-related
Any service before goAML registration is actually completed
Operating outside the specific conditions PVARA imposes on the NOC
Marketing a Virtual Asset whose Issuer is unlicensed s.43(1)
Decision deadline: PVARA must issue or refuse within 60 calendar days following assessment NOC Reg 17.1. Apply at pvara.gov.pk. Full requirements in Section 09.
Phase 2: SECP Incorporation, goAML & Local Presence
Immediately After NOC Issuance NOC Reg 15.3
Regulation 15.3 sets three post-NOC duties in sequence: register the foreign entity on goAML, incorporate the local company, and file the licensing application within three months of the VASP licensing regulations being promulgated. Once the local entity is licensed, the local entity assumes the goAML reporting-entity role and must keep active reporting credentials at all times NOC Reg 11.5.
SECP Incorporation
Local company under the Companies Act 2017 — required by s.50(1)(a)
FMU goAML Registration
Foreign chapter registers first as reporting entity; local entity takes over post-licence NOC Reg 11.4–11.5
Registered Office in Pakistan
Mandatory for every Licensee s.20(6)
Resident Key Individual
At least one Key Individual ordinarily resident in Pakistan vested with operational and decision-making authority s.20(6)
Technical Readiness to File
Demonstrate capability to file STRs and CTRs immediately upon goAML registration NOC Reg 11.6
FBR Tax Registration
Licensees must comply with the Income Tax Act 2001 and FBR rules s.66; see Tax & Banking
Phase 3: Full VASP Licence
Application under s.19(4) · Grant under s.21
Following incorporation, the licence application goes to PVARA in the prescribed form with the prescribed non-refundable fee and supporting documents s.19(4). PVARA may grant subject to conditions, refuse with written reasons, or issue a provisional or limited-scope licence on a case-by-case basis s.21(1)–(2). Only after grant may a VASP conduct full commercial operations in its licensed categories.
Minimum Financial Resources
Paid-up capital, liquid assets and financial resources for your category, held at all times s.25
Customer Asset Segregation
Segregated accounts, fiduciary duty, no rehypothecation without explicit consent s.24
Cryptographic Proof-of-Reserves
Furnished at prescribed intervals, reconciled against customer liabilities s.27(1)
Annual Statutory Audit
By a Chartered Accountancy firm approved by the Cabinet Division, verifying customer-asset segregation s.27(2)
Custody & Key Management
Secure custody, disaster recovery, business continuity, and PVARA's technical key-management standards s.26
Real-Time Supervisory Access
Secure reporting channels and, where required, automated interfaces giving PVARA and notified agencies access to prescribed data s.48
After grant: the ongoing obligations in s.22 apply continuously — periodic returns, audited statements, prior approval for any material change in control or business, and supervision and renewal fees.
Alternative Route: Sandbox or No-Action Letter
For novel models that cannot yet meet full licensing s.35
Where the model is genuinely novel, or where live testing is needed to answer a regulatory question, the Sandbox is the better first door. PVARA may issue guidance, no-objection statements or no-action communications under s.35(3), and eligibility, procedures, supervisory arrangements, risk limits, duration and exit are all set by the Sandbox Guidelines 2026. Applications are accepted year-round. Full detail in Section 17.
Transitional Route: Already Operating in Pakistan
Six-month window s.70
Any person providing Virtual Asset Services immediately before commencement of the Act has six months to apply for a licence, or must cease providing those services. A person who files a complete application within that window may continue existing services — provided they fully comply with any interim directives issued by PVARA and continue to adhere to the Act's core obligations, particularly on customer asset protection and AML/CFT/CPF. The concession attaches to existing services only; it is not a licence to expand.
NOC Regulations 2025
IN FORCEPVARA/REG/AML-REG/2025-1 · v1.0 Final · Effective 2 December 2025
This is the instrument that actually governs market entry today. Issued by PVARA's Licensing & Supervision Division, it runs to six Parts plus Annex A containing eight statutory forms. Regulation 1.2 provides that it comes into force upon publication on PVARA's official website, and Regulation 2.1 applies it to all VASPs seeking an NOC.
Its stated objectives (Reg 3.1) are to set AML/CFT minimum standards; ensure fitness and propriety of Controllers and Key Individuals; require systems to prevent, detect and report ML/TF; mandate risk-based, proportionate control frameworks; integrate every VASP with the FMU goAML system; prevent unregistered and non-compliant VASPs from operating in Pakistan; and facilitate the phased pathway under which AML-Registered Services may be provided ahead of full licensing.
The Four AML-Registered Services Reg 2.3
For the purposes of goAML registration and following receipt of an NOC, these four services are designated non-financial businesses and professions. An applicant granted AML Registration may provide them prior to obtaining a licence, subject to PVARA's conditions and until the licence application is finally determined. Every other Virtual Asset Service requires a full licence first, unless otherwise agreed with PVARA.
Exchange Services
Spot conversion, order matching, order book
Broker-Dealer Services
Order arrangement, own-account trading, distribution
Custody Services
Safekeeping of assets and private keys
Virtual Asset Derivatives Services
Futures, options, swaps, CFDs
Part 2 — Governance & the Eight Mandatory Key Individuals Reg 4–6
Roles You Must Fill Reg 5.1
Only one combination is allowed: Compliance Officer and MLRO may be combined where justified by the applicant's size and complexity Reg 5.2. Form A1 §3.2 requires these details for both the global entity and the proposed local Pakistani entity.
Board Duties & Disqualifications Reg 4.2, 6.3
THE APPLICANT BOARD MUST OVERSEE:
NO ONE MAY SERVE AS A KEY INDIVIDUAL WHO:
PVARA may interview Key Individuals to satisfy itself of competence, independence, knowledge and suitability Reg 6.2, 16.2. Each must file Form A3 Reg 6.4.
Part 4 — The AML/CFT Framework You Must Have Built Reg 8–14
Nine Mandatory Framework Components Reg 8.2
Documentation Standards Reg 8A.1
A quietly decisive clause — non-compliant submissions get returned. Every document filed with PVARA must:
CDD, EDD & Sanctions Reg 9–12
You cannot outsource your way out of AML Reg 14
AML-critical functions — CDD, EDD, sanctions/TFS screening, transaction monitoring, STR/CTR reporting and MLRO responsibilities — may not be outsourced unless the applicant conducts due diligence on the provider, maintains effective oversight, retains audit and inspection rights, and ensures the legal enforceability of audit and supervisory rights including across borders. No arrangement may impair your ability to meet AMLA or PVARA obligations (Reg 14.2). Disclose every arrangement on Form A5, signed by the Compliance Officer, with a per-service register covering data shared, SLAs, audit rights, sub-outsourcing, termination rights, risk rating and monitoring frequency.
Annex A — The Eight Statutory Forms
Form A1 — NOC Application
Ten sections: applicant details and group structure chart; services sought and full business-model narrative; governance and Key Individuals; Controllers, ownership and UBO; AML/CFT documentation checklist; technology and systems; goAML STR/CTR workflow; financial resources and capital evidence; other Pakistani and foreign licences; declaration.
Signed by two authorised signatories — typically CEO plus one other Key Individual
Form A2 — Controller & UBO Disclosure
Completed by every Controller (20%+) and every Beneficial Owner, for the applicant and the proposed local entity. Covers identity, PEP status, nature of control, shareholding chart, professional background, regulatory and criminal record, financial soundness, and full Source of Wealth / Source of Funds narratives with documentary evidence.
If funds originate offshore: jurisdiction, bank and transfer pathway must be given
Form A3 — Fit & Proper Questionnaire
Twelve sections per Key Individual: personal info, ten-year employment history with reasons for leaving, qualifications and AML training, regulatory record, criminal record, financial soundness, conflicts of interest, integrity and professional conduct, health and capacity, two independent professional references, and other time commitments.
References must not be relatives, subordinates or conflicted persons. Employment gaps of 3+ months must be explained.
Form A4 — AML/CFT Framework Statement
Signed by CEO and MLRO jointly. Certifies eleven documents are submitted in final Board-approved form; confirms compliance with AMLA 2010, the NOC Regulations and goAML requirements; attaches the Board resolution; and confirms operational readiness of onboarding, screening, monitoring, blockchain analytics, case management and retention systems.
Must certify the framework is tailored to your business model and not a template
Form A5 — Outsourcing Declaration
Compliance Officer declaration plus a line-by-line register for each AML-relevant outsourced service: provider name, country, function, AML relevance, data shared, SLA summary, audit rights, sub-outsourcing permission, termination rights, risk rating and monitoring frequency.
Contracts must include audit and inspection rights for the Applicant and PVARA
Form A6 — Annual AML/CFT Return
Filed once per calendar year by NOC holders. Eight sections: entity profile and Key Individuals in post; MLRO annual statement and governance changes; risk assessment update and emerging typologies; CDD metrics; transaction monitoring metrics; STR/CTR counts and suspicion categories; independent audit findings and remediation status; joint CEO and MLRO declaration.
Metrics include customers refused at onboarding and exited on AML grounds
Form A7 — Internal SAR (ISAR)
Minimum content for internal escalation: reporter details; customer name, wallet addresses and account numbers; transaction dates, amounts, type and on-chain / off-chain details; suspicion narrative with observed behaviour and red flags; and the MLRO determination — file STR, do not file, or seek further information.
VASPs may use their own ISAR format provided it carries at least this content
Form A8 — Key Individual Change
One form per individual, filed on any new appointment, replacement, role modification, resignation or removal. Requires Form A3, signed CV, CNIC/passport, Board approval resolution, police clearance for new appointments, and employment contract where applicable — plus an acknowledgment signed by the Key Individual personally.
Triggered by any change affecting an existing Key Individual, not only new hires
Eight forms, one rejected page
Incomplete NOC applications "may be delayed or returned" (Form A1 preamble). The failure points we see most: Form A3 references from subordinates, missing Board resolutions behind Form A4, unindexed PDFs breaching Reg 8A.1, and ownership charts that stop before the ultimate natural person.
Assessment, Decision & Revocation Reg 16–19
What PVARA Assesses Reg 16.1
All of this is re-evaluated at the licensing stage — the NOC assessment is not a one-time clearance. PVARA may also conduct inspections or request further information Reg 16.3.
Five Grounds for Revocation Reg 19.1
Revocation is applied proportionately, taking into account the severity and impact of the breach Reg 19.2. Note the fifth ground: an NOC is a bridge with a time limit, not a destination.
Ongoing Obligations of an NOC Holder Reg 18.1
Requirements
Corporate Requirements (SECP & PVARA)
Fit & Proper — Who and How s.20
AML/CFT & the Travel Rule s.46–49
Technology, Cyber & Data s.34, s.39–40
The requirement most applicants underestimate
It is not capital. It is operational readiness. Form A4 requires the CEO and MLRO to jointly certify that onboarding and KYC tools, sanctions and TFS screening, transaction monitoring software, blockchain analytics, case management, and data retention systems are "implemented, tested and operational" — not planned, not procured. Regulation 16.1(b) makes operational readiness an assessment criterion in its own right, and Regulation 11.6 requires demonstrable technical capability to file STRs and CTRs immediately on goAML registration. Build the stack before you file, not after.
Customer Assets & Prudential Rules
Chapter 4 is the part of the Act that most directly answers the question a Pakistani retail user will ask you: "what happens to my coins if you go under?" The answers are unusually strong by regional standards — statutory segregation, bankruptcy remoteness, a codified fiduciary duty, and a rehypothecation ban.
Segregation of Customer Assets
A Licensee must hold Customer Assets — Virtual Assets and fiat — in segregated accounts separate from its own assets at all times, in the manner prescribed by Regulations.s.24(1)
Bankruptcy Remoteness
Notwithstanding any other law, Customer Assets held by a Licensee shall not form part of the Licensee's estate in the event of insolvency or liquidation.s.24(2)
Statutory Fiduciary Duty
A Licensee owes a fiduciary duty to its customers and must at all times act honestly, fairly and in their best interests when dealing with Customer Assets.s.24(3)
No Rehypothecation Without Consent
A Licensee shall not rehypothecate, lend, pledge or otherwise encumber Customer Assets — Virtual Assets or fiat — without the customer's explicit, informed and revocable written consent.s.24(4)
Custody Standards & Key Management s.26
Proof-of-Reserves & Audit s.27, s.29
Why s.24(2) is a commercial asset, not just a compliance cost
Bankruptcy-remoteness written into primary legislation — with an express override of any inconsistent insolvency law — is a marketing fact, not a footnote. Combined with the s.24(3) fiduciary duty and the s.24(4) rehypothecation ban, a PVARA-licensed venue can make a stronger customer-protection claim to Pakistani users than an offshore platform serving the same market from a jurisdiction with none of these. Firms that build disclosure around this get to convert regulation into trust.
Stablecoins & Token Issuance
Chapter 5 governs anyone who wants to issue a token in or from Pakistan — a PKR or USD stablecoin, a tokenized-gold instrument, or a public token sale. Three regimes apply: Initial Virtual Asset Offerings (s.30), Fiat-Referenced Tokens (s.31), and Asset-Referenced Tokens (s.32), with an enhanced tier for Significant Issuers (s.33).
Fiat-Referenced Tokens (FRT) s.31
A Virtual Asset that purports to maintain a stable value relative to a single Official Currency of any country and is redeemable at par value by its issuer s.3(ix). Every FRT issuer must comply with:
PVARA may differentiate requirements by size, scope, complexity or risk — including expedited approval, stress testing and ongoing supervision — and must consult the State Bank of Pakistan on reserve arrangements s.31(2).
Asset-Referenced Tokens (ART) s.32
A Virtual Asset representing ownership rights, claims or economic interests — including entitlements to income or returns — in one or more underlying assets, or designed to hold stable value by reference to them s.3(i).
Initial Virtual Asset Offerings s.30, s.42
Algorithmic Tokens & Significant Issuers
Prohibition on algorithmic tokens s.53: No person shall issue, offer or market a Virtual Asset whose primary mechanism for maintaining value is algorithmic and not fully or adequately collateralised — unless specifically permitted by Regulations and subject to the safeguards prescribed there. This is a default prohibition with a narrow regulatory door, not a licensing condition.
Significant Issuers s.33: An Issuer is deemed Significant where it meets thresholds prescribed by Regulations having regard to size, scale, systemic importance, market impact, number of holders and cross-border activity. Significant Issuers must be registered with PVARA and comply with enhanced reporting, disclosure, governance and risk management requirements. Plan for this tier before you cross into it — the thresholds are set by Regulation, not by negotiation.
Conduct, Prohibitions & Penalties
Criminal Offences — the Full Section 54 Schedule
| Offence | Imprisonment | Fine | Section |
|---|---|---|---|
| Wilfully providing an unlicensed Virtual Asset Service | Up to 5 years | Up to PKR 50 million | s.54(1) |
| Conducting an Initial Virtual Asset Offering in contravention of the Act | Up to 3 years | Up to PKR 25 million | s.54(2) |
| Market manipulation or insider trading — natural person | Up to 3 years | Up to PKR 25 million | s.54(3)(a) |
| Market manipulation or insider trading — legal person | — | 3× profit gained or loss avoided; if indeterminable, up to 15% of total annual turnover in the preceding financial year | s.54(3)(b) |
| Knowingly making a false or misleading statement in any application, return or document submitted to PVARA | Up to 3 years | Up to PKR 20 million | s.54(4) |
| Obstructing an officer of the Authority in the exercise of powers | Up to 2 years | Up to PKR 10 million | s.54(5) |
| Wilfully failing to comply with any order or decision of the Authority | Up to 1 year | Up to PKR 25 million (plus administrative penalties) | s.54(6) |
| Wilfully refusing to provide information required by an Authorized Officer | Up to 1 year | Up to PKR 1 million | s.57(3) |
| Administrative penalty for any contravention of the Act | — | Up to PKR 25 million | s.59(4) |
Swipe the table sideways to see fines and section references
Fines are stated as maxima. Where an offence is committed by a body corporate with the consent, connivance or neglect of any director, manager, secretary or similar officer, that person is deemed to have committed the offence personally s.55. Offences are investigated, tried and punished under the Code of Criminal Procedure 1898 and the Qanun-e-Shahadat Order 1984, and the Federal Government may designate Special Courts s.54(7)–(8). No court may take cognizance except on a written report by an authorised officer of PVARA s.57(4).
Prohibited Activities Chapter 9, ss.50–53
Market Conduct Duties Chapter 7, ss.41–45
Integrity & fair dealing
Conduct business honestly, fairly and professionally, in customers' best interests and in a manner upholding market integrity s.41(1)
Conflicts of interest
Identify, manage and disclose conflicts; never place your own interests above your customers' s.44
Complaint handling
Establish and maintain internal complaint-handling procedures per Regulations s.45(1)
Independent dispute resolution
PVARA may establish or recognise an independent scheme for claims below a prescribed monetary threshold s.45(2)
Enforcement Powers
Administrative Sanctions s.59
Emergency & Access-Blocking Powers s.60–61
Sandbox Suspension & Revocation
Separately from the Act's enforcement regime, PVARA may temporarily suspend sandbox testing and approval where it has reason to believe a participant has failed to adhere to agreed details or imposed conditions, until the matter is fully clarified — and may completely withdraw approval with a public notice where a serious discrepancy relating to consumer detriment or any other serious matter is observed. Under Annexure-B, PVARA may also terminate participation on 15 days' written notice, or immediately for breach of the testing plan, expected negative consequences for consumers or financial stability, failure to provide requested information, or public interest.
Appeals & the Virtual Assets Appellate Tribunal
Chapter 11 creates a specialist forum with exclusive jurisdiction: no ordinary court may take cognizance of a legal dispute under the Act or its Rules and Regulations to which the Tribunal's jurisdiction extends. If PVARA refuses your NOC, refuses or revokes your licence, or imposes a sanction, this is the route.
Composition & Qualification s.62
Powers & Procedure s.64
Procedural protections worth knowing before you need them
The Act builds in due process at several points. A licence cannot be varied, suspended or revoked without written notice and an opportunity of being heard (s.23(1)). Refusals of an NOC or a licence must carry written reasons (s.19(3), s.21(1)(b)). Access-blocking orders must state reasons and statutory basis, and carry a 10-day representation right with a 15-day response deadline (s.61(3),(5)). Criminal prosecution requires a written report by an authorised PVARA officer before any court takes cognizance (s.57(4)), prosecutions are conducted by a special public prosecutor (s.58(1)), and hearings may not be adjourned more than fourteen days at a time without recorded sufficient cause (s.58(4)). Document every interaction with the regulator from day one — these protections are only as good as your record of what was said and when.
Key Bodies & People
Bilal bin Saqib
CEO, Pakistan Crypto Council
Special Assistant to the PM on Blockchain & Crypto | Senior crypto-policy figure
Muhammad Aurangzeb
Finance Minister
Chairman, Pakistan Crypto Council. Also sits on PVARA via the Secretary, Ministry of Finance seat under s.7(1)(b)
Changpeng Zhao (CZ)
Strategic Advisor — PCC
Binance Founder | Advisor to the Pakistan Crypto Council (PCC), not to PVARA
The Pakistan Crypto Council is not PVARA
The PCC is a policy and promotion body. PVARA is the statutory regulator created by Section 6 of the Act, with its own Board composition fixed by Section 7(1). Advisors and officers of the PCC hold no licensing authority. Applications, forms and correspondence go to PVARA — a warm introduction at the PCC does not shorten the s.19 process or the 60-day clock under NOC Regulation 17.1.
Regulatory Bodies & Who Does What
Primary licensing, sandbox and supervision authority for all Virtual Asset Service Providers and Issuers. Autonomous body corporate, HQ Islamabad. s.6, s.9
Company incorporation under the Companies Act 2017 and securities oversight. Its Chairperson sits on the PVARA Board; PVARA notifies SECP to initiate winding-up on licence revocation. s.7(1)(e), s.23(2)
Financial Monitoring Unit — receives STRs and CTRs via the mandatory goAML portal. A statutory information-sharing counterparty, not a PVARA Board member. s.17(1), s.46(2)(a)
State Bank of Pakistan. Governor sits on the PVARA Board and their presence is mandatory for quorum. Consulted on FRT and ART reserve arrangements. s.7(1)(d), s.8(2), s.31(2)
National AML-CFT Authority. Its Chairman sits on the PVARA Board, and PVARA must coordinate with it and the FMU to combat ML/TF involving Virtual Assets. s.7(1)(f), s.9(1)(g)
Pakistan Digital Authority — its Chairperson holds a seat on the PVARA Board. s.7(1)(g)
Federal Board of Revenue. Every licensed VASP must comply with the Income Tax Act 2001 and FBR rules; FBR is a statutory information-sharing counterparty but holds no Board seat. s.66, s.17(1)
Federal Investigation Agency — named in s.17(1) among the agencies with which PVARA must share supervisory and enforcement information in a timely and secure manner.
Specialist appellate forum with exclusive jurisdiction over disputes under the Act. Three members; 30-day filing window; 3-month decision deadline. s.62–65
Banking access — SBP Circular No. 10 of 2026
The State Bank of Pakistan is reported to have authorised commercial banks to open and maintain accounts for PVARA-licensed VASPs on 14 April 2026. If accurate, this removes what had been the single biggest operational barrier for crypto companies in Pakistan — a licence with no bank account is a licence you cannot use. Verify the exact scope and conditions against the official circular before relying on it, particularly whether it extends to NOC holders providing AML-Registered Services or only to fully licensed VASPs. See our Tax & Banking services for bank account facilitation.
Current Market Status
Reported NOC Activity Per Media Reports
World's largest crypto exchange — reported in media to have received a PVARA No Objection Certificate.
Major Asian exchange — reported in media as progressing through the PVARA process.
How to verify: PVARA does not maintain a public NOC holders list, so all NOC reporting is media-sourced and unverified. What will be verifiable is the register of full Licensees — Section 21(4) requires PVARA to maintain and publish an up-to-date register on its official website showing each Licensee's name, licence number, permitted services and current regulatory status. Until a firm appears there, treat any "licensed in Pakistan" claim with caution.
Where the first-mover advantage actually sits
Not in being first to announce. In being first through Regulation 15.3: NOC issued → goAML registration completed → local entity incorporated → licensing application filed within three months of the VASP licensing regulations being promulgated. Firms that complete goAML registration early can lawfully run Exchange, Broker-Dealer, Custody and Derivatives services while competitors are still assembling Form A1 attachments — and Regulation 19.1(e) makes clear that an NOC holder who does not progress toward a full licence can have that NOC revoked. The advantage goes to whoever moves through the pipeline fastest, not whoever enters it first.
Regulatory Sandbox 2026
LIVEOfficial PVARA Sandbox Guidelines 2026 · Act s.35
PVARA's Regulatory Sandbox is a controlled environment for testing innovative Virtual Asset products and services under supervision, without a full licence from day one. The Guidelines operationalise the mandate at Section 35 of the Virtual Assets Act 2026 (drafted against Ordinance ss.42–45) and set out procedures for intake, assessment, onboarding, supervision, monitoring and exit — balancing innovation against investor protection, financial stability, market integrity and risk management.
The Seven Stated Objectives
No-Action Relief
PVARA may issue a no-action letter to a participant, stating that it does not intend to take enforcement action in respect of specified conduct for the duration of the test period. The statutory basis is s.35(3), which lets PVARA issue guidance, no-objection statements or no-action communications in accordance with Regulations.
Key Sandbox Definitions
Agile Approach — a process under which applicants may submit applications at any time during the year. There are no fixed intake windows or cohorts.
Participant — an applicant approved to operate within the Sandbox under a supervisory agreement with the Authority.
Exit — the process at the conclusion of testing through which a participant either transitions to full licensing, discontinues the service, or takes other steps as directed by the Authority.
The sandbox is not a shortcut around the licence
Under the Annexure-B undertaking, a participant expressly agrees that if the product or service is deemed successful, its rollout shall be subject to licence or approval by the Authority and compliance with regulatory requirements. It also agrees that PVARA is under no obligation to amend the regulatory framework or introduce new provisions to accommodate the product, and that any determination on regulatory change remains at PVARA's sole discretion. Enter the sandbox to answer a regulatory question — not to avoid one.
All applicants must satisfy each of the following before PVARA will consider a sandbox application. Note that the fit-and-proper test here reaches directors, sponsor shareholders, controllers and key management.
Fit & Proper
No director, sponsor shareholder, controller or key manager found liable for fraud, financial crime or misconduct; prior regulatory or licensing breaches including proscribed and designated persons; or bankruptcy or insolvency proceedings unless adequately resolved.
Clearly Defined Testing Plan
Objectives, duration, KPIs and target users. Vague pilots do not pass screening — PVARA needs to know what success looks like before it grants a Letter of Approval.
Governance & Internal Control
Complete governance structure with a clearly identifiable Ultimate Beneficial Owner; enterprise risk assessment; KYC and screening covering both originator and beneficiary; complaint handling; segregation of client money and virtual assets; liability management; suspicious-transaction flagging and reporting.
Consumer Protection
Data security, dispute resolution, safeguarding of consumer assets, fraud liability management, and complete risk disclosure to clients.
Technology Risk & Cybersecurity
System controls, cybersecurity and protection of the private key. Compliance with cross-border supervision and information-sharing protocols where applicable.
Exit Plan & Scalability
A sandbox exit plan specifying transition to full authorisation or orderly wind-down, plus demonstrated readiness for scalability across technical, financial and human resources.
Regulatory & Risk Assessment
A comprehensive submitted assessment addressing cybersecurity, data privacy and operational risks, plus market risk and systemic risks.
The Purpose Test
Confirm compliance with the applicable legal framework and that the product or service is not designed for speculation, anonymity, or illicit activity. This is an express eligibility condition — privacy-maximalist and pure-speculation models are screened out at the door.
Foreign Applicants
Where the applicant is not a local company, it will be required to have the company incorporated and to evidence tax registration with local tax authorities as and when sandbox approval is granted (Form I §E). Budget the incorporation timeline into your test-start date, not after it.
Agile Approach: applications are accepted across the year. No fixed intake windows, no cohorts — submit when you are ready.
Submit Form I
Five parts: (A) innovation and VASP proposition — a 500–1,000 word innovation summary, blockchain/technology stack, cybersecurity strategy, regulatory and legal environment, risk management table; (B) readiness for testing; (C) exit strategy and scaling; (D) applicants' background; (E) applicant particulars and technical details including your Schedule I application category.
Submit the Annexure-A Self-Assessment
A structured checklist scored against positive and negative indicators across eight dimensions: scope, business scalability, technology and security, genuine innovation, consumer and investor benefit, readiness, genuine need for the sandbox, and ML/TF compliance preparedness. Filed with the application, not after.
Initial Screening
Applications are reviewed for all required documents and mandatory information. Incomplete applications are returned with a request for revisions, with up to two resubmissions permitted. Use them carefully — there is no third.
Assessment Phase — 60 Working Days
Comprehensive evaluation must be completed within sixty working days from the conclusion of initial screening, unless PVARA determines there is reasonable cause to extend. Where the applicant is already regulated elsewhere, input from the relevant regulator may be sought, and PVARA may request further information at any point.
Letter of Approval & Annexure-B Undertaking
Successful applicants receive a Letter of Approval (LoA) subject to terms and conditions approved by the Authority. On approval, the participant must submit the formal Annexure-B undertaking. A No-Action Letter may be issued for the testing period.
Testing Phase
Operate for the approved period, submitting reports whose contents, format and frequency are agreed with PVARA before testing commences. If an unexpected technical or business difficulty arises beyond your control, an extension request must be submitted at least two weeks before expiry. Any unforeseen circumstance impairing your ability to commence or complete testing must be notified promptly.
Completion Report — Within Two Weeks
Submit within two weeks of the close of the testing period: overall results and statistics; an objective assessment of potential impact including a comparison of results against the objectives defined at inception; the scope for scaling out to a larger audience if successful; and how you will fully comply with relevant legal and regulatory requirements.
Exit Stage
PVARA analyses the testing results together with your completion report and determines the future course of action — transition to full licensing, discontinuation, or other directed steps.
Form I — Submission Checklist (Twelve Items)
Innovation & Market Impact
- Novelty: a product, service or business model not currently offered in the market
- Harnessing technology: a new application of existing technology, or a completely new one
- Differentiation: a significant departure from or improvement on existing offerings, addressing market inefficiencies
- Inclusion: transitions a largely informal, high-risk market into a formalised, regulated ecosystem
Risk Management & Compliance
- Review of systemic, operational and ML/TF/PF risks
- Evaluation of cybersecurity, data protection and consumer protection frameworks
- Consultation with Shariah advisors where applicable
- Strong KYC/AML processes integrated into platform design, aligned with FATF and Pakistan's AML laws
Feasibility & Exit Strategy
- Technical and operational readiness, including team expertise
- Clear testing parameters
- Exit plans — winding down if unsuccessful, transitioning to licensing if successful
- PVARA may impose limits on transaction volumes, user numbers or exposure case by case
Financial Strength
- Demonstrated financial capacity to undertake the proposed business model
- Budget and funding commitments for the test phase
- KPIs and KRIs clearly defined
- Insurance coverage to indemnify clients against losses from fraud or gross negligence
Tax Law Compliance
- Demonstrated compliance with applicable tax laws in Pakistan, if based in Pakistan
- Complete financial records as required by law
- No engagement in or facilitation of tax evasion
- International applicants: incorporate locally and register with tax authorities on approval
Consumer & Investor Benefit
- Increases transparency, lowers costs or improves efficiency for users
- Enhances financial inclusion or access to digital financial services
- Identifies and proposes mitigation for ML/TF, volatility, fraud and cyber risks
- Benefits to users, markets and the national exchequer
Annexure-A negative indicators — what gets you rejected
The self-assessment scores against explicit negatives: not related to Virtual Asset Services; weak or stagnant user adoption; reliance on niche or unsustainable demand such as speculative hype only; no security audits or reliance on unverified smart contracts; no safeguards for custody of consumer funds in a cyber intrusion; numerous similar models already existing in Pakistan or only minor tweaks to an existing product; limited transparency or cost inefficiency; no clear risk mitigation for hacks, price manipulation or data privacy; concept only on paper; and — decisively — live testing not being necessary to answer a regulatory or market question. If your model does not need regulatory flexibility, the sandbox is the wrong door.
On approval, the participant executes a formal undertaking in favour of PVARA (Annexure-B), given unconditionally and irrevocably and signed by authorised signatories with power of attorney, before two witnesses. These are the obligations that bind you during testing — read them before you apply, not after you are approved.
Operating Discipline
Operate strictly within the parameters set by PVARA; adhere to all applicable Pakistani laws, rules and regulations; maintain consumer protection, ML/TF/PF, data security and risk management measures; and ensure retention and confidentiality of consumer data.
Reporting & Access
Submit progress reports signed by a competent authority designated by the CEO, in the agreed format and timelines. Allow PVARA complete access to core reporting, accounting and significant software. Maintain proper records for review at any time. Allow PVARA to validate transactions and trace the flow of funds.
Incident Response Clock
Notify PVARA within one hour of any material incident, risk event or compliance breach, detailing the extent of the breach and remediation undertaken — then submit a detailed incident report within 48 hours covering nature and scope, containment and resolution steps, and measures to prevent recurrence. Build the escalation runbook before you go live.
Insurance & Indemnity
Obtain insurance coverage to indemnify clients against losses incurred as a result of fraud or gross negligence. Indemnify and hold PVARA harmless from any claims arising from participation. PVARA may impose terms on limits of liability at any appropriate time.
Test User Rights
Afford all test users the highest standard of protection, fairness and transparency. Never engage in any practice resulting in consumer harm, financial loss, misleading information or unfair treatment. Keep personal and financial data secure and confidential. Test users have the right to access, correct or request deletion of their personal data at any time.
Termination Triggers
PVARA may terminate on 15 days' written notice, or immediately for: breach of the testing plan; deployment expected to have negative consequences for consumers or overall financial stability; failure to provide requested information; or public interest.
Exit & Commercialisation
Abide by and execute the exit strategy per PVARA's decision. Accept that commercial rollout requires a licence or approval. Where deployment depends on regulatory change, PVARA may allow continued provision under specific terms until amendments are adopted — but is under no obligation to amend the framework, and that determination is at its sole discretion.
Records, Tax & Disputes
Retain all transaction records and proper books of account for seven years. Fulfil all tax obligations and never facilitate tax evasion. Consent to PVARA disclosing or publishing non-identifying information about your participation. Attempt in good faith to resolve disputes; unresolved disputes go to a competent court in Pakistan. The decision of the Authority is final.
Ready to Apply for the PVARA Regulatory Sandbox?
Applications are open year-round — but you only get two resubmissions if the pack comes back incomplete. We prepare Form I, the Annexure-A self-assessment and the Annexure-B undertaking, and pre-test the whole file against the screening criteria before it goes in.
PVARA FAQ
The twelve questions we are asked most often by exchanges, payment firms and token issuers looking at Pakistan — answered directly from the Act, the NOC Regulations and the Sandbox Guidelines, with the section reference in each answer.
What is PVARA and what law created it?
How many VASP licence categories are there in Pakistan?
Can a VASP operate in Pakistan with only a PVARA NOC, before getting a full licence?
How long does PVARA take to decide an NOC application?
What is the penalty for operating an unlicensed crypto exchange in Pakistan?
Is a local Pakistani company required for a PVARA licence?
Are existing crypto businesses in Pakistan grandfathered?
Does PVARA regulate NFTs and in-game tokens?
Are algorithmic stablecoins allowed in Pakistan?
What is the PVARA Regulatory Sandbox and who can apply?
How long must a Pakistani VASP keep AML records?
Can I appeal a PVARA decision?
Next Steps
Ready to Enter Pakistan's Crypto Market?
Route & Category Assessment
We map the right entry route — NOC, Sandbox, No-Action Letter or full licence — identify which of the ten Schedule I categories you actually need, and model the capital and timeline for each.
Application Build & Pre-Test
Full preparation of Form A1 with Forms A2–A5, or the Sandbox Form I with Annexures A and B — pre-tested against the Reg 8A.1 documentation standards and the assessment criteria before filing.
Local Setup & Ongoing Compliance
SECP incorporation, goAML registration, AML framework and FBR registration, banking access, and the s.22 ongoing obligations including the Form A6 annual return.
Sources & Disclaimer
This guide is for informational purposes only and does not constitute legal, financial or regulatory advice. It is based on three official documents: the Virtual Assets Act, 2026 as passed by the National Assembly of Pakistan (74 sections and Schedule I, successor to the Virtual Assets Ordinance, 2025 (VII of 2025)); the PVARA No Objection Certificate Regulations 2025 (document code PVARA/REG/AML-REG/2025-1, version 1.0 Final, effective 2 December 2025, issued by the PVARA Licensing & Supervision Division, including Annex A Forms A1–A8); and the PVARA Sandbox Guidelines 2026 (including Form I, Annexure-A and Annexure-B). Section references are given throughout so every claim can be independently verified against the source text.
Important qualifications. The NOC Regulations 2025 and Sandbox Guidelines 2026 were drafted against the Virtual Assets Ordinance, 2025 and cite its section numbering, which the Act 2026 subsequently changed; both remain operative by virtue of Section 74. Per-category minimum paid-up capital figures are drawn from the Draft Pakistan Virtual Asset Services Regulations 2026 and remain in draft — the Act itself sets no amounts, and figures must be confirmed at filing. No published PVARA fee schedule had been located at the time of writing, but Sections 14(2)(h), 19(2) and 19(4)(a) expressly contemplate NOC, licensing, supervision and renewal fees; treat fees as pending rather than absent. NOC recipient information is based on media reports only — PVARA does not maintain a public NOC holders list, though Section 21(4) requires a public register of full Licensees. References to SBP Circular No. 10 of 2026 are reported and should be verified against the official circular. User and market statistics are estimates. Readers should consult qualified professionals and verify current requirements directly with PVARA before making any business decisions.
Official Sources: pvara.gov.pk · secp.gov.pk · sbp.org.pk · fbr.gov.pk · fmu.gov.pk
© 2026 CoinConnect | Published: March 2026 | Last Updated: 8 August 2026 | v3.0
Continuing analysis on the CoinConnect blog
This guide tracks the instruments themselves. Ongoing commentary, worked examples and updates as PVARA issues new regulations are published on blog.coinconnect.site, the official CoinConnect blog.