Key takeaways
- The Virtual Assets Act, 2026 establishes PVARA to license and supervise all VASPs and token issuers in or from Pakistan.
- Existing operators have six months to apply for a PVARA licence or cease operations (Section 70).
- Licensing is a two-stage process: a No-Objection Certificate before incorporation, then a full licence after.
- The Act has extraterritorial reach — foreign businesses serving Pakistani users may be in scope.
Pakistan has enacted one of the most comprehensive virtual asset regulatory frameworks in South Asia. Whether you run a crypto exchange, a stablecoin issuer, a DeFi lending protocol, or a custody business, this Act directly affects you.
What is the Virtual Assets Act, 2026?
The Act is Pakistan's primary legislation governing Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs). Passed by the National Assembly, it came into force immediately and replaces the Virtual Assets Ordinance, 2025. Its core objectives are investor protection, AML/CFT/CPF compliance aligned with FATF Recommendations, innovation enablement through a regulatory sandbox, blockchain adoption, and global competitiveness.
Key point for existing operators: any business providing Virtual Asset Services before the Act's commencement has six months to apply for a PVARA licence or must cease operations (Section 70).
What is a Virtual Asset under Pakistani law?
Under Section 3(xxxi), a Virtual Asset is "a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes." Virtual Assets are not legal tender in Pakistan. The definition excludes digital representations of fiat currency, securities, or other regulated financial assets — unless those are represented, issued, or transferred using DLT.
What is NOT a Virtual Asset
The substance-over-form principle: PVARA classifies assets by economic function and real-world effect — not labels. Calling your token a "utility token" or "governance token" does not exempt it. PVARA has explicit power under Section 9(f) to assess any asset based on its substantive features, irrespective of its name.
Who does the Act apply to?
The Act applies to two categories of person (Section 2): VASPs — any person who, as a business, provides one or more Virtual Asset Services to third parties on a professional basis, in or from Pakistan; and Issuers — any legal person that offers, originates, or distributes, on its own behalf, a Virtual Asset in or from Pakistan.
Extraterritorial reach. PVARA can exercise enforcement powers beyond Pakistan's borders and will prescribe the conditions under which a Virtual Asset Service conducted outside Pakistan is deemed offered or marketed to persons in Pakistan (Section 4). If your business targets Pakistani users from abroad, you may fall within scope.
What activities require a PVARA licence?
Section 18 and Schedule I define ten categories of regulated Virtual Asset Services. Carrying on these activities in or from Pakistan without a valid PVARA licence is a criminal offence.
- Advisory services — personalised investment recommendations relating to VA transactions. General market research and educational content does not qualify.
- Broker-dealer services — arranging or facilitating buy/sell orders, soliciting or accepting orders, proprietary trading using customer assets, market-making, or placement/distribution for Issuers. Dealing solely on one's own account, without customer orders or control of customer assets, is exempt.
- Custody and administration services — safekeeping of VAs or private keys on behalf of customers. Self-custody wallet providers (where the customer retains exclusive key control) are not caught.
- Exchange services — exchanging VAs for fiat or for other VAs, matching buyers and sellers, or maintaining an order book.
- Lending and borrowing services — facilitation, arrangement, intermediation, or direct provision of VA lending/borrowing with a contractual obligation to return equivalent assets plus interest/fees.
- VA derivatives services — offering, executing, clearing, or arranging futures, options, swaps, CFDs, or similar where the underlying is a VA.
- VA management and investment services — fiduciary/agency management of another's VAs, including discretionary portfolio management and discretionary staking.
- VA transfer and settlement services — transfer, transmission, or settlement of VAs between parties or wallet addresses (excludes exchange execution).
- VA issuance services — creation, issuance, initial offering, administration and ongoing management, including supply control, reserve management, redemption, governance and disclosures.
- Mining-related services — mining that provides services to third parties involving customer assets or funds. Pure mining for own account does not require a licence.
The PVARA licensing process, step by step
Obtaining a licence is a two-stage process. No Virtual Asset Service may be carried on without completing both stages.
Stage 1 — No-Objection Certificate (NOC)
Before incorporating a company to carry on Virtual Asset Services, you must first obtain a NOC from PVARA (Section 19(1)). Submit an application in the prescribed form, provide prescribed information, and pay the prescribed fee. PVARA reviews it against the Act's objectives and market integrity requirements, and may grant (with or without conditions) or refuse with written reasons. You cannot incorporate until the NOC is granted.
Stage 2 — Full licence application
After incorporation, submit a full licence application (Section 19(4)) with the non-refundable application fee and all prescribed documentation — corporate documents, business plan, ownership structure, AML/CFT framework, key personnel details, and IT/cybersecurity documentation. PVARA may grant a full licence (with conditions), grant a provisional or limited-scope licence on a case-by-case basis (Section 21(2)), or refuse with written reasons.
PVARA maintains a publicly accessible register of all licensees showing name, licence number, permitted services, and current status (Section 21(4)).
Fit-and-proper requirements
The fit-and-proper assessment is a continuing obligation, not a one-time check. PVARA directly assesses (Section 20(1)) Controllers (holding 20%+ of voting power, ownership or share capital, or significant influence), Sponsors, CEOs, and Directors. The licensee itself is responsible for assessing the fitness of all other Key Individuals — Managing Director, CFO, COO, Head of Internal Audit, Head of Compliance, MLRO/AML Compliance Officer, Head of Risk Management, Head of Information Security, and any other position PVARA designates.
Key rules: any person subject to the criteria must notify PVARA of any matter affecting their fitness (Section 20(4)); every licensee must ensure at least one Key Individual ordinarily resident in Pakistan holds operational and decision-making authority (Section 20(6)); and PVARA may refuse, suspend, or revoke a licence where any Controller, Sponsor, or Key Individual fails the criteria (Section 20(3)). The MLRO/AML Compliance Officer is a Key Individual and must satisfy fit-and-proper criteria on a continuing basis.
Ongoing obligations for licensees
Financial requirements: maintain prescribed minimum paid-up capital, liquid assets and financial resources at all times; PVARA may impose higher requirements based on category, size, complexity or risk.
Customer asset segregation — among the Act's most critical provisions, and its protections are absolute:
- Customer Assets (VAs and fiat) must be held in segregated accounts separate from the licensee's own assets at all times (Section 24(1)).
- Customer Assets are ring-fenced in insolvency — they do not form part of the licensee's estate (Section 24(2)).
- Licensees owe a fiduciary duty and must act honestly, fairly, and in customers' best interests.
- No rehypothecation, lending, pledging, or encumbering Customer Assets without the customer's explicit, informed, revocable written consent (Section 24(4)).
Custody and proof-of-reserves: secure custody, disaster recovery and business continuity (Section 26); cryptographic proof-of-reserves reconciled against customer liabilities furnished to PVARA at prescribed intervals (Section 27(1)); and an annual audit by an approved firm of Chartered Accountants verifying customer asset segregation (Section 27(2)). Licensees must also submit periodic returns and audited financials, obtain prior approval for any material change in control or business, maintain risk/compliance/cybersecurity systems, and pay applicable fees.
AML, CFT and CPF compliance for VASPs
Chapter 8 ties the virtual asset sector directly to the Anti-Money Laundering Act, 2010. Under Section 46, all VASPs are deemed financial institutions for the purposes of the AML Act — so the full range of AML obligations applies, including CDD, EDD for high-risk customers, and suspicious transaction reporting.
Every VASP and Issuer must report suspicious transactions to the Financial Monitoring Unit (FMU); maintain CDD, transaction and other records for the prescribed period; appoint an MLRO/AML Compliance Officer (a Key Individual for fit-and-proper purposes); and establish internal controls and compliance programmes to prevent ML, TF and PF.
The Travel Rule (Section 47): licensees must obtain, hold, and transmit originator and beneficiary information for any VA transfer at or above the PVARA-prescribed threshold, consistent with FATF Recommendations, while complying with applicable data protection and cybersecurity laws. PVARA must align its AML/CFT/CPF supervisory framework with FATF standards (Section 46(3)), tracking FATF Recommendation 15 (new technologies/VASPs) and Recommendation 16 (the Travel Rule).
Stablecoin and token issuance rules
Fiat-Referenced Tokens (stablecoins)
A Fiat-Referenced Token (FRT) purports to maintain a stable value relative to a single official fiat currency and is redeemable at par by its Issuer. Requirements under Section 31: 100% reserve backing with High-Quality Liquid Assets (or other prescribed assets) held as a Segregated Reserve; par redemption mechanisms available without undue delay; audited reserve disclosures; robust AML/CFT/CPF and sanctions programmes; and prioritised holder protections in insolvency.
Asset-Referenced Tokens
An Asset-Referenced Token represents ownership rights, claims, or economic interests in underlying assets. Key requirements under Section 32: must be fully backed by the underlying assets at all times; assets may be tangible or intangible (commodities, real estate, securities, or a combination of official currencies); cannot be backed by or derive value from other Virtual Assets; reserves held in custody per Regulations; with audited disclosures, AML programmes and insolvency protections.
Prohibition on algorithmic tokens (Section 53). No person may issue, offer, or market a Virtual Asset whose primary value-maintenance mechanism is algorithmic and not fully or adequately collateralised, unless specifically permitted by Regulations with prescribed safeguards. This directly reflects global lessons from algorithmic stablecoin collapses.
Initial Virtual Asset Offerings (IVAOs): only legal entities registered in Pakistan meeting prescribed criteria may conduct an IVAO (Section 30). Conducting one without authority is a criminal offence attracting up to three years' imprisonment and/or a fine of up to PKR 25 million.
Market conduct and consumer protection
Chapter 7 establishes conduct standards. Licensees must conduct business honestly, fairly and professionally, in customers' best interests and upholding market integrity (Section 41). Any Issuer offering a VA to the public must publish a whitepaper in the prescribed form, make ongoing disclosures of material information including reserve attestations, and comply with mandatory risk disclosures. No person may advertise or market a VA unless the Issuer holds a valid licence (Section 43), and all marketing must contain prescribed risk disclosures. Licensees must also identify, manage and disclose conflicts of interest (Section 44) and maintain internal complaint-handling procedures (Section 45).
Penalties and enforcement
All criminal prosecutions are conducted by a Special Public Prosecutor and heard by designated Special Courts. Where an offence is committed by a body corporate with the consent, connivance, or neglect of a director, manager or officer, that individual is deemed to have committed the offence personally (Section 55).
Administrative sanctions (Section 59) — without criminal prosecution PVARA may issue a written reprimand or public censure, direct cessation or remediation, impose a financial penalty up to PKR 25 million per contravention, suspend or revoke a licence, or disqualify individuals. Emergency powers (Section 60) allow PVARA to suspend specified services or freeze related assets for up to 30 days. Blocking of unlicensed services (Section 61) lets PVARA direct telecoms, hosting providers, app stores, search engines, ad networks and payment providers to block or remove material promoting unlicensed VA services.
How to appeal a PVARA decision
Any person aggrieved by a PVARA order may appeal to the Virtual Assets Appellate Tribunal (VAAT) within 30 days (Section 63). The VAAT comprises a presiding officer (a retired High Court judge or an advocate with 10+ years' experience), a technical expert, and a financial expert, and must decide appeals within three months; its decisions carry the force of civil court decrees. A further appeal lies to the Supreme Court of Pakistan within 30 days of the VAAT's order (Section 65).
Key takeaways for businesses
If you are a VASP already operating in Pakistan: you have six months to apply or cease. A complete application within that window may let you continue existing services during processing, provided you comply with interim directives and core AML obligations.
If you are planning to enter the market: obtain a NOC before incorporating, then apply for a full licence post-incorporation. Build your AML programme, fit-and-proper documentation, and custody/capital structure before approaching PVARA.
If you are a token issuer: review your token's economic function honestly — if it can be used for payment or investment and is transferable, it likely falls within the definition. FRTs require 100% HQLA backing and a Segregated Reserve; algorithmic tokens are prohibited unless specifically permitted by future Regulations.
If you are operating cross-border: do not assume you fall outside scope simply because you are incorporated outside Pakistan. If your services are offered to Pakistani users, PVARA's extraterritorial reach may apply. ComplyFactor's AML advisory and compliance programme services help VASPs and issuers assess gaps and build a credible transition plan.
Frequently asked questions
Does the Act apply to pure crypto mining?
Are NFTs regulated under the Act?
Does running a self-custody wallet app require a licence?
What happens to my existing NOC or licence from the 2025 Ordinance?
Is DeFi activity regulated?
How does the Act interact with Pakistan's existing AML framework?
ComplyFactor is a specialist AML and regulatory compliance advisory firm working with MSBs, PSPs, fintechs, and VASPs across multiple jurisdictions. Our advisors hold CAMS certification and bring direct regulatory experience to every engagement.
