ABS & Co has examined the enactment of the Virtual Assets Act, 2026 (the “Act” or “VA Act 2026”) and the subsequent operationalisation of the Pakistan Virtual Asset Regulatory Authority (“PVARA”) mark the most consequential structural change to Pakistan’s financial-services landscape in over a decade. The Act applies to all Virtual Asset Service Providers that carry on, or hold themselves out as carrying on a Virtual Asset Service in or from Pakistan, as well as to any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan.
This Insight examines the legal architecture of the new regime and the analysis is intended as an overview rather than an exhaustive treatment, and should not be relied upon in substitution for legal advice.
- The Legislative Architecture of Virtual Assets Act, 2026
The Act is a self-contained statute and it primarily covers four discrete functions.
First, it defines “virtual asset” as any digital representation of value that can be digitally traded, transferred and used for payment or investment purposes but expressly excludes digital representations of fiat currency, securities or other financial assets regulated under any other law unless represented, issued or transferred using distributed ledger technology.
Second, it establishes PVARA as the sole federal regulator for virtual-asset services. Under Section 6 of the Act, the Authority is constituted as a body corporate with its objectives, functions and powers laid out under Section 9, while Board composition and procedures are governed by Sections 7 and 8 respectively. The institutional architecture is closer to that of a regulator than to a sectoral promotion body, and the powers conferred are correspondingly extensive.
Third, the Act criminalises unlicensed activity. The carrying-on of an unlicensed Virtual Asset Service is an offence carrying imprisonment for a term up to five years, or with fine up to fifty million Rupees, or with both.
Fourth, the Act empowers PVARA to issue regulations, standards, directives, guidelines, handbooks and circulars as deemed necessary for the implementation of and for carrying out the purposes of the Act. Therefore, it is crucial for exchanges to not only review the Act itself but the steady accumulation of subordinate instrumentation that gives operational meaning to the primary statute.
- Jurisdictional Reach: Section 4 and the Extraterritorial Question
The Act’s scope is anchored in the phrase “in or from Pakistan.” Section 2 applies the Act to any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan, and to any Issuer that offers, originates or distributes a Virtual Asset in or from Pakistan. The same formulation is reflected in Section 50, which prohibits any person from engaging in, or representing itself as engaging in, Virtual Asset Services in or from Pakistan without being incorporated in Pakistan and holding a valid license from the Authority.
The Act therefore does not treat place of incorporation alone as determinative. Nor does it expressly state that mere technical accessibility of an offshore platform from Pakistan is, by itself, sufficient to bring the platform within scope. The statutory question remains whether the relevant Virtual Asset Service is being carried on, or held out as being carried on, in or from Pakistan.
Section 4 addresses the enforcement dimension of that jurisdictional reach. For investigation and enforcement purposes, the Authority may exercise its powers extraterritorially to the fullest extent permitted by law. It may also enter into arrangements with foreign regulators and law-enforcement agencies for mutual assistance, information sharing, and recognition and enforcement of regulatory decisions. Importantly, Section 4 further provides that the Authority shall prescribe, by Regulations, the conditions under which a Virtual Asset Service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to Persons in Pakistan.
This leaves an important issue to be addressed through Regulations. Until those Regulations are issued, offshore exchanges and issuers should avoid assuming that absence of a local office or incorporation outside Pakistan is sufficient to take them outside the Act. Where services are offered, marketed, provided, or represented as being available to persons in Pakistan, the Act may require licensing and compliance. The Authority also has express power under Section 61 to remove, block, or direct the removal or blocking of online material, including websites, apps, advertisements and payment links, where it promotes, operates, or relates to an unlicensed Virtual Asset Service or otherwise contravenes the Act.
- The Ten-Category Licensable-Activity Matrix
Section 18 of the Act provides that the Virtual Asset Services subject to licensing and regulation are the services specified in Schedule I, together with any other service notified by the Federal Government and subsequently included in Schedule I. A license is granted in respect of specified Virtual Asset Services, rather than as a generic authorisation to conduct “crypto business”. Section 21 further provides that a license granted to a Virtual Asset Service Provider shall specify the Virtual Asset Services that it is permitted to undertake.
The ten categories specified in Schedule I are: (i) advisory services; (ii) broker-dealer services; (iii) custody and administration services; (iv) exchange services; (v) lending and borrowing services; (vi) virtual asset derivatives services; (vii) virtual asset management and investment services, including discretionary portfolio management and staking on behalf of customers where performed on a discretionary basis or as part of a broader investment management mandate; (viii) virtual asset transfer and settlement services; (ix) virtual assets issuance services; and (x) mining-related virtual asset services but only where mining operations provide services to third parties involving customer virtual assets or funds. Pure mining for own account is excluded.
The classification exercise matters because a single product may involve more than one Schedule I service. For example, exchange services include exchanging Virtual Assets for fiat currency, exchanging one or more types of Virtual Assets, matching orders between buyers and sellers, and maintaining an order book for those purposes. Custody and administration services are separately engaged where a person safekeeps or administers Virtual Assets, private cryptographic keys, or other means of access on behalf of customers. Derivatives services are separately described as offering, facilitating, executing, clearing, trading or arranging derivatives that have a Virtual Asset, basket or index as the underlying reference asset.
The Act also gives the Authority power to assess, determine and classify any Virtual Asset, service, activity, offering, Issuer or service provider by reference to its substantive features, underlying function, method of use, or economic effect, irrespective of the nomenclature, structure or designation assigned to it. Accordingly, classification should be approached as a legal and regulatory analysis of the actual product and operating model, rather than a label selected for application purposes.
- Entry Pathways: NOC, Sandbox, and Full License
The Act establishes a licensing pathway for Virtual Asset Service Providers, beginning with a No-Objection Certificate where an applicant intends to incorporate a company in Pakistan with the primary objective of engaging in Virtual Asset Services. Following incorporation, the applicant may proceed to apply for a license in the prescribed form and manner. Separately, the Act also permits the Authority to operate a regulatory sandbox for the controlled testing of innovative Virtual Asset products or services. The sandbox is therefore not a mandatory licensing stage, but a specific pathway for propositions that require supervised testing before wider deployment.
The No-Objection Certificate. The NOC is the gateway clearance under Section 19 of the Act. It is a preliminary determination by PVARA that the applicant’s corporate, governance, and compliance posture is, in principle, compatible with the Act and that the applicant may proceed to incorporate a Pakistani vehicle, register on the Financial Monitoring Unit’s goAML portal, and prepare for full licensing. The NOC is targeted for issuance within sixty (60) calendar days of a complete submission, subject to any observations raised by PVARA. In practice, applicants who submit incomplete or inadequately drafted applications add four to eight weeks of supplementary-question correspondence before the substantive review begins.
The Full License. The full license is the substantive operating authorisation. After incorporation, an application for license is made to the Authority in the prescribed form and manner. Under Section 21, the Authority may grant a license subject to terms and conditions, refuse the application with written reasons, or grant a provisional or limited-scope license on a case-by-case basis. A license must specify the Virtual Asset Services that the licensee is permitted to undertake. The detailed licensing requirements, including any activity-specific conditions, financial resource requirements, documentary requirements and supervisory expectations, will therefore need to be read with the Rules, Regulations and application materials issued by the Authority from time to time.
The Regulatory Sandbox. Section 35 of the Act establishes a statutory basis for a controlled testing environment for innovative Virtual Asset products or services. The sandbox is a specific entry pathway for applicants whose product, service, technology stack or delivery model requires supervised testing before wider commercial rollout. The PVARA Sandbox Guidelines, 2026 set out an Agile Approach under which applications may be submitted at any time during the year through Form I, covering inter alia the applicant’s Innovation / VASP Proposition, Readiness for Testing, Exit Strategy and Scaling, and the Applicant’s Background, with evaluation against criteria including consumer benefit, technological soundness, and compatibility with financial stability and market integrity. The Guidelines also require the applicant to demonstrate fit-and-proper standing, a clearly defined testing plan, risk-management and consumer-protection measures, cybersecurity and data-privacy controls, scalability readiness and an exit plan. Successful applicants may be issued a Letter of Approval and allowed to test within approved parameters, subject to supervision, reporting, record-keeping, consumer protection obligations and exit-stage review. Section 35 also contemplates guidance, no-objection statements and no-action communications in accordance with Regulations. In practical terms, no-action relief should be understood as limited supervisory comfort for specified conduct during the approved test period, and not as legal immunity or a substitute for a license where the applicant intends to operate commercially outside the approved sandbox parameters.
The practical entry assessment is therefore fact-specific. For an applicant with an established operating model, the ordinary route will generally be the NOC, incorporation and license pathway, subject to the Authority’s prescribed requirements. For an applicant proposing an innovative, untested or technology-led model that requires live testing under controlled conditions, the sandbox may provide a supervised route before broader commercial deployment.
- Corporate Structuring: Entry Vehicles for Foreign Exchanges
The Act does not set out a menu of entry vehicles for foreign exchanges. Instead, its licensing architecture is built around a Pakistani corporate and operational presence. Section 19 provides that any person intending to incorporate a company under the Companies Act, 2017, or any other law for the time being in force, with the primary objective of engaging in Virtual Asset Services, must first apply to the Authority for a No-Objection Certificate before commencing incorporation. Following incorporation, the license application is made to the Authority in the prescribed form and manner.
For foreign exchanges, the practical starting point is therefore the establishment of an appropriate Pakistani licensing vehicle. The Act does not expressly prescribe whether that vehicle must be wholly owned by the foreign parent or may include Pakistani shareholders. Those are structuring choices to be assessed by reference to the applicant’s ownership model, governance requirements, funding arrangements, tax position, foreign exchange considerations, and any conditions prescribed by the Authority or other regulators. What the Act does make clear is that the eventual Licensee must maintain a registered office in Pakistan and ensure that at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority, subject to prescribed conditions.
The ownership and control structure will also be relevant to the fit-and-proper assessment. The Authority is required to determine whether Controllers, Sponsors, the Chief Executive Officer and Directors are fit and proper, and may prescribe additional requirements for corporate Controllers, including assessment of corporate behaviour, integrity and track record of Controllers and ultimate beneficial owners. Accordingly, the Pakistani vehicle’s shareholding, board composition, controller profile, governance arrangements and management structure should be settled before the NOC and licensing process is advanced.
Corporate structuring should therefore not be treated as a formality. The proposed vehicle, constitutional documents and governance framework should be aligned with the actual Virtual Asset Services to be undertaken and with the categories for which licensing is sought.
- The Multi-Regulator Landscape
PVARA is the primary regulator for Virtual Assets and Virtual Asset Service Providers, but the Act expressly contemplates coordination with other regulators and public authorities. Section 5 provides that the Act is in addition to other laws, with specific recognition of the Foreign Exchange Regulation Act, 1947, and applicable laws on data protection, data governance, cybersecurity, financial secrecy and cross-border transfers of personal data. Section 9 also empowers PVARA to consult the State Bank of Pakistan and the Securities and Exchange Commission of Pakistan where an asset or activity exhibits features falling within their respective mandates.
The most immediate regulatory touchpoints are therefore likely to be the State Bank of Pakistan, for banking access, fiat settlement arrangements, foreign-exchange compliance and regulated-entity obligations; the Securities and Exchange Commission of Pakistan, for incorporation, corporate filings and any token or activity that may engage the securities perimeter; the Financial Monitoring Unit and National AML/CFT framework, for suspicious transaction reporting, customer due diligence, record-keeping and AML/CFT/CPF controls; and the Federal Board of Revenue, for tax registration, reporting and compliance under the Income Tax Ordinance, 2001 and FBR-issued rules or regulations. Section 17 specifically requires PVARA to cooperate and share supervisory and enforcement information with SBP, SECP, FMU, FIA, FBR and other competent authorities.
The SBP position is now particularly important. BPRD Circular Letter No. 10 of 2026 replaces SBP’s 2018 prohibition on dealing in virtual currencies/tokens and permits SBP-regulated entities to open accounts for entities duly licensed by PVARA as VASPs, subject to strict compliance conditions. Banks must obtain and verify the VASP’s valid PVARA license, conduct due diligence on the VASP’s business, customer onboarding process, customer base and geographic markets, and apply risk-based controls and ongoing monitoring. The circular also contemplates separate PKR-denominated, non-remunerative Client Money Accounts for settlement of authorised transactions of licensed VASPs, with strict segregation from other VASP accounts and a prohibition on commingling VASP funds with client funds.
Importantly, the circular also addresses the sequencing issue. Banks may open limited-purpose accounts for entities holding PVARA NOCs to enable them to complete the formalities for obtaining a PVARA licence. Additional services, including virtual-asset-related transactional activity, may be extended only after grant of the licence and subject to the circular’s conditions. SBP-regulated entities also remain prohibited from investing, trading or holding virtual assets using their own funds or customer deposits, and remain responsible for compliance with applicable SBP regulations, including foreign-exchange regulations.
Accordingly, applicants should not treat the PVARA application as a standalone filing exercise. The regulatory strategy should sequence the PVARA NOC, incorporation, tax registration, banking arrangements, AML/CFT/CPF framework, client-money segregation, foreign-exchange considerations and eventual licence application as a single workstream. The practical challenge is not simply obtaining the PVARA licence; it is ensuring that the applicant’s corporate, banking, tax, AML and data architecture can operate within the wider regulatory framework once the licence is granted.
Practical Observations on Application Quality
In our experience, application quality turns less on the volume of documents submitted and more on whether the applicant’s legal, corporate, operational, technology and AML/CFT position has been properly mapped before filing. The NOC Regulations require a structured submission covering, among other things, the applicant’s business model, Virtual Asset Services for which registration or licensing is sought, governance and Key Individuals, Controllers and beneficial ownership, AML/CFT framework, goAML readiness, technology systems, financial resources, outsourcing arrangements and supporting statutory forms.
Common weaknesses therefore include incomplete activity classification, generic AML/CFT policies not tailored to the applicant’s actual business model, insufficient controller or beneficial-owner disclosures, incomplete fit-and-proper documentation for Key Individuals, inadequate explanation of technology architecture or transaction-monitoring systems, and failure to align the business-model narrative with the applicant’s proposed Pakistan operations.
These issues are not usually solved by adding more narrative to the application. They require a disciplined application workstream: identifying the relevant licensable activities, aligning the corporate vehicle and governance arrangements with the Act and the NOC Regulations, preparing controller and Key Individual documentation, demonstrating AML/CFT and goAML readiness, and ensuring that financial resources, technology systems, outsourcing arrangements and operational controls are consistent with the applicant’s actual service model. This is particularly important because the Authority may re-evaluate fitness and propriety, AML/CFT readiness, governance and internal controls, financial soundness, technology architecture, monitoring systems and the applicant’s ML/TF risk profile during the process.
Concluding Observations
The Virtual Assets Act, 2026 represents a significant reordering of the legal framework for Virtual Asset activity in Pakistan. The statutory framework is now in place, and the NOC Regulations have begun to give practical shape to the first stage of market entry. At the same time, several operational details, including full licensing requirements, activity-specific conditions, financial resource requirements and supervisory expectations, will continue to be shaped through Rules, Regulations, directions and regulatory practice.
For foreign exchanges and other applicants considering entry into Pakistan, the prudent first step is a structured legal and regulatory diagnostic before filing. This should include mapping the applicant’s product surface against the Schedule I service categories, assessing whether the ordinary NOC and licensing pathway or the sandbox route is more appropriate, reviewing the proposed Pakistani corporate structure, identifying Controllers and Key Individuals, and sequencing banking, tax, AML/CFT/CPF, goAML, technology, data and customer-asset safeguards into a single application strategy.
The decision to enter, defer entry into, or refrain from entering the Pakistani Virtual Asset market is ultimately a strategic decision informed by law. It requires a careful assessment of the applicant’s product model, regulatory appetite, corporate structure, capital planning and operational readiness. The framework is new, but the direction is clear: applicants that approach the process as a coordinated legal, regulatory and operational exercise are likely to be better placed than those treating it as a form-filling exercise.
ABS & Co. advises applicants on the legal and regulatory aspects of entry into Pakistan’s Virtual Asset market, including corporate structuring, interpretation of the Act and NOC Regulations, licensable-activity classification, NOC and licensing submissions, sandbox applications, fit-and-proper requirements, AML/CFT/CPF legal review, and related regulatory correspondence. In this area, ABS & Co. also works with industry and technical participants, including CoinConnect, where appropriate, to support coordinated application workstreams. Through this collaboration with CoinConnect and other market participants, applicants can benefit from ABS & Co.’s Pakistani legal and regulatory advice, while drawing on additional technical and operational support where a particular application requires it.
This Insight has been prepared by Ahmed Reza Mirza, Partner, and Khadeeja Ahmad, Senior Associate, as part of ABS & Co.’s virtual assets and financial regulation practice.
