Inside Pakistan’s Virtual Assets Act: What PVARA Actually Regulates

For years, buying crypto in Pakistan meant operating in a country that had never quite decided whether the activity was legal, tolerated, or simply unaddressed. The State Bank had repeatedly discouraged banks from touching virtual assets, but no statute actually banned individuals from holding or trading them, and in doing so Pakistan built one of the world’s largest crypto markets, ranking third globally, behind only India and the United States, on the Chainanalysis 2025 Global Crypto Adoption Index, with an estimated 40 million users transacting almost entirely outside any formal system. That ambiguity ended, formally, on September 5, 2026, not with a ban, but with a deadline. This is the story of how Pakistan got there, and what the resulting regime actually requires.

From Legal Grey Zone to Regulated Market – A Short History

For most of the last decade, Pakistan’s crypto market grew despite the law rather than because of it. The State Bank periodically warned that virtual assets were not legal tender and that banks should not facilitate transactions involving them, but no statute prohibited individuals from trading. That started changing in July 2025, when the government created the Pakistan Virtual Assets Regulatory Authority by presidential ordinance, an emergency legislative measure with a built-in expiry. Senate extended it by 120 days that November to allow proper drafting, and Parliament passed the Virtual Assets Act, 2026 on March 6, converting PVARA into a permanent federal regulator just before the ordinance would otherwise have lapsed, a move that also fulfilled a reform milestone under Pakistan’s IMF programme. PVARA treats March 5 as the law’s commencement date, the detail that fixed the September deadline.

Where PVARA Regulates

Image Source: CryptoNews

PVARA sits under the Ministry of Finance, chaired by Bilal Bin Saqib, and operates as Pakistan’s independent federal regulator for licensing, supervising, and regulating virtual assets and VASPs, coordinating with the State Bank, Securities and Exchange Commission of Pakistan (SECP), and the Financial Monitoring Unit. Under its own site’s licensing page, PVARA licenses eleven distinct categories of acivity drawn from Schedule I of the Act: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Derivatives, Management and Investment, Transfer and Settlement, Asset-Referenced Token Issuance, Fiat-Referenced Token Issuance, and Mining Related Services. Several secondary outlets have reported only ten categories; the Act’s own published text and PVARA’s site both confirm eleven, and the law’s reach extends to any provider serving Pakistani users “in or from Pakistan,” regardless of where the firm itself is incorporated. Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Derivatives, Management and Investment, Transfer and Settlement, Asset-Referenced Token Issuance, Fiat-Referenced Token Issuance, and Mining Related Services.

The Licensing Framework

To get licensed, a firm must be incorporated in Pakistan under the Companies Act 2017, no foreign entity can plug into the market without a local subsidiary. Beyond incorporation, PVARA requires meeting a minimum paid-up capital requirements scaling by category, passing a “fit and proper” test on directors and key personnel, and functioining AML/CFT, cybersecurity systems, and business-continuity systems before authority will sign off. It is crucial to note here that this is a significant step up from the zero-infrastructure baseline most firms serving Pakistani users were operating from a year ago.

Track A – Regulatory Sandbox to Licence – PVARA’s sandbox route is designed for firms testing new or novel products under regulatory supervision, particularly tokenised assets or lending models that do not fit existing licence categories. Firms operate within an approved scope and customer limit, meet PVARA’s reporting and safeguarding requirements, and can then exit the sandbox and apply for a full licence.

Thank B – NOC to Licence – The NOC route applies to firms following the standard licencing process. Applicants submit their business plan and corporate documents, obtain preliminary approval, register with the Financial Monitoring Unit (FMU), incorporate a local subsidiary, and then submit a full licence application. This route was particularly important for transitional operators, firms alreadly serving Pakistani users before the new framework took effect, which were required to regularise their operations through this process.

The September 5 NOC Deadline

The deadline applies to specifically to what the Act calls transitional persons, firms already serving Pakistani users on or before March 5, 2026, when the law took effect. Under Section 70, those firms had six months to file for an NOC. Firms that filed on time could continue their existing services while PVARA reveiwed their applications, although the regulator could impose interim restrictions on onboarding, products, transaction volumes or custody. Those that failed to apply by the deadline could no longer legally continue operating. PVARA’s application portal opened only on August 22, leaving firms rougly two weeks to file before the deadline from June 11 to July 2.

PVARA chairman Bilal Bin Saqib told TechJuice that seventy companies filed for an NOC by the deadline, a mix of international platforms and Pakistani startups filing for the first time. Binance and HTX had already secured NOCs in December 2025, well ahead of the general window. Binance’s early positioning isn’t entirely a coincidence either, Changpeng Zhao was appointed an adviser to Pakistan’s Crypto Council back in April 2025. Set against an estimated 40 million users, seventy filed applications is a real number, but a small one.

For firms that missed the deadline, the Act is specific, stating under Section 54, unlicensed operation is a criminal offense carrying fines of up to PKR 50 million (~$179,000) and imprisonment of up to five years, with a separate, lighter penalty of up to PKR 25 million and three years for unauthorized token offerings specifically.

What Licencing Actually Requires – AML, FATF, and the Travel Rule

Licensing brings VASPs into a significantly broader compliance framework. As financial institutions under Pakistan’s Anti-Money Laundering Act, they must conduct customer due diligence, apply enhanced checks to politically exposed persons and high-risk jurisdictions, report suspicious transactions to the Financial Monitoring Unit, and retain customer and transaction records for several years. This move exchanges away from the lighter KYC models previously used by some platforms operating in Pakistan.

A key additional requirement is the FATF Travel Rule, which requires originator and beneficiary information to accompany virtual asset transfers above the prescribed threshold, including transfers between exchanges. While this is already a familiar compliance requirement in markets such as the EU, UK and Singapore, it represents a significant new operational requirement for platforms that previously served Pakistani users without a comparable compliance infrastructure.

Banking Access – SBP Circular No. 10 of 2026

The regulatory changes also address one of crypto businesses’ biggest practical obstacles i.e., the access to Pakistan’s banking system. The SBP Circular Letter No.10 of 2026 introduced a phased framework replacing the previous restrictions. NOC holders can open limited-purpose accounts for regulatory fees, local incorporation costs and PKR payroll, while fully licenced VASPs can access segregated client-money accounts and broader transactional banking, with client and company funds kept separate. However, banks remain prohibited from holding virtual assets on their balance sheets or extending credit against them, making this a controlled opening of banking access rather than permission for banks to take direct crypto exposure.

The Market Behind the Urgency

Part of why PVARA has moved as fast as it has comes down to the scale. PVARA Chairman Saqib has told the Senate Standing Committee on Cabinet Secretariat that Pakistan has rougly 40 million crypto-linked accounts, a figure he’s used to estimate the country’s virtual asset market at around $250 billion. The gap with Pakistan’s rougly six million active taxpayers highlights the potential for formalisation to improve both transaction visibility and tax compliance. The opportunity extends to remittances with Pakistan receiving a record $38.3 billion in remittances in FY25, with FY26 projected at $42 billion, meaning even a one-percentage-point reduction in transfer costs could potentially save around $400 million annually. PVARA’s MoU with SC Financial Technologies to explore stablecoin-based cross-border payments shows how the new regulatory and banking framework could support that market.

Shariah Compliance: A Distinctly Pakistani Piece

A distinctive element of Pakistan’s framework is its potential Shariah-compliance layer, with the Act establishing a Shariah Advisory Committee within PVARA whose rulings will bind licensed firms offering Shariah-compliant products. However, the underlying question remains unresolved with a June 2026 fatwa signed by Mufti Muhammad Taqi Usmani and other scholars declared purchasing goods with cryptocurrency impermissible, while PVARA Chairman Saqib has argued that blockchain infrastructure, stablecoins and cryptocurrencies should be assessed separately. Their July meeting did not indicate a change in Mufti Usmani’s position, leaving the regulatory framework ahead of a definitive Shariah assessment. If that distinction is eventually established, a regulator-backed Shariah-compliant digital asset market could potentially position Pakistan to tap the wider Islamic finance market, where global sukuk issuance reached rougly $300 billion in 2025.

hich is not a formal feature of major regimes such as the EU’s MiCA or the UAE’s VARA framework. Reporting suggests PVARA may require products marketed as Shariah-compliant to obtain appropriate approval, although the issue remains unsettled pending a reported joint statement with Islamic finance scholar Mufti Muhammad Taqi Usmani on cryptocurrency’s permissibility under Shariah law. If formalised, a regulator-backed Shariah-compliant exchange could differentiate Pakistan’s market and potentially attract capital from Islamic finance markets across the Gulf and Malaysia.

Challenges and Open Questions

The framework’s biggest test may be implementation. PVARA must build that technical capacity to assess sophisticated VASP applications and supervise what it estimates could be a $250 billion market, while curbing the existing P2P grey market will require coordination with agencies such as the Pakistan Telecommunication Authority (PTA) beyond the licensing portal itself. There is also a question of whether Pakistan’s traditionally cautious banks will actually provide the services permitted under the new SBP framework, or whether regulatory permission will outpace commercial adoption. Finally, international exchanges may decide that complying with Pakistan’s AML/CFT requirements is too costly and instead block Pakistani users, potentially pushing activity back toward the offshore and unregulated platforms the framework is designed to bring within the formal system.

What Happens Next

PVARA expects to issue the first full licences in Q4 2026, moving the framework beyond transitional NOCs toward fully licensed and supervised operators. Travel Route enforcement and deeper integration with the Financial Monitoring Unit are expected in 2027, bringing Pakistan’s compliance requirements closer to other FATF-aligned markets. However, for now, the market remains split between NOC holders operating under the interim clearence and firms that failed to meet the September deadline. The real test will be whether these measures change how Pakistan’s crypto market actually operates, bringing users, transactions, and capital into regulated channels, or whether activity simply migrates to platforms and payment routes beyond PVARA’s reach. That will ultimately determine whether Pakistan’s framework becomes a functioning market infrastructure or remains, largely, a regulatory framework on paper.

Conclusion

Pakistan spent the better part of a decade with one of the world’s largest crypto markets and no legal infrastructure to govern it emerged. The Virtual Assets Act, 2026, has moved quickly to close that gap, establishing a licensing framework, an NOC pathway, regulated banking access and a Shariah-compliance mechanism that is still being worked out. But buidling tha framework is only the first ste, its success will depend on whether PVARA can supervise the market at scale, whether banks translate regulatory permission into actual services, and whether international exchanges choose compliance over simply excluding Pakistani users. The next 12 months will show whether Pakistan has genuinely brought crypto into the formal economy, or simply created the rules for doing so.