PVARA rules, made simple.
The Virtual Assets Act 2026 and the August 2026 regulations, in plain terms. Focused on AML CFT.
Summary as of October 2026. Read with the official texts on pvara.gov.pk. Not legal advice.
notified
categories
capital
What do the PVARA regulations require?
Pakistan's Virtual Assets Act 2026 and the regulations notified in August 2026 require VASPs to hold a PVARA license in one of ten categories, meet minimum capital, and enter through the sandbox (Track A) or a no-objection route (Track B). The Board owns AML CFT, outsourcing must be disclosed, and the FMU's goAML system is used for reporting.
UpdatedFrom ordinance to licensing in about a year.
PVARA constituted
The Pakistan Virtual Assets Regulatory Authority is set up through a presidential ordinance.
Virtual Assets Act, 2026 passed
Parliament makes PVARA a permanent federal regulator with licensing, supervision and enforcement powers.
Prior approval advisory
PVARA states that any virtual asset pilot, partnership or MoU needs its prior authorization. Early engagement routes: sandbox, no-action relief, or NOC.
Public consultation
Draft regulations, a general handbook and ten activity handbooks published for comment. Consultation closed 2 July 2026.
Two regulations notified
Pakistan Virtual Asset Services Regulations, 2026 (S.R.O. 1419(I)/2026) and the Activity Specific Regulations, 2026 (S.R.O. 1420(I)/2026). Licensing opens.
Transitional deadline
Operators active on or before 5 March 2026 had to apply for an NOC under section 70, or cease operations.
Ten categories. One license per activity.
A license lists the categories it authorizes. A combined product needs each activity licensed. Pure mining for your own account is not a licensed service.
| Category | Minimum paid-up capital (PKR) |
|---|---|
| Advisory services | 15,000,000 |
| Broker-dealer services | 75,000,000 |
| Custody services | 200,000,000 |
| Virtual asset management and investment services | 200,000,000 |
| Virtual asset transfer and settlement services | 200,000,000 |
| Fiat-referenced token issuance services | 300,000,000 |
| Asset-referenced token issuance services | 300,000,000 |
| Exchange services | 500,000,000 |
| Lending and borrowing services | 500,000,000 |
| Virtual asset derivatives services | 500,000,000 |
| Mining-related virtual asset services | 500,000,000 |
Issuance is split into fiat-referenced and asset-referenced tokens. Source: PVARA licensing page.
Three routes to a license.
Sandbox to license
Apply to the regulatory sandbox, get admitted, test under supervision, meet the exit criteria, then apply for a license. No separate NOC needed after a successful exit.
NOC to license
Apply for an NOC on Form I. After issuance: meet compliance requirements including FMU registration, incorporate in Pakistan, then apply for the license within the NOC's validity.
Existing operators
Businesses operating on or before 5 March 2026 had until 5 September 2026 to apply for an NOC under section 70 of the Act.
| Stage | Timeline stated by PVARA |
|---|---|
| NOC decision | Within 60 days of a complete application |
| NOC validity | 3 months, extendable once by up to 3 months if requested before expiry |
| License decision | Within 90 days of a complete application, extendable by up to 60 days |
| Director and Controller approval | Within 30 business days, with updates at least every 15 business days |
What PVARA expects from your AML CFT.
An AML CFT program to get licensed
KYC, transaction monitoring and suspicious activity reporting systems are licensing requirements. The NOC submission includes an AML CFT framework.
FMU registration on goAML
Applicants on the NOC track register with the Financial Monitoring Unit before licensing.
The Board owns it
Responsibility for AML CFT/CPF and market integrity controls stays with the Board. The Board must also oversee any outsourcing.
Outsourcing is disclosed
The application describes the use of group entities, agents and outsourcing, including where key functions sit. Outsourcing contracts are disclosed in Part D.
Tested even in the sandbox
The sandbox technical review covers custody, cybersecurity, KYC/AML and incident response. Governance needs a clearly identified compliance lead.
Banks will do their own due diligence
SBP's BPRD Circular Letter No. 10 of 2026 sets how banks deal with licensed VASPs, including due diligence and client-money account segregation.
Test live. Under supervision.
- Agreed scope, duration and customer limits
Live testing with real users under user limits and transaction caps. - Application with an exit plan
Product, risk framework, testing plan and exit strategy. - Regular reporting
Reporting, safeguarding and disclosure duties apply throughout testing. - Exit criteria
Technical stability, risk controls and user protection, plus a plan for user funds if the test does not proceed.
Operating without a license
Up to five years' imprisonment, a fine of up to PKR 50 million, or both.
Unauthorized offerings or promotion
Up to three years' imprisonment, a fine of up to PKR 25 million, or both.
Applicant questions.
Which law governs virtual asset services in Pakistan?
The Virtual Assets Act, 2026. It makes PVARA the federal regulator for virtual asset services, with powers to license, supervise and enforce, and replaces the 2025 ordinance under which PVARA was first constituted.
Which regulations were notified in August 2026?
The Pakistan Virtual Asset Services Regulations, 2026 (S.R.O. 1419(I)/2026) and the Pakistan Virtual Asset Services Activity Specific Regulations, 2026 (S.R.O. 1420(I)/2026). Both took effect on 21 August 2026.
Can a foreign company apply?
PVARA states there is no Pakistani shareholding requirement and no foreign ownership cap. The licensee must be a company incorporated in Pakistan with at least three directors.
Is the sandbox a license?
No. Sandbox admission allows supervised testing within an agreed scope. Successful completion lets you apply for a license without a separate NOC. It does not guarantee one.
What happens to unlicensed operators?
Operating an unlicensed virtual asset service is an offense punishable by up to five years' imprisonment, a fine of up to PKR 50 million, or both.
Applying? Start with AML CFT.
We co-source it with you. Application to license.