PVARA Licensing in Pakistan: What the Rules Require

• The transitional deadline ran from a commencement reference of 5 March 2026, so the six-month Section 70 clock closed on 5 September and anyone serving Pakistani users without a filed application now faces up to five years, a fine of up to fifty million rupees, or both.
• PVARA notified the licensing framework on 21 August 2026 without the two numbers applicants need. Schedule I capital figures are absent from the published text and fees are deferred to Rules that have not been issued, while the capital ladder circulating in advisory write-ups has no regulator source behind it.
• Two licensing clocks run at once. The Services Regulations give a three-month NOC validity with one extension, and the 2025 NOC Regulations require the full application within three months of the licensing regulations being issued, which puts roughly 21 November 2026 on the first-wave NOC holders including Binance and HTX.
• The State Bank’s April circular reopened banking through segregated, non-remunerative rupee client money accounts that cannot take cash in or out, which hands licensed venues a structurally worse on-ramp than the informal P2P market they are meant to replace.
• The published constraint most applicants are underweighting is Regulation 32(1), a continuing requirement to hold net liquid assets equal to 1.2 times adjusted monthly operating expenses, which bites a thin-margin operator harder than any one-time capital gate.

Pakistan’s crypto industry woke up on 6 September inside a legal perimeter it had until the previous evening to enter. Section 70 of the Virtual Assets Act, 2026 gave anyone providing virtual asset services before commencement six months to apply for a license or stop, that clock expired on 5 September, and anyone still quoting a price to a Pakistani user this morning without a filed application is exposed under Section 54 to imprisonment of up to five years, a fine of up to fifty million rupees, or both.

The regime those firms just filed into is more complete than anything else built in the region at this speed, and it is still missing the one number every applicant needs to write a business case. PVARA notified both the Pakistan Virtual Asset Services Regulations, 2026 and the Activity Specific Regulations on 21 August, four months after the State Bank reopened the banking system to licensed operators, and two weeks before the deadline that turned staying outside the perimeter into an offense. The capital schedule is referenced throughout the text and the fee schedule is deferred to Rules that have not been published. A regulator closed the back door before it put a price on the front one.

The future of finance is here. Trade crypto and more

Six months from a commencement date that did most of the work

Parliament passed the Act on 6 March 2026, converting the Virtual Assets Ordinance of July 2025 into permanent law after the Senate had already extended that ordinance by 120 days on 4 November 2025 to buy drafting time. PVARA now treats 5 March 2026 as the reference commencement, which is the arithmetic that landed the transitional deadline on 5 September rather than some later date, and firms that assumed the six months ran from the Act’s publication or from the notification of the regulations lost about a month of runway they never had.

Legislating this by ordinance first drew fair criticism at the time, and the Free and Fair Election Network’s read from October 2025 flagged both the process problem and the substantive one, which was a high and opaque regulatory burden with unclear fees and timelines. Ten months later the process objection is moot because parliament ratified the thing, and the substantive objection has aged well.

Section 7(1) seats the Authority’s board with the Secretaries of Finance and of Law and Justice, the Governor of the State Bank, the SECP Chairperson, the chairs of the National AML/CFT Authority and the Pakistan Digital Authority, plus two independent directors. Every agency that could obstruct a crypto license in Pakistan sits on the body that grants it, which solves the coordination problem that has stalled VASP regimes elsewhere and creates a different one, because a regulator whose board is the government does not have much room to disagree with the government.

Two doors into the perimeter, and neither one is quick

New entrants choose between the sandbox track and the NOC track, and the licensing page sets out both as five-step sequences ending in the same full VASP application. The NOC route is the commercially live one because it is what an existing operator or a foreign exchange with a Pakistani user base uses to get pre-incorporation clearance before spending money on a local entity.

Regulation 6(3) gives the Authority sixty days to decide an NOC on a complete application, Regulation 6(5) makes the resulting certificate valid for three months with one three-month extension available, and Regulation 7(3) and 7(4) give PVARA ninety days on the full license application with a further sixty available for reasons recorded in writing. Run that end to end and an applicant who filed on 5 September could reasonably be looking at a decision in the second quarter of 2027, which is before you account for the observation cycles that ABS & Co estimated would add four to eight weeks in practice.

There is a second clock, and it does not agree with the first. The NOC Regulations that took effect on 2 December 2025 require a successful applicant to submit its licensing application within three months of the issuance of the VASP licensing regulations, which puts a hard date of roughly 21 November 2026 on every firm holding a 2025-vintage NOC, independent of when that certificate was granted or how long its own three-month validity has left to run. Binance and HTX are in that cohort. So is anyone else PVARA cleared in the first wave, and the two provisions read together mean the earliest NOC holders are on a tighter leash than firms that filed last week.

The NOC is not permission, and Regulation 5A is why the market kept trading

Regulation 6(4) says the certificate is issued without prejudice to a full assessment of any subsequent license application, and it confers no authority to provide services. Read on its own that would have taken every domestic exchange offline in March.

What kept order books live is Regulation 5A(2), which lets a transitional person with a complete application continue operating pending determination, provided it complies with any interim directives and adheres to the core obligations of the Act, and requires prior approval from the Authority for any marketing activity during that window. That marketing condition is doing more work than it looks like it is, because it hands PVARA a supervisory lever over firms it has not yet licensed and cannot yet fine into shape, and a platform that runs an aggressive acquisition campaign while its file sits in review is giving the Authority a reason to slow the file down.

The capital schedule nobody outside the building has read

Regulation 31(1) requires a licensee to maintain minimum paid-up capital in accordance with Schedule I, Regulation 10(3) repeats the obligation as a continuing prudential condition, and the schedule itself is not in the text of the notified Services Regulations as published. Fees are worse. Regulation 11(1) says an applicant pays processing, licensing, annual supervisory and renewal fees as published in the Rules, Regulation 11(2) confirms they are non-refundable, and the Rules have not been notified.

Buy bitcoin and stocks. Signup to Coinbase today

Figures are circulating in advisory write-ups anyway, usually a ladder running from fifteen million rupees for advisory up to five hundred million for an exchange, and I could not tie any of them to a regulator-published source. Treat them as planning assumptions from consultants pricing engagements rather than as statutory minimums, and budget the range rather than the midpoint until PVARA publishes.

The requirement that is published, and that most applicants are underweighting, sits in Regulation 32(1), which obliges a licensee to hold net liquid assets equal to 1.2 times its adjusted monthly operating expenses at all times, in high-quality liquid assets under Regulation 32(3). Paid-up capital is a one-time gate you clear with a founder’s check. A rolling 1.2x liquidity floor against opex is a permanent tax on the cost base, and for a thin-margin local broker running a Karachi office and a compliance team it will bind long before any exchange-tier capital number does.

Client money accounts, and the cash rule that decides the market

BPRD Circular Letter No. 10 of 2026, issued 14 April, superseded the April 2018 prohibition that had kept Pakistani banks out of crypto for eight years, and it did so with unusual precision about what it was and was not opening. Regulated entities may onboard a PVARA licensee or NOC holder after obtaining and independently verifying the license. Client money accounts are rupee-denominated and non-remunerative, must be strictly segregated, and commingling VASP funds with client funds is prohibited outright. Banks may not invest, trade or hold virtual assets using their own funds or customer deposits, so the bank holds the fiat leg and never touches the asset leg.

Cash deposits and cash withdrawals are not permitted in client money accounts, and the balances cannot be pledged as collateral or security for financing, which is the pair of restrictions that reshapes the domestic market.

Pakistan’s retail crypto market runs on cash-settled peer-to-peer trades and informal merchant networks, and taking cash out of the licensed channel means a licensed venue competes for the same customer while carrying full KYC, transaction monitoring and reporting overhead against an informal merchant carrying none. Data Darbar’s read is that internalizing fiat conversion inside the licensed perimeter squeezes those merchants over time, and that is the plausible medium-term path. In the near term the circular has handed licensed operators a structurally worse on-ramp than the one they are meant to displace, and whether the regime works comes down to whether banking legitimacy is worth more to a Pakistani retail user than converting cash at a corner shop.

Custody drafted by people who watched FTX

The client asset provisions are the strongest part of the framework and they are recognizably post-2022. Regulation 33(2) bars a licensee from treating customer assets as its own or using, pledging, encumbering, lending or rehypothecating them without prior informed explicit consent, and Regulation 33(4) requires assets held against withdrawal and redemption obligations to equal 100% of the relevant customer liabilities at all times.

The Activity Specific Regulations go further on custody than the general text does. Customer assets do not form part of a licensee’s estate on insolvency, custodians run daily reconciliations across client ledger balances and on-chain balances and must notify the Authority without delay of any material discrepancy left unrectified for twenty-four hours, proof of reserves is a standing obligation rather than a marketing exercise, and staking or yield generation on client assets requires explicit prior written informed consent. A custodian also cannot outsource the principal custody activity at all, though it may use wallet infrastructure providers if ultimate responsibility and effective control stay in-house, which is a meaningful constraint on the common model of a local brand fronting a foreign qualified custodian.

Exchanges got a lighter touch on listings and a heavier one on disclosure. A venue may admit an asset without prior authority approval where the asset is not restricted and clears internal due diligence, and it carries full responsibility for that decision, while every listed asset needs a published summary covering market capitalization, fully diluted value, circulating supply, smart contract audit status and largest historical price decline. On the frequently repeated claim that the Act bans privacy coins, no such prohibition could be found in the Act or in either set of notified regulations, and what exists is a general admission standard requiring exchanges to assess legal and regulatory risk. Record retention runs seven years under Regulation 10(1)(c) rather than the ten that has been circulating in compliance summaries, which is a real difference when you are sizing archive infrastructure for a decade.

Brokers and advisers got conduct rules borrowed almost intact from securities regulation. A broker-dealer owes best execution, taking all reasonable steps to obtain the best possible result across price, cost, speed and likelihood of execution and settlement, and must publish an execution policy naming the venues it relies on and how it monitors quality. Incidental holding of client assets is capped at temporary operational possession strictly necessary to execute, transfer or settle, which closes the obvious workaround of running de facto custody off a broker license. The sharpest provision sits on the advisory side, where a licensee may not structure its services in a way that produces de facto execution, order routing control or discretionary management without holding the relevant license, and may not describe its advice as independent or market-wide unless the range of products, venues and issuers it considers genuinely supports the claim. Anyone who has watched a regional advisory shop quietly turn into an unlicensed brokerage will recognize exactly what those two lines are for.

The future of finance is here. Trade crypto and more

The eleventh category, and the stablecoin slot nobody has claimed

Schedule I of the Act lists ten heads of virtual asset service, and PVARA’s own licensing page enumerates eleven, because issuance has been split into asset-referenced token issuance and fiat-referenced token issuance as separate licensable activities. That split is not cosmetic. It creates a dedicated authorization for a fiat-referenced stablecoin issuer inside a statute that defines virtual assets as something other than legal tender, and it does so in a country where the central bank governor sits on the board that would grant the license.

Nobody has claimed the slot yet, and the mechanics of who would say yes are the interesting part. A rupee-referenced token issued under a PVARA license would be a private claim on rupees circulating on public rails, which touches the State Bank’s monetary and payments mandate directly, and the governance design means the SBP does not need to object from outside the process because it is already inside it. Practically, an issuer’s approval risk is concentrated in a single board seat.

For anyone modeling entry, that argues for treating fiat-referenced issuance as the slowest of the eleven categories regardless of what the published timelines say, and for building any Pakistan stablecoin thesis around a foreign-issued token distributed through a licensed local exchange rather than around domestic issuance. The regulations give exchanges room to admit assets on their own due diligence, which makes distribution the cheaper door.

The AML layer is a bank regime pointed at crypto firms

Licensed operators do not get a purpose-built reporting channel. They register with the Financial Monitoring Unit and file into the same architecture the Anti-Money Laundering Act built for banks, and FMU registration sits as a discrete step in the NOC-to-license sequence rather than as a post-licensing formality, which means a firm needs its monitoring stack working before it has a license to run it. Saqib described the supervised entry framework for Binance and HTX in exactly those terms, with mandatory AML registration and direct FMU linkages as the first of three control areas alongside ownership verification and timeline enforcement.

Section 46 of the Act carries the customer identification and suspicious transaction reporting obligations, and the State Bank circular stacks a second layer on top by requiring banks to run enhanced due diligence on the VASP itself, revise their customer risk-profiling models to account for virtual asset exposure, and report suspicious activity on the fiat leg. A licensed exchange is therefore monitored twice on the same transaction, once by itself and once by the bank holding the client money account, and the two views will not always agree.

That redundancy is deliberate and it has a cost that shows up in onboarding time rather than in fees. Pakistani banks have eight years of institutional habit telling them crypto exposure is prohibited, the circular replaced the prohibition without replacing the habit, and the practical bottleneck for a newly licensed firm will be finding a bank whose compliance committee is willing to be first.

Residency is the bill offshore platforms have not priced

Governance requirements are where a foreign exchange’s Pakistan entity stops being a nameplate. Independent directors must make up at least a third of the board under Regulation 20(3), at least one key individual vested with operational and decision-making authority must be resident in Pakistan under Regulation 10(4), and the compliance officer must be resident under Regulation 23(3). Outsourcing a critical function needs prior written approval under Regulation 10(6) and responsibility for the outsourced activity stays with the licensee under Regulation 37(1), while Regulation 15(2) lets the Authority demand an independent cybersecurity, systems or controls assurance report at any point.

Sourcing a compliance officer in Pakistan who can run FATF-grade monitoring on a virtual asset book, and finding independent directors willing to take statutory exposure on a crypto license in a country whose banks were barred from touching the sector until April this year, is a labor market problem rather than a legal one. It is also the constraint most likely to gate the first licenses.

Extraterritorial by design, and already tested

Section 4(1) lets the Authority exercise its powers extraterritorially to the fullest extent permitted by law, and the Act reaches services provided in or from Pakistan regardless of where the provider is incorporated. Whether that survives contact with a platform that simply geo-blocks and waits is an open question everywhere, and Pakistan has at least started from the position that presence is defined by who you serve.

Buy bitcoin and stocks. Signup to Coinbase today

PVARA got its answer early from the two largest offshore venues. Binance and HTX received NOCs on 13 December 2025, which PVARA Chairman Bilal bin Saqib was careful to frame as the first practical step in a phased supervised entry rather than approval to operate, telling reporters that this was the foundation of a building the platforms still had to construct, and pointing at the thirty to forty million Pakistanis already holding crypto outside any regulatory relationship as the reason for moving at all. Both now sit under the November licensing clock with everyone else, and the first full exchange license PVARA grants will tell the market more about the regime’s real standard than any of the notified text does.

Two enforcement tracks, and an AML framing that expired in 2022

The FIA stood up a dedicated crypto crime unit inside its National Command and Control Centre in July 2026, and the division of labor was stated plainly by the agency’s counter-terrorism director, with PVARA holding regulation and the FIA taking criminal activity involving virtual assets. Two doors, two sets of consequences, and an unlicensed operator that ignored the September deadline now has both open to it.

One correction is worth making because it keeps turning up in compliance memos on Pakistan. The country is routinely described as sitting on the FATF’s list of jurisdictions under increased monitoring, and it has been off that list since 21 October 2022, when the FATF stated that Pakistan was no longer subject to increased monitoring. The AML pressure driving this framework is real and it comes from a different direction, which is IMF program conditionality and the standing follow-up obligations of a delisted jurisdiction that has no appetite to go back. The texture of that pressure showed up clearly in 2025 when the IMF rejected Pakistan’s proposal to route 2,000 megawatts of surplus generation to bitcoin miners at a subsidized 23 to 24 rupees per kilowatt-hour, on the grounds that a targeted power concession distorts the market and never gets unwound cleanly. The mining ambitions in Schedule I of the Act exist inside that constraint.

The tax piece never shipped

Nothing crypto-specific has been enacted. The FBR’s position is that existing law already reaches these transactions, with mining treated as business income and disposals treated as capital gains under the Income Tax Ordinance, and officials told Arab News in June that a dedicated rate landing somewhere between 10% and 20% was under consideration for the budget, subject to a final FBR decision.

The 15% figure that circulates as though it were settled crypto policy is the capital gains rate on listed equities for registered filers, and it has been used as a comparator rather than adopted as a rule. Anyone building a Pakistani retail product should assume disposals are taxable today under general principles, should assume a specific rate is coming, and should not hard-code 15% into a client-facing tax report.

What to watch before December

Three things resolve the open questions faster than any amount of reading the regulations will. The first is whether PVARA publishes a public NOC register, because the market currently cannot tell a filed applicant from an operator that ignored the deadline, and neither can a bank running verification under the State Bank circular. The second is whether the Rules carrying fees and any published capital schedule arrive before the 21 November licensing application deadline binds the 2025 NOC cohort, since asking firms to file a full application without knowing what it costs is a defensible way to start and an indefensible way to continue. The third is how many banks open client money accounts, because one or two institutions serving the entire licensed sector is a bottleneck dressed up as access.

Pakistan built a credible framework in under six months, which is faster than most jurisdictions manage and faster than the drafting quality would suggest. The order of operations was the problem. Criminal liability for operating outside the perimeter arrived before the price of entering it, and the firms that filed on 5 September did so on faith that the missing numbers will be survivable.

See more: Compare verified licensed companies