Pakistan’s virtual asset licensing regime is now live. In under 6 months, Pakistan has moved from primary legislation to notified regulations and an open licensing process. The Virtual Assets Act, 2026 now strictly governs Pakistan’s digital asset market. Consequently, under Section 70 of the Virtual Assets Act, 2026, the Pakistan Virtual Assets Regulatory Authority (PVARA) requires all existing Virtual Asset Service Providers (VASPs) to obtain formal VASP licensing before offering services.
This new framework guarantees that only legitimate, qualified, and accountable companies operate within the country. Furthermore, it actively protects consumers and maintains complete market integrity. Licensees must follow rigorous operational standards. These include safeguarding customer funds, maintaining robust cybersecurity, providing clear disclosures, and ensuring transparent business practices.
PVARA Reveals Mandatory VASP Licensing Requirements
Before PVARA grants a full VASP license, applicants must meet six foundational requirements. Therefore, companies must completely overhaul their compliance structures.
| Requirement | Description |
| Legal Registration | The applicant must be a registered company in Pakistan under the Companies Act 2017. |
| Capital Limits | Companies must meet prescribed minimum paid-up capital requirements based on their license category. |
| Fit and Proper Test | Directors and key personnel must pass strict background checks and fit-and-proper criteria. |
| AML/CFT Program | Firms must establish comprehensive KYC, transaction monitoring, and suspicious activity reporting. |
| Cybersecurity | Platforms must implement robust cybersecurity measures to protect customer assets and data. |
| Business Continuity | Companies must maintain active disaster recovery and business continuity arrangements. |
Comprehensive VASP Categories
The Virtual Assets Act, 2026 sets out multiple license categories under Schedule I. Interestingly, an applicant can apply for one or several of these specific licenses.
| License Category | Permitted Operations |
| Advisory | Advising on virtual assets, investment merits, and portfolio composition. |
| Broker-Dealer | Receiving and transmitting orders, and dealing on own/client accounts. |
| Custody | Safekeeping and controlling virtual assets or access keys for clients. |
| Exchange | Operating a platform to exchange virtual assets for fiat or other crypto. |
| Lending & Borrowing | Facilitating the lending or borrowing of virtual assets. |
| Derivatives | Dealing in or operating a platform for virtual asset derivatives. |
| Management & Investment | Managing virtual asset portfolios on a discretionary basis for clients. |
| Transfer & Settlement | Transferring assets between accounts and settling those transfers. |
| Asset-Referenced Tokens | Issuing stablecoins pegged to an asset, basket, or right. |
| Fiat-Referenced Tokens | Issuing stablecoins pegged to a single fiat currency. |
| Mining Related Services | Providing mining, validation, or related infrastructure services. |
PVARA Reveals the Legal Paths to VASP Licensing
Companies must choose their licensing path based on their current operational status and regulatory requirements.
Track A: Sandbox to Licence
This track targets firms that want to test an innovative product under regulatory supervision. First, companies apply to test their product. Next, PVARA admits them with an agreed scope, duration, and customer limit. Throughout this controlled testing, firms must meet strict reporting and safeguarding rules. Finally, upon a successful exit, the company can apply for a full VASP Licence. Startups can directly apply for the Regulatory Sandbox to begin this process.
Track B: NOC to Licence
This track helps firms incorporate a newly licensed entity in Pakistan. However, it carries a critical deadline for existing operators.
Under Section 70 of the Virtual Assets Act, 2026, “Transitional Persons” currently face a massive time crunch. Any entity operating on or before March 5, 2026, must submit an NOC application by September 5, 2026. If they fail to meet this deadline, they must immediately cease all operations in Pakistan.
To secure the NOC, existing platforms must submit a solid business plan and corporate documents. After receiving preliminary approval, they must register with the Financial Monitoring Unit. Next, they must establish a local subsidiary under the Companies Act 2017. Finally, they submit the ultimate VASP licensing application.
Operators can start an application through the official PVARA portal right now. Since the September deadline is just days away, existing platforms must act immediately to avoid forced closures.
With this crucial step, Pakistan is now finally opening the front door to the global digital asset economy, with clear rules, regulatory oversight and accountability.
