Pakistan

Crypto Licensing

Pakistan's crypto-licensing perimeter has moved from transitional to fully operative within a matter of months. The Virtual Assets Act, 2026 has been in force since 5 March 2026, requiring registration before any entity offers virtual asset services, via a valid PVARA licence held by an incorporated company. The Pakistan Virtual Assets Regulatory Authority's Services Regulations, 2026 and Activity-Specific Regulations, 2026 then came into force on 21 August 2026, the date of their gazette notification, defining ten distinct VASP licence categories together with governance, prudential, conduct, technology and AML/CFT/CPF standards that licensed entities must meet.

The transitional mechanism built into the Act has already run its course. Pre-existing VASPs, those already providing virtual asset services before the new regime took effect, were required under section 70 to file a No-Objection Certificate application by 5 September 2026 or cease operations. Unlicensed operation of virtual asset services after that date is an offence under section 54, and reporting indicates the broader prohibition carries penalties reportedly reaching up to five years' imprisonment and a PKR 50 million fine for unlicensed provision of services, with unauthorised offering or promotion carrying up to PKR 25 million and three years' imprisonment, though the precise statutory pinpoints for these penalty figures rest on secondary legal commentary rather than independently verified gazette text this period.

The practical significance of this sequence is that Pakistan now has a comprehensive, operative VASP licensing framework with a hard compliance deadline already behind it, but no confirmed track record of licence grants or enforcement actions under the new regime exists yet. The regime is therefore best read as newly commenced and untested rather than as a mature supervisory system; the gap between what the law now requires and what the regulator has demonstrably done with that authority is the central uncertainty for any firm assessing its own position relative to the NOC deadline.

Outlook

The period following the passed NOC deadline is the one to watch. The first licence grants or enforcement actions arising from the post-5-September landscape are expected within the current quarter and would clarify how strictly PVARA intends to apply the new regime to the pre-existing VASP population, an outcome flagged as uncertain in the absence of any confirmed enforcement or licensing outcome to date. Minimum paid-up capital figures for each licence category, set out in the regulations' schedule, have also not yet been independently retrieved and remain a gap for firms assessing entry.

Crypto Licensing

Pakistan's crypto licensing framework now rests on a fully enacted statute, the Virtual Assets Act, 2026, which creates Pakistan Virtual Assets Regulatory Authority, PVARA, as the sole domestic licensing authority for virtual asset services (CLM-PK-001). Section 50 of the Act prohibits any person from engaging in, or holding itself out as engaging in, virtual asset services 'in or from Pakistan' unless that person is incorporated in Pakistan and holds a valid PVARA licence. This is a Tier-1, primary-text finding: the claim traces directly to the Gazette-published Act text rather than to secondary commentary, and it is rated Confirmed.

The regime's transitional mechanics have now moved from pending to active. Section 70 required any person already providing virtual asset services before the Act commenced to submit a no-objection-certificate application by 5 September 2026 or cease operations; continuing to operate past that date without having applied is framed in the statute as an offence (CLM-PK-002). That deadline has now elapsed as of this cycle, which converts what was, in the prior cycle, a forward-looking compliance deadline into a live question of which pre-existing operators did or did not file in time, and what PVARA's posture toward non-filers will be. This claim carries Probable confidence and a Tier-2 press source rather than a primary filing record, so the composed record treats the deadline's passage as established but PVARA's enforcement response to it as unverified.

The licensing architecture beneath the Act is built around ten distinct VASP licence categories rather than a single catch-all authorisation, pointing to an activity-specific design intended to separately capture functions such as mining-related services. Whether all ten categories' implementing rulebooks are now fully in force, or whether some remain in draft, is an open question this cycle does not resolve -- it is carried forward as a tracked gap rather than treated as settled.

Outlook

The near-term signal to watch is enforcement behaviour against the now-passed NOC deadline: whether PVARA moves against operators who did not file, and how quickly the remaining activity-specific rulebooks move from draft to confirmed in-force status. Both would materially sharpen the amber traffic-light rating this module currently carries, which reflects a regime that is statutorily complete but not yet fully operational in its implementing detail.

Crypto Licensing

The Virtual Assets Act, 2026 establishes that all entities offering virtual-asset services in or from Pakistan must obtain a licence from PVARA, which publishes a public register of authorised VASPs. This is the core licensing requirement under the Act and is Tier-1 sourced directly from PVARA's own publication, assessed at Confirmed confidence. Section 70 of the Act imposes a specific transitional obligation: Transitional Persons who were operating on or before 5 March 2026 must submit a PVARA no-objection-certificate application by 5 September 2026 or cease operations, a deadline that falls within this reporting cycle.

Secondary industry commentary, sourced at Tier 4 confidence, describes PVARA's rulebook as establishing ten distinct VASP licence categories, each attached to Schedule I capital requirements. This granular structural detail has not been independently verified against primary rulebook text this cycle and should be treated as probable rather than confirmed pending that corroboration.

The most significant complicating factor in this module is a reported statement from Pakistan's Finance Secretary asserting that crypto remains illegal under current law, a position that sits in direct tension with PVARA's operative licensing activity, including its published VASP register and the active Transitional Persons deadline. This contradiction was not resolved this cycle. It matters because it bears directly on whether a PVARA licence functions as a genuine legal safe harbour or whether licensed entities remain exposed to a competing executive-branch legal position. The traffic-light assessment for this module is amber precisely because of this contradiction, notwithstanding that the licensing statute itself is comprehensive and operationally live.

Outlook

The Transitional Persons NOC deadline having fallen within this cycle, the volume and outcome of applications submitted by 5 September 2026 will be the first concrete data point on how much of Pakistan's pre-existing crypto activity is converting into PVARA-licensed status versus ceasing operations or continuing informally. Resolution of the Finance Secretary contradiction, in either direction, is the development most likely to move this module's traffic-light assessment next cycle.

Consumer Protection

PVARA's chair has publicly stated, via press coverage of the regime's launch, that licensed virtual-asset service providers will be required to keep customer holdings segregated from the firm's own assets, will be barred from lending or pledging client holdings without written consent, and will not be permitted to touch client assets if the platform fails (CLM-PK-012). This is recorded as a Probable-confidence finding: the underlying statement is attributed to the regulator's chair through secondary press reporting, and the specific custody-rule clause in PVARA's own rulebook that would give this principle legal force has not been retrieved in primary form. The composed record treats the custody-segregation principle itself as reported, while leaving open whether, and how precisely, it is codified. No crypto-specific market-abuse regime or complaints-handling mechanism has been located under the Virtual Assets Act, 2026, and that absence is tracked as an open gap rather than a negative finding about the regime's design.

Outlook

The custody-segregation principle, if and when confirmed against primary rule text, would be a materially significant consumer-protection development given its direct bearing on client-asset risk in the event of platform failure. Until the primary clause is retrieved, this module's rating remains provisional.

Consumer Protection

Chapter 7 of the Virtual Assets Act, 2026 requires licensees to conduct their business honestly, fairly and professionally, and in the best interests of customers. This conduct-of-business standard is the primary consumer-protection provision identified this cycle, and it is sourced from secondary legal-commentary description of the Act rather than from primary gazette text, which limits confidence to Probable rather than Confirmed.

No further granular consumer-protection detail, such as specific disclosure requirements, complaint-handling mechanisms, or compensation-scheme provisions, was retrieved this cycle beyond this general conduct standard. The standard itself is meaningful in that it establishes a statutory basis for consumer-protection enforcement against licensed VASPs, but its practical scope and enforcement mechanism remain undetailed on the evidence available.

Outlook

The development to watch is whether PVARA publishes implementing regulations that give the Chapter 7 conduct standard operational teeth, such as specific disclosure or complaint-handling requirements, and whether the primary gazette text of the Act is retrieved to confirm the secondary-commentary description of this provision.

Cross-Border Transfer

Pakistan's cross-border and banking-access position for virtual-asset businesses has shifted materially with SBP Circular No. 10 of 2026, dated 14 April 2026. The circular permits regulated banks to open accounts, including segregated Client Money Accounts, for PVARA-licensed VASPs, subject to licence verification and AML/CFT controls. This replaces a banking-access restriction that had been in place since 2018, under which banks had been effectively unable to service crypto-related businesses, and represents a material liberalisation of the formal banking gateway available to licensed virtual-asset operators.

The circular is structured around licence verification: a bank's willingness to open an account for a VASP is conditioned on that VASP holding a valid PVARA licence, tying the newly reopened banking channel directly to the licensing perimeter established under the Virtual Assets Act, 2026 and the Services and Activity-Specific Regulations that came into force on 21 August 2026. For a VASP that has completed the NOC process and holds or is pursuing a PVARA licence, the circular supplies a defined route into the regulated banking system; for an entity that has not obtained a licence, the pre-existing practical exclusion from banking services continues to apply, since the circular's protection is conditioned on licensed status.

Beyond the banking-access gateway itself, no cross-border transfer-specific rules, such as outbound remittance limits for virtual-asset transactions or foreign-exchange treatment of VASP-to-VASP cross-border flows, were independently retrieved this period. The circular addresses domestic banking access for licensed entities rather than the mechanics of cross-border virtual-asset transfer itself.

Outlook

How banks implement the licence-verification requirement in practice, and whether any further SBP guidance addresses cross-border transfer mechanics specifically rather than domestic account access, are the open questions for this module. The interaction between the banking-access gateway and the broader NOC/licensing timeline, now that the 5 September 2026 deadline has passed, will determine how many VASPs are actually able to make use of the reopened banking channel in the near term.

Cross-Border Transfer

Section 4 of the Virtual Assets Act, 2026 gives PVARA an explicit mandate to prescribe, by regulation, the conditions under which a virtual-asset service conducted outside Pakistan is, or is not, deemed to be offered or marketed to persons inside Pakistan (CLM-PK-017). This is, in substance, an enabling provision for a reverse-solicitation and extraterritorial-reach test: a mechanism that will determine whether an offshore platform serving Pakistani customers without actively soliciting them falls inside or outside PVARA's licensing perimeter. The provision itself is part of the enacted, in-force Act text, so the existence of the mandate is well-evidenced. What is not yet evidenced is the content of the implementing regulation itself -- the actual conditions PVARA will set. The claim's underlying secondary-source commentary, which would have elaborated on how the test is expected to operate in practice, could not be retrieved this cycle: the source attempted was unreachable at the network level, leaving the claim resting on the Act's own enabling text alone rather than on any interpretive gloss. This is recorded as a Probable-confidence, Tier-3-sourced finding, and the composed record treats only the existence of the forthcoming test -- not its substance -- as established.

This matters structurally because until the implementing regulation is published, no offshore virtual-asset business can assess with confidence whether its existing relationship with Pakistani users would bring it inside PVARA's licensing perimeter. The gap is compounded by an unresolved question already on record: whether PVARA licensing, once obtained, would carry any cross-border or passporting recognition in other jurisdictions -- a question this cycle's sources do not address in either direction.

Outlook

The implementing regulation under section 4 is the single most consequential unretrieved document in this jurisdiction's cross-border posture. Its eventual content will determine how restrictively Pakistan treats offshore virtual-asset services reaching Pakistani users without a local establishment, and will interact directly with the Travel Rule and remittance-adjacent obligations that sit within the world-payments monitor's remit. Until that text is retrieved, the module's rating remains amber on the strength of the enabling provision alone.