PVARA Launches Formal Licensing Framework for Crypto and Digital Asset Companies
Pakistan has formally launched its regulatory framework for cryptocurrency and virtual asset businesses, allowing companies to seek approval to operate legally in the country.
The Pakistan Virtual Asset Regulatory Authority notified the Pakistan Virtual Asset Services Regulations, 2026 on August 21, bringing the licensing system under the Virtual Assets Act, 2026 into operation.
Under the new framework, Virtual Asset Service Providers, commonly known as VASPs, must obtain regulatory approval before offering covered virtual asset services in or from Pakistan.
The regime applies to cryptocurrency exchanges, custodians, brokers, digital asset investment businesses, token issuers and several other types of virtual asset companies.
PVARA has established different regulatory routes depending on whether a company is already operating, setting up a new business or testing an innovative product.
Existing operators can enter the No Objection Certificate-to-licence pathway, while qualifying innovative businesses can use PVARA’s regulatory sandbox before seeking a full licence. Participation in the sandbox, however, does not automatically guarantee approval for a licence.
The move represents one of Pakistan’s biggest regulatory changes for the cryptocurrency industry and shifts the market toward formal licensing, compliance and supervision.
September 5 Deadline Set for Existing Crypto Operators
Companies already providing virtual asset services before the Virtual Assets Act took effect face an important deadline.
The Act came into force on March 5, 2026. Existing providers have six months to enter the regulatory process or stop providing covered services. This places the deadline at September 5, 2026.
The new regulations state that an existing provider that submits a complete NOC application within the transitional period may continue its existing services while the application is being considered, subject to PVARA’s conditions and compliance requirements.
Such companies must continue meeting core requirements relating to customer asset protection and anti-money laundering, counter-terrorism financing and proliferation-financing controls.
Marketing by transitional operators may also require prior PVARA approval while their applications are pending.
For new entrants, an NOC is an important preliminary step.
After receiving the required approval, businesses can complete relevant anti-money laundering registration, establish a Pakistani company and proceed toward the applicable VASP licence.
The regulations allow applicants to seek one or multiple licence categories depending on the services they intend to provide.
Exchanges Face Rs500 Million Minimum Capital Requirement
The new regime covers a wide range of crypto and blockchain-related commercial activities.
These include advisory services, broker-dealer operations, custody, cryptocurrency exchanges, lending and borrowing, derivatives, investment management, transfers and settlement.
It also covers fiat-referenced token issuance, asset-referenced token issuance and mining-related virtual asset services.
Capital requirements vary significantly depending on the activity.
Under PVARA’s notified regulations:
- Advisory services require at least Rs15 million in paid-up capital.
- Broker-dealer services require Rs75 million.
- Custody services require Rs200 million.
- Virtual asset management and investment services require Rs200 million.
- Transfer and settlement services require Rs200 million.
- Fiat-referenced token issuance requires Rs300 million.
- Asset-referenced token issuance requires Rs300 million.
- Exchange services require Rs500 million.
- Lending and borrowing services require Rs500 million.
- Virtual asset derivatives require Rs500 million.
- Mining-related virtual asset services require Rs500 million.
Licensed businesses must also maintain sufficient liquid financial resources. The regulations require net liquid assets equivalent to at least 1.2 times adjusted monthly operating expenses, subject to the detailed regulatory conditions.
Applicants must establish a company under Pakistan’s Companies Act, 2017 and satisfy governance and fit-and-proper requirements for directors, controllers and key personnel.
They must also demonstrate the source and availability of capital and provide financial projections and detailed business plans.
Strict AML, Cybersecurity and Customer Protection Rules Apply
Obtaining a licence will involve significantly more than simply registering a crypto company.
VASPs must implement anti-money laundering and counter-terrorism financing controls in accordance with Pakistani law.
Requirements include customer due diligence, transaction monitoring, record keeping and suspicious transaction reporting.
Technology and cybersecurity are also central to the new framework.
Licensed businesses must maintain written cybersecurity policies designed to protect customer information and technology systems.
They must establish access controls, vulnerability management, incident monitoring, recovery processes and safeguards for virtual asset transactions.
Businesses will also need formal business continuity and disaster recovery arrangements.
Those plans must be periodically tested to ensure companies can continue operating or recover safely following major technology failures or cybersecurity incidents.
The framework is intended to bring Pakistan’s growing digital asset industry under greater regulatory oversight while creating a legal route for legitimate companies to enter the market.
PVARA will have responsibility for licensing, supervision and enforcement against companies operating outside the regulatory system.
For crypto businesses already serving Pakistani customers, the immediate priority will be meeting the transitional requirements before the September deadline and beginning the path toward formal licensing.
