Hassaan Salahuddin & Taha Hafeez | Salahuddin, Saif & Aslam (Attorneys at Law)
A virtual asset business can fall within Pakistan’s regime before it has applied for anything. Marketing to Pakistani customers, or accepting rupees, is enough. The licence a firm needs, the route to it and the controls the Pakistan Virtual Asset Regulatory Authority (“PVARA”) will expect on day one are largely fixed by decisions made long before the application, often without the regime in mind. This guide sets out those decisions in the order a firm meets them. It is written for international exchanges, custodians and other virtual asset groups weighing entry into Pakistan or restructuring an existing offering.
References to the “Act” are to the Virtual Assets Act, 2026. The “Regulations” are the Pakistan Virtual Asset Services Regulations, 2026, and the “Activity-Specific Regulations” are the Pakistan Virtual Asset Services Activity Specific Regulations, 2026, which set out separate rules for each licence category. The “Exchange Regulations” are the Exchange Services Regulations within them.
1. Marketing, Not Access, Sets the Perimeter
Section 50(1) of the Act prohibits anyone from providing, or representing themselves as providing, a virtual asset service in or from Pakistan by way of business unless it is a Pakistani company holding a PVARA licence. The Regulations extend the prohibition to anyone who holds itself out as carrying on a service. What a firm says in its marketing is therefore part of the perimeter.
Wilfully offering an unlicensed service is an offence punishable by up to five years’ imprisonment, a fine of up to PKR 50 million, or both (section 54(1)). PVARA can direct the blocking of websites, apps, advertisements and payment links (section 61), and it classifies a service by its substance, whatever the firm calls it (section 9(1)(f)).
The test is targeting, not accessibility. A platform carries on business in Pakistan if it targets, solicits or onboards persons in Pakistan, or serves them in rupees or through channels accessible in Pakistan (regulation 3(4)). A website that merely opens in Pakistan does not bring a platform inside. Regulation 3(5) provides a safe harbour for a platform that does not market or solicit in Pakistan, does not onboard persons in Pakistan, does not support PKR payment rails or Pakistan-targeted channels, and takes reasonable steps to prevent onboarding where it does not intend to serve Pakistan. PVARA may still decide otherwise, but only on reasoned, written grounds.
The safe harbour is a set of controls to build and evidence, not a position to assert once PVARA asks. Marketing exclusions must reach affiliates and promoters. Onboarding must assess location and residency rather than rely on self-declaration. There must also be a documented process for the day a Pakistan-based customer gets through. The fourth condition turns on reasonable steps, so the record of those steps matters as much as the steps themselves.
For a platform already accessible in Pakistan, the starting point is a map of its legacy onboarding, affiliate arrangements, custody and payment flows. Only then can it choose, on evidence, between authorisation and a defensible exclusion. In our experience, legacy users and affiliate marketing are where offshore positions are weakest.
A firm that wants Pakistani customers must come in through a Pakistani company holding the licence. A company formed for that purpose needs a No-Objection Certificate (“NOC”) from PVARA first (section 19).
2. One Platform, Several Licences
PVARA licenses eleven categories of activity, set out in Schedule I to the Act, and a licence covers only the categories it names. Products do not arrive sorted into them. A platform that calls itself an exchange may also be providing custody, lending or advice, and each added feature can engage another category.
The rules leave little room for manoeuvre. A licensee may not carry on an activity within another category unless it is licensed for that category too or authorised in writing (regulation 5(4)). It cannot rely on one category as cover for another, or structure its business to avoid another category’s requirements (regulation 2 of the Activity-Specific Regulations). Staking, earn products and margin should each be tested against the categories before launch, not after.
Labels mislead in both directions. The same feature can be a different activity depending on who controls the assets, who executes the transaction and who owes the obligation to the customer. Dealing solely on one’s own account falls outside broker-dealer services, for example, but trading on one’s own account alongside customer business does not. Ancillary activity has limited room: it must be subordinate to the licensed service, not separately marketed or remunerated, and not a material business line in its own right, and it needs PVARA’s prior written approval. PVARA can require an additional category if an ancillary activity grows, so the perimeter must be revisited at every product launch.
What holds this together is a perimeter map. For each feature it records what the customer sees, what the platform does, who controls the assets or keys, how the platform earns, which group entity is involved and which category is relied on. A useful cross-check is what a customer would think the firm offers from reading its website alone. If that answer differs from the map, PVARA’s answer will follow the website.
Capital follows the same logic. Each category carries a minimum paid-up capital under Schedule I to the Regulations, but a multi-category licensee cannot assume the figures will simply be added together. Under regulation 31(2), PVARA may set the methodology in the licence itself, with prudential add-ons for risks such as custody exposure or cross-border activity, after hearing the licensee. In our view, the Schedule I figures are a floor, not a budget. A multi-category applicant should model its capital on more than one basis, allow for an add-on where it holds client assets or relies on offshore group entities, and propose its own methodology in the business plan rather than leave the question to PVARA.
3. The NOC Is a Deadline, Not a Milestone
There are two routes to a licence. A firm testing a new product can enter the regulatory sandbox. Completing it allows the firm to apply for a licence directly, without a separate NOC, but guarantees nothing (regulation 7(6)). A firm ready to establish in Pakistan applies for an NOC, incorporates and then applies for the licence. A NOC is a preliminary approval, not a licence, and it authorises no service (regulation 6(4)).
The NOC route turns on timing. A NOC is valid for three months, extendable once by up to three more, and the licence application must be filed within that period by a Pakistani company that by then exists. In our view, a firm that begins the licence file only once the NOC is granted has already left it too late. The file should be built while the NOC application is pending.
The licence clock is the one that matters. It starts only when PVARA confirms in writing that the application is complete (regulation 7(2)). PVARA then has 90 days to decide, extendable by up to 60, and the clock stops each time PVARA asks for further information (regulations 7(3) and 7(4)). A complete file is worth more than an early one.
Firms already operating when the Act came into force had until 5 September 2026 to apply or stop (section 70(1)). Applicants holding an NOC granted under the NOC Regulations, 2025 may apply for a licence directly, and those whose applications are still pending need not refile (regulation 7(7)).
4. The File Must Tell One Story
The application is made on Form I and its Annexure, and its parts are read together. Part C, the business plan, is where the rest is tested. It calls for three-year projections with stress and downside cases, the business model, the custody model and the way services will be delivered in and into Pakistan, including geo-targeting and where key functions sit. Part B (capital and liquidity) and Part D (sponsors, chief executive and directors) must be consistent with it.
A custody model that does not match the group’s offshore arrangements will draw queries. So will projections that assume Pakistani retail volumes from day one, or a delivery model that contradicts the geo-blocking controls described elsewhere. In our experience, the queries that cost an applicant most time come from inconsistencies between parts of the file, not from missing documents. Every round stops the clock.
Build the board before filing. A licensee needs at least three directors, with independent directors making up at least one third of the board unless PVARA specifies otherwise, and the board must have competence in risk management, technology and cybersecurity, and financial crime compliance (regulation 20). No one may act as a controller, sponsor, managing director or director without PVARA’s approval, which PVARA must decide within 30 Business Days of a complete application (regulations 20(6) and 20(7)). Suitable independent directors take time to find. The search belongs at the NOC stage.
Settle the group structure first. The Pakistani company must be the contracting, regulated provider, and it cannot outsource its principal licensed activity. It may outsource other functions, including to group entities abroad, provided it remains fully responsible and PVARA can still supervise them (regulation 5 of the Activity-Specific Regulations). Before filing, the group must settle which entity contracts with customers, controls assets, executes transactions and supplies the technology.
This is where global exchanges most often run into difficulty. If the matching engine, custody keys or execution sit offshore, it is not enough to label the function “group support”. The question is whether the Pakistani licensee is still the one carrying on the licensed activity, and the answer must be visible in the contracts, not just asserted in the business plan.
5. Client Assets Are the First Test of Readiness
A licence can set a deadline for commencing business, and PVARA may vary, suspend or revoke it if the deadline is missed (regulation 9(4)). Readiness is therefore part of the licence, not something to address afterwards.
Client assets come first. They are not the licensee’s, and they must be identifiable and segregated from its own. They cannot be used, pledged, lent, staked or rehypothecated except to carry out a client instruction or with the client’s prior explicit written consent (regulation 109). Staking and earn products therefore need a consent mechanism designed before launch, not retrofitted to an existing product. A licensee holding client assets must also be able to show that its liabilities to clients are matched by reserves, and report on this to PVARA every six months (regulation 112).
Financial crime controls follow. A licensee needs a fit and proper Money Laundering Reporting Officer and Compliance Officer (regulations 81 and 93), and AML, CFT and CPF policies, risk assessments and customer due diligence in line with Pakistan’s federal AML laws (regulations 95 to 98).
6. A Licence Does Not Open a Bank Account
SBP’s BPRD Circular Letter No. 10 of 2026 allows banks to provide accounts to PVARA-licensed VASPs, but only after verifying the licence with PVARA. A company holding only an NOC can open a limited-purpose account to complete licensing formalities, and nothing more. Client money must be kept apart from the VASP’s own funds, and foreign exchange rules continue to apply to every cross-border flow. Projections should not assume rupee on-ramps before the licence is granted.
The bank will test the same facts PVARA does. The account structure should follow the licence scope and the entity map, and the ownership, forecasts and source-of-funds explanations given to the bank must match the PVARA application. Our insight Banking for VASPs in Pakistan: What SBP Circular Letter No. 10 of 2026 Changes covers the circular in full.
7. Data Duties Arrive Before a Data Protection Law
Pakistan has no general data protection statute yet, but a licensed VASP already has binding duties on customer data, offshore hosting, cybersecurity and incident reporting under the Act and regulations 68 to 71, with further requirements arriving through its banking partners. Until a statute defines the term, wallet addresses and transaction records that can be linked to a customer should be treated as personal data.
Two points bear directly on the licence work. A single incident can start several notification deadlines at once, so the incident plan must map each of them and let the earliest drive the first response. And records must generally be kept for the longer of the AML Act period or seven years, so data should be classified at the outset to allow deletion requests to be answered with reasons.
8. PVARA Will Read the Records Together, Even If the Firm Does Not
A licence settles what a firm may do. It does not settle how each decision will be judged. Section 47(1) of the Act requires a licensee to act honestly, fairly and professionally, in its customers’ best interests and in a way that upholds market integrity. Section 44 requires it to identify, manage and disclose conflicts without putting its own interests above those of its customers, and section 52 prohibits market manipulation and insider trading. Regulation 27 turns this into a duty to take reasonable steps to identify, prevent, manage and, where necessary, disclose conflicts. Disclosure is the fallback where a conflict cannot be managed, not a substitute for controls.
PVARA will not assess a listing, a proprietary position and a run of complaints in isolation, and a licensee should not either. Each sits with a different team and is governed by a different rule. A firm can comply with each and still be unable to show that anyone considered them together. Under section 44, that is the question that matters, and the answer must come from records made at the time.
Listings. Notifying PVARA of a listing does not transfer responsibility for the decision to the regulator (Exchange Regulations, regulations 9 and 10). The exchange needs its own record of the assessment against its published standards and of who took the decision. Its conflicts rules expressly reach affiliated listings and economic interests in listed assets (Exchange Regulations, regulation 14), so the record should show how any group link was identified and kept from influencing the outcome.
Proprietary positions. This is the sharpest version of the problem for a platform that operates the market, holds client assets and trades for itself. Regulation 56 requires internal governance over proprietary activity, covering approval, limits and monitoring, with a record of each transaction and its rationale. It is a governance requirement, not a regulatory approval. The Broker-Dealer Services Regulations add controls against front-running and against preferring proprietary trades to customer orders, and an exchange’s proprietary trading policies need board approval and disclosure to PVARA (Exchange Regulations, regulation 14). PVARA can also direct a licensee to suspend, restrict or cease activity in an asset, so a delisting process should exist before the first listing.
Complaints. These are easily treated as a service issue. Repeated withdrawal delays or fee disputes can point to a wider conduct weakness, and regulations 52 and 53 give that data a paper trail through the Client Agreement and complaint records. Complaint trends belong in the board’s quarterly risk reporting under regulation 84, not only with the customer service team.
9. Accountability Sits With the Board
PVARA’s powers escalate from inspections and information requests (section 9(2)) through directives and sanctions to suspension or revocation of a licence, and an information request can test a firm’s conduct long before any sanction is in view. Wilful market abuse is a criminal offence (section 54(3)), and under section 55 a director or officer whose consent, connivance or neglect lies behind a company’s offence is treated as having committed it. Regulation 21 gives the board overall responsibility for governance, compliance and market-integrity controls. A conduct failure is a governance failure, not only a compliance one.
Supervisory practice under the new regime is still developing. That is a reason to build the record now, not to wait for PVARA to define what it expects to see.
Before You File
A firm that can answer each of these questions from its own documents is ready to talk to PVARA, and to its bank.
1. For each product feature, which licence category is relied on, and would a customer reading only the website reach the same answer?
2. If the platform is offshore, what evidence shows that each of the four safe harbour conditions is met?
3. Which entity contracts with customers, controls assets and keys, executes transactions and supplies the technology, and is anything principal being outsourced?
4. How has capital been modelled across categories, and has an add-on been allowed for custody or cross-border risk?
5. Can the licence file be completed within the NOC’s validity, and is the board in place to be approved?
6. Does the bank account structure follow the licence scope, and is there a legal basis for each cross-border flow?
7. Who approves a listing, against which published standard, and how are group links recorded?
8. What limits apply to proprietary positions, who records the rationale, and when do complaint trends reach the board?
The first two questions fix the categories, the capital, the group structure and the story the application must tell. A change at that stage costs far less than one made after filing, and far less again than one made under supervision. A licence shows that a firm may operate. Its records show whether it has operated fairly.
This guide provides general information on the regulatory framework discussed and does not constitute legal advice. The appropriate approach will depend on the proposed activities, licence categories, corporate structure, customer base and applicable requirements.
How SSA Advises Virtual Asset Businesses
Salahuddin, Saif & Aslam advises domestic and international virtual asset businesses on PVARA licensing, regulatory perimeter assessments, multi-category authorisations, group and corporate structuring, banking arrangements and ongoing compliance. We build the licensing strategy around how the business will actually operate. Before a filing, we help clients settle which licence categories they need, how the Pakistani company fits within the group, and what the bank and PVARA will each expect to see. We welcome an early conversation on a proposed licensing structure.
About the Authors
Barrister Hassaan Salahuddin (Managing Partner) and Taha Hafeez (Junior Partner) lead the firm’s fintech practice and advise on fintech regulation, digital payments and virtual assets.