Taha Hafeez | Junior Partner, Salahuddin, Saif & Aslam (Attorneys at Law)
A successful sandbox test is not a licence; a stablecoin remittance is not a domestic payment; and a digital token is not necessarily a virtual asset. As Pakistan’s framework develops, these distinctions determine how financial products are structured, authorised and brought to market.
Every fintech launch in Pakistan arrives at the same question: may this product, structured in this way, be offered to this customer, through these partners, today? The answer increasingly depends on how the mandates of the State Bank of Pakistan (SBP), the Securities and Exchange Commission of Pakistan (SECP) and the Pakistan Virtual Asset Regulatory Authority (PVARA) intersect. A sandbox test, access to Raast and a virtual asset licence each address different parts of the journey; none alone resolves classification, banking access, contractual responsibility or permission to launch. The decisive questions arise where these frameworks meet, and they are shaped by structure more often than by technology. This article follows those points of intersection, from experimentation to commercial execution, and identifies the legal decisions that should precede a product launch.
The Sandbox Is Not a Licence
The State Bank of Pakistan (“SBP”) Regulatory Sandbox has completed its first cohort, in which four of the six shortlisted participants succeeded; among them were Taptap Send UK Limited with United Bank Limited on inward remittances, and Digi Khata, Swich Retail and Neem on open banking. The more instructive point is what SBP said next. On 16 September 2026 it clarified that completion of the sandbox is not regulatory approval, so that successful testing demonstrates regulatory engagement and product validation without itself authorising commercial deployment, and a participant must still obtain the approvals its business requires before launch.
For virtual asset businesses the position is richer, because the Pakistan Virtual Asset Regulatory Authority (“PVARA”) has instruments of its own. Section 35 of the Virtual Assets Act, 2026 allows it to run a regulatory sandbox and to issue guidance, no-objection statements and no-action communications. Under regulation 7(6) of the Pakistan Virtual Asset Services Regulations, 2026, a successful sandbox participant may apply directly for a licence without a separate no-objection certificate, although participation creates no entitlement to one; regulation 7(5) allows PVARA to grant a limited-scope licence whose scope, duration, conditions and exit criteria are specified in the licence itself. The ordinary route from no-objection certificate to licence is set out in our guide, From Perimeter to Supervision: A Practical Guide to PVARA Licensing in Pakistan, and is not repeated here. These are distinct outcomes with distinct legal effects. They are not interchangeable.
In our view the choice among them turns on three questions. The first is whether the product’s classification is settled; if it is not, the question is best put to the regulator, and a sandbox place or a written communication are the routes the Act contemplates, although each remains at PVARA’s discretion. The second is whether the product needs limits to be safe to launch, in which case a limited-scope licence, with its caps and exit criteria written in, gives the regulator a reason to say yes. The third is whether a bank or commercial partner is waiting for something in writing; sandbox participation does not itself provide commercial authorisation, while the legal effect of a licence or a written communication depends on its terms and scope. In every case, the first point to settle is what the regulator will have recorded when the exercise ends.
One Customer, Three Firms, No Owner
Raast supplies the rails and open banking turns customer-authorised data into the basis of new products; neither creates a licence of its own, but each raises a question of responsibility whenever several firms take part in a single transaction. The customer experiences a single product, while the firms taking part may each remain subject to distinct regulatory and contractual obligations, and the four questions below are those that most often go unanswered.
These responsibilities should be allocated expressly in the contractual arrangements governing the partnership, rather than left to operational documentation or resolved after integration, and each firm should be able to show how its own responsibilities were addressed.
Stablecoin-Enabled Inward Remittances to Pakistan: The Regulatory Pathway
For international payment service providers, remittance platforms and virtual asset businesses, stablecoin-enabled inward remittances represent an emerging opportunity within Pakistan’s evolving regulatory framework. However, structuring a cross-border transfer using stablecoins requires careful consideration of PVARA authorisation, SBP payment regulations, foreign exchange requirements and the arrangements governing settlement through Pakistani banking channels. The distinction between using stablecoins as a cross-border settlement mechanism and their use for domestic commercial payments is central to determining whether a proposed business model can be lawfully implemented.
Remittances are where the two regulatory tracks meet. SBP’s second cohort invites technology-enabled inward remittances, while PVARA’s advisory PVARA/ADV/001/2026 of 26 April 2026 requires prior authorisation for virtual asset pilots, partnerships and announcements, including stablecoins used for remittances and cross-border payments; since the advisory reaches announcements as well as pilots, the prudent sequence is to approach PVARA first and to announce afterwards.
The Transfer and Settlement Services Regulations, which form part of the Pakistan Virtual Asset Services Activity Specific Regulations, 2026 (S.R.O. 1420(I)/2026, which we call the Activity-Specific Regulations), apply whether value moves on-chain, off-chain, through internal ledgers or over banking rails (regulation 2(3)), so that a business cannot escape the category by keeping its movements on its own books. The more decisive provision is regulation 3(6) of the Regulations, under which virtual assets may not facilitate, or be used or recognised as, a means of payment for domestic commercial transactions except where SBP has specifically approved it. A stablecoin-based transfer may therefore form part of a properly authorised cross-border arrangement in which the beneficiary is paid in rupees through authorised channels, subject to the other requirements that apply, and a product designed around the token leg, with the rupee leg considered last, will usually have to be rebuilt. Nor does a licence displace the foreign exchange regime, since the Act prevails over inconsistent law with the Foreign Exchange Regulation Act, 1947 expressly excepted (section 5(1)).
Three further features of the Transfer and Settlement Services Regulations deserve attention from anyone building a corridor. First, final settlement must be completed within 24 hours of execution, to the extent that settlement is within the licensee’s reasonable control. A model that needs a longer cycle, because of infrastructure dependencies, product design or another objectively justified factor, must be notified to PVARA before it is implemented and disclosed to customers (regulation 10(5) and (6)). Second, where a transfer passes between two licensees and the failure lies with the recipient, responsibility is allocated by the facts, the contractual arrangements and the applicable law, and PVARA may still require a client to be made whole (regulation 9(4) and (5)). The contract between the licensees is therefore doing regulatory work, and it should be drafted as such. Finally, a licensee must disclose the point of settlement finality and any restriction on a route (regulation 11(1)), which is the practical counterpart of the prohibition on marketing a route that the licensee knows, or ought reasonably to know, is materially constrained (regulation 6(4)). The foreign exchange treatment of offshore settlement is considered in our insight, Banking for VASPs in Pakistan: What SBP Circular Letter No. 10 of 2026 Changes.
Is It Even a Virtual Asset?
The first question to ask of any token is whether the Act applies to it at all. Loyalty points, in-app credits, game currencies and creator rewards resemble tokens, and some of them lie outside the Act; section 2(2)(a) excludes a closed-loop token, but only where, by design, technical architecture or enforceable system controls, every listed condition is satisfied. The value must be usable or redeemable solely within a restricted platform; it must not be transferable outside it, directly or indirectly, exchangeable for fiat outside it, redeemable for real-world goods or services outside it, convertible into or interoperable with any other virtual asset, or saleable or tradable on any external market; and it must not be designed, marketed or used for payment, investment or value transfer beyond the ecosystem.
These conditions are cumulative, and each is tested against the design and the actual controls of the product rather than against its description. As a product expands its functionality, features such as cash-out arrangements, redemption for goods outside the platform, external trading, conversion into other virtual assets or promotion as an investment may remove the exclusion, whereas transfers confined to the platform do not of themselves do so; where the exclusion is lost, the token is then tested against the definition in section 3, and the outcome depends on the substance of the arrangement rather than on its label. PVARA is itself empowered to classify an asset, service or issuer by its substance, after consulting SBP or the Securities and Exchange Commission of Pakistan (“SECP”) where relevant (section 9(1)(f)).
For a business that wishes to remain outside the Act, the practical discipline is a legal gate on the product roadmap, so that each new feature is tested against the section 2(2)(a) conditions before it ships and the conclusion is recorded. Beyond its own analysis, such a business can seek comfort from PVARA, which may expressly exclude further categories of digital representation (section 2(2)(f)) and may issue no-action communications (section 35(3)).
Securities call for a more careful reading. The Act excludes securities and other regulated financial assets from the definition of a virtual asset, but not where they are represented, issued or transferred using distributed ledger technology (section 3); section 2(2)(b) separately excludes securities, derivatives and collective investment schemes within the jurisdiction of SBP or SECP. Read together with PVARA’s classification power, our view is that a tokenised financial instrument cannot safely be assumed to sit on either side of the line until the classification has been settled with the regulators concerned, and where it is uncertain the sensible course is to seek that clarity before launch.
Tokenisation Without the Slogans
Section 5(3) of the Act vests the regulation and supervision of the tokenisation of real-world assets primarily in PVARA, in coordination with other regulators where applicable. The Issuance Services Regulation, within the Activity-Specific Regulations, then places no limit on the types of asset that may be tokenised, provided the resulting token is not prohibited and complies with the Regulations (regulation 3(3)). The legal question for a real asset is therefore not whether it may be tokenised but whether, where the token is fiat- or asset-referenced, three promises can be kept consistently: what stands behind the token, who holds the reserves, and how quickly a holder can redeem.
The difficulty appears with an illiquid asset. A holder is ordinarily entitled to redemption within 24 hours of a complete and valid request, and a longer period may apply only where it is reasonably necessary, for reasons that include the liquidity of the reference asset, non-business days, banking hours or ledger conditions, and is clearly disclosed to holders (regulation 10(2)); a token over property or receivables must therefore be designed around that rule from the outset, rather than around the convenience of the asset. For that reason, in our view, a restricted pilot under the simplified requirements PVARA may specify (regulation 4(5)), or a limited-scope licence with caps on supply, holders and volumes, is usually the prudent first step, which allows the structure to be proved before any retail offer.
Mining, and the Blockchain Work That Is Not Crypto
Mining illustrates the distinction between technology and regulated activity. Section 37(2) of the Act does not treat mining for one's own account, by itself, as a licensed virtual asset service; mining involving customer assets or funds is treated as a service requiring a licence. Hosted, pooled or managed mining models therefore require a substance-based assessment, regardless of whether they are described as hosting, hash-rate sales or profit-sharing. Section 37(3) also permits PVARA to establish a registration or declaration framework for large operators by reference to scale, energy use or hash rate, with thresholds to be prescribed in regulations. Operators should revisit that position as implementing requirements emerge.
The second area is blockchain used for purposes other than tokens. PVARA’s functions include promoting and regulating the adoption of blockchain and distributed ledger technology across Pakistan (section 9(1)(e)); section 5(3) vests the supervision of blockchain technology primarily in PVARA, and the Act requires it to issue regulations, standards and guidelines on its adoption, deployment and use, after consulting other regulators and ministries (section 36). A business building record-keeping or verification tools on a ledger is therefore working within a mandate that is still being filled in.
Consider an overseas remittance provider proposing a stablecoin-enabled inward transfer with a Pakistani bank as payout partner. The commercial proposition may appear to be a single customer journey, but its launch depends on several separate determinations: the characterisation of the token and transfer service, the relevant PVARA authorisation, the treatment of offshore and onshore settlement under applicable foreign exchange rules, the bank's SBP obligations, and contractual allocation of settlement failures and customer claims. These questions should be resolved as one transaction design rather than passed sequentially from the product team to licensing counsel and then to the bank. This illustration is a structuring example, not a statement that any particular corridor or arrangement has been approved.
Where the Mandates Meet
A product that combines payments, lending, investment features and tokens may fall under all three regulators at once, and the Act expects the regulators to speak to one another. It requires PVARA to cooperate and share supervisory and enforcement information with SBP, SECP and other agencies (section 17); a business should therefore keep its disclosures and operating descriptions consistent across the authorities involved, while recognising that information sharing remains subject to the Act and to applicable confidentiality requirements. Where more than one regulator is engaged, sequencing matters: the classification and the applicable authorisation route should be settled early, while banking and commercial arrangements are developed in parallel and aligned with the resulting structure, since a bank will test the same facts that the regulator does.
A PVARA licence, moreover, does not resolve every question, since banking access follows its own SBP rules, as our banking insight explains, and the data governance duties of a licensed business are covered in our insight, Virtual Assets and Data Protection in Pakistan: Navigating the Regulatory Gap.
Execution Is a Legal Question
The regulatory pieces are largely in place; what most businesses lack is a single, consistent view of their own product. The six questions below are the ones a business should be able to answer, from its own documents, before it launches; licensing, technology architecture, banking, outsourcing and compliance can then be settled together, instead of one after another.
Sandboxes will admit further cohorts, payment rails will carry more traffic and the virtual asset regime will mature; none of that will decide which businesses reach the market. That will be decided in large part by the legal and structural work done before the product is built. A sandbox can show that a product works and a licence can show that it may be offered, but neither supplies the structure that joins them, in which classification, authorisation, banking, technology and contract answer to one another. Pakistan’s fintech sector is moving from regulatory announcements to commercial execution. The businesses best placed to benefit will treat licensing, banking access, technology and compliance as parts of a single design from the first meeting, and not as issues to be resolved after launch. The question this article began with is best answered before the product is built.
About the Author
Taha Hafeez is a Junior Partner at Salahuddin, Saif & Aslam (Attorneys at Law), where he is part of the firm's FinTech practice. His work focuses on fintech regulation, digital payments and virtual assets, including the interaction of regulatory authorisation and commercial implementation.