How PVARA, SBP and SECP requirements shape data governance, offshore hosting and compliance obligations in the absence of a comprehensive data protection law
Taha Hafeez
Junior Partner, Salahuddin, Saif & Aslam (Attorneys at Law)
Pakistan has yet to enact a comprehensive general personal data protection statute, but virtual asset service providers entering the market already face binding obligations on customer information, offshore hosting, cybersecurity and incident reporting under sector-specific frameworks. How they meet them will shape licensing preparation, technology architecture and banking relationships.
The Pakistan Virtual Asset Regulatory Authority (“PVARA”) licenses virtual asset service providers (“VASPs”) under the Virtual Assets Act, 2026 (the “Act”) and the Pakistan Virtual Asset Services Regulations, 2026 (the “Regulations”). PVARA obligations apply to the VASP itself. The State Bank of Pakistan (“SBP”) regulates its banking and payment partners; their requirements do not automatically bind the VASP, but may be reflected in banking, outsourcing or service contracts. A business separately conducting regulated digital lending may also need to comply directly with Securities and Exchange Commission of Pakistan (“SECP”) requirements. The table distinguishes these regulatory layers.
Pakistan’s Data Protection Gap: Why VASPs Cannot Wait
The Regulations define Personal Data as “any information that relates to an identified or identifiable natural person”, and extend it to anything covered by “any applicable personal data protection law in force in Pakistan from time to time”. Section 5(2) of the Act says that where any law sets measures on data protection, cybersecurity, financial secrecy or cross-border transfer of personal data, those measures prevail. Section 39(1) allows offshore hosting subject to applicable data law. Regulation 68(1) repeats the duty. The rest of the framework defers to a general data protection statute that does not yet exist.
The absence of a general statute does not mean the absence of enforceable sector-specific duties. Information that relates to an identifiable person is Personal Data without waiting for a statute, so a wallet address or transaction record that can be linked to a customer should be treated as Personal Data now. What a future statute adds is the open question.
PVARA’s Existing Data Governance Obligations
Offshore Hosting: Three Regulators, Different Rules
Data Retention, Consent and Customer Rights
The Act makes consent to non-essential processing revocable. SBP’s BC&FRF does not bind a VASP directly, but it requires the banks and payment firms a VASP works with to delete customer data once it is no longer needed and to let customers withdraw consent at any time, and those expectations may be passed on to the VASP by contract. The Regulations pull the other way. Regulation 86(4) requires records to be kept for the period set by the Anti-Money Laundering Act, 2010 or seven years, whichever is higher.
The tension becomes manageable when the data is sorted at the start. Identification, transaction and due diligence records are kept because the law requires it, and a deletion request is answered by saying what must be kept and why. Non-essential processing, such as marketing, needs consent. The risk lies in the one database where all of it sits together.
Cybersecurity Incidents and Competing Notification Deadlines
A single incident may engage several notification obligations. The first two rows concern reporting by a VASP to PVARA. The remaining rows concern SBP-regulated institutions, not automatic reporting duties of the VASP. Contractual notification requirements may nonetheless require a VASP to inform its bank or payment partner sooner.
A bank may need information from the VASP before the VASP has finished its own reporting, so the banking agreement should set prompt notice terms. A cybersecurity incident involving personal data may engage both Regulation 67 and Regulation 71. The VASP should satisfy each obligation separately and let the earliest deadline drive its first response. Regulation 67 runs from detection, Regulation 71 from awareness and SBP’s technology governance framework from the incident. The BC&FRF and the outsourcing circular do not say whether the clock runs from occurrence or discovery.
Travel Rule Compliance and Cross-Border Data Transfers
Transfers at or above the Pakistani rupee equivalent of USD 1,000 need originator and beneficiary information to be obtained, held and passed on (section 47 of the Act and Regulation 100). Section 47(2) requires this to respect applicable data protection law. The data goes to counterparties, often abroad, who are not bound by PVARA’s rules, so the data protection terms in each Travel Rule arrangement carry the weight.
Separately, where disclosure to PVARA collides with banking secrecy or confidentiality obligations, Regulation 70 gives the route: tell PVARA, give what can lawfully be given, and offer summaries, redactions or controlled access.
What Virtual Asset Businesses Should Do Before Licensing
A Compliance Architecture That Can Adapt
An international exchange considering Pakistan should assess its hosting arrangements, customer-data flows, banking interfaces and incident response before launching operations or finalising its licence application. The same dataset may be subject to direct PVARA obligations, contractual requirements imposed by an SBP-regulated partner and, where a separate regulated activity is involved, additional sector-specific rules. A documented, adaptable data governance programme is therefore a practical licensing and operational asset. It should not wait for a general data protection statute.
This article provides general information on the regulatory framework discussed and does not constitute legal advice. The appropriate approach will depend on the proposed activities, licence scope, banking arrangements, hosting arrangements and applicable requirements.
About the Author
Taha Hafeez is a Junior Partner at Salahuddin, Saif & Aslam (Attorneys at Law). He advises on fintech regulation, digital payments and virtual assets.