PVARA licensing under the Virtual Assets Act 2026: what crypto businesses must do
Pakistan now has a statutory regulator for crypto. Anyone providing virtual-asset services to Pakistanis — local start-up or foreign platform — needs to understand the licensing routes and the transition deadline.
Published 26 October 2026
The legal framework
The Pakistan Virtual Assets Regulatory Authority (PVARA) was set up in July 2025 and placed on a statutory footing by the Virtual Assets Act, 2026. PVARA licenses and supervises virtual asset service providers (VASPs), sets anti-money-laundering and counter-terrorist-financing rules for the sector, and enforces sanctions compliance.
In August 2026 PVARA opened applications for its licensing regime, with three entry points: a regulatory sandbox, a No Objection Certificate (NOC) for existing operators, and a full VASP licence.
Which activities need a licence
PVARA's published categories cover advisory services, broker-dealing, custody, exchanges, lending and borrowing, virtual-asset derivatives, asset management, transfer and settlement, issuance of asset-referenced and fiat-referenced tokens, and mining-related services. A single business often falls into more than one category — an exchange that also holds client assets is both an exchange and a custodian — so map every activity before applying.
The three routes
Sandbox: for genuinely new products that need controlled testing before a full licence. NOC: for businesses already operating — preliminary approval, compliance build-out and local incorporation, followed by a full licence application. Full VASP licence: for firms ready to operate at scale from day one.
Under section 70 of the Act, businesses already acting as VASPs on or before 5 March 2026 had to apply for an NOC by 5 September 2026 or stop operating. Operators who missed that window should take advice before continuing any activity.
What PVARA expects to see
A company incorporated in Pakistan; minimum paid-up capital at the level PVARA prescribes; fit-and-proper directors and key staff; AML/CFT and sanctions-screening systems; cybersecurity controls; and business continuity arrangements. Expect detailed questions on custody of client assets and on how tokens are listed.
Foreign platforms
Offshore exchanges serving Pakistani users should plan for local incorporation and Pakistani compliance staff rather than assume a passport from another regulator will be recognised. Structuring the local entity, intra-group service agreements and data flows is where most of the legal work sits.
How we help
We map activities to PVARA categories, incorporate the local company with SECP, draft AML/CFT and custody policies, prepare the application file and handle correspondence with the regulator. See our Virtual Assets & Crypto practice.
Frequently asked questions
Do I need a PVARA licence if my company is based abroad?
If you provide virtual-asset services to people in Pakistan, assume yes and take advice; PVARA's framework expects local incorporation.
What was the NOC deadline for existing operators?
5 September 2026 for businesses operating as VASPs on or before 5 March 2026.
Is crypto mining covered?
Mining-related virtual asset services are one of PVARA's licensing categories.
This article is general information as of October 2026, not legal advice. Rules change; contact the firm about your specific matter.