Pakistan went from banning banks from touching crypto to running a full licensing system in less than a year. The result is a rulebook that reaches further than many companies assume, including those with no office in the country.
This guide sets out what the Pakistan Virtual Assets Regulatory Authority (PVARA) requires, based on its own published pages and on reporting where those pages are silent. It is general information, not legal advice. PVARA itself notes that the Act and Regulations prevail over anything in its FAQ.
How the rules came together
- December 2025Binance and HTX receive preliminary No-Objection Certificates, according to The Block and a report linked on PVARA's site.
- March 2026Parliament passes the Virtual Assets Act, 2026, making PVARA a permanent statutory body.
- 14 April 2026The State Bank replaces its 2018 restriction. Banks may now serve licensed providers.
- 26 April 2026PVARA warns that pilots enabling virtual asset services need its prior authorisation.
- 11 June to 2 July 2026Public consultation on draft regulations.
- 21 August 2026The Pakistan Virtual Asset Services Regulations, 2026 are notified.
- 5 September 2026Deadline for existing operators to apply for an NOC or stop operating.
Who needs a licence
The test is broad. PVARA's FAQ says an activity may count as carried on "in or from Pakistan" where it targets, solicits, promotes to or onboards people in Pakistan. It lists marketing through a website or app, payment rails, and providing services in rupees among the factors it considers.
So a company with no staff in Pakistan can still be in scope if it is marketing to Pakistanis or paying out in PKR. Applicants are asked to describe their geo-targeting and geo-blocking controls, which shows the regulator is looking at this directly.
Anyone carrying on a virtual asset service in or from Pakistan must be a company incorporated under the Companies Act, 2017, with at least three directors. PVARA says there is no requirement for Pakistani shareholding and no cap on foreign ownership, so a fully foreign-owned local company is allowed.
Eleven licence categories
PVARA's FAQ and licensing page both list 11 categories, each with a minimum paid-up capital requirement.
Some early coverage counted ten categories. We use PVARA's own list, which separates fiat-referenced and asset-referenced tokens.
Where stablecoins fit
Those two token categories are the stablecoin rules in practice. PVARA defines them as tokens that purport to keep a stable value by reference to a single fiat currency, or to another asset, basket or right.
Its April advisory is the only PVARA page we found that uses the word "stablecoins", and it places them within the Authority's remit. It also warns that any agreement or announced pilot that directly enables such services needs prior authorisation.
We found no separate stablecoin rule on PVARA's public pages. A company that only uses stablecoins behind the scenes, rather than issuing them, would need to look at the transfer, exchange and custody categories, and take its own advice.
Two routes in
The sandbox route. A company applies to the sandbox, tests within an agreed scope and customer limit, meets its reporting and safeguarding requirements, and then satisfies the exit criteria. It can then apply directly for a licence without an NOC. PVARA is clear that sandbox participation creates no entitlement to one.
The NOC route. A company applies for an NOC, incorporates in Pakistan, and applies for a licence while the NOC is valid.
The timelines PVARA publishes are short:
- An NOC decision comes within 60 days of a complete application.
- An NOC lasts three months and can be extended by up to three more.
- A licence decision comes within 90 days of a complete application, extendable by up to 60 days.
The tight NOC window matters. A company has to incorporate and prepare a full licence application within months.
An NOC does not allow a company to offer any service. It only opens the door to applying.
What happened on 5 September
Under Section 70 of the Act, anyone operating on or before 5 March 2026 had to apply for an NOC by 5 September 2026 or stop. Nukta reported that operating without an application after that date is an offence.
The Block reported penalties in the Act of up to PKR 50 million and five years in prison for unlicensed operations, and up to PKR 25 million and three years for unauthorised offerings or promotion. We have not checked those figures against the Act's text.
What it means for customers
PVARA's pages say licensees must follow strict standards safeguarding customer funds, and applicants must disclose their custody model. Nukta reported that licensed providers must keep customer holdings separate from their own, cannot lend or pledge them without written consent, and cannot touch them if the platform fails.
Banking is the other half of this. Since April, banks may serve licensed providers, including through segregated client money accounts, according to Nukta.
The practical question for a customer is simple: is this provider licensed? That is harder to answer than it should be. PVARA's FAQ says it publishes a public register of licensees, but we could not find it on the pages we read, and we found no official list of NOC holders. Until there is one, treat any app's claim to be regulated in Pakistan with care, and remember that an NOC isn't a licence.
What we don't know yet
- How many NOC applications PVARA received before the deadline.
- Which companies hold an NOC, beyond those reported.
- Whether any company has received a full licence.
- What PVARA will do about offshore apps that serve Pakistanis without applying.
We will update this guide as those answers emerge.
This guide is general information, not financial, legal or tax advice. Rules, fees and availability change, so check with the provider and your own adviser before you act.