Tokenised Securities in Pakistan: When Securities Law Applies

For virtual asset operators in Pakistan, understanding the exact regulatory classification of the digital assets they deal with is paramount. The landscape is not always straightforward, especially when an asset appears to be a virtual asset but carries characteristics that align with traditional financial instruments. Misclassifying an asset can lead to significant compliance gaps, exposing a business to regulatory enforcement action from an unexpected authority.

The proposed Pakistan Virtual Assets Regulatory Authority (PVARA) framework is designed to regulate virtual assets that do not fall under existing financial laws. However, many digital tokens, particularly those representing ownership or debt, may instead be considered “securities” under the purview of the Securities and Exchange Commission of Pakistan (SECP). This distinction is not merely academic; it dictates which laws apply, which regulator has jurisdiction, and what licensing and compliance obligations a business must meet.

Navigating this regulatory perimeter is crucial for any firm operating or planning to operate in Pakistan’s digital asset space. Operators must be vigilant in assessing their offerings to ensure they are compliant with the correct set of rules, thereby mitigating legal and operational risks.

What are tokenised securities?

Tokenised securities are digital representations of traditional financial assets, such as shares, bonds, or units in a collective investment scheme, recorded on a blockchain or distributed ledger. They derive their value and legal standing from the underlying real-world asset and are therefore subject to existing securities laws, rather than solely virtual asset regulations.

These tokens essentially package the rights and obligations of a conventional security into a digital format. For example, a token could represent a fractional ownership stake in a property, a share in a company, or a claim on future revenue. While they leverage blockchain technology for issuance, transfer, and record-keeping, their fundamental legal nature remains that of a security. This means that all regulatory requirements associated with traditional securities, such as prospectus disclosure, investor protection, and market conduct rules, generally apply.

How do tokenised securities differ from other virtual assets?

The key difference lies in their legal nature and the underlying rights they confer. While many virtual assets are primarily utility tokens, cryptocurrencies, or non-fungible tokens (NFTs), tokenised securities grant holders specific rights associated with traditional financial instruments, such as ownership, dividends, or voting rights, making them subject to different regulatory oversight.

To illustrate this distinction, consider the following:

• Cryptocurrencies (e.g., Bitcoin, Ethereum): Primarily function as a medium of exchange or store of value. They typically do not confer ownership in an underlying company or a right to future profits from a specific enterprise.
• Utility Tokens: Provide access to a specific product or service within a blockchain ecosystem. Their value is derived from their utility within that ecosystem, not from an underlying financial asset. For more on how NFTs are treated, see our analysis on NFTs and Virtual Asset Regulation in Pakistan: When Do Rules Apply?.
• Tokenised Securities: Represent a direct claim on a traditional asset or a share in a company. They are essentially digital wrappers for existing securities.

The determination of whether a virtual asset is a security often hinges on an “economic reality” test, which examines the substance of the offering rather than just its form. This approach is common in many jurisdictions, including Pakistan’s proposed framework, and involves assessing whether the asset represents an investment contract.

Which regulator oversees tokenised securities in Pakistan?

In Pakistan, the Securities and Exchange Commission of Pakistan (SECP) is the primary regulator for securities and capital markets. If a virtual asset qualifies as a security, it falls under SECP’s purview, even if it uses blockchain technology. The State Bank of Pakistan (SBP) also has a role in payment systems and financial stability.

The SECP’s mandate covers the issuance, trading, and settlement of securities, as well as the licensing of market intermediaries such as brokers, custodians, and asset managers. Any entity dealing with tokenised securities would likely need to comply with SECP regulations and potentially seek appropriate licenses from them, in addition to any virtual asset specific licenses from PVARA if other virtual asset activities are conducted. Our article on SECP’s Role in Pakistan’s Virtual Asset Regulation: A Guide for Operators provides further detail on this intersection. The State Bank of Pakistan (SBP) also maintains a position on virtual assets, as explored in State Bank of Pakistan’s Crypto Policy: What Operators Need to Know.

What is the current regulatory position in Pakistan?

Pakistan’s virtual asset regulatory framework, primarily proposed by PVARA, focuses on virtual assets that are not already classified as securities or other regulated financial instruments. For tokenised securities, existing securities laws and regulations overseen by the SECP apply. The distinction is crucial for compliance, as the PVARA framework is still under consultation.

The PVARA framework, once finalised, aims to provide a comprehensive regulatory regime for Virtual Asset Service Providers (VASPs). However, this framework generally seeks to avoid overlapping with existing regulatory domains. This means that if an asset falls squarely within the definition of a security under the Securities Act 2015 or other SECP-administered laws, then SECP’s rules take precedence. Operators should consult the latest regulatory updates on our blog for developments.

What are the implications for Virtual Asset Service Providers (VASPs)?

VASPs dealing with tokenised securities must understand that they may be subject to dual regulation. This means complying with PVARA’s virtual asset rules for certain activities, while also adhering to SECP’s securities regulations, including licensing and disclosure requirements, for activities involving tokenised securities.

This dual regulatory burden can be complex. For instance, a platform that facilitates the trading of both cryptocurrencies and tokenised shares would need to navigate:

1. PVARA Licensing: For its virtual asset services, such as exchange or custody of non-security virtual assets. Information on VASP licensing is available at /vasp-licensing/.
2. SECP Licensing: For its activities related to tokenised securities, potentially as a broker-dealer, asset manager, or an alternative trading system.
3. Enhanced Compliance: Implementing robust Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) measures under both frameworks, as well as investor protection mechanisms required by SECP. Our guide on who needs a VASP licence in Pakistan can help clarify the scope.

How can operators determine if an asset is a tokenised security?

Operators should conduct a thorough legal assessment based on the asset’s characteristics, rights conferred, and economic reality. Factors include whether it represents ownership in a company, a debt instrument, or a share in a collective investment scheme, regardless of its technological form.

Key questions to ask when performing this assessment include:

• Does the token represent an investment of money?
• Is there an expectation of profits from the investment?
• Are the profits derived from the efforts of others (e.g., a promoter or third party)?
• Does the token confer ownership rights, voting rights, or a claim on assets or profits of an enterprise?
• Is the token marketed as an investment opportunity?

This assessment should go beyond the name or technical description of the token. It requires an in-depth understanding of the underlying project, its economic purpose, and the rights and obligations attached to the token. Seeking expert legal advice is strongly recommended for accurate classification.

What are the risks of misclassification?

Misclassifying a tokenised security as a mere virtual asset can lead to severe penalties, including fines, operational restrictions, and legal action from the SECP. It can also result in investor protection failures, reputational damage, and potential criminal liabilities for individuals involved.

The cost of non-compliance can be substantial. Regulators have broad enforcement powers, including the ability to:

• Issue cease and desist orders.
• Impose significant monetary penalties. For context on penalties, see Crypto Compliance Penalties: The Cost of Non-Compliance for VASPs.
• Revoke or deny licenses.
• Initiate criminal proceedings.
• Order restitution to investors.

Furthermore, a lack of proper disclosure and investor protection measures, as required for securities, can expose businesses to civil lawsuits from aggrieved investors. Pakistani courts have also begun to address virtual asset cases, and their evolving stance can be found in our analysis of How Pakistani Courts Have Treated Virtual Assets So Far.

What steps should operators take?

Operators should seek expert legal advice to classify their offerings accurately. They must establish robust internal processes to identify and comply with all applicable regulations, whether under PVARA, SECP, or other relevant authorities.

Here are practical steps for operators:

1. Legal Opinion: Obtain a legal opinion from qualified Pakistani counsel on the classification of each digital asset offered or intended to be offered.
2. Regulatory Business Plan: Develop a comprehensive regulatory business plan that clearly outlines the nature of the services, the assets involved, and the applicable regulatory framework. Our guide on Crafting a Crypto Regulatory Business Plan for Approval in Pakistan offers insights.
3. Compliance Framework: Implement a compliance framework that addresses both virtual asset regulations (e.g., AML/CTF, cybersecurity, data protection) and securities regulations (e.g., disclosure, investor protection, market conduct).
4. Risk-Based Approach: Adopt a robust risk-based approach to AML for crypto businesses and other compliance areas, tailoring controls to the specific risks posed by each asset type.
5. Staff Training: Ensure all relevant staff, especially those in compliance and product development, are adequately trained on the distinctions between virtual assets and tokenised securities and the associated regulatory obligations. For more on training, refer to AML Training Requirements for Virtual Asset Service Providers in Pakistan.
6. Ongoing Monitoring: Continuously monitor regulatory developments and reassess asset classifications as new guidance emerges from PVARA, SECP, or other authorities.

How does this relate to FATF recommendations?

The Financial Action Task Force (FATF) Recommendation 15 covers virtual assets and Virtual Asset Service Providers (VASPs), urging countries to regulate and supervise VASPs for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) purposes. However, FATF also clarifies that if a virtual asset is already covered by existing financial sector regulations (like securities or derivatives), then those specific rules apply.

FATF’s guidance is clear: the underlying nature of the asset determines the applicable regulatory regime. If a virtual asset functions as a security, then the jurisdiction’s securities laws and the FATF standards for securities firms should apply. This principle underpins Pakistan’s approach, where the SECP’s existing framework for securities would govern tokenised securities, while PVARA would regulate other virtual assets. Understanding FATF Recommendation 15 is fundamental for all virtual asset operators.

What are the key differences in regulatory approach?

PVARA’s proposed approach primarily focuses on anti-money laundering (AML) and counter-terrorist financing (CTF), consumer protection for virtual assets, and operational resilience specific to crypto. SECP’s approach focuses on investor protection, market integrity, disclosure, and capital market stability.

The table below summarises these distinct focuses:

This distinction means that operators dealing with tokenised securities must not only adhere to the stringent AML/CTF requirements that are common across financial sectors but also comply with the extensive investor protection and market integrity rules designed for traditional capital markets.

About this analysis

This analysis has been prepared by Sarzif Policy, an independent research desk in Islamabad. Our insights are derived from publicly available information, including proposed regulatory frameworks, guidance from international bodies like FATF, and general principles of financial regulation. We aim to provide clear, actionable information for crypto business operators.

Please note that Pakistan’s virtual asset regulatory framework is still under consultation and subject to change. Specific requirements, thresholds, and timelines must be verified against the latest official publications from PVARA, SECP, the State Bank of Pakistan, and the Federal Board of Revenue (FBR). This article is for informational purposes only and does not constitute legal or regulatory advice. For specific guidance tailored to a business model, it is essential to consult with qualified legal and compliance professionals. You can learn more about our work on our /about/ page and review our /editorial-policy/ for our commitment to accuracy. For further inquiries, please /contact/ us.