Pakistan spent years without a clear answer to a simple question: is running a crypto exchange here legal or not? Operators worked in the gap between a State Bank that discouraged banks from touching virtual assets and a legislature that had not written a rule either way. Banking access came and went. Nobody could plan.
The Pakistan Virtual Assets Regulatory Authority — PVARA — is the answer to that question. It replaces ambiguity with a licence: a defined list of regulated activities, a set of conditions, and a body with the power to authorise or refuse.
This guide explains what PVARA is, which businesses fall under it, and what the licensing process asks of you.
What is PVARA?
PVARA is the Pakistan Virtual Assets Regulatory Authority, the government body responsible for licensing and supervising virtual asset service providers in Pakistan. It defines which crypto activities require authorisation, sets the conditions firms must meet to obtain it, and holds inspection and enforcement powers over the firms it licenses.
In practice, PVARA does four things:
- Defines the perimeter. It sets out which activities count as regulated virtual asset services, and therefore who must be licensed.
- Licenses firms. It receives applications, assesses them, and grants or refuses authorisation.
- Sets ongoing conditions. Capital, governance, anti-money-laundering controls, reporting and record-keeping.
- Supervises and enforces. It inspects licensed firms and acts against those breaching conditions or operating without a licence.
For current requirements and published notifications, the authoritative source is the PVARA official website. Rules at this stage are moving, and anything in this article should be checked against what PVARA has published on the day you read it.
What is a virtual asset service provider?
A virtual asset service provider, or VASP, is any business that conducts virtual asset activity on behalf of other people. The defining test is whether you handle someone else’s assets or act as intermediary in their transactions. Trading your own funds is not a VASP activity. Holding, moving or exchanging someone else’s is.
The category usually covers:
- Exchanges and trading platforms — matching buyers and sellers, or acting as counterparty
- Custodians and wallet providers — holding or safeguarding client assets, where you control the keys
- Broker-dealers — buying and selling virtual assets on a client’s instruction
- Transfer and payment services — moving virtual assets between parties
- Issuance and offering services — selling virtual assets to the public
- Advisory firms — advising clients on virtual asset investments
This definition is not a Pakistani invention. It follows the Financial Action Task Force’s Recommendation 15, the international standard almost every virtual asset regime is built on. That matters practically: if your firm is already licensed in a jurisdiction that follows FATF standards, much of your existing documentation will map onto what PVARA asks for.
Who needs a PVARA licence?
Any firm providing virtual asset services to customers in Pakistan requires authorisation. This includes companies incorporated in Pakistan and foreign platforms that actively serve Pakistani users. Where the company is registered does not decide the question. Where the customers are does.
The test regulators apply is whether a platform is actively targeting the market. Signals include:
- Marketing or advertising aimed at Pakistani users
- Local language support or a Pakistan-specific interface
- Onboarding customers who declare Pakistani residence
- Accepting deposits in Pakistani rupees
- Local payment integrations or banking relationships
A global exchange that a handful of Pakistanis reach through a VPN is a different case from one running rupee deposits and local marketing. The second needs a licence.
What does a licence application involve?
Applications across FATF-aligned regimes ask for broadly the same evidence, and PVARA’s framework follows that pattern. Applicants should expect to demonstrate corporate substance, financial soundness, fit management, and working compliance systems — not policies written for the file, but controls that operate.
Expect to produce:
- Corporate documentation — incorporation, ownership structure, and beneficial ownership up the chain
- Fit-and-proper submissions — background, qualifications, financial standing and criminal record checks for directors, senior managers and significant shareholders
- Capital adequacy evidence — proof you hold the required minimum, and that it is genuinely yours rather than borrowed for the filing
- An AML and CFT programme — customer due diligence, risk scoring, sanctions screening, transaction monitoring and suspicious transaction reporting
- Travel rule capability — the technical means to send and receive originator and beneficiary information on transfers
- Custody and asset segregation arrangements — how client assets are held, and how they stay separate from company funds
- Governance and risk framework — board structure, reporting lines, and a compliance function with real authority
- Business continuity and cyber security — incident response, key management, disaster recovery
- Market surveillance — for trading venues, systems that detect manipulation and abuse
The two that most often sink an application are fit-and-proper and AML. Fit-and-proper fails when ownership runs through structures the applicant cannot fully explain. AML fails when the programme is a document rather than a system — a policy that describes monitoring nobody is actually performing.
How long does a licence take?
No firm has completed the full PVARA process yet, because licensing is still at consultation stage. Comparable regimes offer the realistic benchmark: applicants in the UAE and Singapore typically spend six to twelve months from first filing to approval, and considerably longer where the initial submission is incomplete.
Preparation is where the time is won or lost. Firms that assemble documentation before filing tend to move through review in one pass. Firms that file early to “start the clock” usually spend the following months answering questions they could have answered up front, and the clock restarts anyway.
What happens to firms operating without a licence?
Operating outside the perimeter carries consequences well beyond a penalty. Once a regime is in force, unlicensed operation puts a firm outside the legal system entirely — with the practical effects arriving long before any enforcement action does.
The realistic consequences:
- Banking access closes. Regulated banks will not knowingly serve an unlicensed VASP. This usually bites first and hardest.
- Directors carry personal exposure. Enforcement in most regimes reaches individuals, not just the company.
- Future applications get harder. A firm that operated unlicensed starts its eventual application with the regulator already holding a file on it.
- Counterparties disappear. Licensed exchanges, custodians and payment providers decline unlicensed relationships as a matter of policy.
The firms that come through a regime change intact are generally the ones that engaged with the regulator early, even when they were not yet fully compliant.
What should a firm do now?
While the framework is still at consultation stage, useful preparation does not depend on the final rules:
- Work out which licence category you fall into. The obligations differ sharply between an exchange, a custodian and an advisory firm.
- Map your gaps honestly. Compare what your compliance programme does today against what a FATF-aligned regime requires.
- Clean up your corporate structure. Ownership chains that cannot be explained clearly become fit-and-proper problems later.
- Fix the travel rule now. It is a technical integration, not a policy document, and it takes longer than most firms expect.
- Respond to the consultation. Industry comment shapes final rules, and a regulator remembers who engaged constructively.
- Get an adviser who has filed before. The cost difference between an experienced adviser and a cheap one is usually smaller than the cost of one rejected application.
About this analysis
This article was prepared by the Sarzif Policy research desk from primary regulatory sources and published international standards, principally FATF Recommendation 15 and the licensing frameworks operating in comparable jurisdictions. It was reviewed by the lawyer on our team before publication.
Where this article describes general licensing practice rather than a specific published Pakistani requirement, we have said so. Pakistan’s framework is at consultation stage and detail will change. Verify every specific requirement against the current position published by PVARA before acting on it.
Firms working through market entry and regulatory positioning in Pakistan may also find the market coverage at CoinConnect useful as background.
This is information, not legal advice. If you are applying for a licence and want a shortlist of consultants who have completed comparable filings, our matching service will send you one at no cost.
Published 7 August 2026. Corrections to sarzifpolicy@gmail.com.
