Pakistan Launches Licensing Regime for Virtual Asset Service Providers

Pakistan has opened a formal licensing route for virtual asset service providers (VASPs), with 11 licensable activity categories and two paths to authorization. For crypto exchanges, custodians, brokers, token issuers, and the PSPs that serve them, the message is straightforward: operate in Pakistan now means getting in line with PVARA.

1. The Pakistan Virtual Assets Regulatory Authority (PVARA), the country’s independent federal regulator for the crypto industry, has launched a licensing portal for companies providing virtual asset services. The new framework sits on top of the Virtual Assets Act, 2026, which the Pakistani government introduced in March 2026 and which requires VASPs to obtain a license before offering services in the country.
2. PVARA officially published two regulations on August 21, 2026: Pakistan Virtual Asset Services Regulations, 2026, S.R.O. 1419(I)/2026, which set the general rules for licensing and supervision, and Pakistan Virtual Asset Services Activity Specific Regulations, 2026, S.R.O. 1420(I)/2026, which set requirements by service type. PVARA adopted both under Section 68 of the Virtual Assets Act, 2026.
3. The regime covers 11 categories of licensable activity: advisory services, broker-dealer services, custody services, cryptocurrency exchange services, virtual asset lending and borrowing, crypto derivatives activities, virtual asset and investment management, virtual asset transfers and settlements, issuance of asset-backed tokens, issuance of fiat-referenced tokens, and virtual asset mining-related services. A company can apply for licenses in multiple categories at the same time, which matters for groups bundling exchange, custody, and payments flows under one operating model.
4. Before the final rules landed, PVARA ran public consultations from June 11 through July 2, 2026. Participants included crypto exchanges, custodians, broker-dealers, token issuers, financial institutions, compliance professionals, and other market participants, which is usually the part where the market gets to tell the regulator what sounds neat on paper and painful in production.
5. To obtain authorization, applicants must register a legal entity in Pakistan, meet minimum paid-up capital requirements, pass fit-and-proper assessments for directors and key personnel, maintain AML/CFT (anti-money laundering and counter-terrorist financing) controls, conduct customer identification and verification, monitor transactions, comply with cybersecurity requirements, maintain a risk management framework, safeguard client assets and data, and keep business continuity and disaster recovery plans in place. Depending on the company, licensing can come either through a regulatory sandbox or through a No Objection Certificate (NOC), with the sandbox route designed for testing products in a controlled environment before applying for a license.