Pakistan Launches Licensing Regime for Crypto Companies

The Pakistan Virtual Assets Regulatory Authority (PVARA), the country’s independent federal regulator for the crypto industry, opened a licensing portal for companies that provide virtual asset services. The launch followed the introduction of detailed rules setting out requirements for crypto exchanges, custodians, brokers, token issuers, and other VASPs.

The licensing framework was further detailed in 2 sets of regulations that PVARA officially published on August 21, 2026:

• Pakistan Virtual Asset Services Regulations, 2026, S.R.O. 1419(I)/2026. The regulations establish general rules for the licensing and supervision of VASPs;
• Pakistan Virtual Asset Services Activity Specific Regulations, 2026, S.R.O. 1420(I)/2026. The regulations set requirements based on the specific type of services provided.

PVARA adopted both sets of regulations under the authority granted by Section 68 of the Virtual Assets Act, 2026. Before adopting the final rules, the regulator held public consultations from June 11 through July 2, 2026. Participants included crypto exchanges, custodians, broker-dealers, token issuers, financial institutions, compliance professionals, and other market participants.

The new framework covers 11 categories of licensable activities:

1. Advisory services
2. Broker-dealer services
3. Custody services
4. Cryptocurrency exchange services
5. Virtual asset lending and borrowing
6. Crypto derivatives activities
7. Virtual asset and investment management
8. Virtual asset transfers and settlements
9. Issuance of asset-backed tokens
10. Issuance of fiat-referenced tokens
11. Virtual asset mining-related services

A company can apply for licenses in multiple categories at the same time.

PVARA’s mandatory licensing requirements include:

• registering a legal entity in Pakistan;
• meeting minimum paid-up capital requirements;
• completing fit-and-proper assessments for directors and key personnel;
• maintaining an anti-money laundering and counter-terrorist financing framework;
• conducting customer identification and verification;
• monitoring transactions;
• complying with cybersecurity requirements;
• maintaining a risk management framework;
• safeguarding client assets and data;
• maintaining business continuity and disaster recovery plans.

Depending on the type of company, there are 2 main pathways to obtaining a license:

1. Through a regulatory sandbox. Companies can test innovative products and services in a controlled environment and then apply for a license;
2. Through a No Objection Certificate (NOC). A company obtains regulatory approval, meets the applicable requirements, registers a legal entity in Pakistan, and then applies for a full VASP license.

Existing market participants are subject to a transition period. VASPs must obtain preliminary regulatory approval by September 5, 2026. Otherwise, they must stop providing services in Pakistan.

Pakistan’s authorities began developing regulations for digital assets and virtual asset service providers in 2025.