How to Obtain a PVARA Licence: Step-by-Step Pakistan VASP Application Guide

Last updated: 24 August 2026

The first surprise in a Pakistan crypto licence application is that the application does not really begin when you open PVARA’s portal.

It begins much earlier—when the founders agree on what the business actually does.

Is the platform an exchange or a broker? Who controls the wallets? Does it execute customer orders or merely provide software? Is staking customer-directed or discretionary? Will the Pakistan company make decisions, or simply follow instructions from an overseas parent?

Until those questions have consistent answers, drafting forms is mostly theatre.

The Pakistan Virtual Assets Regulatory Authority (PVARA) licenses an operating model, not a collection of polished documents. Your legal structure, product flows, capital, people, technology, customer terms and compliance controls must all describe the same business.

This step-by-step guide explains how to obtain a PVARA licence, from regulatory classification and the No Objection Certificate (NOC) to Pakistan incorporation, the full VASP licence application, regulatory review and controlled launch.

Pakistan VASP application

• Regulator: Pakistan Virtual Assets Regulatory Authority
• Primary law: Virtual Assets Act, 2026
• Standard route: Classification → NOC → Pakistan incorporation → full VASP licence
• NOC form: Form I
• Licence form: Form II
• NOC decision period: 60 days after completeness
• Full licence decision period: 90 days after completeness, extendable by up to 60 days
• Capital range: PKR 15m to PKR 500m, depending on category
• Application portal: NOC, Sandbox and VASP licence applications are available online

Before applying: understand the three PVARA routes

PVARA’s official licensing page provides access to three routes.

No Objection Certificate route

The NOC is the standard preliminary route for a person intending to establish a Pakistan company to provide virtual asset services. PVARA assesses the proposed activities, sponsors, controllers, directors, funding, and initial readiness before the operating company is incorporated.

The NOC is not a crypto licence. It does not authorise customer onboarding or commercial VASP activity. It is preliminary regulatory clearance to proceed towards incorporation and licensing.

Regulatory Sandbox route

The Sandbox is intended for innovative products requiring controlled testing under PVARA supervision. The Authority may impose customer, transaction, product, duration, disclosure and reporting limits.

Sandbox participation does not guarantee a licence. However, a participant that completes testing to PVARA’s satisfaction may apply directly for a licence without obtaining a separate NOC under regulation 7(6) of the Pakistan Virtual Asset Services Regulations, 2026.

Transitional route

PVARA states that persons who provided virtual asset services on or before 5 March 2026 must submit the required NOC application by 5 September 2026 or cease operations, subject to section 70 of the Act and regulation 5A.

Existing operators should preserve evidence of their operating history, assess whether transitional treatment applies and avoid assuming they are automatically grandfathered.

Step 1: Confirm that the business needs a PVARA licence

Do not begin with the form. Begin with the regulatory perimeter.

Schedule I of the Act regulates Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Derivatives, Management and Investment, Transfer and Settlement, Virtual Asset Issuance and Mining-Related Virtual Asset Services.

Prepare a transaction map showing:

• the customer and contracting entity;
• each fiat and virtual asset movement;
• who receives and executes orders;
• who controls wallets, keys and transaction approvals;
• how liquidity is obtained;
• who makes investment or staking decisions;
• how the business earns fees, spreads, interest or rewards;
• which functions are outsourced; and
• the countries and customer types being targeted.

Then classify every substantive function against the Act and the Activity Specific Regulations. One product may require several licence categories. For example, an app that accepts orders, matches trades, holds customer assets and processes withdrawals may involve Broker-Dealer, Exchange, Custody, and Transfer and Settlement Services.

The phrase “incidental service” should be used carefully. A substantive function does not become incidental simply because it happens in the background or produces less revenue. Under the activity-specific framework, an incidental activity must be genuinely subordinate, not separately marketed or charged for, not material and treated consistently with any required PVARA approval.

The recommended output is a written regulatory-classification memorandum identifying:

1. services inside the PVARA perimeter;
2. the proposed licence categories;
3. genuine exclusions or exemptions;
4. possible SBP, SECP, FMU or foreign-exchange overlap; and
5. issues requiring clarification from PVARA.

This document became the legal foundation of the Pakistan VASP licence application.

Step 2: Design the application strategy

Once the categories are clear, turn the business model into an application plan.

Decide which entity will hold the licence, how it will relate to overseas group companies and where critical functions will sit. Identify the intended shareholders, ultimate beneficial owners, controllers, sponsors, directors and Key Individuals.

At this stage, applicants should also decide:

• whether the standard NOC or Sandbox route is appropriate;
• whether retail, professional or institutional customers will be served;
• which activities will be performed locally;
• which group or third-party providers will support the business;
• whether customer assets will be held in segregated or omnibus wallets;
• whether custody will be internal, external or hybrid;
• how the Pakistan company will be funded; and
• what products will be offered at initial launch rather than in a later phase.

Trying to license every future idea at once can increase complexity, capital and review time. A carefully defined first-phase scope is often easier to explain and implement, provided it still reflects a viable business.

Create a responsibility matrix covering legal, compliance, AML, finance, product, technology, cybersecurity, custody and corporate workstreams. Licensing fails when everyone assumes someone else owns the difficult document.

Step 3: Conduct a PVARA readiness assessment

A readiness assessment compares the proposed business with the Virtual Assets Act, the Pakistan Virtual Asset Services Regulations, 2026 and the applicable activity-specific rules published through PVARA’s regulatory framework page.

The assessment should test at least six areas.

Ownership and funding

Can every direct and indirect owner be identified? Is the ultimate beneficial ownership chain transparent? Can sponsors prove net worth, source of funds and source of wealth? Are there nominees, trusts, side agreements or voting arrangements requiring disclosure?

Governance and people

Are the proposed directors and senior personnel credible for the selected activities? Can the applicant demonstrate local authority and an independent compliance function? Are conflicts between group and local responsibilities manageable?

Financial resources

Is the applicable paid-up capital genuinely available? Has the applicant budgeted for operating expenditure in addition to regulatory capital? Can it maintain the required net liquid assets and obtain appropriate insurance?

Compliance and financial crime controls

Can the applicant perform customer and beneficial-owner due diligence, sanctions screening, blockchain analytics, transaction monitoring, Travel Rule compliance and suspicious-transaction reporting?

Technology and customer assets

Are wallet architecture, access rights, private-key controls, reconciliations, proof-of-reserves arrangements, cybersecurity and incident reporting documented and testable?

Operational resilience

Do outsourcing contracts, business continuity, disaster recovery, complaint handling and wind-down arrangements work in practice?

Record every gap, the person responsible, the required evidence and the deadline. “We will hire an MLRO after approval” or “the vendor will handle cybersecurity” is not a complete remediation plan.

Step 4: Prepare Form I and the NOC application

Regulation 6 of the Pakistan Virtual Asset Services Regulations, 2026 establishes the NOC process. The application is made using Form I and the Annexure to Form I.

At the NOC stage, Parts A–E principally request:

• applicant and proposed-company information;
• intended legal status and licence categories;
• proposed memorandum and articles;
• shareholders, controllers, directors and board composition;
• proposed authorised and paid-up capital;
• capital and liquidity attestations;
• three-year financial projections, including stress and downside scenarios;
• a detailed business plan;
• custody and wallet model;
• cross-border delivery and distribution channels;
• location of key operational functions;
• group, affiliate and outsourcing arrangements;
• experience, qualifications and regulatory history of proposed personnel;
• material legal, insolvency, bankruptcy or enforcement matters; and
• prescribed declarations and confirmations.

The business plan is not a marketing deck. It should explain the problem being solved, target customers, products, transaction flows, revenue, customer acquisition, jurisdictions, partners, custody, technology, risk management, staffing and financial sustainability.

Three-year forecasts should connect directly to operational assumptions. Customer numbers should reconcile with transaction volume. Volume should reconcile with revenue. Revenue should reconcile with staffing, technology and compliance costs. Capital must remain adequate under the downside scenario, not only when every commercial assumption succeeds.

The NOC application can be initiated through PVARA’s online portal, which requires an applicant account and allows applications to be saved and tracked.

Step 5: Manage the NOC review

PVARA is required to grant or refuse a complete NOC application within 60 days. The important word is complete.

The Authority may request additional information while reviewing Form I. A submission uploaded to the portal is not necessarily an application accepted as complete. Applicants should therefore avoid presenting the 60-day period as a guaranteed approval date.

Use a central regulatory-response log recording:

• each PVARA question;
• the internal owner;
• documents affected by the response;
• the approved answer;
• supporting evidence; and
• the submission date.

Before responding, check the entire application. If the regulator’s question changes the custody model, the answer may also require revisions to the business plan, financial forecasts, outsourcing description and technology diagrams.

If PVARA grants the NOC, read every condition carefully. Under regulation 6(4), the NOC does not constitute a licence, does not prejudge the full application and may be withdrawn if obtained through materially false, misleading or incomplete information.

The NOC is valid for three months. A reasoned extension request made before expiry may extend it by up to another three months. Build incorporation and licensing milestones backwards from that expiry date.

Step 6: Incorporate the Pakistan VASP

After receiving the NOC under the standard route, incorporate the applicant company under the Companies Act, 2017 and align its constitutional documents with the approved business.

The company’s objects, shareholding, directors and proposed activities should be consistent with the NOC. Changes made for convenience during incorporation can create a mismatch requiring explanation or approval.

Complete tax, banking, FMU/goAML and other registrations or regulatory requirements applicable to the model. Where funds are injected from abroad, ensure the transfer, repatriation and source-of-funds evidence can be demonstrated in the form required by PVARA and other competent authorities.

The company must be more than a paper subsidiary. It needs a registered office in Pakistan, operational capacity and local decision-making authority.

Step 7: Appoint the board and Key Individuals

Regulation 20 requires at least three directors. Unless PVARA specifies otherwise based on the applicant’s nature, scale, complexity and risk, independent directors should comprise at least one-third of the board.

The board should collectively understand the relevant services, financial crime, risk management, technology, cybersecurity and customer-asset obligations. Prestigious titles do not compensate for missing competence.

The applicant must also establish a clear management structure. Key positions may include:

• Managing Director or Chief Executive Officer;
• resident Compliance Officer;
• Money Laundering Reporting Officer;
• Chief Financial Officer;
• risk-management lead;
• information-security or cybersecurity lead;
• operations and custody leadership; and
• internal audit, where appropriate.

The Compliance Officer must be sufficiently senior, adequately resourced, fit and proper, and resident in Pakistan. A licensee must also maintain at least one resident Key Individual with operational and decision-making authority who is accountable to PVARA. Depending on scale and risk, the Authority may require more.

Controllers, sponsors, the Managing Director and directors require PVARA approval and must satisfy the continuing fit-and-proper criteria. Expect scrutiny of integrity, reputation, competence, experience, financial soundness, conflicts, regulatory history, criminal matters, insolvency and litigation.

Disclose difficult facts with context. An historic regulatory issue explained transparently is generally easier to manage than an omission discovered during verification.

Step 8: Inject capital and establish financial resources

Schedule I prescribes the following minimum paid-up capital:

For several licence categories, the general prudential floor is the highest applicable category minimum unless PVARA determines that a separate, non-overlapping risk requires an additional amount. PVARA may also impose risk-based add-ons.

The capital must be injected and maintained in the applicant’s Pakistan bank account or as otherwise accepted by PVARA, with documentary evidence of its source and availability. It is not a fee paid to the regulator.

Regulation 32 also requires net liquid assets equal to at least 1.2 times adjusted monthly operating expenses. Eligible paid-up capital held in qualifying liquid assets may count toward this requirement.

Professional indemnity and commercial crime insurance are listed among the licensing documents and must become effective before regulated activity begins. Cyber coverage may also be relevant to the risk and insurance programme.

Step 9: Build the full licensing evidence pack

Following incorporation and within the NOC validity period, the company applies using Form II. The Annexure to Form I is updated and supplemented for the licence stage.

Part F identifies 35 principal information and document categories, including:

Corporate and ownership documents

• certificate of incorporation;
• shareholders and ultimate beneficial owners;
• directors and Key Individuals;
• fit-and-proper affidavits;
• organisational and associated-company structure;
• paid-up capital and source-of-funds evidence; and
• overseas licences, approvals and regulatory history.

Governance, risk and compliance documents

• compliance manual and monitoring arrangements;
• enterprise risk-management framework;
• AML/CFT/CPF and FATF compliance framework;
• anti-bribery and corruption policy;
• conflicts-of-interest policy;
• insider list and personal-dealing controls;
• records-management framework; and
• wind-down plan.

Customer and market-conduct documents

• customer onboarding and consumer-protection policy;
• complaint-handling mechanism;
• market-conduct policy;
• marketing policy and plan;
• client-asset protection and segregation controls;
• token listing policy, where applicable; and
• description of the virtual assets to be managed.

Technology and operational documents

• technology infrastructure design;
• technology-governance and risk framework;
• information-security and cybersecurity policies;
• key and wallet-management policy;
• business-continuity and disaster-recovery plan;
• personal-data protection arrangements;
• outsourcing policy; and
• insurance contracts.

The list is not closed. Item 35 permits PVARA to request other information.

Avoid downloading generic policies and changing the company name. Every policy should identify responsible people, systems, thresholds, escalation routes, records and board oversight. If the document says withdrawals require three approvals, the platform and access logs should prove it.

Step 10: Implement and test the controls

PVARA is not only reviewing whether the applicant understands the rules. It is assessing whether the company can operate safely.

Before submitting the full Pakistan VASP licence application, test the control environment through:

• sample customer and beneficial-owner files;
• sanctions and adverse-media screening tests;
• blockchain transaction-monitoring scenarios;
• Travel Rule workflows;
• wallet-access and transaction-approval demonstrations;
• daily reconciliation samples;
• proof-of-reserves methodology;
• cyber penetration and vulnerability testing;
• incident-response tabletop exercises;
• business-continuity and system-restoration tests;
• complaint escalation exercises; and
• compliance-monitoring reports presented to management or the board.

Contracts with banks, custodians, liquidity providers, cloud hosts, KYC vendors, blockchain analytics providers and group service companies should provide appropriate audit, access, security, incident, continuity, subcontracting and termination rights.

Outsourcing a function does not outsource accountability. The principal licensed activity must remain with the licensee, and critical providers must be subject to effective oversight.

Step 11: Submit Form II and the licence application

Form II identifies the Pakistan company, the requested categories and the NOC on which the application relies. It must be signed by the sponsors and directors and accompanied by the updated Annexure, supporting documents and evidence of the prescribed non-refundable processing fee.

Regulation 11 provides for processing, licensing, annual supervisory, renewal and other fees. However, as at 24 August 2026, the notified regulations and public licensing materials do not state numerical amounts. Applicants should confirm the current schedule through the portal or directly with PVARA rather than relying on unofficial figures.

Perform a consistency review before submission. Compare the forms, business plan, financial model, policies, corporate records, website, contracts, diagrams and system configuration. The application should use the same product names, entities, customer types, custody model and transaction flows throughout.

Step 12: Navigate PVARA’s licence review

Under regulation 7, PVARA is to decide on a complete application within 90 days. It may extend that period by up to 60 days where the application is complex, presents novel risks or requires consultation with another authority.

The clock is suspended when PVARA requests information and remains suspended until the information is provided. A weak submission can therefore turn a 90-day statutory period into a much longer calendar process.

PVARA may request:

• revised financial projections or stress tests;
• explanations of ownership and funding;
• policy amendments;
• contracts with critical providers;
• demonstrations of onboarding, monitoring or wallet systems;
• independent technology, security or assurance reports;
• evidence of hiring and local operations; and
• interviews with controllers, directors, the CEO, Compliance Officer, MLRO or technology leadership.

Prepare key personnel to explain the business in their own words. A director who cannot describe the company’s main risks, or an MLRO who has never seen the transaction-monitoring rules, will undermine even an impressive written submission.

Respond promptly, but never improvise. Each response should be accurate, approved, supported by evidence and checked against previous answers.

Step 13: Receive the decision and prepare for launch

PVARA may grant the requested categories, refuse the application, impose conditions or issue a limited-scope licence under regulation 7(5). Form III records the authorised activities, effective date and any additional conditions. The licence is issued to the Pakistan company and is non-transferable.

Before going live:

1. confirm every authorised category, customer type, product and condition;
2. complete pre-commencement capital, insurance, staffing or system conditions;
3. activate regulatory reporting and recordkeeping;
4. approve customer agreements, disclosures and risk warnings;
5. train staff and outsourced teams;
6. verify website and marketing statements;
7. test incident and complaint escalation; and
8. obtain board approval for controlled commencement.

Do not assume approval permits every product mentioned during the application. The licence authorises only its stated scope.

How long does the PVARA application process take?

These periods exclude preparation, incorporation, recruitment, capital injection, vendor contracting and control implementation. They also pause when requested information is outstanding.

For internal planning—not as a PVARA commitment—a prepared applicant may require four to twelve weeks for classification and NOC preparation, followed by incorporation and several months of implementation and licence review.

A total project duration of six to twelve months or more may be prudent for exchanges, custodians, derivatives platforms, token issuers and complex international groups.

Seven mistakes that delay a PVARA licence

1. Applying for the wrong categories. The business model and requested permissions do not match.
2. Treating the NOC as a licence. Commercial activity or marketing begins before full authorisation.
3. Hiding ownership complexity. Controllers, voting rights, funding or side arrangements emerge late.
4. Using generic policies. Documents describe systems and committees that do not exist.
5. Under-resourcing Pakistan operations. Local personnel lack authority, experience or availability.
6. Submitting before implementation. Controls are promised but cannot be demonstrated.
7. Answering PVARA inconsistently. Regulatory responses contradict forms, forecasts, contracts or technology.

The fastest application is rarely the one filed first. It is the one that creates the fewest unanswered questions.

Final word

A PVARA licence application is not won by producing the largest pile of documents. It is won by creating the clearest evidence that the proposed business can be trusted with customers, assets, technology and regulatory responsibility.

Start with the truth of the product. Select the correct categories. Build a credible Pakistan company. Put competent people in charge. Prove the capital. Implement the controls. Then make every page of the application reflect that reality.

When this sequence is followed, the forms become the final expression of a licensing strategy—not a substitute for one.

Legal disclaimer: This article provides general information as at 24 August 2026 and does not constitute legal, regulatory, tax, financial or investment advice. PVARA may issue new rules, fee schedules, forms, directions or interpretations, and application requirements depend on the facts of each business. Applicants should obtain professional advice and confirm current requirements directly with PVARA and any other competent authority before acting.

FAQs