Pakistan Crypto Advisory, Asset Management, Lending and Derivatives Licences Explained

Last updated: 28 August 2026

A platform that recommends Bitcoin, rebalances a customer’s portfolio, pays yield on deposited tokens, and offers perpetual futures is not providing one regulated service.

It may be providing four.

Pakistan’s PVARA framework separates:

• Advisory Services—personalized recommendations where the customer retains the investment decision;
• Management and Investment Services—management or administration of a customer portfolio under an agreed Mandate;
• Lending and Borrowing Services—virtual-asset loans, borrowing, margin lending and similar financing; and
• Derivatives Services—futures, perpetuals, options, swaps, contracts for difference and leveraged or synthetic exposures.

The distinction is based on substance. Calling a product “research,” “earn,” “managed wallet,” or “advanced trading” does not determine its legal classification.

Pakistan’s crypto licensing framework and PVARA investment products

• Advice: Personalized recommendation; customer decides
• Management: Provider manages a portfolio under a Mandate
• Lending: Assets or financing are lent, borrowed, or deployed
• Derivatives: Exposure is leveraged, margined, synthetic or derived
• Capital floors: PKR 15 million; PKR 200 million; PKR 500 million; PKR 500 million respectively
• Derivatives prerequisite: Ordinarily an Exchange or Broker-Dealer licence plus PVARA approval for the intended client class
• Combined products: Each substantive category must be licensed

Four licences at a glance

The governing sources are the Virtual Assets Act, 2026, the Pakistan Virtual Asset Services Regulations, 2026 and the Activity-Specific Regulations, 2026.

Advisory Services: When information becomes regulated advice

The critical dividing line is personalization.

General market commentary, factual information, research and education do not by themselves constitute Advisory Services. The perimeter changes where the communication becomes a Personalized Recommendation directed to a particular customer’s circumstances.

Examples likely to require Advisory analysis include:

• recommending a particular token after reviewing the customer’s objectives;
• proposing a portfolio allocation based on risk tolerance;
• advising whether the customer should buy, sell, hold or exchange a virtual asset;
• recommending a staking, lending or yield strategy for that customer; or
• using a robo-adviser to generate individualized recommendations.

Suitability and basis of advice

Regulations 3, 6 and 7 of the Advisory Services Regulations require recommendations to be made honestly, fairly, professionally and in the customer’s best interests. The adviser must collect and periodically update sufficient information concerning matters such as the customer’s knowledge, experience, financial position, capacity for loss, objectives, risk tolerance and time horizon.

The firm must maintain a documented methodology explaining how it formulates, approves, communicates, and reviews recommendations. A broad risk score or unexplained algorithmic output is not enough: the recommendation must be suitable for the individual customer.

Where the adviser considers only affiliated products or a limited range of tokens, issuers, venues or strategies, that limitation must be disclosed. A firm cannot describe its advice as independent or market-wide unless its product universe and commercial arrangements support that claim.

Advice is not execution or management

Advisory Services should remain distinct from marketing, education, execution, principal dealing and discretionary management. If the provider decides what to buy and implements the decision without separate customer approval, the service has moved beyond advice.

An adviser that also routes or executes the resulting order may need Broker-Dealer Services. If it controls the customer’s portfolio or keys, Management and Investment or Custody Services may also apply.

Management and Investment Services: Managing under a Mandate

Management begins where the provider undertakes responsibility for a customer’s portfolio rather than merely recommending an action.

The Regulations recognise:

• Discretionary Management, where the manager can make portfolio decisions without a separate instruction for every transaction; and
• Non-Discretionary Management, where the customer retains decision-making authority and the manager acts on customer instructions or approvals.

The category may include portfolio construction, allocation, monitoring, rebalancing and administration. Discretionary staking may also fall within it where staking forms part of a broader investment-management Mandate, subject to any additional category required by the structure.

The Mandate is the regulatory boundary

Regulation 8 requires a documented Mandate before service begins. It must define:

• investment objectives, risk tolerance and time horizon;
• whether authority is discretionary or non-discretionary;
• permitted assets, products, protocols and strategies;
• whether derivatives, leverage, staking, lending, liquidity provision, yield strategies or unlisted tokens are allowed;
• diversification, concentration, liquidity, custody and counterparty limits;
• fees and charges; and
• variation, suspension and termination rights.

A manager should not materially depart from the Mandate except where necessary to protect the customer or portfolio in exceptional circumstances, consistent with the agreement and law, and with the reasons documented and communicated.

Portfolio controls and conflicts

The manager must establish suitability, portfolio-construction, execution, valuation, allocation, rebalancing and risk-monitoring controls. Decisions must be taken in customers’ best interests using fair and consistently applied criteria.

Particular conflicts arise where the manager:

• operates proprietary or related-party portfolios;
• receives rebates from exchanges, issuers, validators or protocols;
• allocates limited opportunities among customers;
• invests in affiliated tokens or platforms; or
• earns performance fees that encourage excessive risk.

Client position and order information must not be used for front-running or proprietary advantage.

Management authority does not automatically include custody, dealing, lending or derivatives. The transaction lifecycle must be classified separately.

Lending and Borrowing Services: Yield is not custody

This category covers collateralized and uncollateralized virtual-asset lending, borrowing, margin lending and similar financing arrangements.

It can apply where a platform:

• lends its own assets to customers;
• arranges loans between lenders and borrowers;
• takes customer assets and deploys them to generate a return;
• provides virtual-asset-backed credit;
• offers margin financing; or
• promises interest or yield derived from lending customer assets.

The decisive issue is the legal and economic use of the asset. A customer balance held safely and returnable on demand may be custody. A balance transferred, lent, rehypothecated or exposed to borrower default is a lending arrangement and must not be presented as equivalent to safekeeping.

Credit, collateral and liquidity controls

Regulations 4, 5, 8, 10, 13 and 14 of the Lending and Borrowing Regulations require board-approved controls covering:

• customer eligibility and credit assessment;
• counterparty and concentration limits;
• eligible collateral, valuation and haircuts;
• initial and variation margin;
• liquidation and close-out triggers;
• liquidity and asset sufficiency;
• withdrawal rights and restrictions;
• stress testing and contingency planning; and
• permitted reuse of customer assets.

Collateral must be liquid, realizable and capable of prudent valuation. The firm must monitor sharp price declines, concentrated defaults, withdrawal spikes and combined market-liquidity stress.

It must maintain enough fiat and virtual assets to meet contractual obligations when due and must not operate with a structural or persistent mismatch between customer obligations and available assets. A likely inability to meet obligations must be notified to PVARA without undue delay.

Customer agreements and asset reuse

The agreement must explain the assets involved, custody and return rights, interest calculation, lock-ups, withdrawals, defaults, liquidations, collateral application, shortfall allocation and termination.

Customer assets cannot be lent, pledged, rehypothecated, staked or otherwise reused merely because the operator holds a VASP licence. Prior written, explicit and informed consent is required, together with disclosure of risks, withdrawal restrictions, returns, losses and liabilities.

Consent does not cure an unlicensed business model. Custody, Transfer and Settlement, Broker-Dealer or other categories may still be required.

Derivatives Services: More than futures and options

The Derivatives category extends beyond traditional futures.

A Derivative Contract includes a future, perpetual contract, option, swap, contract for difference or another contract whose value is derived from a virtual asset or permitted reference. A Leverage Arrangement includes leveraged, margined or synthetic exposure created through a derivative, leveraged token, financing mechanism or similar structure.

Accordingly, the category can cover:

• crypto futures and perpetuals;
• options and swaps;
• contracts for difference;
• leveraged tokens;
• leveraged spot arrangements; and
• synthetic long or short exposure.

Derivatives generally require an underlying licence

Regulation 3 of the Derivatives Services Regulations provides that an applicant must ordinarily hold a valid Broker-Dealer or Exchange Services licence, unless it satisfies alternative requirements specified by PVARA. Losing the underlying licence requires immediate notification and cessation of new Derivatives Services unless PVARA directs otherwise.

PVARA’s explicit approval is also required for the client classes to be served—Institutional, Professional and/or Retail Clients. A derivatives approval should therefore be treated as product- and customer-sensitive, not as unrestricted permission for every leveraged product.

Product governance, margin and liquidation

Before introducing a new contract or leverage arrangement, the VASP must assess its legal character, settlement model, leverage, target market, valuation, margin methodology, dependencies and market-abuse risks.

Customers must be categorized and assessed for eligibility and, where applicable, appropriateness. Heightened review is required for particularly complex, volatile or highly leveraged products.

The control framework must cover:

• initial and maintenance margin;
• eligible collateral and haircuts;
• margin calls and top-up periods;
• leverage, concentration and position limits;
• reference prices, indices and valuation;
• liquidation and default management;
• funding payments and other charges;
• stress testing, model validation and back-testing; and
• conflicts involving proprietary trading, internalization or related-party liquidity.

A fixed leverage cap is not a substitute for a risk-sensitive margin framework. Disclosures must explain amplified losses, total loss of margin, liquidation triggers, settlement, pricing, outages and the operator’s intervention rights.

Where the VASP holds customer margin or collateral, safeguarding, segregation and reconciliation standards equivalent to the Custody framework apply. The arrangement must not be used to bypass a Custody licence.

When multiple PVARA licences are required

The four categories frequently overlap with one another and with Exchange, Broker-Dealer and virtual asset custody services.

Under General Activity-Specific Regulation 2, one licence cannot be used to carry on another regulated category. Ancillary activity is permitted only where subordinate, not separately marketed or remunerated, not a material business line, not materially different in risk and approved by PVARA in writing.

Capital and prudential requirements

The minimum paid-up capital floors are:

• Advisory Services: PKR 15 million;
• Management and Investment Services: PKR 200 million;
• Lending and Borrowing Services: PKR 500 million; and
• Derivatives Services: PKR 500 million.

For multiple categories, the starting floor is generally the highest applicable amount rather than the automatic sum, unless PVARA identifies separate and non-overlapping risks requiring additional capital. Risk-based additions may apply.

The licensee must also maintain net liquid assets of at least 1.2 times adjusted monthly operating expenses, appropriate insurance and any product-specific resources. Speak with our crypto regulatory advisory team for Customer assets, margin and collateral remain separate from company capital and cannot fund the VASP’s own obligations.

Common classification mistakes

1. Calling personalized recommendations education. Substance overrides the disclaimer.
2. Calling discretionary management advice. Authority to decide or rebalance changes the perimeter.
3. Calling a lending balance custody. Deployment and borrower exposure create different risks.
4. Treating consent as a licence. Consent supports asset use but does not authorize an unlicensed activity.
5. Assuming margin lending and derivatives are identical. Financing and derived exposure must be mapped separately.
6. Offering derivatives under an Exchange licence alone. Separate Derivatives permission and client-class approval are required.
7. Using a generic risk score as suitability. Individual circumstances and capacity for loss matter.
8. Ignoring connected custody or execution. Portfolio and lending products often control assets and place orders.
9. Promising instant withdrawals while assets are locked. Contract, liquidity and marketing must align.
10. Launching new leveraged products without governance. Each material product requires documented assessment and controls.

Final word

These four licences regulate four different promises.

The adviser promises that a recommendation fits the customer. The manager promises to operate within the Mandate. The lender promises to manage credit, collateral, liquidity and withdrawal risk. The derivatives provider promises that leverage, margin and liquidation are controlled and transparently disclosed.

The safest classification method is to follow decision-making authority, asset use and risk transfer. Ask who selects the investment, who can act without further consent, whether assets are deployed, and whether the customer receives direct or leveraged exposure.

Those answers—not the product label—determine the PVARA route.

Legal disclaimer: This article provides general information as at 28 August 2026 and does not constitute legal, regulatory, tax, financial or investment advice. Classification depends on the actual customer journey, contractual terms, decision-making authority, asset flows, product design and client class. PVARA may impose additional categories, conditions, prudential requirements or interpretations. Applicants should obtain professional advice and confirm current requirements directly with PVARA and other relevant authorities.

FAQs