Do You Need a PVARA Licence? Pakistan’s Crypto Licensing Perimeter Explained

A founder says, “We are not a crypto exchange—we are only a technology platform.”

The product team says, “We never touch the customer’s money.”

The website says, “Buy, sell and earn crypto in Pakistan in three clicks.”

Those three statements may describe the same business. They may also point to three completely different regulatory conclusions.

That is why the question “Do I need a crypto licence in Pakistan?” cannot be answered by looking at a company’s name or its preferred label. Under the Virtual Assets Act, 2026 and PVARA’s implementing regulations, the answer depends on what the product actually does, who controls the assets, how the company earns money, which customers it targets and where the service is carried on.

This article explains the Pakistan crypto licensing perimeter for exchanges, brokers, wallet providers, token issuers, fintechs, miners, overseas platforms and Web3 developers.

Pakistan’s crypto licensing framework — at a glance

• Core law: Virtual Assets Act, 2026
• Regulator: Pakistan Virtual Assets Regulatory Authority
• General rule: A person may not carry on—or hold itself out as carrying on—a virtual asset service by way of business in or from Pakistan without the relevant PVARA licence
• Overseas reach: Pakistan-directed marketing, onboarding or PKR channels may bring a foreign operator within scope
• Key exclusions: Qualifying closed-loop tokens, certain traditional financial instruments, central-bank digital currency and genuinely non-financial NFTs
• Maximum penalty for wilful unlicensed VASP activity: Five years’ imprisonment, a fine of up to PKR 50 million, or both

The short answer

You are likely to need a PVARA licence if your business does one or more of the following in or from Pakistan:

• advises individual customers on virtual asset transactions;
• arranges, receives, transmits or executes crypto orders;
• operates a crypto exchange or order book;
• holds customer virtual assets, private keys or other means of control;
• lends or borrows virtual assets, or facilitates such arrangements;
• offers or arranges crypto derivatives;
• manages virtual asset portfolios or exercises investment discretion;
• transfers or settles virtual assets on behalf of customers;
• creates, issues or manages a virtual asset or stablecoin; or
• provides regulated mining-related services to third parties.

You may also be within scope if the business is incorporated abroad but deliberately targets people in Pakistan.

You may not need a licence where you invest only your own money, provide software leaving customers in exclusive control, conduct pure own-account mining, publish general market information or deal with an expressly excluded digital item. Each conclusion depends on substance.

In other words, “crypto-related” does not automatically mean “PVARA-licensed”—but “we are not a crypto company” does not automatically mean the opposite either.

What is the PVARA regulatory perimeter?

The regulatory perimeter is the legal boundary between activity that requires PVARA authorisation and activity that does not.

Section 2(1) of the Virtual Assets Act, 2026 applies to a Virtual Asset Service Provider carrying on, or holding itself out as carrying on, a virtual asset service in or from Pakistan. It also applies to an issuer offering, originating or distributing a virtual asset in or from Pakistan.

Regulation 5(1) of the Pakistan Virtual Asset Services Regulations, 2026 adds the operative licensing rule: no person may, by way of business, engage in or hold itself out as engaging in a virtual asset service in or from Pakistan unless it is an eligible Pakistan-incorporated company and holds a valid PVARA licence for the relevant category.

PVARA’s official licensing guidance similarly states that VASPs must obtain a formal licence before offering virtual asset services in Pakistan.

Five questions therefore determine most perimeter analyses:

1. Is the relevant product or right a “virtual asset” under the Act?
2. Is the business performing a regulated virtual asset service?
3. Is the activity conducted by way of business—or held out as a business service?
4. Is it carried on in Pakistan, from Pakistan or deliberately targeted at Pakistan?
5. Does an exclusion, exemption or another regulator’s jurisdiction alter the result?

Missing any one of these questions can produce the wrong answer.

Test 1: Is there a virtual asset?

The first mistake is to begin with the licence categories before classifying the underlying asset.

A virtual asset is generally a digital representation of value or rights that can be digitally traded or transferred. The analysis depends on function and economic effect, not the issuer’s label.

Closed-loop and loyalty tokens

Section 2(2)(a) excludes a qualifying closed-ecosystem or closed-loop token only if strict conditions are met. Among other things, it must remain usable solely within the restricted platform or ecosystem; must not be transferable outside it; must not be exchangeable for fiat; must not be redeemable for external goods or services; must not interoperate with other virtual assets; and must not trade on an external market.

A “loyalty token” transferable to an external wallet, traded externally or redeemable with third parties may not qualify.

NFTs and digital collectibles

An NFT is not automatically outside Pakistan crypto regulation. Section 2(2)(d)–(e) requires its substance, function and economic effect to be genuinely non-financial.

A one-of-one digital artwork may be outside scope. Fractionalised NFTs marketed for profit, tokenised property interests, yield-bearing collectibles or transferable instruments representing financial claims require a much closer analysis.

Securities and other traditional financial instruments

Section 2(2)(b) excludes securities, derivatives, collective investment schemes, depositary receipts and other traditional financial instruments falling within the jurisdiction of the State Bank of Pakistan or the Securities and Exchange Commission of Pakistan.

A token representing shares, fund units or debt may instead fall within the SECP or SBP perimeter—or require regulatory coordination. “Tokenised” does not mean “unregulated.”

Central-bank money

Digital representations of fiat currency issued by the SBP or another central bank or monetary authority are excluded under section 2(2)(c). A privately issued stablecoin is different. Fiat-referenced and asset-referenced tokens are expressly regulated under the Act.

Test 2: Are you performing a regulated virtual asset service?

Once the asset is classified, examine every function in the customer journey. Schedule I of the Act establishes the principal service categories. 

1. Advisory Services

A PVARA Advisory Services licence may be required for professional, personalised recommendations that take—or appear to take—the customer’s circumstances, objectives or risk profile into account.

General education, non-individualised research and market commentary are not necessarily regulated advice. The line can be crossed when a newsletter, chatbot, influencer or consultant tells a particular user what to buy, sell or hold based on that user’s situation.

A “not financial advice” disclaimer will not cure personalised advice in substance.

2. Broker-Dealer Services

A crypto broker licence in Pakistan may be required where a business arranges or facilitates purchases and sales, solicits or accepts orders, receives consideration, deals for customers, acts as an intermediary for issuers or conducts regulated market-making.

An OTC desk introducing buyers and sellers for a spread can be a broker-dealer even without an order book.

The Act contains an important own-account exemption. A person dealing solely on its own account, not executing customer orders and not holding or controlling customer assets is not regarded as providing Broker-Dealer Services. This can protect a genuine proprietary trading company using only its own capital.

The exemption can disappear when the business accepts customer orders or assets, manages outside capital or provides a dealing service.

3. Custody and Administration Services

A crypto custody or wallet licence in Pakistan may be required where the operator safeguards or administers customer virtual assets, private keys or another means of access that allows assets to be transferred or disposed of.

Control is crucial. Ask who can initiate, approve, block, recover or redirect a transaction. Outsourced infrastructure and multi-party computation do not automatically make a platform non-custodial.

The Act excludes the mere provision of software, hardware or infrastructure that enables customers to retain exclusive control of their own keys. A self-custody wallet developer may therefore be outside Custody Services if it truly cannot control assets. However, swap routing, order execution, staking, fee collection or recovery features may introduce other regulated services. That’s where our virtual asset custody services come in.

4. Exchange Services

A Pakistan crypto exchange licence is likely required for operating a platform that exchanges virtual assets for fiat, exchanges one virtual asset for another, matches buyers and sellers, executes conversions or maintains an order book.

A mobile app can be an exchange even if execution uses a third-party liquidity venue. A pure virtual asset exchange services interface that neither matches, executes nor controls transactions requires separate analysis.

5. Lending and Borrowing Services

This category covers virtual asset lending and borrowing services, the facilitation, arrangement, intermediation or direct provision—as principal—of virtual asset lending and borrowing arrangements where assets are made available subject to an obligation to return equivalent assets, usually with interest, fees or rewards.

Crypto credit and certain “earn” products may fall here; calling a return a reward rather than interest is not decisive.

6. Virtual Asset Derivatives Services

Futures, options, swaps, contracts for difference and similar instruments referencing virtual assets fall within the derivatives category when offered, facilitated, executed, cleared, traded or arranged as a business.

The activity-specific regulations generally contemplate a Broker-Dealer or Exchange permission alongside derivatives activity unless PVARA approves an alternative arrangement. Derivatives may also raise questions under Pakistan’s broader securities framework, making early regulatory classification particularly important.

7. Management and Investment Services

A crypto asset management licence in Pakistan may be required where a business manages another person’s virtual assets in a fiduciary or agency capacity. This includes discretionary portfolio management and responsibility for staking as part of a broader management mandate.

The key distinction to virtual asset management and investment services is discretion: customer-directed software differs from an operator choosing assets, protocols or strategies.

8. Transfer and Settlement Services

Transmitting or settling virtual asset transfer and settlement services from one person, wallet, address or location to another on behalf of customers can require a PVARA Transfer and Settlement Services licence.

This category is relevant to crypto remittance and payment routing even where customers see fiat at both ends.

Importantly, regulation 3(6) states that virtual assets must not be used or recognised as a means of payment for domestic commercial transactions unless specifically approved by the SBP under section 9(1)(f) of the Act. A PVARA licence alone may therefore be insufficient for a domestic crypto-payment product.

9. Virtual Asset Issuance Services

Creating, issuing, initially offering, administering or managing a virtual asset—including supply, reserves, redemption, governance and required disclosures—may require issuance authorisation.

The Act specifically regulates Fiat-Referenced Tokens and Asset-Referenced Tokens. A fiat-referenced token must meet reserve and par-redemption requirements, while an asset-referenced token requires appropriate backing and governance. Stablecoin remittance pilots, tokenisation projects and public token announcements should be classified before they are marketed.

In April 2026, PVARA stated that pilots enabling issuance, transfer, custody, exchange or arrangement require prior engagement and authorisation. See its Advisory on Virtual Asset-Related Announcements and Activities.

10. Mining-Related Virtual Asset Services

Pure mining for one’s own account is excluded from the licensing requirement under section 37(2). The position changes where the operation provides professional services to third parties or involves customer virtual assets or funds.

Hosted or customer-funded mining requires particular care. PVARA may also set registration or declaration thresholds based on scale, energy use or hash rate.

Test 3: Is the activity conducted “by way of business”?

Regulation 5 targets persons engaging in virtual asset services by way of business. This helps distinguish a commercial service from an individual’s personal use of crypto.

A person buying Bitcoin for a personal portfolio is not ordinarily operating a VASP merely because they trade frequently. A company that accepts orders, charges fees, earns spreads, advertises services, manages other people’s assets or builds an ongoing commercial operation is in a different position.

Indicators include:

• repeated activity and commercial remuneration;
• customer contracts, marketing or solicitation;
• custody or control of another person’s assets; and
• professional infrastructure or holding out.

The phrase “holds itself out” matters. A company can create perimeter risk before its first customer transaction if its website, proposal, social media or public announcement claims that it offers regulated services.

Test 4: Is the activity in, from or targeted at Pakistan?

Being incorporated outside Pakistan does not automatically keep an operator outside PVARA’s reach.

Regulation 3 applies to services carried on in Pakistan or from Pakistan. Under regulation 3(4), an activity may be regarded as conducted in Pakistan where it targets, solicits, promotes to or onboards persons in Pakistan. Relevant channels include websites, mobile apps, marketing, PKR payment rails and Pakistan-accessible service channels.

An overseas exchange may therefore require a PVARA licence for foreign crypto companies where it:

• runs Pakistan-specific advertising or affiliates;
• accepts Pakistani identity and address documents;
• supports PKR payment routes; or
• deliberately onboards Pakistani residents.

The website-accessibility safe harbour

Regulation 3(5) clarifies that a foreign platform is not treated as operating in Pakistan solely because its website or app can technically be accessed there, provided it:

1. does not market or solicit in Pakistan;
2. does not onboard persons in Pakistan;
3. does not support PKR rails or Pakistan-targeted channels; and
4. takes reasonable steps to prevent onboarding if it does not intend to serve Pakistan.

The safe harbour is based on conduct. A terms-of-use restriction will carry little weight if the platform accepts Pakistani users, advertises locally or operates PKR channels in practice.

Test 5: Does an exclusion or another regulator change the answer?

PVARA is central to Pakistan crypto regulation, but it does not operate in isolation. The Act is additional to other applicable laws, including Pakistan’s AML, foreign-exchange, companies, securities, payment-services and data-protection frameworks.

A project may involve:

• PVARA, for the virtual asset service or issuance;
• SBP, for payment systems, domestic payment use, banking, remittance or foreign-exchange issues;
• SECP, for securities, collective investment schemes, companies or capital-market products;
• Financial Monitoring Unit, for AML/CFT reporting and compliance; and
• other competent authorities depending on technology, consumer, tax or enforcement considerations.

Obtaining one approval does not silently satisfy the others. A stablecoin payment product, tokenised investment or crypto remittance structure may require a coordinated regulatory strategy.

Borderline business models: likely perimeter outcomes

This table is a starting point, not a substitute for a legal opinion. Small design details can alter the result.

Can one product require several PVARA licence categories?

Yes. PVARA authorises activities, not marketing labels.

Consider a crypto app that:

1. accepts customer orders;
2. matches trades;
3. holds assets in omnibus wallets;
4. transfers assets to external addresses; and
5. recommends portfolios based on a suitability questionnaire.

That one app may involve Broker-Dealer, Exchange, Custody, Transfer and Settlement, and Advisory Services.

The Activity Specific Regulations contain a limited concept of incidental activity, but it should not be stretched. An activity is not incidental merely because it produces less revenue or happens behind the scenes. It must be subordinate, not separately marketed or charged for, not material and treated consistently with any required written PVARA approval.

Trying to force a multi-service platform into the cheapest licence category usually creates more regulatory risk than savings.

NOC, Sandbox or licence: what authorisation do you actually need?

These terms are often used interchangeably, but they have different legal effects.

No Objection Certificate

The NOC is generally the first stage for a new applicant. PVARA reviews the proposed activities, founders, controllers, funding and initial regulatory readiness before the local operating company is incorporated.

An NOC is not a VASP licence. It does not authorise commercial operations or allow the applicant to market itself as licensed. Under regulation 6, PVARA is to decide a complete NOC application within 60 days. An issued NOC is valid for three months and may be extended for up to a further three months.

Regulatory Sandbox

The Sandbox permits controlled testing of an innovative model subject to limits and conditions. It is useful where live evidence is genuinely needed to assess technology or risk.

Sandbox admission is not a general exemption and successful testing does not guarantee licensing. A successful participant may, however, apply directly for a full licence without first obtaining an NOC under regulation 7(6).

Full VASP licence

Only the full licence authorises the approved commercial virtual asset services, subject to its scope and conditions. The applicant must ordinarily be incorporated in Pakistan, maintain the applicable capital, demonstrate local substance and meet governance, AML/CFT, customer-asset, conduct, cybersecurity and operational requirements.

Applications can be initiated through PVARA’s online application portal.

Common licensing myths

• “We do not hold fiat.” Crypto-only custody, brokerage, exchange, transfer, advice, lending or management can still be regulated.
• “Our smart contract is decentralised.” DeFi is not a statutory exemption; identify who controls the interface, upgrades, fees, keys and marketing.
• “A third party provides custody.” Outsourcing does not remove the platform’s other regulated activities or its oversight responsibility.
• “We only market the service.” Solicitation, arranging, order transmission and holding out can be relevant and can establish Pakistan targeting.
• “It is a utility token.” Transferability, convertibility, trading, investment expectations and economic rights remain decisive.
• “We have an overseas licence.” Foreign authorisation does not replace PVARA approval.

What happens if you operate without a PVARA licence?

Under section 54(1) of the Virtual Assets Act, 2026, a person who wilfully provides an unlicensed Virtual Asset Service may face imprisonment for up to five years, a fine of up to PKR 50 million, or both.

PVARA also has powers relating to investigation, directions, administrative sanctions, suspension, revocation and our corporate structuring services for crypto and Web3 businesses avoids the blocking of access to unauthorised services. The commercial consequences may include banking problems, terminated vendor relationships, investor concerns, customer claims and difficulty obtaining a future licence.

The PVARA FAQ expressly warns that operating as a VASP without proper approval is illegal.

A practical PVARA perimeter assessment

Before launching or entering Pakistan, document:

1. every token, fiat leg, contractual right and customer entitlement;
2. the flow of orders, assets, keys, advice, transfers and fees;
3. the entity performing each function and signing each contract;
4. who can move assets, change software or approve transactions;
5. target customers, onboarding countries, marketing and payment rails;
6. the Schedule I classification and every exclusion relied upon; and
7. SBP, SECP, AML, foreign-exchange and other regulatory overlaps.

This is not an exercise to complete once and forget. A self-custody wallet can become custodial after an account-recovery feature is introduced. A general research platform can become advisory after personalisation. A proprietary trader can become a broker after accepting outside capital or customer instructions.

Regulatory status moves when the product moves.

Final word

The most dangerous word in crypto licensing is “only.”

“We only provide software.” “We only connect buyers and sellers.” “We only hold one signing key.” “We only market the product.” Each statement may sound reassuring, but each can hide a regulated function.

The correct way to determine whether you need a PVARA licence is to follow the transaction from beginning to end. Identify the asset. Identify every decision-maker. Trace the money and tokens. Examine the keys. Read the customer promise. Then compare the substance of the model against the Act and the activity-specific rules.

If the model falls inside the perimeter, early classification gives the business time to select the right licence categories, budget for capital, structure the Pakistan entity and build compliant systems. If it falls outside, a well-supported legal analysis gives boards, investors, banks and commercial partners a much stronger basis for relying on that conclusion.

In both cases, certainty is an asset. Assumption is not.

Legal disclaimer: This article provides general information as at 24 August 2026 and does not constitute legal, regulatory, tax, financial or investment advice. PVARA may issue new rules, directions, classifications or guidance, and licensing outcomes depend on the facts of each business. Obtain professional advice and confirm current requirements with PVARA, the SBP, the SECP or other relevant authorities before launching or offering services in Pakistan.

FAQs