PVARA NOC vs Regulatory Sandbox vs Full VASP Licence: Which Route Applies?

Last updated: 28 August 2026

Under Pakistan’s crypto licensing framework, PVARA’s application portal presents three options: a No Objection Certificate, the Regulatory Sandbox and a VASP licence. They are not three alternative approvals of equal effect.

For most new market entrants, the real choice is between two pathways:

• NOC to licence: for a business with a sufficiently settled model that intends to establish a Pakistan company and proceed through ordinary licensing; or
• Sandbox to licence: for a genuinely innovative product that requires controlled live testing before PVARA can determine how it should operate at scale.

The full VASP licence is ordinarily the destination, not a substitute for those preparatory routes. It authorises continuing commercial Virtual Asset Services within its stated categories and conditions.

PVARA route selection 

• NOC: Preliminary approval to incorporate and pursue licensing; not permission to provide Virtual Asset Services
• Sandbox: Controlled, supervised and limited testing of genuine innovation; not a full licence | Full licence: Authorisation for ongoing business within specified categories and conditions
• Successful Sandbox exit: Direct licence application permitted without a separate NOC
• Ordinary new applicant: NOC before Pakistan incorporation, then Form II licence application
• Existing pre-Act provider: Separate transitional rules may temporarily apply

The three approvals at a glance

PVARA describes the two public tracks as Sandbox to Licence and NOC to Licence on its official licensing page.

Route 1: The PVARA NOC

What the NOC is for

Section 19(1) of the Virtual Assets Act, 2026 requires a person intending to incorporate a company whose primary objective is Virtual Asset Services to apply to PVARA for an NOC before commencing the incorporation process.

Regulation 6 of the Pakistan Virtual Asset Services Regulations, 2026 operationalises this as a preliminary approval. The applicant submits Form I and Parts A–E of its Annexure, covering the proposed company, licence categories, ownership, Controllers, governance, capital, business plan, projections, technology, custody and regulatory history.

PVARA must grant or refuse a complete NOC application within 60 days. The NOC remains valid for three months and may, on a reasoned application made before expiry, be extended for up to a further three months. So, the question arises do you need a PVARA licence? 

What the NOC does not permit

Regulation 6(4) is explicit:

• the NOC is not a VASP licence;
• it does not authorise the provision of any Virtual Asset Service;
• it does not prejudge the full licence assessment; and
• it may be withdrawn if obtained through materially false, misleading or incomplete information.

An applicant should not describe itself as a “PVARA-licensed exchange” merely because it has an NOC. It should not onboard customers, accept customer money or virtual assets, execute orders, operate custody or publicly launch regulated products unless a specific legal permission applies.

PVARA’s April 2026 advisory also warns that any agreement or announced pilot resulting in, or directly enabling, Virtual Asset Services requires prior authorisation. Public announcements without prior engagement can create legal, reputational and FATF-related risk. PVARA Regulatory Advisory PVARA/ADV/001/2026

Who should use the NOC route?

The NOC route will ordinarily suit established exchanges entering through a local subsidiary, custodians deploying tested models, broker-dealers with defined execution flows, advisory or management businesses, transfer-and-settlement providers, and token issuers whose legal rights, reserves, custody and redemption model are sufficiently settled.

The presence of technology does not itself justify Sandbox admission. If the principal question is whether the applicant can meet known licensing standards—not whether a novel mechanism can work safely in a live environment—the NOC route is usually the better fit.

What happens after the NOC?

The applicant completes relevant registrations, incorporates its Pakistan company, injects capital, appoints Key Individuals, implements systems and submits Form II with the updated Annexure and Part F evidence.

If a company incorporated pursuant to an NOC does not submit its licence application within the applicable period, regulation 6(7) requires PVARA to give written notice and at least 30 Business Days to apply, request an extension for reasonable cause or confirm that it will not conduct or hold itself out as conducting Virtual Asset Services.

The NOC is therefore a short implementation bridge, not a status to hold indefinitely.

Route 2: The PVARA Regulatory Sandbox

What the Sandbox is designed to achieve

Section 35 of the Virtual Assets Act authorises PVARA to establish a controlled environment for testing innovative Virtual Asset products and services. PVARA’s public Sandbox Guidelines address application, assessment, testing, monitoring, completion, exit and no-action relief.

Although the Guidelines retain Ordinance-era references, section 74 of the Act and regulation 5A(4) preserve prior instruments to the extent they are consistent with the current framework, until amended, replaced or revoked.

The Sandbox is not a place to develop an early idea using the regulator’s resources. The applicant must be ready to test.

The genuine-need test

A strong Sandbox proposition should answer two questions:

1. What is genuinely innovative? The product, technology or business model should be new to the market, materially improve an existing solution, address an inefficiency or help move informal high-risk activity into a regulated environment.
2. Why is controlled live testing necessary? There should be a regulatory, operational, technology, consumer or market question that cannot be answered adequately through internal testing, a testnet or an ordinary licence application.

The Guidelines identify negative indicators including minor changes to existing products, reliance on speculative hype, absence of a clear market, weak security, an untested concept and live testing that is unnecessary to answer the relevant questions.

Who may be a suitable Sandbox candidate?

Examples may include novel Asset-Referenced Token custody or redemption mechanics; multi-institution real-world-asset tokenisation; a new regulated blockchain settlement mechanism; privacy-preserving compliance technology; a materially new DeFi control model; or new safeguarding, identity or supervisory-reporting infrastructure.

Innovation alone is insufficient. The applicant must also demonstrate fit-and-proper ownership and management, technical readiness, financial capacity, risk management, cybersecurity, customer safeguards, AML/CFT/CPF controls, a defined testing plan and a credible exit strategy. The product must not be designed for speculation, anonymity or illicit activity.

Sandbox application and assessment

Applications may be submitted throughout the year. The applicant files Sandbox Form I and the Annexure A self-assessment. Incomplete applications may be returned, with up to two resubmissions allowed.

Following initial screening, PVARA evaluates innovation, market relevance, technology, compliance, readiness, safeguards, financial strength and exit planning. The stated assessment period is 60 working days from completion of initial screening, unless extended for reasonable cause.

A successful applicant receives a Letter of Approval subject to terms and conditions and must execute the prescribed undertaking.

What may happen during testing?

Testing occurs only within PVARA’s approved scope and period. Case-specific limits may cover users, transaction volumes, financial or token exposure, products, custody, distribution, reporting and incidents.

The participant must provide agreed reports, maintain records, protect consumers, safeguard assets and data, permit regulatory access, trace funds and comply with applicable laws. The undertaking requires notification of a material incident, risk event or compliance breach within one hour and a detailed incident report within 48 hours.

The current public Guidelines do not prescribe one standard test duration for every applicant. The approved period and any commencement extension are case-specific. Applicants should therefore avoid presenting a generic “12-month PVARA Sandbox” as a fixed rule.

Exit and transition to licensing

Within two weeks after testing closes, the participant must submit a completion report containing the results, statistics, comparison against objectives, potential scale and the route to full compliance.

PVARA then determines the future course. The product may:

• proceed towards full licensing;
• require additional conditions, remediation or legal change;
• be discontinued and wound down; or
• follow another direction specified by PVARA.

Under regulation 7(6), successful completion to PVARA’s satisfaction allows the participant to apply directly for a full licence without obtaining a separate NOC. Testing outcomes and the participant’s compliance history may inform the licence assessment, but Sandbox participation creates no entitlement to approval.

Does a no-action letter make the activity legal?

No. The Sandbox Guidelines permit PVARA to state that it does not intend to take enforcement action for specified conduct during a defined testing period. The letter:

• applies only to the conduct and period identified;
• is not general approval for the business;
• does not bind another regulator or disapply another law;
• does not constitute legal immunity; and
• may be withdrawn by written notice.

A no-action letter is regulatory comfort within a controlled experiment—not a commercial licence.

Route 3: The full PVARA VASP licence

The licence is the operating authority

Section 50 of the Act and regulation 5 require a person conducting Virtual Asset Services by way of business in or from Pakistan to be a company incorporated in Pakistan and hold a valid PVARA licence.

The licence identifies the approved categories. A licensee may not undertake another category merely because it is technologically connected or described as incidental; a variation or written authorisation may be required.

The applicant must demonstrate implemented governance, suitable personnel, financial resources, AML/CFT/CPF, cybersecurity, customer protection, insurance, resilience, audit, reporting and activity-specific readiness.

PVARA determines a complete licence application within 90 days. It may extend the period by up to 60 days where the matter is complex, presents novel risks or requires consultation with another authority. The clock starts only after PVARA confirms in writing that the application is complete and is suspended while requested information is outstanding.

Limited-scope licence is not the Sandbox

Regulation 7(5) permits PVARA to issue a limited-scope licence with specified scope, duration, conditions and exit criteria. Regulation 34 also contemplates limited-scope licences for FRT or ART issuance, potentially including caps on supply, holders, volumes, distribution and use cases.

This remains a licence. It differs from Sandbox approval because it authorises the stated regulated activity as a licensee, subject to the limits imposed. An applicant should not assume it can select this outcome; PVARA determines whether a limited-scope licence advances the Act’s objectives.

The transitional exception for existing providers

Existing operators require separate analysis.

Section 70 of the Act and regulation 5A apply to a person providing Virtual Asset Services immediately before the Act commenced on 5 March 2026. Such a provider must apply within six months—by 5 September 2026—or cease providing the services.

Where a qualifying provider submits a complete application satisfying the NOC application requirements within that period, it may continue its existing services pending determination, subject to:

• PVARA’s interim directions;
• continuing customer-asset protection and AML/CFT/CPF compliance;
• any limits on onboarding, products, volumes or custody; and
• prior PVARA approval for marketing while the application is pending.

This is not a general NOC operating permission. It does not protect a new entrant, a person that began after the statutory cut-off or an existing provider launching new services. Transitional status should be evidenced carefully rather than assumed from a website, customer or corporate-registration date alone.

A practical route-selection test

Ask the following questions in order.

1. Is the activity a Virtual Asset Service in or from Pakistan?

Map the actual transactions, customer relationship, wallet control, token rights and revenue to Schedule I. If the activity falls outside PVARA’s perimeter, none of the three routes may be appropriate—although another approval or a written perimeter engagement may be needed.

2. Is the applicant already licensed for the relevant category?

If yes, determine whether the change is within its licence. If not, use a variation application. Novel testing requires PVARA’s agreement.

3. Was the applicant operating before 5 March 2026?

If yes, assess regulation 5A and the urgent transitional deadline. Do not apply the exception to new products or assume continued operation is unconditional.

4. Is the model genuinely innovative and does it require live testing?

If both answers are yes, the Sandbox may apply. If innovation can be validated through internal development or testnet evidence, ordinary NOC-to-licence may still be appropriate.

5. Is the model settled enough for ordinary licensing?

If yes, apply for the NOC, incorporate and build the full licence file. Do not use the Sandbox merely to postpone capital, governance or compliance work.

6. Has the applicant successfully exited the Sandbox or obtained an earlier valid NOC?

If yes, it may proceed directly to Form II, subject to local incorporation and all licensing requirements.

Worked examples

• Conventional international exchange: Proven spot exchange, broker-dealer and custody model. Likely route: NOC to multi-category licence.
• Tokenised agricultural inventory: New oracle, title, inspection, custody and redemption arrangements require real-user validation. Potential route: Sandbox, then licence after successful exit.
• Early-stage wallet concept: No functioning product, security audit, funding, controls or test plan. Current route: neither; first establish readiness.
• Successful Sandbox participant: KPIs and exit conditions are satisfied. Next route: direct licence application under regulation 7(6), without a separate NOC.
• Licensed broker-dealer adding custody: Likely route: licence variation for Custody Services, not a new NOC.

Common route-selection mistakes

1. Calling an NOC a licence. It does not authorise Virtual Asset Services.
2. Using the Sandbox as a cheaper licence. Full licensing standards still apply before scale.
3. Applying with an idea only. Sandbox applicants must be ready for controlled testing.
4. Assuming novelty equals eligibility. The applicant must show a genuine need for live testing.
5. Treating no-action relief as immunity. It is limited, conditional and withdrawable.
6. Assuming successful testing guarantees approval. Regulation 7(6) expressly rejects that conclusion.
7. Ignoring other regulators. PVARA approval does not automatically satisfy SBP, SECP, FMU, foreign-exchange, securities, tax or data obligations.
8. Relying on transitional status without evidence. The exception is date-specific and confined to existing services.
9. Missing the NOC validity window. Incorporation and Form II preparation must be planned before the NOC expires.
10. Confusing a limited-scope licence with Sandbox testing. One is a licence; the other is supervised experimentation.

Final word

The correct question is not, “Which approval is fastest?”

It is, “What does the business need permission to do next?”

If the next step is establishing a Pakistan company for a settled VASP model, the NOC is the ordinary route. If the next step is a limited live experiment needed to resolve genuine innovation and risk questions, the Sandbox may be appropriate. If the company is ready to serve the market on an ongoing basis, only the full licence authorises that business—and the applicant must first have reached the licence stage through a legally available pathway.

An NOC establishes preliminary acceptability. Sandbox approval permits controlled learning. A licence permits regulated operation. Keeping those effects separate is fundamental to a credible market-entry strategy. Speak with our Pakistan crypto licensing team and Know More!

Legal disclaimer: This article provides general information as at 28 August 2026 and does not constitute legal, regulatory, tax, financial or investment advice. Route selection depends on the applicant’s activities, incorporation status, operating history, technology, customer model and interaction with other Pakistani authorities. PVARA may amend the Sandbox Guidelines, issue further Regulations, directions or licence conditions, or change application processes. Applicants should obtain professional advice and confirm current requirements directly with PVARA and other relevant authorities.

FAQs