PVARA Transfer and Settlement Licence: Crypto Payments, Remittance, Wallets and SBP Approval

Last updated: 28 August 2026

A customer sends stablecoins through an app and a recipient receives Pakistani rupees.

To the customer, that is one payment. For a Pakistan’s crypto licensing framework, it may contain several regulated activities:

• accepting or controlling virtual assets;
• transferring those assets between addresses or internal accounts;
• converting virtual assets into fiat currency;
• moving funds through Pakistan’s payment system;
• conducting foreign exchange or cross-border remittance; and
• paying the recipient through a bank, exchange company, electronic-money institution or payment-service provider.

A PVARA Transfer and Settlement Services licence regulates the virtual-asset transfer layer. It does not automatically authorise the fiat, payment, remittance or foreign-exchange layers overseen by the State Bank of Pakistan (SBP).

This distinction determines whether a business needs PVARA authorisation alone, additional PVARA categories, an SBP approval, or regulated banking and payment partners.

Transfer and Settlement 

• PVARA scope: Initiating, routing, processing, settling or completing virtual-asset movements
• Technology: On-chain, off-chain, internal-ledger, banking-rail or hybrid arrangements
• Minimum paid-up capital: PKR 200 million
• Ordinary settlement: Within 24 hours where reasonably within the VASP’s control
• Wallet rule: Asset or private-key control may also require Custody
• Fiat rule: PVARA authorisation does not replace SBP approval
• Cross-border rule: Remittance and foreign-exchange activities must use legally authorised structures and channels

What Transfer and Settlement Services cover

Schedule I of the Virtual Assets Act, 2026 describes Virtual Asset Transfer and Settlement Services as transferring virtual assets between addresses or accounts and providing settlement of those transfers.

Regulations 2 and 3 of the Transfer and Settlement Services Regulations expand the operational perimeter. A business may be within scope where, for or on behalf of another person, it:

• initiates a virtual-asset transfer;
• routes or transmits a Transfer Instruction;
• processes movement between wallets or accounts;
• settles a virtual-asset obligation;
• completes a transfer between customers or with a third party; or
• provides the transfer component of another virtual-asset service.

A Transfer Instruction includes an instruction to send, transmit, transfer, settle, redeem, burn or otherwise move a virtual asset or related obligation.

The framework is technology-neutral. It applies whether movement occurs:

• directly on a blockchain;
• between sub-accounts on an internal ledger;
• through a custodian or wallet infrastructure provider;
• using a bank or payment rail; or
• through a hybrid crypto-fiat arrangement.

The governing texts are the Virtual Assets Act, 2026, the Pakistan Virtual Asset Services Regulations, 2026 and the Activity-Specific Regulations, 2026.

What the licence does not authorise

Transfer and Settlement authorisation does not itself permit the VASP to:

• operate a virtual-asset exchange;
• buy or sell virtual assets for customers;
• safeguard customer assets on an ongoing basis;
• manage customer portfolios;
• lend or deploy customer assets;
• provide derivatives; or
• issue a fiat-referenced or asset-referenced token.

Those functions must be assessed under their own licence categories.

For example, receiving Bitcoin from a customer, selling it for rupees and paying the rupees into a bank account may involve:

1. Custody Services, if the operator controls the customer’s Bitcoin or private keys;
2. Broker-Dealer or Exchange Services, depending on how conversion is executed;
3. Transfer and Settlement Services, for moving and settling the assets; and
4. SBP-regulated activity, if the operator itself provides the fiat payment, remittance or foreign-exchange service.

The commercial label “crypto payment gateway” does not collapse those functions into one licence.

Crypto payments: When Transfer and Settlement applies

A crypto-payment processor may enable a customer to pay a merchant in virtual assets, settle the merchant in the same asset, or convert and settle in fiat. So the question arises that Do You Need a PVARA Licence?

Crypto-in, crypto-out

Where the customer transfers a virtual asset and the merchant receives that virtual asset, the principal activity may be Transfer and Settlement. Custody also becomes relevant if the processor holds assets, controls wallets or can authorize transfers.

If the processor merely supplies non-custodial software and the customer independently signs and broadcasts the transaction, the licensing analysis depends on whether the provider is genuinely only supplying technology or is initiating, routing, processing or completing transfers as a business.

Crypto-in, fiat-out

Where the customer pays in crypto and the merchant receives rupees, the model adds conversion and fiat settlement. The VASP must determine:

• who buys the virtual asset;
• who sets the exchange rate or spread;
• who receives and controls the crypto;
• who receives or holds the fiat funds;
• which entity instructs the bank or payment provider; and
• which regulated entity owes the merchant the final payment.

If the VASP executes the conversion, Broker-Dealer or Exchange Services may apply. If an independent licensed counterparty performs it, contracts and customer disclosures must identify that counterparty and allocate execution, failure and safeguarding responsibility.

Fiat-in, crypto-out

A service accepting rupees and delivering crypto similarly combines a fiat funding leg, conversion and virtual-asset transfer. Receiving customer money into the VASP’s own account can create client-money and SBP perimeter issues.

Using a regulated bank or payment institution does not automatically remove those issues if the VASP remains the actual payment provider or holder of customer funds.

Remittance: Crypto rails do not remove foreign-exchange law

Pakistan crypto licence for foreign companies for cross-border remittance is not classified solely by the technology used between sender and recipient.

Consider a worker abroad who pays a platform in stablecoins while a family member receives rupees in Pakistan. The platform may describe the stablecoin as an internal settlement rail, but the economic service is still an inward remittance with foreign-exchange and domestic payout components.

Regulation 6 of the PVARA Transfer and Settlement Services Regulations requires compliance with all applicable Pakistani laws concerning transfer, settlement, remittance, payments and foreign exchange. Regulation 17 also prevents settlement netting or offsetting from being used inconsistently with payment-system, banking or foreign-exchange laws and authorised routing requirements.

The relevant SBP framework may include:

• the Foreign Exchange Regulation Act, 1947;
• SBP’s Foreign Exchange Manual and directions;
• the regulatory framework for exchange companies;
• rules governing home-remittance arrangements and authorised dealers;
• the Payment Systems and Electronic Fund Transfers Act, 2007;
• the Rules for Payment System Operators and Payment Service Providers; and
• the Regulations for Electronic Money Institutions.

SBP states that home remittances should flow through formal channels. Exchange companies entering agency arrangements with foreign remittance entities are subject to specific requirements and regulatory engagement.

The precise route must therefore be agreed with an authorised bank, exchange company or other eligible SBP-regulated institution rather than recreated through unlicensed crypto settlement.

Relevant official sources include SBP’s Foreign Exchange Manual, Rules for Payment System Operators and Payment Service Providers and Regulations for Electronic Money Institutions.

When is SBP approval likely to be relevant?

There is no single “SBP crypto payment licence.” The applicable approval depends on the fiat function actually performed.

An applicant should not write “SBP approval is not required because settlement uses blockchain.” The correct analysis follows the fiat funds, customer claim, payment instruction and foreign-exchange conversion.

Partnership is not regulatory borrowing

A VASP may structure the fiat leg through an SBP-regulated bank, exchange company, EMI, PSO or PSP. That can be a workable model where the partner genuinely performs the regulated fiat service.

The arrangement should establish:

• which entity contracts with the customer;
• who receives and safeguards funds;
• who performs KYC and transaction monitoring;
• who controls payment execution;
• who handles chargebacks, refunds and complaints;
• who performs foreign-exchange conversion;
• who reports to SBP and PVARA; and
• what happens if the payment partner suspends service.

A VASP cannot simply display a partner’s name while performing the regulated payment or remittance activity itself.

Wallets: Custody, transfer or both?

“Wallet” describes technology, not a licence category.

Non-custodial wallet

Where the customer exclusively controls the keys and independently authorizes transactions, the provider may be supplying software rather than custody.

Transfer and Settlement analysis still arises if the provider substantively initiates, routes, processes or completes transfers rather than merely enabling the customer to interact with a network.

Custodial wallet

Where the provider controls private keys, seed phrases, signing devices, recovery credentials or withdrawal approvals, Custody Services will usually be relevant. If the same provider processes customer transfers, Transfer and Settlement Services may also apply.

Internal wallet transfers

A transfer between two users of the same platform may take place only through ledger entries, without an on-chain transaction. Regulation 2(3) expressly includes off-chain and internal-ledger settlement, so the absence of a blockchain transaction does not remove the activity from scope.

Transfer execution and settlement standards

The licence imposes operational responsibility, not merely an obligation to broadcast transactions.

Integrity of instructions

Regulations 7 and 8 require controls for:

• authenticating customer instructions;
• validating wallet addresses and account identifiers;
• detecting unauthorized or anomalous transactions;
• preventing fraud and sanctions breaches;
• resolving ambiguous or conflicting instructions; and
• reconciling internal records against blockchain and account balances.

The VASP must not process an instruction where available information creates a material concern about an invalid destination, fraud, sanctions exposure or loss until the issue is resolved.

Failed and erroneous transfers

Under Regulation 9, the VASP is responsible for executing transfers according to the customer’s instruction and disclosed service conditions.

Where a failure attributable to the VASP causes non-execution, defective execution or incompleteness, remedial action may include tracing, correction, reversal, restoration or compensation.

The VASP cannot guarantee that every blockchain transfer is reversible. It must instead explain Settlement Finality, confirmation requirements, the point at which a transaction becomes final and the limited circumstances in which cancellation or reversal is possible.

The 24-hour settlement standard

Regulation 10 requires final settlement within 24 hours of execution where settlement is within the VASP’s reasonable control.

If the ordinary model needs a longer cycle for an objectively justified reason, the VASP must notify PVARA before implementation and disclose the cycle to customers.

Delays caused by network congestion, chain malfunction, counterparties, custodians, banking rails, Travel Rule checks, sanctions controls or fraud prevention must be managed and communicated.

Travel Rule, sanctions and cross-border controls

Transfer and Settlement Services must support the collection, transmission, receipt and retention of required originator and beneficiary information.

The control framework should address:

• identification of the originating and beneficiary VASP;
• counterparty-VASP due diligence;
• sanctions and high-risk-jurisdiction screening;
• blockchain analytics and wallet-risk scoring;
• unhosted-wallet risk assessment;
• missing or inconsistent Travel Rule data;
• suspicious-transaction escalation and reporting; and
• rejection, suspension or restriction rules.

The Travel Rule is not satisfied by collecting a wallet address alone. The required information must accompany or be associated with the transfer in the manner prescribed by applicable AML/CFT requirements.

Customer assets and third-party arrangements

Regulation 14 prohibits the VASP from using, lending, pledging, converting or encumbering customer assets except where strictly necessary to execute the customer’s instruction or otherwise expressly permitted.

Temporary holding, prefunding and settlement buffers must comply with safeguarding, segregation, disclosure and recordkeeping requirements. If the arrangement becomes ongoing safekeeping or control, Custody Services should be included.

Banks, custodians, liquidity providers, blockchain infrastructure companies and payment providers may support the service. However, Regulation 16 prohibits outsourcing the core responsibility or operating as a mere booking entity for an unlicensed third-party operator.

The PVARA licensee remains responsible for due diligence, oversight, audit access, operational resilience, contingency arrangements and customer outcomes.

Common business models and likely approvals

Capital and financial resources

The minimum paid-up capital for Transfer and Settlement Services is PKR 200 million.

This is a continuing regulatory-capital floor, not an application fee. PVARA may impose risk-based additions reflecting transaction volumes, prefunding, settlement exposures, cross-border operations, third-party concentration or operational complexity.

The VASP must also maintain net liquid assets of at least 1.2 times adjusted monthly operating expenses. Customer assets and settlement funds cannot be counted as the company’s own capital or liquidity.

Separate financial-resource requirements may arise under any applicable SBP licence or regulated-partner arrangement.

Common mistakes

1. Assuming PVARA authorises fiat payments. It governs the virtual-asset layer, not every SBP-regulated function.
2. Calling remittance a blockchain transfer. Economic substance and the recipient payout remain relevant.
3. Ignoring internal-ledger movements. Off-chain settlement is expressly covered.
4. Treating every wallet as non-custodial. Recovery and withdrawal controls may amount to Custody.
5. Using a bank account as regulatory permission. Banking access does not itself authorise payment or remittance services.
6. Relying on a partner’s licence without allocating roles. The regulated partner must genuinely perform the relevant service.
7. Promising instant settlement. Network, screening and banking dependencies must match customer disclosures.
8. Failing to define finality. Customers must know when a transfer becomes irreversible.
9. Using settlement buffers as working capital. Customer assets must remain safeguarded.
10. Outsourcing the regulated core. PVARA responsibility remains with the licensee.

Final word

A crypto payment is rarely regulated as a single arrow from sender to recipient.

The virtual asset may be received, held, converted, transferred and settled. Fiat money may then enter a banking, electronic-money, payment-system, foreign-exchange or remittance channel. Each entity and each step must be legally mapped.

The PVARA Transfer and Settlement licence answers who may move and settle virtual assets. It does not, by itself, answer who may issue a fiat wallet, operate a payment gateway, conduct foreign exchange or pay out a remittance in Pakistan.

Follow both sides of the transaction. Follow the virtual asset under PVARA and the fiat money under SBP. A compliant product requires the two routes to meet through documented, authorised and operationally credible arrangements. Speak with our Pakistan crypto licensing team and Know More!

Legal disclaimer: This article provides general information as at 28 August 2026 and does not constitute legal, regulatory, tax, financial or investment advice. Classification depends on the complete asset flow, contractual structure, custody model, payment functionality, currencies, jurisdictions and regulated counterparties. PVARA and SBP may issue further rules, approvals, directions or interpretations. Applicants should obtain professional advice and confirm current requirements directly with PVARA, SBP and other relevant authorities.

FAQs