Pakistan Crypto Licence Guide 2026: PVARA Requirements, Costs, Process and Timelines

Pakistan’s crypto market has reached the point where “we will deal with regulation later” is no longer a strategy. It is a liability.

Imagine the familiar founder story. The product works, the wallet infrastructure is ready, and the launch campaign is sitting in drafts. Then someone asks a deceptively simple question: which Pakistan crypto licence do we need? Suddenly, the plan becomes a maze of activity classifications, capital, local incorporation, ownership evidence, AML controls, and regulatory submissions.

That is usually the expensive mistake.

Under Pakistan’s 2026 framework, a licence is not a certificate added to a finished crypto business. It is the operating architecture around which the business must be built. The legal entity, products, customer journeys, wallets, banking arrangements, governance, technology and marketing all have to tell the same regulatory story.

This guide explains that story in practical language: who needs authorisation from the Pakistan Virtual Assets Regulatory Authority (PVARA), which activities are regulated, how much capital may be required, what the application involves, and how long the process can realistically take.

PVARA 2026

• Regulator: Pakistan Virtual Assets Regulatory Authority
• Primary law: Virtual Assets Act, 2026
• Application routes: NOC, Regulatory Sandbox, or full VASP licence
• Minimum paid-up capital: PKR 15 million to PKR 500 million, depending on activity
• Official review periods: 60 days for a complete NOC application; 90 days for a complete licence application, extendable by up to 60 days
• Transitional deadline: 5 September 2026 for qualifying pre-existing operators

The short answer: what does it take to become licensed?

In broad terms, an applicant must:

1. identify every regulated virtual asset service in its business model;
2. choose the appropriate entry route—normally a No Objection Certificate (NOC), or potentially the Regulatory Sandbox;
3. satisfy PVARA on the fitness and propriety of its owners, controllers, directors and key personnel;
4. obtain the NOC before incorporating the Pakistan operating company, unless a different route or transitional treatment applies;
5. establish genuine local substance, including a registered office and resident senior authority;
6. inject and maintain the required paid-up capital and liquid financial resources;
7. submit the full VASP licence application and supporting evidence;
8. implement AML/CFT, sanctions, Travel Rule, custody, conduct, cyber, risk, complaints and business-continuity controls; and
9. complete regulatory review, respond to information requests and satisfy any pre-launch conditions.

That is the clean version. The real work is making each element consistent with the others. A company cannot describe itself as a simple software platform while its customer journey shows that it controls keys, executes orders, or transfers customer assets. PVARA will look at what the business actually does—not merely what the pitch deck calls it.

Why Pakistan’s 2026 framework matters

The Virtual Assets Act, 2026 established PVARA as Pakistan’s specialist virtual asset regulator. It gave the Authority powers to license and supervise virtual asset service providers, set prudential and conduct standards, protect customer assets, oversee token issuance, enforce AML/CFT requirements and take action against unauthorised businesses.

The Act is supported by the Pakistan Virtual Asset Services Regulations, 2026 and the Pakistan Virtual Asset Services Activity Specific Regulations, 2026, both notified on 21 August 2026. Together, they turn the Act’s broad obligations into an operational rulebook. PVARA publishes the legislation and regulatory instruments through its official regulatory framework page.

The practical message is straightforward: Pakistan now has a dedicated permissioning regime. Incorporating a company with the Securities and Exchange Commission of Pakistan does not authorise it to provide virtual asset services. A tax registration, offshore licence or pending application is not a substitute for PVARA authorisation.

The consequences are serious. Under section 54 of the Act, wilfully providing an unlicensed virtual asset service may lead to imprisonment for up to five years, a fine of up to PKR 50 million, or both. PVARA also has administrative, investigative, and access-blocking powers. Authorisation is therefore a basic question of whether the business can lawfully operate.

Do you need a Pakistan crypto licence?

Start with three questions:

• What does the business do? Look at the substance of each product and transaction.
• Where is the service provided? Consider teams, systems, contracting entities, and operational functions.
• Who is being targeted? Pakistani customers may bring an overseas operator within scope even without a local office.

The Services Regulations apply to virtual asset services carried on in or from Pakistan. They can also reach an overseas person that actively targets persons in Pakistan—for example through Pakistan-focused advertising, local onboarding, Pakistan rupee payment rails or other deliberate market-facing conduct.

Mere technical accessibility of a foreign website is not necessarily enough. Regulation 3 provides a limited safe-harbour concept where there is no Pakistan-directed marketing, no onboarding of Pakistan customers, no PKR rail, and reasonable measures are used to prevent the service being provided into Pakistan.

That is not permission to place a generic disclaimer in the footer while accepting Pakistani users in practice. Geography controls, onboarding logic, marketing data and payment flows must support the position.

Certain assets or arrangements may fall outside the Act, including qualifying closed-loop tokens, central bank digital currencies, traditional financial instruments already within the SBP or SECP perimeter, and genuinely non-financial NFTs. Labels are not decisive. Calling a transferable investment product an “NFT”, or a payment token a “loyalty point”, does not remove its economic function.

Pure virtual asset mining, by itself, is not a licensable virtual asset service under section 37(2) of the Act. Mining operations involving customer assets, customer funds or professional services for third parties can, however, enter the regulated perimeter. PVARA may also establish registration or declaration requirements for mining operations.

If the answer is uncertain, obtain a formal regulatory classification before launch. Classification is far cheaper than restructuring a live platform and migrating customers.

Which crypto activities does PVARA regulate?

PVARA licenses by activity. One platform may need more than one category if it performs several substantive services.

The Activity Specific Regulations make clear that a principal licensed activity cannot be disguised as “incidental”, and that each substantive activity requires the relevant approval. An incidental service must be genuinely subordinate, not separately marketed or paid for, not material to the business, and approved in writing where required.

The current categories and minimum paid-up capital amounts in Schedule I of the Pakistan Virtual Asset Services Regulations, 2026 are:

Two cautions matter here.

First, capital is assessed against the actual operating model. A platform that calls itself a broker but maintains an order book may also be performing exchange services. A “non-custodial” interface may still fall into custody if its design gives the operator control over keys, approvals or asset movement.

A remittance product using virtual assets behind the scenes may involve transfer and settlement services even if the customer sees only fiat at either end.

Second, multiple categories do not automatically mean adding every capital figure together. Under regulation 32, the prudential floor is generally the highest minimum applicable to the categories held, unless PVARA determines that another activity creates a separate, non-overlapping risk requiring an additional amount.

Regulation 31 also allows risk-based capital methodology and prudential add-ons. Applicants should therefore model capital conservatively and seek confirmation rather than assuming either full aggregation or a simple highest-category rule will always settle the matter.

The three routes into the PVARA framework

PVARA’s official licensing page presents three relevant pathways: the NOC route, the Regulatory Sandbox and the full VASP licence.

1. No Objection Certificate

For a new applicant following the standard route, the NOC is the regulatory gateway. It allows PVARA to assess the founders, controllers, funding, proposed activities, and business concept before the Pakistan company is incorporated.

An NOC is not a licence. It does not permit commercial virtual asset services, customer onboarding, or public claims that the applicant is a licensed VASP.

It is valid for three months and may be extended, on a timely application and for recorded reasons, for up to a further three months.

2. Regulatory Sandbox

The Sandbox is designed for innovative models that would benefit from controlled, supervised testing. PVARA may impose customer limits, transaction caps, testing parameters, disclosures, reporting requirements and other safeguards.

Sandbox entry is not a shortcut around regulation, and successful testing does not guarantee a licence. It can nevertheless be valuable where the product is genuinely novel and evidence from a restricted live test would help demonstrate risk controls.

Under regulation 7(6), a successful sandbox participant may apply directly for a licence without first obtaining an NOC.

3. Transitional route for existing operators

PVARA states that persons who were already providing virtual asset services on or before 5 March 2026 must submit an NOC application by 5 September 2026 or cease operations, subject to section 70 of the Act and the applicable regulations.

Existing businesses should not assume that historic operations create a permanent grandfathering right. A transitional operator should immediately assess eligibility, preserve its operating history,y and align ongoing conduct with PVARA’s requirements.

How to obtain a Pakistan crypto licence: the process

The licensing process is easier to understand when treated as a sequence of design decisions rather than one enormous form.

Step 1: Map the complete business model

Create a transaction-level map showing:

• who contracts with the customer;
• which entity receives fiat or virtual assets;
• who controls wallets, private keys and transaction approvals;
• how orders are accepted, routed, matched and executed;
• which parties provide liquidity;
• where customer and corporate assets are held;
• how fees, spreads, interest and commissions are earned;
• what is outsourced and to whom;
• which countries are targeted; and
• how funds and assets move from onboarding to withdrawal.

This map is the backbone of the application. It determines licence categories, capital, customer-asset rules, AML exposure, outsourcing permissions and technology controls.

If counsel, product and engineering each describe a different model, the application is not ready.

Step 2: Classify the activities and products

Match each revenue stream and customer function against Schedule I of the Act and the detailed Activity Specific Regulations.

Do this before fixing the corporate structure or raising capital. Activity classification affects almost everything downstream.

For derivatives, for example, the activity-specific rules generally contemplate an accompanying broker-dealer or exchange permission unless PVARA approves an alternative arrangement. Issuers of fiat-referenced and asset-referenced tokens face reserve, disclosure, and redemption duties beyond those applicable to ordinary platforms.

The output should be a written regulatory perimeter memorandum: activities in scope, activities out of scope, assumptions, category rationale,e and any points requiring PVARA confirmation.

Step 3: Run a readiness and gap assessment

Now compare the proposed business with PVARA’s requirements. Look at ownership transparency, financial resources, board composition, staffing, compliance, technology, customer assets and cross-border dependencies.

The purpose is to discover difficult issues early.

Is an ultimate beneficial owner unwilling to provide source-of-wealth evidence? Does the business depend on an offshore custodian whose audit rights are too narrow? Can the system generate Travel Rule data? Does the planned Pakistan team have real authority, or is every decision made abroad? Is the capital genuinely available and unencumbered?

A useful gap assessment assigns every deficiency an owner, deadline,e and form of evidence. “Policy to be drafted” is not a solution.

Step 4: Prepare and submit the NOC application

The NOC package introduces the applicant before a local operating company exists. PVARA will expect a coherent explanation of the proposed services, ownership and control chain, founders and senior personnel, financial capability, source of funds, technology and compliance approach.

The Authority may request additional information. The 60-day statutory decision period applies only after PVARA regards the application as complete. A thin submission does not start a reliable countdown; it usually creates rounds of questions.

If granted, review every NOC condition carefully. Build those conditions into the incorporation and licence workplan. Do not market the NOC as permission to operate.

Step 5: Incorporate the Pakistan company and establish local substance

Following the standard route, the applicant uses the NOC to incorporate a company under the Companies Act, 2017 and prepare the local entity for licensing.

The entity needs more than a registered address. The Services Regulations require a local registered office and at least one resident Key Individual with meaningful authority.

Governance must include at least three directors, with ordinarily at least one-third independent directors, together with appropriate experience and oversight arrangements.

PVARA will look through organisational charts to see where decisions are genuinely made. A Pakistan company that merely forwards every compliance, risk and customer decision to an offshore parent may struggle to demonstrate adequate substance and accountability.

Step 6: Satisfy capital, liquidity and insurance requirements

Inject the category-specific paid-up capital and ensure it remains eligible and available. This amount is a continuing prudential requirement—not money paid to PVARA and not a one-off entry ticket that can be withdrawn after approval.

Licensees must also maintain net liquid assets equal to at least 1.2 times adjusted monthly operating expenses. Eligible paid-up capital held in qualifying liquid assets may count toward that requirement.

PVARA can require additional resources based on size, complexity, custody exposure, market risk or other features.

Applicants should also arrange suitable professional indemnity, commercial crime and cyber insurance, subject to the applicable regulatory requirements and PVARA’s assessment.

Start insurance conversations early: policy exclusions, territorial scope, custody risks and insurer information demands can take time to resolve.

Step 7: Build the full application dossier

The licence form and its annexure require a substantial evidence pack—roughly 35 categories of documentation. A strong submission usually contains:

• a detailed business plan and corporate structure;
• three-year financial forecasts, assumptions, stress tests and capital calculations;
• ownership, controller, ultimate beneficial owner and source-of-funds evidence;
• fit-and-proper documents for directors and key individuals;
• local staffing, reporting lines, responsibility maps and committee terms;
• descriptions of products, customer journeys and cross-border delivery;
• AML/CFT, sanctions, proliferation-financing and Travel Rule frameworks;
• enterprise risk, compliance monitoring, conflicts and anti-bribery policies;
• customer asset, wallet, key-management and reconciliation controls;
• cybersecurity, technology governance, incident response and penetration-testing evidence;
• business continuity, disaster recovery, outsourcing and wind-down plans;
• conduct, complaints, marketing, onboarding and disclosure policies;
• token admission or listing standards, where relevant;
• insurance and external-service-provider arrangements; and
• evidence of other necessary regulatory approvals or engagements.

Templates can accelerate drafting, but a policy referring to systems, committees or tools that do not exist weakens the application.

Step 8: Implement the control environment

PVARA is licensing a functioning institution, not a folder of future intentions. The applicant should be able to demonstrate that controls have been configured, allocated, tested, and documented.

That means approved risk appetites, live screening arrangements, working escalation paths, wallet controls, access logs, maker-checker approvals, reconciliations, incident playbooks, employee training and board reporting.

It also means contracts with banks, custodians, liquidity providers, cloud services and outsourced compliance vendors must support the regulatory obligations.

Mock customer files, tabletop cyber exercises, reconciliation samples and compliance-monitoring tests can expose gaps before the regulator does.

Step 9: Submit the full VASP licence application

Once incorporated and ready, the Pakistan company submits its licence application through PVARA’s prescribed process and pays the applicable non-refundable processing fee.

PVARA may interview controllers, directors, the chief executive, compliance officer, MLRO, technology leaders or other key personnel. It may ask for clarifications, revised forecasts, system demonstrations, independent assessments or evidence that local functions are operational.

Responding quickly is useful; responding consistently is essential. Maintain a central issues log so every answer is approved, evidenced and reflected across the application.

Step 10: Satisfy conditions and prepare to go live

PVARA may grant, refuse or limit the scope of a licence and may impose conditions. Approval should therefore trigger a controlled launch process, not an improvised opening day.

Before onboarding customers, verify the precise permitted activities, customer types, products, jurisdictions, limits and conditions. Complete any pre-commencement items, train relevant staff, activate regulatory reporting and make sure website statements accurately describe the firm’s status.

The licence remains an ongoing relationship. Changes to controllers, key individuals, material outsourcing, products, token listings or the business model may require notification or prior approval.

The requirements that deserve the most attention

Some workstreams consistently carry more regulatory weight than their page count suggests.

Fit and proper ownership and leadership.

PVARA assesses controllers, sponsors, directors, the chief executive and key individuals for integrity, track record, financial soundness, competence and conflicts. Corporate controllers are examined through to their ultimate beneficial owners.

Prepare a clean ownership chart and an evidence trail for every significant funding movement. Historic regulatory findings, litigation, insolvencies, criminal matters or business failures should be identified and explained honestly.

A difficult fact disclosed with context is usually more manageable than a fact discovered after an incomplete declaration.

Fitness and propriety is continuing. Relevant changes must be monitored and reported; it is not a test passed once at application.

AML/CFT, sanctions and the Travel Rule

Virtual asset businesses combine speed, cross-border reach, pseudonymous addresses and irreversible transfers. PVARA therefore expects a risk-based AML/CFT framework that works at transaction level.

The programme should cover customer and beneficial-owner verification, enhanced due diligence, sanctions and proliferation-financing screening, source-of-funds and source-of-wealth analysis, transaction monitoring, blockchain analytics, suspicious-transaction escalation, high-risk jurisdictions and recordkeeping.

AML/CFT records generally need to be retained for seven years under the Services Regulations and applicable federal law.

For qualifying virtual asset transfers at or above the PKR equivalent of USD 1,000, the Travel Rule requires prescribed originator and beneficiary information to accompany or be available with the transfer.

Firms need operational rules for missing data, unhosted wallets, counterparty VASP due diligence, rejected transfers and data protection—not simply a sentence in the AML manual.

Customer assets, custody and proof of reserves

If the business holds or controls customer money or virtual assets, segregation must be legal, operational and visible in the ledger.

Customer assets cannot be treated as corporate property or used, pledged, lent, rehypothecated or otherwise disposed of except where expressly permitted and properly authorised.

Controls should cover wallet architecture, key generation, cold and hot storage, transaction approval, withdrawal allow-listing, reconciliations, access recovery, forks, airdrops, incident handling and third-party custody.

Licensees holding customer virtual assets must be able to demonstrate that customer liabilities are fully matched by reserve assets or equivalent safeguarding arrangements, with independent validation where required.

“We use a respected global custodian” is not the end of the analysis. PVARA will still expect the licensee to understand concentration risk, insolvency treatment, sub-custody, audit rights, cyber controls and the process for returning customer assets.

Technology, cybersecurity and operational resilience

The regulator’s interest is not limited to whether the platform has ever been hacked. It extends to governance, secure development, access control, encryption, vulnerability management, penetration testing, backups, vendor risk, capacity, change management and recovery.

Material cyber incidents require rapid escalation. The Services Regulations contemplate initial notification within 24 hours, an interim report within five working days and a final report within 30 days.

Teams should rehearse those deadlines before an incident, when facts are incomplete and operational pressure is highest.

Business continuity and disaster recovery must match the actual architecture. A beautifully written plan is of little value if the backup environment shares the same failure point as production or no one has tested the restoration sequence.

Conduct, disclosures and marketing

Crypto customers must receive information that is fair, clear and not misleading. Risk warnings, fees, spreads, execution arrangements, custody risks, conflicts, complaint channels and product-specific terms should be presented before the customer commits—not buried behind a hyperlink after the transaction.

Marketing teams need approval workflows and evidence for performance claims. Influencers, affiliates and introducers do not create a compliance shield; their communications can expose the licensed firm.

Token issuers may also require approved whitepapers, reserve disclosures and redemption arrangements.

The safest rule is simple: if the compliance team would be uncomfortable showing an advertisement to PVARA, it should not be published.

Outsourcing and group arrangements

Cloud hosting, identity verification, blockchain analytics, custody technology, call centres and group-shared services may all be outsourced, but accountability cannot be outsourced. The principal licensed activity must remain with the licensee.

Contracts should provide service levels, confidentiality, data handling, audit and access rights, incident notification, subcontracting controls, business continuity, regulatory cooperation and exit support.

The licensee should maintain an outsourcing register and a realistic plan for replacing a critical provider.

What does a PVARA licence cost?

This is where many search results create confusion. There are three different cost layers.

1. Regulatory capital

Paid-up capital ranges from PKR 15 million for Advisory Services to PKR 500 million for Exchange, Lending and Borrowing, Derivatives and Mining-Related Services.

It belongs to the licensed company and must be maintained subject to prudential rules. It is not an application fee.

For a multi-activity model, plan for the highest applicable floor plus any PVARA risk-based add-on, as well as the net-liquid-assets requirement. Token issuers also need to finance reserves separately from ordinary regulatory capital.

2. PVARA fees

Regulation 11 provides for processing, licensing, annual supervisory, renewal and other fees. Processing fees are non-refundable, and annual fees are payable in advance.

However, as at 24 August 2026, the notified Services Regulations and PVARA’s public licensing materials do not state numerical amounts for those charges.

The forms retain placeholders,s and the regulation says fees will be published in the Rules. Applicants should obtain the current schedule directly through PVARA’s portal or written communication and should not rely on unofficial figures.

3. The real implementation budget

The wider implementation budget often includes:

• incorporation, premises, local staffing and professional advice;
• compliance, MLRO, risk, audit and governance support;
• AML screening, blockchain analytics and Travel Rule tools;
• wallet, custody and transaction-monitoring infrastructure;
• cybersecurity reviews, penetration tests and assurance reports;
• insurance premiums;
• financial audit, proof-of-reserves and independent validation;
• localisation of contracts, disclosures and data processes; and
• contingency for remediation during PVARA review.

The right question is therefore not “what is the licence fee?” but “what will it cost to create and operate a compliant Pakistan VASP?”

Those are very different numbers.

How long does PVARA licensing take?

The official decision periods begin only when an application is complete.

The licence review clock is suspended while requested information remains outstanding. The statutory 90 days can therefore become longer in calendar time if the submission is incomplete or responses are delayed.

For planning purposes—not as a PVARA promise—a well-prepared applicant might spend four to twelve weeks on classification, structuring and NOC readiness; several further weeks on incorporation, hiring, capitalisation and control implementation; and then enter the formal licence review.

Complex exchanges, custodians, derivatives platforms, token issuers or cross-border groups can take materially longer. A total project horizon of six to twelve months or more may be prudent, depending on starting readiness and regulatory questions.

The best way to shorten the process is not to push the regulator harder. It is to remove ambiguity before filing: settle the category analysis, nominate credible people, document the source of capital, test the technology, and submit evidence that answers the next question as well as the current one.

Seven mistakes that slow applications down

1. Building first and classifying later

If the technology, contracts, and revenue model are fixed before the licence analysis, the applicant may discover that it has built an exchange when it budgeted for brokerage, or custody when it promised investors a non-custodial product.

2. Treating the NOC as permission to trade

An NOC is a preliminary regulatory clearance, not a VASP licence. Operating or marketing as licensed during the gap can create enforcement and credibility risk.

3. Submitting polished but generic policies

A policy that mentions committees, controls, and systems absent from the organisation invites uncomfortable questions. Every document should match the people, vendors, product and technology that will exist at launch.

4. Underestimating local substance

A prestigious global board does not replace resident authority and local accountability. PVARA needs to know who in Pakistan can make decisions, stop activity, escalate incidents, and answer for compliance.

5. Confusing capital with total funding

The minimum capital floor does not cover every launch and operating expense. Hiring, insurance, technology and reserves can require substantial additional cash, while regulatory capital must remain intact.

6. Leaving vendors until the end

Custody, banking, analytics, Travel Rule and cloud contracts often determine whether regulatory promises can be delivered.

Their limitations should be assessed before the application describes them as settled arrangements.

7. Giving inconsistent answers

The regulator will compare the business plan, policies, financial model, system demonstrations, interviews,s and website.

If one document says customer assets are never controlled while another shows an omnibus wallet operated by the company, the issue is not merely drafting—it is trust.

Final word

Pakistan’s new regime gives serious virtual asset businesses something the market has needed: a defined regulatory path. It also raises the standard for entry.

The businesses most likely to navigate PVARA successfully will not be those with the longest policy manuals or the loudest launch announcements.

They will be the ones that can explain, in plain language, what they do; show where every customer asset goes; identify who is accountable; prove that financial resources are real; and demonstrate that controls work when markets, systems or people come under pressure.

That is the mindset to take into a Pakistan crypto licence application.

Do not treat authorisation as the final administrative hurdle before launch. Treat it as the design discipline that turns a promising crypto product into a durable regulated business.

Legal disclaimer: This article provides general information as at 24 August 2026 and does not constitute legal, regulatory, tax or investment advice. PVARA may issue new rules, fee schedules, directions, forms or interpretations, and the correct licensing treatment depends on the facts of each business. Applicants should obtain current professional advice and confirm requirements directly with PVARA before acting.

FAQs