Pakistan Crypto Licence for Foreign Companies: Local Incorporation and Cross-Border Rules

A foreign crypto licence is not a passport into Pakistan.

Even a well-regulated international exchange requires PVARA authorisation if it targets or onboards persons in Pakistan.

Pakistan’s framework separates three issues that international groups often combine:

1. Foreign ownership: whether overseas shareholders may own the Pakistan VASP.
2. Local incorporation and substance: which entity must hold the PVARA licence and make accountable decisions in Pakistan.
3. Cross-border activity: when an overseas platform is treated as providing Virtual Asset Services “in Pakistan,” even without an office there.

The central rule is straightforward: a foreign group may own and support a Pakistan business, but regulated services in or from Pakistan must ordinarily be provided through a locally incorporated and PVARA-licensed company.

Foreign VASP entry

• Foreign licence: Does not substitute for PVARA authorisation
• Licence holder: Company incorporated in Pakistan
• Ordinary route: PVARA NOC before local incorporation, followed by Form II | Registered office: Required in Pakistan
• Local authority: At least one resident Key Individual with operational and decision-making authority
• Compliance Officer: Resident in Pakistan
• Cross-border trigger: Targeting, soliciting, promoting to or onboarding persons in Pakistan 
• Passive website: May fall within the safe harbour if Pakistan is not targeted and reasonable exclusion measures operate
• Overseas outsourcing: Permitted subject to continuing Pakistan accountability and regulatory access

Can a foreign company obtain a PVARA licence?

A foreign parent cannot ordinarily hold the operating licence in its existing overseas corporate identity.

Section 50 of the Virtual Assets Act, 2026 and regulation 5 of the Pakistan Virtual Asset Services Regulations, 2026 require a person conducting Virtual Asset Services by way of business in or from Pakistan to:

• be a company incorporated under the Companies Act, 2017 or another applicable Pakistani law governing company incorporation; and
• hold a valid PVARA licence for every relevant service category.

PVARA describes the ordinary route as establishing a subsidiary company under the Companies Act, 2017 after receiving the NOC. Its official licensing page also states that the licence applicant must be a company registered in Pakistan.

The regulated entity should therefore be the Pakistan subsidiary—not merely its foreign parent, representative office or overseas branch. Customer contracts, capital, governance and regulated records must correspond to the Pakistan licensee.

Can the Pakistan VASP be foreign-owned?

The notified PVARA Regulations do not state a general Pakistani-shareholder requirement or a numerical foreign-ownership ceiling. Form I expressly accommodates foreign sponsors, shareholders and directors through passport and nationality disclosures. Corporate and individual Controllers are assessed on their merits.

Pakistan’s general investment policy permits up to 100% foreign equity across many non-manufacturing activities, subject to sector-specific licences and exceptions. Pakistan Board of Investment

That general policy is not itself approval for 100% foreign ownership of a licensed VASP. Before fixing the structure, confirm PVARA’s position on the ownership chain, SECP and beneficial-ownership requirements, investment or security clearances, SBP foreign-exchange rules, capital-injection routes, tax and profit repatriation.

The safer legal conclusion is therefore: foreign ownership is contemplated and no blanket PVARA cap appears in the notified rules, but the proposed structure remains subject to regulatory approval and other Pakistani laws.

Who will PVARA assess in an international group?

PVARA looks through the local subsidiary to the people and entities that ultimately own, fund and influence it.

A Controller generally includes a person who, alone or with associates, holds or controls at least 20% of the voting power, ownership interest or share capital, or otherwise exercises significant influence over management or policy.

Foreign applicants should expect to disclose:

• each direct and indirect shareholder;
• ultimate beneficial owners;
• voting, veto, nomination and reserved-matter rights;
• trusts, nominees or shareholder agreements;
• corporate Controllers and group entities;
• source of wealth and source of funds;
• foreign regulatory licences and permissions;
• material supervisory findings or enforcement matters during the previous five years; and
• financial soundness, reputation and track record of the group.

A respected overseas parent can strengthen the application, but it can also broaden the due-diligence file. PVARA may contact foreign regulators, seek regulatory references and assess whether historic incidents were disclosed and remediated.

Changes to Control or material ownership after licensing require prior PVARA approval. The group should therefore design future investment rounds, reorganisations, option plans and intra-group transfers with the 20% threshold and significant-influence test in mind.

The NOC must ordinarily come before incorporation

Section 19 of the Act requires a person intending to establish a company primarily for Virtual Asset Services to obtain a PVARA No Objection Certificate before commencing incorporation.

The standard foreign-company sequence is:

1. classify every intended activity and identify regulatory overlaps;
2. select the foreign parent, sponsors, Controllers and proposed directors;
3. submit Form I and Parts A–E for the NOC;
4. receive the NOC, subject to its conditions;
5. complete relevant regulatory registrations;
6. incorporate the Pakistan subsidiary through SECP;
7. inject and evidence the prescribed capital in Pakistan;
8. establish local governance, staffing, systems and contracts; and
9. submit Form II and the complete licence evidence pack.

The NOC is not permission to launch. Regulation 6(4) expressly states that it is not a licence or authorisation to provide any Virtual Asset Service. It is valid for three months and may be extended, on a reasoned application made before expiry, by up to another three months.

For Pakistan’s crypto licensing framework, a successful Regulatory Sandbox participant may apply directly for a licence without a separate NOC under regulation 7(6), but must still satisfy local-incorporation and full licensing requirements.

What local substance must the foreign group establish?

Local incorporation cannot be treated as a nameplate exercise.

Registered office and local authority

Section 20(6) of the Act and regulation 10(4) require the licensee to maintain a registered office in Pakistan and have at least one Key Individual resident in Pakistan who possesses operational and decision-making authority and is accountable to PVARA. The Authority may require additional resident officers depending on the business’s scale, complexity and risk.

That person should not need approval from another time zone for every material compliance, customer-protection or incident decision.

Board and senior management

Schedule I requires at least three directors. Foreign nationals may be proposed, but the board must collectively possess relevant competence and satisfy the fit-and-proper criteria. The governance model should explain where the board meets, how Pakistan matters are decided and how conflicts with the foreign parent are managed.

Resident Compliance Officer

Regulations 23 and 81 require a resident Compliance Officer with appropriate seniority, competence, resources, access to information and a reporting line to the board or relevant committee. The role should ordinarily be a full-time position unless PVARA permits another arrangement.

Pakistan capital and banking

The applicant must evidence paid-up capital injected and maintained in Pakistan bank accounts, together with its source. Repatriation and availability arrangements must be acceptable to PVARA. Capital cannot be temporary, circular, encumbered or dependent on customer assets.

The local entity must therefore be able to demonstrate real governance, people, resources and records—not merely a certificate of incorporation beneath a foreign operating platform.

When does an overseas platform fall within PVARA’s perimeter?

Regulation 3 applies the framework to a person carrying on, or holding itself out as carrying on, Virtual Asset Services in Pakistan or from Pakistan.

An activity may be treated as carried on in Pakistan where the overseas business targets, solicits, promotes to or onboards persons in Pakistan, including through marketing, websites, applications, payment rails, PKR services or Pakistan-accessible channels.

Indicators include accepting Pakistan addresses or identity documents; Pakistan-specific webpages, promotions or advertising; local influencers, affiliates or agents; Pakistan-directed support; PKR integrations; local distribution; and failing to prevent Pakistan onboarding despite claiming exclusion.

Using an overseas server, foreign contracting entity or non-PKR settlement asset does not neutralise a business that substantively targets Pakistan.

PVARA also has extraterritorial investigation and enforcement powers under section 4 of the Act and may cooperate with overseas regulators and law-enforcement agencies.

The passive-accessibility safe harbour

Regulation 3(5) provides an important but limited safe harbour. A foreign website, application or interface is not treated as operating in Pakistan solely because it can be accessed there, where the operator:

1. does not market or solicit in Pakistan;
2. does not onboard persons in Pakistan;
3. does not support PKR rails or Pakistan-targeted channels; and
4. takes reasonable steps to prevent Pakistan onboarding where it does not intend to serve the market.

Those steps may include jurisdictional eligibility rules, IP and device-location controls, residence verification, blocked Pakistan documents and telephone codes, payment restrictions, affiliate controls, staff instructions, periodic testing and records of rejected attempts.

A disclaimer stating “not available in Pakistan” will carry little weight if the onboarding system accepts Pakistani customers. PVARA may determine that the business has targeted Pakistan or has a real and substantial connection with it, but the determination must be reasoned, recorded and communicated in writing.

Serving foreign customers from Pakistan

The territorial rule works in both directions.

A Pakistan-incorporated team providing Virtual Asset Services to customers abroad may be operating from Pakistan and require the relevant PVARA categories. The Pakistan licence does not automatically authorise solicitation in another country.

The VASP should maintain a jurisdiction matrix covering countries served or blocked, local licensing and marketing rules, permitted customers and products, sanctions, data restrictions, complaints and ownership of each customer relationship.

The result may be dual regulation: PVARA supervises the Pakistan licensee, while the destination jurisdiction regulates services offered to its residents.

Can the Pakistan VASP use the foreign group’s systems and staff?

Yes, subject to controlled outsourcing.

Regulations 37–43 allow outsourcing within or outside Pakistan, including to affiliates, group entities, cloud providers and specialist vendors. The Pakistan VASP nevertheless remains fully responsible.

For material outsourcing, it must maintain :

• documented risk assessment and provider due diligence;
• board-approved policy and an outsourcing register;
• a responsible Key Individual;
• written service levels and security obligations;
• incident-notification and business-continuity terms;
• access to information and records for the VASP and PVARA;
• control over sub-outsourcing; and
• credible termination, transfer or insourcing arrangements.

Prior PVARA approval may be required where outsourcing a material or critical function materially affects regulatory compliance. Other material arrangements carry advance or prompt notification requirements.

Our corporate structuring services for crypto and Web3 businesses, the parent may supply technology, liquidity, cybersecurity or operational support. It cannot absorb the Pakistan board’s responsibility or prevent PVARA from supervising the licensed business.

Cross-border data and technology

Section 39 of the Act and regulation 60 permit data to be stored or processed outside Pakistan, subject to applicable data-protection, cybersecurity and cross-border-transfer laws and safeguards.

The licensee should document what data leaves Pakistan, the countries and providers involved, the lawful basis and contractual protections, security and retention controls, PVARA access, incident response and localisation contingencies.

PVARA may require immediate localisation or restrict particular transfers where necessary for national security, financial stability, consumer protection or effective enforcement. A conflict between foreign secrecy or cloud restrictions and PVARA access must be documented, mitigated and notified where it materially affects compliance through our cross-border legal support for crypto and Web3 expansion.

Cross-border transfers and overseas counterparties

International transaction flows also engage AML/CFT/CPF and Travel Rule controls.

Regulation 100 requires originator and beneficiary information for qualifying virtual asset transfers. Before establishing a material transfer relationship with a VASP in another jurisdiction, the Pakistan licensee must conduct risk-based due diligence on that counterparty’s Travel Rule and AML/CFT controls and review it annually and when heightened-risk indicators arise.

The foreign group should not assume that transfers between affiliates are lower risk merely because the entities share a brand. Each counterparty, wallet model, data-transfer mechanism, sanctions exposure and customer-allocation arrangement must be assessed.

PVARA does not replace other Pakistani approvals

PVARA is the primary virtual-asset regulator, but its licence does not disapply other laws.

To access our regulatory compliance advisory services, foreign applicants should assess possible involvement of:

• SECP: incorporation, company law, securities and corporate filings;
• SBP: foreign exchange, banking, payment services and any proposed domestic payment use;
• FMU: AML reporting and registration requirements;
• FBR: tax registration, reporting and withholding;
• data and cybersecurity authorities: privacy, electronic crimes and transfer rules; and
• foreign regulators: services marketed or delivered outside Pakistan.

Regulation 3(6) also states that virtual assets may not be used or recognised as a means of payment for domestic commercial transactions unless specifically approved by SBP under section 9(1)(f) of the Act.

Practical structuring examples

Foreign exchange entering Pakistan

The group establishes a Pakistan subsidiary owned by its overseas holding company. The subsidiary obtains the NOC, capitalises locally, appoints Pakistan-resident control personnel and applies for Exchange, Broker-Dealer, Custody and any other required categories. Group technology is documented as outsourcing.

Global platform excluding Pakistan

The platform does not market in Pakistan, blocks Pakistani onboarding, does not support PKR and monitors circumvention. Mere technical accessibility should not, by itself, place it in scope, subject to PVARA’s substance-based assessment.

Offshore platform using Pakistani influencers

The platform has no office or PKR rail but pays influencers to recruit Pakistani users and accepts Pakistan identity documents. This presents strong targeting and onboarding indicators. An offshore contract is unlikely to remove PVARA exposure.

Pakistan technology hub serving overseas users

A Pakistan entity operates wallets or executes transfers for foreign customers. Because the service is carried on from Pakistan, PVARA licensing may apply alongside the destination countries’ laws.

Foreign applicant checklist

Check our company formation services Before filing Form I, confirm that:

• every activity is mapped to the correct PVARA category;
• the Pakistan subsidiary—not the foreign parent—is the proposed licensee;
• ownership, Controllers and UBOs are fully traceable;
• foreign regulatory history and approvals are disclosed;
• capital funding and repatriation routes are documented;
• the registered office and resident authority model are credible;
• group services are classified and documented as outsourcing;
• Pakistan and overseas customer responsibilities are contractually clear;
• geo-targeting and geo-blocking controls match the jurisdiction strategy;
• cross-border data flows preserve PVARA access;
• foreign VASP counterparties undergo Travel Rule and AML review; and
• SECP, SBP, FMU, FBR and foreign-law overlaps are resolved.

Common mistakes

1. Relying on a foreign licence. Regulatory reputation supports the application but does not create passporting rights.
2. Using a branch instead of the licensee required by PVARA. The operating entity must satisfy Pakistan-incorporation requirements.
3. Creating a shell subsidiary. Local titles without authority do not establish substance.
4. Contracting customers with the wrong entity. The website, terms, wallets and complaints process must identify the responsible licensee.
5. Calling access “passive” while onboarding Pakistan. Actual controls matter more than disclaimers.
6. Hiding group outsourcing. Intra-group support remains outsourcing where the regulatory definition is met.
7. Blocking PVARA’s access. Foreign secrecy, cloud or vendor terms must not make supervision ineffective.
8. Ignoring destination-country law. A PVARA licence does not authorise worldwide solicitation.
9. Treating affiliate transfers as automatically low risk. Travel Rule, sanctions and counterparty controls still apply.
10. Assuming crypto can be used for local payments. Specific SBP approval is required.

Final word

Pakistan does not require an international group to abandon its global technology, brand or expertise. It does require the group to place legal responsibility somewhere identifiable and supervisable.

That responsibility sits with the Pakistan licensee.

The foreign parent may own it. Group companies may support it. Overseas systems may process its data. International VASPs may settle its transfers. But the Pakistan entity must possess the licence, capital, governance, local authority, controls and records necessary to answer to PVARA.

The strongest structure is a transparent international group with a genuinely accountable Pakistan VASP at its centre.

Legal disclaimer: This article provides general information as at 28 August 2026 and does not constitute legal, regulatory, corporate, foreign-investment, tax, foreign-exchange or financial advice. Ownership, incorporation and cross-border outcomes depend on the applicant’s activities, jurisdictions, group structure, customer model and other regulatory permissions. PVARA and other Pakistani authorities may issue further requirements or interpretations. Applicants should obtain professional advice and confirm the current position directly with the relevant authorities.

FAQs