VASP License Pakistan: The Complete 2026 Guide to PVARA Licensing

 ● 12 min read ● ~4,500 words ● Author: Malik Abbas, CEO CoinConnect

• On This Page

What a VASP License Is	Documentation Checklist
Legal Basis: VAO 2025	Realistic Timeline
Who Regulates: PVARA	Cost Breakdown
Who Needs a License	Foreign Exchange Entry
Licensable Activities	After Approval
Sandbox vs NOC vs Full License	Why Applications Fail
Form A1 — The NOC Application	Working With CoinConnect
Eligibility Requirements	FAQ

• Quick summary. Pakistan now regulates virtual assets under the Virtual Assets Act 2026 (originally promulgated as the Virtual Assets Ordinance, 2025), administered by the Pakistan Virtual Assets Regulatory Authority (PVARA). The Draft VASP Regulations 2026 define ten license categories, each with a minimum paid-up capital set out in Schedule I — from PKR 25 million for Advisory up to PKR 1 billion for an Exchange or a token issuer. That capital is recoverable (it sits in your own company; it is not paid to the regulator), and PVARA has confirmed there is currently no prescribed application fee. You can enter through four routes: a No Objection Certificate (NOC), the Regulatory Sandbox (which reduces upfront capital), a No-Action Relief Letter, or a full VASP license. This guide walks through all of it in detail.
  
  1. What a VASP License Actually Is
  
  

A VASP (Virtual Asset Service Provider) license is the authorization issued by PVARA that allows a business to legally provide virtual asset services in or from Pakistan. "Virtual asset services" is a broad term that covers running an exchange, holding customer assets in custody, brokering trades, transferring or settling virtual assets, lending, derivatives, asset management, advice, and issuing tokens. Under the Virtual Assets Act 2026, conducting any of these commercially without the appropriate PVARA authorization is prohibited and carries serious civil and criminal consequences.

It is important to understand what the licence is not. It is not a one-page registration, and it is not a formality you can bolt on after you have started operating. It is a substantive authorization that PVARA grants only after it is satisfied that your company is properly capitalised, your people are fit and proper, your anti-money-laundering systems actually work, your custody and cybersecurity are sound, and your business will treat Pakistani consumers fairly. In other words, the licence is the regulator's statement that it trusts you to operate in its market.

For a global exchange, the licence is what converts an informal, grey-market user base into a legal, banked, taxable operation — one that can advertise, open corporate bank accounts, move rupees through the formal system, and build a durable brand. In Pakistan, with one of the largest crypto-using populations on earth and a young, mobile-first demographic, that conversion is a substantial prize for early, compliant entrants who establish position before the market matures.

• 
  

• 2. The Legal Basis: Virtual Assets Ordinance 2025
  
  Pakistan's entire VASP framework rests on a single foundational statute: the Virtual Assets Act 2026, originally promulgated as the Virtual Assets Ordinance, 2025 (signed on 8 July 2025) and now operating as the Act. This law established PVARA as the sole federal regulator for virtual asset services, defined the licensable activities, created the entry routes (NOC, Sandbox, No-Action Relief, and full licence), and imposed the AML/CFT, tax-reporting, and consumer-protection obligations that every VASP must meet.

  Crucially, the Act is no longer a bare statute. PVARA has since published the operational rulebook that turns the law into a workable licensing regime:

  • The NOC Regulations — governing the No Objection Certificate route.
  • The Regulatory Sandbox Guidelines 2026 — the supervised testing regime, including the Form I application and the agile, year-round intake.
  • The Activity-Specific Handbooks 2026 — detailed conduct, custody, disclosure, capital, and reporting expectations for each licensed activity. These are the operational rulebooks an applicant must actually design against.
  • The Draft Pakistan Virtual Asset Services Regulations 2026 — which define the ten license categories and their Schedule I minimum paid-up capital.

• Because the VASP Regulations are still in draft, some figures and procedures may change before they are finalized — which is why a serious applicant treats published numbers as draft and confirms them at filing. For the complete walkthrough of the framework, see our complete PVARA Guide.
  
  3. Who Regulates What — Understanding the Authority
  
  PVARA is the primary regulator for virtual assets, but it does not operate in isolation. Four federal bodies share jurisdiction over different slivers of your operation.

Authority	What It Covers
PVARA	Virtual asset licensing, conduct, AML rules, Sandbox, Form A1, ongoing supervision of VASPs
State Bank of Pakistan (SBP)	Fiat on/off-ramps, foreign exchange controls, banking access for VASPs, cross-border settlement
SECP	Corporate registration of the VASP entity (the Private Limited Company itself), securities overlap where tokens are securities
FBR (Inland Revenue)	Taxation, Section 285BAA reporting obligations, withholding, documentation
FMU	AML/CFT reporting through the goAML system, STR/CTR obligations under FATF Travel Rule

A typical licensed VASP ends up with touch-points at all five bodies. Founders who enter Pakistan assuming PVARA is the only door to knock on miss the 40% of compliance that lives elsewhere — especially SBP (for fiat flows) and FBR (for tax).For a deeper comparison of regulatory remits, read our cluster piece: PVARA vs SBP vs SECP — Who Regulates What in Pakistan Crypto.

• 
  

• 4. Who Needs a VASP License
  
  Short answer: Any business carrying on a licensable virtual asset activity commercially in or from Pakistan needs PVARA authorization. That includes:

  • Centralised exchanges (spot and derivatives).
  • Custodians and hosted-wallet providers.
  • OTC desks and brokers acting as principal or agent.
  • Transfer, remittance, and payments businesses built on crypto or stablecoin rails.
  • Lending and borrowing platforms.
  • Virtual-asset managers and advisers (including staking-as-a-service and discretionary management).
  • Token issuers — both fiat-referenced (stablecoins) and asset-referenced (e.g. tokenized commodities).

What does not require a licence is equally important. Pure individual self-custody and personal investing are not licensable activities — the framework regulates the providers who serve customers, not private holders. A person holding their own crypto in a hardware wallet is not a VASP. A business offering custody, exchange, or transfer services to those people is.

• A subtle but important point for foreign companies: the obligation can attach to services provided from Pakistan as well as in Pakistan, and to businesses that actively target Pakistani users. If you are onboarding Pakistani customers at scale, assume you are in scope and plan accordingly.
  
  

• 5. The Licensable Activities — PVARA's 7-Category Matrix
  
  
• The Draft VASP Regulations 2026 define ten license categories, each with a minimum paid-up capital under Schedule I. A single licence can cover more than one category. The capital is recoverable share capital held in your own company — not a government fee — and it can be reduced under the Regulatory Sandbox. The figures below are from the draft regulations and should be confirmed at filing.

License Category	Minimum Paid-Up Capital (PKR)	Approx. USD
Advisory Services	PKR 25 million	~$89,000
Broker-Dealer	PKR 100 million	~$357,000
Custody	PKR 200 million	~$714,000
Virtual Asset Management & Investment	PKR 200 million	~$714,000
Virtual Asset Transfer & Settlement	PKR 200 million	~$714,000
Lending & Borrowing	PKR 500 million	~$1.79 million
Virtual Asset Derivatives	PKR 500 million	~$1.79 million
Exchange	PKR 1 billion	~$3.57 million
Fiat-Referenced Token Issuance (stablecoins)	PKR 1 billion + reserves	~$3.57 million
Asset-Referenced Token Issuance (e.g. tokenized gold)	PKR 1 billion + reserves	~$3.57 million

Here is what each category actually means in practice:

• • Exchange — matching buyers and sellers and converting virtual assets (crypto-to-crypto and crypto-to-fiat). The flagship category for a trading platform, and the most capital-intensive of the operating licenses at PKR 1 billion.
  • Custody — holding virtual assets on behalf of customers in hot and cold wallets. Almost every exchange needs this alongside Exchange, because exchanges hold customer assets.
  • Broker-Dealer — acting as principal or agent in transactions, including OTC desks and large-ticket facilitation.
  • Virtual Asset Transfer & Settlement — moving and settling virtual assets, including cross-border transfers and stablecoin-based payments and remittance. This is the core category for a remittance or payout business.
  • Lending & Borrowing — virtual-asset lending and borrowing services.
  • Virtual Asset Derivatives — futures, perpetuals, options, and leveraged products, subject to stricter capital and risk rules.
  • Virtual Asset Management & Investment — discretionary management and investment services in virtual assets.
  • Advisory Services — investment advice on virtual assets; the lowest-capital category at PKR 25 million, but it permits advice only, not exchange, custody, or transfer.
  • Fiat-Referenced Token Issuance — issuing a token pegged to a fiat currency (a PKR or USD stablecoin). PKR 1 billion plus reserve-asset requirements backing every token issued.
  • Asset-Referenced Token Issuance — issuing a token backed by another asset or basket (for example tokenized gold). Like fiat-referenced tokens, PKR 1 billion plus reserve requirements.

The two token-issuance categories deserve special emphasis because they are the most demanding. Beyond the PKR 1 billion base capital, issuers must maintain reserve assets backing the tokens in issue and meet additional disclosure, redemption, and audit obligations that can scale as the token's market capitalisation grows. If your model is a stablecoin or a tokenized commodity, treat it as capital plus reserves, and budget accordingly.

• 
  
  
  
• Everything global crypto exchanges, token issuers, and fintechs need to know about getting licensed in Pakistan under the Virtual Assets Act 2026 — the ten licensable activities and their Schedule I capital, eligibility and fit-and-proper, the NOC, Sandbox vs full licence, the real cost envelope, realistic timelines, and the failure modes that sink applications — from a consultancy working on the ground.
• Quick summary. Pakistan now regulates virtual assets under the Virtual Assets Act 2026 (originally promulgated as the Virtual Assets Ordinance, 2025), administered by the Pakistan Virtual Assets Regulatory Authority (PVARA). The Draft VASP Regulations 2026 define ten licence categories, each with a minimum paid-up capital set out in Schedule I — from PKR 25 million for Advisory up to PKR 1 billion for an Exchange or a token issuer. That capital is recoverable (it sits in your own company; it is not paid to the regulator), and PVARA has confirmed there is currently no prescribed application fee. You can enter through four routes: a No Objection Certificate (NOC), the Regulatory Sandbox (which reduces upfront capital), a No-Action Relief Letter, or a full VASP licence. This guide walks through all of it in detail.
• What a VASP License Actually Is
• A VASP (Virtual Asset Service Provider) license is the authorization issued by PVARA that allows a business to legally provide virtual asset services in or from Pakistan. "Virtual asset services" is a broad term that covers running an exchange, holding customer assets in custody, brokering trades, transferring or settling virtual assets, lending, derivatives, asset management, advice, and issuing tokens. Under the Virtual Assets Act 2026, conducting any of these commercially without the appropriate PVARA authorization is prohibited and carries serious civil and criminal consequences.
• It is important to understand what the licence is not. It is not a one-page registration, and it is not a formality you can bolt on after you have started operating. It is a substantive authorization that PVARA grants only after it is satisfied that your company is properly capitalised, your people are fit and proper, your anti-money-laundering systems actually work, your custody and cybersecurity are sound, and your business will treat Pakistani consumers fairly. In other words, the licence is the regulator's statement that it trusts you to operate in its market.
• For a global exchange, the licence is what converts an informal, grey-market user base into a legal, banked, taxable operation — one that can advertise, open corporate bank accounts, move rupees through the formal system, and build a durable brand. In Pakistan, with one of the largest crypto-using populations on earth and a young, mobile-first demographic, that conversion is a substantial prize for early, compliant entrants who establish position before the market matures.
• The Legal Basis: The Virtual Assets Act 2026
• Pakistan's entire VASP framework rests on a single foundational statute: the Virtual Assets Act 2026, originally promulgated as the Virtual Assets Ordinance, 2025 (signed on 8 July 2025) and now operating as the Act. This law established PVARA as the sole federal regulator for virtual asset services, defined the licensable activities, created the entry routes (NOC, Sandbox, No-Action Relief, and full licence), and imposed the AML/CFT, tax-reporting, and consumer-protection obligations that every VASP must meet.

• Crucially, the Act is no longer a bare statute. PVARA has since published the operational rulebook that turns the law into a workable licensing regime:

  • The NOC Regulations — governing the No Objection Certificate route.
  • The Regulatory Sandbox Guidelines 2026 — the supervised testing regime, including the Form I application and the agile, year-round intake.
  • The Activity-Specific Handbooks 2026 — detailed conduct, custody, disclosure, capital, and reporting expectations for each licensed activity. These are the operational rulebooks an applicant must actually design against.
  • The Draft Pakistan Virtual Asset Services Regulations 2026 — which define the ten licence categories and their Schedule I minimum paid-up capital.

Because the VASP Regulations are still in draft, some figures and procedures may change before they are finalised — which is why a serious applicant treats published numbers as draft and confirms them at filing. For the complete walkthrough of the framework, see our complete PVARA Guide.

Who Regulates What — Understanding the Authorities

One of the most common mistakes foreign companies make is assuming PVARA is the only body they deal with. In reality, entering Pakistan as a VASP means coordinating with four or five authorities at once, each with a distinct role:

• • PVARA — the sole federal regulator for virtual asset services. It licenses, supervises, and enforces. It runs the NOC route, the Sandbox, and the full licensing regime, and it can suspend or revoke licences.
  • SECP (Securities and Exchange Commission of Pakistan) — handles incorporation of your local company under the Companies Act 2017, including the resident-director requirement and registered office.
  • FBR (Federal Board of Revenue) — tax registration and reporting, including Section 285BAA virtual-asset transaction reporting and any withholding obligations.
  • FMU (Financial Monitoring Unit) — Pakistan's financial intelligence unit. Every VASP must register on the FMU's goAML system and file Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs).
  • SBP (State Bank of Pakistan) — banking and foreign exchange. SBP Circular No. 10 of 2026 authorised banks to open accounts for PVARA-licensed VASPs — a landmark, because banking was historically the single biggest operational barrier for crypto businesses in Pakistan.

Understanding this map matters because the dependencies run in a specific order. You generally cannot incorporate the right way without knowing your PVARA route; you cannot bank without PVARA recognition and a strong AML programme; and you cannot operate without FBR and FMU registration. Sequencing these correctly is half the battle.

Who Needs a VASP License

Any business carrying on a licensable virtual asset activity commercially in or from Pakistan needs PVARA authorization. That includes:

• • Centralised exchanges (spot and derivatives).
  • Custodians and hosted-wallet providers.
  • OTC desks and brokers acting as principal or agent.
  • Transfer, remittance, and payments businesses built on crypto or stablecoin rails.
  • Lending and borrowing platforms.
  • Virtual-asset managers and advisers (including staking-as-a-service and discretionary management).
  • Token issuers — both fiat-referenced (stablecoins) and asset-referenced (e.g. tokenized commodities).

What does not require a licence is equally important. Pure individual self-custody and personal investing are not licensable activities — the framework regulates the providers who serve customers, not private holders. A person holding their own crypto in a hardware wallet is not a VASP. A business offering custody, exchange, or transfer services to those people is.

A subtle but important point for foreign companies: the obligation can attach to services provided from Pakistan as well as in Pakistan, and to businesses that actively target Pakistani users. If you are onboarding Pakistani customers at scale, assume you are in scope and plan accordingly.

The Licensable Activities — PVARA's 10 License Categories

The Draft VASP Regulations 2026 define ten licence categories, each with a minimum paid-up capital under Schedule I. A single licence can cover more than one category. The capital is recoverable share capital held in your own company — not a government fee — and it can be reduced under the Regulatory Sandbox. The figures below are from the draft regulations and should be confirmed at filing.

License Category	Minimum Paid-Up Capital (PKR)	Approx. USD
Advisory Services	PKR 25 million	~$89,000
Broker-Dealer	PKR 100 million	~$357,000
Custody	PKR 200 million	~$714,000
Virtual Asset Management & Investment	PKR 200 million	~$714,000
Virtual Asset Transfer & Settlement	PKR 200 million	~$714,000
Lending & Borrowing	PKR 500 million	~$1.79 million
Virtual Asset Derivatives	PKR 500 million	~$1.79 million
Exchange	PKR 1 billion	~$3.57 million
Fiat-Referenced Token Issuance (stablecoins)	PKR 1 billion + reserves	~$3.57 million
Asset-Referenced Token Issuance (e.g. tokenized gold)	PKR 1 billion + reserves	~$3.57 million

Here is what each category actually means in practice:

• • Exchange — matching buyers and sellers and converting virtual assets (crypto-to-crypto and crypto-to-fiat). The flagship category for a trading platform, and the most capital-intensive of the operating licences at PKR 1 billion.
  • Custody — holding virtual assets on behalf of customers in hot and cold wallets. Almost every exchange needs this alongside Exchange, because exchanges hold customer assets.
  • Broker-Dealer — acting as principal or agent in transactions, including OTC desks and large-ticket facilitation.
  • Virtual Asset Transfer & Settlement — moving and settling virtual assets, including cross-border transfers and stablecoin-based payments and remittance. This is the core category for a remittance or payout business.
  • Lending & Borrowing — virtual-asset lending and borrowing services.
  • Virtual Asset Derivatives — futures, perpetuals, options, and leveraged products, subject to stricter capital and risk rules.
  • Virtual Asset Management & Investment — discretionary management and investment services in virtual assets.
  • Advisory Services — investment advice on virtual assets; the lowest-capital category at PKR 25 million, but it permits advice only, not exchange, custody, or transfer.
  • Fiat-Referenced Token Issuance — issuing a token pegged to a fiat currency (a PKR or USD stablecoin). PKR 1 billion plus reserve-asset requirements backing every token issued.
  • Asset-Referenced Token Issuance — issuing a token backed by another asset or basket (for example tokenized gold). Like fiat-referenced tokens, PKR 1 billion plus reserve requirements.

The two token-issuance categories deserve special emphasis because they are the most demanding. Beyond the PKR 1 billion base capital, issuers must maintain reserve assets backing the tokens in issue and meet additional disclosure, redemption, and audit obligations that can scale as the token's market capitalisation grows. If your model is a stablecoin or a tokenized commodity, treat it as capital plus reserves, and budget accordingly.

Your Four Entry Routes — Sandbox vs NOC vs No-Action vs Full License

PVARA provides four ways into the market, and choosing the right one is the single most consequential early decision you will make, because it drives your timeline, your capital, and your constraints.

• • No Objection Certificate (NOC). An early regulatory clearance allowing an applicant to begin limited, defined preparatory activity while it builds toward a full licence, subject to baseline AML, governance, and technical conditions. An NOC does not permit commercial launch, offering services to Pakistani users, or marketing — it is a gateway, not an operating permission.
  • Regulatory Sandbox. A supervised testing environment where applicants operate under controlled conditions — limited users, capped volumes, enhanced reporting — and, critically, under reduced, proportionate paid-up capital under Regulation 7(5). The Sandbox lets PVARA observe real-world compliance before granting a full licence, and it lets you test the market without committing the full Schedule I figure. For most new entrants, it is the most capital-efficient starting point.
  • No-Action Relief Letter. Written comfort from PVARA that it does not intend to take enforcement action against a specific, narrowly-defined activity for a limited period. It suits genuinely novel or pilot models that do not yet map cleanly to a defined category. It is not a licence and is not legal immunity — PVARA can withdraw it.
  • Full VASP License. Unrestricted operating permission under the Draft VASP Regulations 2026, granted after meeting the full capital, governance, custody, AML, and audit requirements. This is the durable end-state for an ongoing commercial business.

In practice, most foreign exchanges begin with an NOC or the Sandbox and graduate to a full licence. The Sandbox is usually the smartest first move because the Reg 7(5) capital reduction dramatically lowers the upfront commitment while you prove the model. The right sequence depends on your activity, your appetite for capital lock-up, and how quickly you need to be operating.

The NOC Application — What It Requires

The NOC is typically the first formal step, and getting it right sets the tone for everything that follows. A strong NOC application includes:

• • A detailed business plan for your Pakistan operations and target market.
  • Corporate documents and a clear ownership structure, through to ultimate beneficial owners.
  • Director and shareholder details.
  • Fit-and-proper declarations for key individuals.
  • Proof of financial capability.
  • Your AML/CFT policy and a description of your technology infrastructure.

An NOC grants permission to register on the FMU goAML portal, incorporate a local entity, and proceed toward full licensing. It does not permit commercial launch, offering services to Pakistani users, or marketing in Pakistan — companies that misread this and start operating on the strength of an NOC alone expose themselves badly. Applications are made through the official PVARA portal at pvara.gov.pk.

For the Sandbox route, the primary application document is Form I, accompanied by the Annexure-A self-assessment checklist and, on approval, a formal Undertaking (Annexure-B). The Sandbox runs on an agile, year-round intake — there are no fixed windows — and PVARA targets a comprehensive assessment within roughly 60 working days of a complete application. We cover the Form I requirements in depth in our PVARA Guide.

Eligibility Requirements — Who PVARA Will Actually License

PVARA assesses both the company and the people behind it. The company must be a Pakistan-incorporated entity with a resident director and registered office, properly capitalised for its category, and operationally ready. But the part foreign applicants most often underestimate is the scrutiny of Key Individuals.

Key Individuals are the people who control or significantly influence the VASP — typically the directors, the CEO, the compliance officer or MLRO, significant shareholders, and ultimate beneficial owners. Each must pass a fit-and-proper assessment covering honesty, integrity, competence, and financial soundness. In practice this means:

• • A Pakistan-incorporated Private Limited Company (SECP) with a resident director and registered office.
  • Minimum paid-up capital per Schedule I for your category — recoverable, and reducible under the Sandbox.
  • Police-clearance (character) certificates for Key Individuals from each country of residence, notarised and apostilled (or consular-legalised where apostille does not apply).
  • A documented, genuinely working AML/CFT framework aligned with FATF standards, plus FMU goAML registration.
  • Technical-audit readiness and an appointed, ordinarily Pakistan-resident compliance officer.
  • No history of fraud, financial crime, regulatory sanctions, or relevant criminal conduct among Key Individuals.

The fit-and-proper stage is where confident applications quietly stall, because it depends on documents and histories that take weeks to assemble correctly. A foreign police clearance that needs apostille can take a month or more — start it on day one, not at the end.

The Documentation Checklist

A complete application package generally includes:

• • Memorandum & Articles of Association with a virtual-asset objects clause (SECP).
  • Certificate of Incorporation, NTN, and corporate ownership chart with UBO disclosures.
  • Fit-and-proper packs for all Key Individuals (identity documents, CVs, police clearances, declarations), notarised and apostilled where foreign.
  • Business plan, product scope, and target-market description.
  • AML/CFT policy, KYC/EDD procedures, sanctions and PEP screening, and Travel Rule arrangements.
  • Custody and key-management design; an independent security and technology audit.
  • Capital evidence and financial projections.
  • Consumer-protection, disclosure, and complaint-handling policies.
  • Business-continuity and disaster-recovery plans.

Realistic Timeline — What Actually Happens When

Timelines depend almost entirely on preparation quality, not on the regulator's pace. Two companies that start on the same day can finish a year apart — the difference is whether they filed complete or filed full of gaps. Realistic ranges for a well-prepared applicant:

• • SECP incorporation: roughly 10–20 working days with clean, complete documentation.
  • Compliance build-out: the AML/CFT programme, custody design, FMU registration, and security audit typically run in parallel over roughly 6–12 weeks.
  • Sandbox assessment: PVARA targets a comprehensive evaluation within about 60 working days of a complete application.
  • Sandbox entry: realistically about 3–6 months from incorporation.
  • Full VASP licence: roughly 9–15 months from kick-off.

The two things that blow up timelines are document lead times that you discover late (a police clearance that takes eight weeks, started in week thirty) and the query cycles triggered by an incomplete first filing (each round can add 60–120 days). Both are preventable with preparation, which is exactly where an experienced partner earns their fee.

Cost Breakdown — What a VASP License Actually Costs

The single most misunderstood part of entering Pakistan is cost, so let us be precise — and correct a figure that circulates widely and is simply wrong.

The dominant cost is paid-up capital, and it is recoverable. Depending on your category, this ranges from PKR 25 million (Advisory) to PKR 1 billion (Exchange and token issuance), as set out in Schedule I above. This is not a fee paid to PVARA — it is share capital held inside your own company to fund operations, recoverable on an orderly wind-down. It can also be reduced under the Regulatory Sandbox while you test. Any source telling you an exchange licence "costs around $180,000" is conflating fees with capital and is off by an order of magnitude — the real capital expectation for an Exchange is approximately USD 3.57 million (PKR 1 billion), reducible via the Sandbox.

There is currently no prescribed PVARA application fee. PVARA has confirmed this. If fees are introduced in future, they will be published in the Rules. So the cost equation is dominated by recoverable capital, not by government charges.

Setup and compliance costs are real but knowable. These include SECP incorporation and corporate services, the AML/CFT build, the independent security audit, custody design, banking facilitation, and professional advisory. They are planned upfront and are modest relative to the capital figure.

The practical takeaway is that the headline cost of entering Pakistan is recoverable capital, not fees — which is precisely why structuring the right category mix and using the Sandbox capital reduction matters so much. A well-structured entry can free up a great deal of capital that a naive one would lock away. (All figures are based on the draft 2026 regulations and confirmed at filing.)

CoinConnect's licensing engagements are scoped to your model and route — contact us for a tailored quote.

Foreign Exchange Entry — How Global Exchanges Actually Enter

A foreign entity cannot hold a PVARA licence directly. The standard path for a global exchange is:

• 1. Incorporate a Pakistan subsidiary through SECP. It can be fully foreign-owned, but it needs a Pakistan-resident director and a registered office. See our corporate setup service.
  2. Register with the FBR and the FMU (goAML), and begin banking groundwork immediately.
  3. Obtain an NOC or enter the Sandbox to begin supervised activity under reduced proportionate capital.
  4. Arrange banking under SBP Circular No. 10 of 2026, with an AML programme built to satisfy a bank's compliance team.
  5. Graduate to a full VASP licence and launch commercial operations with compliant PR and community activation.

The step most often underestimated is banking. A licence you cannot bank is unusable — and banking appetite in Pakistan is conditional on a strong AML programme, a credible resident signatory, clear fund flows, and PVARA recognition. Banking should be engineered in parallel from day one, not chased after the licence lands. See our Tax & Banking guide for how the fiat on-ramp, FX, and repatriation pieces fit together.

After Approval — Ongoing Obligations

A licence is the start of supervision, not the end of compliance. Ongoing obligations include:

• • AML/CFT and the FATF Travel Rule: continuous customer due diligence, transaction monitoring, sanctions and PEP screening, and FMU goAML reporting. Originator and beneficiary information must accompany transfers above the applicable threshold.
  • Tax: FBR registration, Section 285BAA transaction reporting, and withholding where applicable. Pakistan's framework is built around exchange-level reporting.
  • Custody and conduct: client-asset segregation, fair and clear disclosures, complaint-handling, and adherence to the standards in PVARA's Activity-Specific Handbooks.
  • Capital and reserves: maintaining Schedule I capital on an ongoing basis, and — for token issuers — maintaining reserve assets backing every token in issue.
  • Reporting and audits: periodic reporting to PVARA, ongoing security and operational audits, and prompt incident notification.

Failure to maintain these can lead to remediation directions, fines, licence conditions, suspension, or revocation — and serious breaches can expose Key Individuals personally. Compliance is a standing operating discipline, not a one-time filing.

Penalties for Operating Without a License

Operating an unlicensed virtual asset business in Pakistan is taken seriously. The Act provides for substantial financial penalties and imprisonment, alongside forfeiture of assets used in the activity and disqualification of those involved from future licensing. Indicatively, unlicensed operation can attract fines up to the order of PKR 50 million and imprisonment of up to five years, with separate provisions for unauthorized token offerings. Exact figures and offences are set out in the Act and should be confirmed against the current text, but the direction is unambiguous: the cost of operating without a licence vastly exceeds the cost of obtaining one.

Why VASP Applications Get Rejected — The Failure Modes

After watching this market closely, we see the same causes of rejection and delay again and again. None of them is bad luck:

• • Filing incomplete. The single biggest cause of delay. An incomplete application triggers query cycles, each adding 60–120 days. The discipline to not file until the application is genuinely complete is the most protective behaviour there is.
  • Compliance on paper, not in practice. An AML programme that describes the right things without doing them collapses under an examiner's questions. Build working systems against the handbooks, not a binder of policies.
  • Capital misjudged. Budgeting from outdated or third-jurisdiction figures instead of Schedule I leads to a credibility crisis with your own board. Price it correctly, and structure it to lock up as little as possible via the Sandbox.
  • Fit-and-proper surprises. Foreign police clearances and apostilles started too late; beneficial-ownership questions no one anticipated. Pre-clear your people first.
  • Wrong route or category. A technically excellent application aimed at the wrong route or category is wasted work, and the fix is structural.
  • Banking left until last. A licence with no rupee rail is not a business. Engineer banking in parallel.
  • No one reading the file the way the regulator will. Applicants read their own files the way an author reads a manuscript — they see what they meant, not what is on the page. Weaknesses then reach PVARA intact.

How CoinConnect Helps

CoinConnect is Pakistan's dedicated crypto market-entry and PVARA licensing firm. We map your route and licence categories, structure your capital to lock up as little as possible, build (not merely describe) your AML/CFT framework, attack your application before PVARA does, engineer banking from day one, and take you all the way to a live, licensed, banked, operating business. You can engage us end-to-end, or for a single component — including a licence-only / NOC engagement if you already have your own banking, AML, and tech teams and just need the regulatory piece.

We never guarantee a regulator's signature — no honest firm can, and you should walk away from anyone who does. What we guarantee is that we control everything except that signature, and that we make you the applicant PVARA has no rational reason to refuse.

Book a free scoping call · WhatsApp +92-329-9552299 · Telegram @Abbas1101 · team@coinconnect.site

The Regulatory Sandbox in Detail

Because the Sandbox is the route most new entrants should consider first, it is worth understanding how it actually works. It runs on an agile, year-round intake — there are no fixed application windows, so you can apply whenever you are ready. The process moves through a defined sequence: you submit Form I (a full description of your innovation, blockchain and technology stack, cybersecurity strategy, regulatory analysis, and a risk-management table), accompanied by the Annexure-A self-assessment checklist. PVARA then screens the application for completeness, and incomplete submissions are returned with a limited number of resubmissions permitted.

Once accepted, PVARA conducts a comprehensive assessment — targeted at around 60 working days — during which it may seek input from other regulators and request additional information. Successful applicants receive a Letter of Approval (LoA) setting out specific terms, conditions, and testing parameters, and may be granted a No-Action Letter for the testing period. Before going live, participants submit a formal Undertaking (Annexure-B) committing to the sandbox terms, consumer protection, AML/CFT obligations, data security, incident notification, record retention, and PVARA's full access rights.

PVARA evaluates Sandbox applications across several dimensions: genuine innovation and market impact; risk management and compliance (including ML/TF, cybersecurity, and consumer protection); feasibility and a credible exit strategy; financial strength; tax-law compliance; and demonstrable consumer or investor benefit. The Authority can also impose limits on user numbers, transaction volumes, or exposure during testing. At the end of the testing period you submit a completion report, and PVARA determines whether you transition to full licensing or wind down. Critically, the Sandbox is where the Regulation 7(5) reduced-capital provision applies — letting you test under proportionate capital rather than the full Schedule I figure.