Pakistan Opens Virtual Asset Licensing Portal as Rules Set Capital and Banking Conditions

New rules put virtual asset businesses under formal supervision

Pakistan has opened an application portal for virtual asset licences, with minimum capital requirements ranging from PKR 15 million to PKR 500 million and separate rules for exchanges, custody providers, token issuers and other businesses. The Pakistan Virtual Assets Regulatory Authority (PVARA) says its two sets of licensing regulations were notified and took effect on August 21, 2026.

Minister of State and PVARA Chairman Bilal Bin Saqib briefed Prime Minister Muhammad Shehbaz Sharif and the federal cabinet on the framework, alongside work on sovereign debt tokenization, digital finance pilots and international cooperation. Officials said the licensing regulations were implemented within five months of the Virtual Assets Act, 2026, and that the authority achieved its stated milestones while spending less than 8% of its allocated budget.

The practical change is a defined route into a regulated market. Companies must obtain authorization for the services they offer, meet capital and governance requirements, protect customer assets and comply with financial crime controls. Conditional access to banking gives licensed providers a way to settle authorized transactions through separate customer money accounts.

There is an important discrepancy in the category count. The cabinet briefing and launch reports describe a framework covering 10 activities. PVARA's official licensing page lists 11 licence categories, separating tokens tied to a single currency from tokens tied to other assets, baskets or rights. Businesses should use the official category list when assessing which permissions they need.

The establishment of a licensing system does not mean every applicant has been approved, or that every asset available through a licensed platform carries a government guarantee. The distinction between preliminary permission, a full licence and approval of an individual investment runs through the framework.

What the licensing framework covers

PVARA's official licensing framework identifies two regulatory instruments made under section 68 of the Virtual Assets Act, 2026: the Pakistan Virtual Asset Services Regulations, 2026, and the Pakistan Virtual Asset Services Activity Specific Regulations, 2026. Both took effect on their gazette notification date, August 21.

The first sets requirements across licensed businesses, including governance, financial resources, market conduct, technology, customer asset protection and controls against money laundering, terrorism financing and proliferation financing. The second adds requirements for each type of service. A licence authorizes only the categories expressly specified in it, rather than providing unrestricted permission to operate throughout the market.

The official list covers advisory services; broker and dealer services; custody; exchanges; lending and borrowing; derivatives; asset management and investment; transfer and settlement; issuance of tokens tied to fiat currency; issuance of tokens tied to other assets; and mining related services. Applicants may seek more than one category.

The difference between the reported total of 10 and the official total of 11 appears to reflect the grouping of token issuance into one activity in launch accounts. The official page treats the two issuance categories separately. Its guidance also says the Act and regulations prevail over the explanatory information on the website.

Mining has a narrower boundary than the category name might suggest. PVARA says pure mining alone does not require a virtual asset services licence. Operations involving customer funds, customer assets or professional services to third parties may require one. A separate registration or declaration framework may also apply if the authority establishes thresholds for scale, energy use or computing activity.

How the framework developed

The five month implementation claim concerns the period from the permanent Act to the licensing regulations. A separate account describes a roughly 15 month institutional journey beginning with PVARA's establishment in July 2025 under an initial ordinance. These periods measure different stages rather than the same starting point.

The sequence also shows that preliminary approvals and banking arrangements preceded the final licensing regulations:

• July 2025: PVARA was established under an initial ordinance.
• December 2025: Binance and HTX received preliminary no objection certificates.
• March 2026: Parliament established the permanent statutory framework through the Virtual Assets Act, 2026.
• April 14, 2026: State Bank of Pakistan Circular No 10 introduced conditional banking access for licensed providers, replacing restrictions dating from 2018.
• June 11 to July 2, 2026: Public consultation PVARA/CON/001/2026 ran, including a stakeholder webinar.
• August 21, 2026: The licensing and activity specific regulations took effect.
• September 5, 2026: The framework set the application deadline for transitional operators.
• September 2026: PVARA participated in a dialogue on blockchain and tokenized finance in New York.

The December approvals should not be confused with full licences under the August regulations. PVARA's guidance allows holders of certificates issued under the 2025 rules to apply directly for a licence, while still undergoing the required assessment.

The deadline and routes to a full licence

Under section 70, transitional businesses operating on or before March 5, 2026, were required to submit a no objection certificate application by September 5, 2026, or cease operations. Launch accounts describe continued operation after that date without filing as an offence. The deadline concerned submitting the preliminary application, not completing the entire licensing process.

A no objection certificate, or NOC, is preliminary permission to proceed through the necessary formalities. It is not a licence to provide virtual asset services. The normal route involves applying for an NOC, incorporating a company in Pakistan and submitting a full licence application within the certificate's validity period.

PVARA must grant or refuse an NOC within 60 days of receiving a complete application. A certificate lasts three months and may be extended by up to a further three months if an application is made before expiry and reasons are recorded.

A complete licence application has a 90 day decision period. PVARA may extend that by up to 60 days for complexity, novel risks or consultation with other authorities. The clock begins only when the authority confirms that the documents are satisfactory and complete. Requests for additional information suspend the decision period until the applicant responds.

The alternative is a regulatory sandbox, a supervised environment in which a business tests an innovative product within agreed limits on customers, duration and activities. Successful participants may apply directly for a licence without a separate NOC. Completion does not guarantee approval, and sandbox participation does not remove the transitional filing requirement described in the launch announcements.

Capital, ownership and management requirements

Applicants must be incorporated in Pakistan under the Companies Act, 2017, and have at least three directors. The Act and regulations do not require Pakistani shareholding or impose a cap on foreign ownership, allowing a company with entirely foreign shareholders to apply if it meets the local incorporation and regulatory conditions.

Minimum paid up capital varies by activity. Advisory services require PKR 15 million, while broker and dealer services require PKR 75 million. Custody, asset management and investment, and transfer and settlement each require PKR 200 million.

Both token issuance categories require PKR 300 million. Exchanges, lending and borrowing, derivatives and mining related services each require PKR 500 million. The highest minimum is therefore about 33.3 times the advisory requirement, comparing PKR 500 million with PKR 15 million. These are capital requirements, not licence application fees.

Applications must contain more than evidence of funding. PVARA requires business plans with three year financial projections and adverse scenarios, ownership and board details, information on custody arrangements, and an explanation of where customers and key operations are located. Directors and senior personnel must meet suitability criteria, including background checks.

Providers also need cybersecurity measures, arrangements to continue operating or recover after disruption, customer identification procedures, transaction monitoring and suspicious activity reporting. Offshore delivery does not necessarily place a business outside the rules: targeting, promoting to or onboarding people in Pakistan may bring an activity within the regulatory scope.

Customer protection is a legal obligation, not an investment guarantee

The framework seeks to separate customer property from the provider's own assets, addressing what happens when a business misuses funds or fails. At the launch, Saqib described the obligations facing licensed companies and the protection intended for their customers.

Licensed Virtual Asset Service Providers must keep customer holdings separate from their own, cannot lend or pledge them without written consent, and cannot touch them if the platform fails. Those will be legal obligations now, not promises.

These rules target the handling of assets, not their market value. Keeping customer holdings separate does not prevent a token from falling in price, and licensing a platform does not establish that every asset it lists is suitable for every customer.

PVARA expressly says it does not approve, endorse or guarantee individual virtual assets. An exchange remains responsible for its listing decisions and must apply its published standards. Notifying the authority about a listing does not constitute approval, although the authority can direct a licensed firm to suspend, restrict or stop specified activity involving an asset.

The official guidance provides a way to distinguish authorization from promotional claims. PVARA maintains a public register of licensees. Licensed companies must also publish their legal name, registered address in Pakistan, contact information, licence number and authorized service categories on their websites.

The cabinet briefing and launch announcements do not establish how many full licences have been issued, the number of customers covered, or how the protections have worked in an actual provider failure. Those are separate measures of implementation from opening the application portal.

Banking access comes with tight limits

The State Bank's April 14 circular supplies a banking route for the licensing system. Regulated institutions may open accounts for PVARA licensed providers after obtaining a copy of the valid licence and independently verifying its authenticity with the authority. The instructions were reported to take effect immediately.

Where the provider's business model requires them, banks may establish separate client money accounts for authorized settlements. These accounts must be denominated in Pakistani rupees and pay no remuneration. Cash deposits and withdrawals are prohibited, and customer funds must not be mixed with the provider's own money.

Funds in those accounts cannot serve as collateral or security for financing extended to the provider. Banks must examine the business, customer base, onboarding arrangements and geographic markets, adjust their risk assessments, monitor the relationship and report suspicious transactions to the Financial Monitoring Unit.

NOC holders may receive limited purpose accounts to complete licensing formalities. Additional services, including transactions related to virtual assets, become available only after a full PVARA licence is granted and the banking conditions are met.

The permission is therefore narrower than unrestricted bank participation in cryptocurrency markets. Banks may not invest, trade or hold virtual assets using their own funds or customer deposits. Their foreign exchange and other regulatory responsibilities also continue even when they work with a licensed provider.

Tokenization plans extend beyond trading platforms

The cabinet briefing placed licensing alongside work on a tokenized financial infrastructure. PVARA is exploring sovereign debt tokenization with the Ministry of Finance, including proposals involving digital Eurobond issuance and Naya Pakistan Certificates. These were described as work in progress or plans under consideration, not completed offerings.

Tokenization means representing an asset or financial claim as a digital token recorded on a blockchain. For a debt instrument, the central issues remain the rights attached to the claim, the issuer's repayment obligations and the rules governing transfers and settlement. A different technical record does not by itself change those obligations.

Saqib also described possible uses involving exporters' trade receivables, working capital and Islamic finance. A trade receivable is money owed to an exporter for goods or services already supplied. The proposed connection to capital markets would concern financing against that claim, rather than simply creating another tradable cryptocurrency.

Officials reported progress on modern payment systems across borders and digital finance pilots. The stated sequence begins with licensing, customer protection and financial crime enforcement, before expanding into remittances, digital exports, trade finance and tokenized securities.

No issuance amounts, participating investors, pilot transaction volumes or firm launch dates were given for the sovereign debt proposals. Their significance lies in the direction of the work: extending the regulatory project from supervising virtual asset businesses to testing financial applications. Claims of completed financing or lower payment costs would require further results.

AI, spending and international engagement

Officials told the cabinet that artificial intelligence had become a core part of PVARA's regulatory system and that major milestones were achieved using less than 8% of the allocated budget. The briefing did not give the budget amount, an expenditure breakdown, or enough operational detail to assess the contribution of AI independently.

A low reported spending share does not establish how much capacity will be needed for continuing supervision. The framework requires assessments of ownership, capital, customer protection, technology and financial crime controls across businesses with different risks. Saqib identified stronger institutional capacity and coordination with existing financial regulators as priorities.

Internationally, PVARA and Pakistan's Permanent Mission to the United Nations worked with the UN Office for Digital and Emerging Technologies on a September 2026 dialogue in New York titled Blockchain and the Tokenized Future. The event concerned safeguards for emerging financial infrastructure and Pakistan's participation in those discussions.

In describing the regulator's purpose during the cabinet briefing, Saqib put credibility and customer protection ahead of announcement totals:

The objective is not to issue licences for the sake of announcements. It is to build a regulator whose licences carry credibility, whose supervision protects Pakistanis, and whose framework enables responsible investment and innovation.

The next measurable developments are the processing of applications, publication of authorized providers and evidence from the proposed pilots. No further fixed hearing, issuance or pilot release date was announced in the briefing. The framework sets decision periods for complete applications, but those periods do not provide a common approval date for all applicants.

Key Points

• PVARA's licensing and activity specific regulations took effect on August 21, 2026, and its application portal is open.
• The official framework lists 11 licence categories, while the cabinet briefing and launch reports describe 10 activities.
• Transitional operators were required to apply for an NOC by September 5, 2026, or cease operations.
• An NOC is preliminary permission, not authorization to provide virtual asset services.
• Minimum paid up capital ranges from PKR 15 million to PKR 500 million, depending on the category.
• Licensed providers can obtain conditional banking access, including separate rupee accounts for customer funds.
• Licensing does not amount to government endorsement or a guarantee of individual virtual assets.
• Sovereign debt tokenization and payment pilots remain development projects, with no firm issuance amounts or launch dates announced.