PVARA Licence Tracker: Who Is Actually Approved in Pakistan

This page is a maintained record, not a news story. It is checked against PVARA's own published instruments and updated when they change. Everything below states the date it was verified. The live status board above reads the same feed the CryptoPakistan mobile app reads, so the two cannot disagree.

The position as of 9 September 2026: no company holds a full PVARA licence. The 5 September deadline for existing providers to file has passed, and PVARA has published nothing since — no enforcement statement, no count of applications, no register. Three exchanges are reported to have reached, or entered, the No Objection Certificate stage. An NOC is not a licence, and PVARA still does not publish the public register that would let anyone verify a claim independently.

The 5 September 2026 deadline

The deadline fell on 5 September 2026. It applied to companies, not to individual traders, and it has now passed without a word from the regulator that set it — no enforcement statement, no list of who filed, no extension. Checked against pvara.gov.pk on 9 September 2026; the licensing page still carries its pre-deadline wording.

Section 70(1) of the Virtual Assets Act, 2026 gives any person who was already providing virtual asset services in Pakistan when the Act commenced six months to apply — or to stop. Regulation 5A(1) of S.R.O. 1419(I)/2026 repeats that six-month clock and routes it through regulation 6, the No Objection Certificate regulation. PVARA's own website states the outcome in plain terms: transitional persons operating on or before 5 March 2026 must submit an NOC application by 5 September 2026 or cease operations.

Regulation 5A(2) is the part worth reading closely. An existing provider that files a complete NOC application inside the window may keep operating while the application is decided — but only while it complies with any interim directive PVARA issues and continues to meet the Act's core obligations on customer asset protection and AML/CFT. A proviso added between the June draft and the notified text goes further: while the application is pending, any marketing activity needs PVARA's prior approval. Regulation 5A(3) lets PVARA impose interim limits on onboarding, products, transaction volumes or custody arrangements during that period.

One ambiguity has never been resolved in the statute. The Act does not name a commencement date. It received assent on 4 March 2026 and was published in the Gazette on 5 March 2026, so six months lands on either 4 or 5 September. Neither notified S.R.O. picks one. PVARA's website picks the Gazette date. The Act does not.

For an ordinary user, the practical read is narrow: if a platform you use has been operating in Pakistan and does not file, its lawful route is to stop serving Pakistani customers. Nothing in the deadline creates an obligation on you personally.

What the deadline actually changed

Three things are now true that were not true a week ago.

A filer may keep trading. Regulation 5A(2) lets a transitional provider that filed a complete NOC application inside the window keep offering its existing services until PVARA decides the application. That permission is conditional: it lasts only while the provider complies with any interim directive and continues to meet the Act's core obligations on customer asset protection and AML/CFT/CPF, and under the proviso it needs PVARA's prior approval for any marketing at all. Regulation 5A(3) lets PVARA cap onboarding, products, transaction volumes or custody arrangements while the application sits.

The two names already on this page were probably not the ones being counted. Binance and HTX hold NOCs granted in December 2025, under the PVARA No Objection Certificate Regulations 2025 — an instrument effective 2 December 2025, ten days before those NOCs were reported. Regulation 7(7) carries a 2025 NOC holder straight to a licence application, and exempts an applicant still in correspondence under the 2025 regime from filing afresh under regulation 5A. Read together, that points away from the two exchanges having had anything to file by 5 September. PVARA's own licensing page states the deadline in blanket terms and has not addressed the point, so this is our reading of two instruments rather than something the regulator has confirmed.

Their own deadline falls in November. Clause 15.3(c) of the 2025 NOC Regulations, repeated at clause 17.1(a)(iv), obliged an NOC holder to submit its licensing application “within three months of the issuance of the VASP licensing regulations”. Those regulations were issued on 21 August 2026, which puts the licence applications for the December 2025 cohort due around 21 November 2026. That obligation survives because regulation 5A(4) saves it: any instrument granted by PVARA under the Virtual Assets Ordinance continues in full force as if issued under the corresponding powers of the Act, and the 2025 Regulations are built on the Ordinance throughout. Nothing in S.R.O. 1419(I)/2026 expressly repeals them, so the three-month condition rides along as a term of a saved grant rather than as a rule of the current regime.

For everyone else, the next date is a decision, not a filing. Regulation 6(3) gives PVARA sixty days from a complete application to grant or refuse an NOC, with written reasons for a refusal. An application filed on the deadline and complete on the day it was filed falls due by 4 November 2026. “Complete” does the work in that sentence: the clock starts when PVARA has what it asked for, and nothing obliges it to say publicly when that happened, or that it happened at all.

What an NOC actually is, and is not

In PVARA's own words, the NOC "gives Virtual Asset Exchanges the regulatory clearance they need to register on the FMU goAML portal and incorporate a licensed local entity in Pakistan."

Regulation 6(4) of S.R.O. 1419(I)/2026 says what it is not, without hedging. An NOC:

• does not constitute a licence or authorisation to carry on any virtual asset service;
• is without prejudice to PVARA's full assessment of any later licence application; and
• may be withdrawn where it was obtained on materially false, misleading or incomplete information.

One qualification, and it is the reason Binance and HTX have been reachable from Pakistan at all. The 2025 NOC Regulations were more permissive than the ones that replaced them: clause 17.1(a)(iii) let an NOC holder provide “AML-Registered Services” — Exchange, Broker-Dealer, Custody and Derivatives only — once it had registered on goAML, in advance of a licence. Regulation 6(4)(a) of the 2026 regulations grants no such thing. An NOC issued today authorises nothing.

Two further details rarely get reported. An NOC is valid for three months from issuance, extendable once by up to three more on an application made before expiry, for reasons recorded — regulation 6(5). And where a company incorporated on the back of an NOC then fails to apply for a licence, regulation 6(7) gives it written notice and at least thirty business days to apply, request an extension, or confirm it will not hold itself out as a VASP; regulation 6(8) lets PVARA refer the matter to the SECP.

So an NOC is a short-lived permission to proceed, not a standing status. A December 2025 NOC is not governed by regulation 6(5)'s three-month life, though: regulation 5A(4) saves instruments granted under the Ordinance, and the 2025 NOC Regulations set their own clock — the licence application is due within three months of the VASP licensing regulations being issued. It is a live permission with a November expiry on the obligation attached to it, not a lapsed one and not an open-ended one either.

What holding an NOC does not give you, as a customer: no supervision of the platform as a licensed VASP, no client-asset segregation enforceable under these regulations, no complaints route to PVARA, and no protection for funds held on the platform.

The two routes to a licence

PVARA publishes two tracks, and they are not equivalent.

Track B — NOC to licence. Apply for an NOC (Form I). Receive it. Complete regulatory compliances, including registration with the Financial Monitoring Unit on the goAML portal. Incorporate a subsidiary in Pakistan under the Companies Act 2017. Then apply for the licence itself (Form II) under regulation 7. This is the track the 5 September deadline runs through.

Track A — sandbox to licence. Apply to test an innovative product under supervision, admit to the sandbox, test within an agreed scope and customer cap, exit against agreed criteria, then apply for a licence. Regulation 7(6) makes the useful part explicit: a sandbox participant that completes testing to PVARA's satisfaction may apply directly for a licence and does not need a separate NOC. Participation creates no entitlement to a licence.

Two features of the sandbox shape who it is for. PVARA's Sandbox Guidelines 2026 require an applicant to confirm the product is "not designed for speculation, anonymity, or illicit activity" — speculation sits there as a disqualifier, not a risk to be managed. And the evaluation criteria list "consultation with Shariah advisors where applicable". Applications are accepted year-round, evaluation runs to sixty working days after initial screening, and an incomplete application can be resubmitted twice.

There is also a legacy path. Regulation 7(7) provides that anyone granted an NOC under the NOC Regulations 2025, or already in correspondence on a 2025 application, may apply directly for a licence without filing fresh under regulation 5A or 6.

The eleven licence categories, and what each costs

Schedule I of the Act sets out eleven licence categories. An applicant may apply for one or more. Schedule-I to S.R.O. 1419(I)/2026 prices each of them, and sets a common governance condition: a company incorporated under the Companies Act 2017 with a minimum of three directors, with the experience and financial-statement requirements in regulations 20–22 and Schedule-II applying across all categories.

Figures read from Schedule-I, page 72 of S.R.O. 1419(I)/2026 as notified, checked against the PDF on 31 August 2026.

Five of these figures fell between the consultation draft of 11 June 2026 and the notified text: Advisory from 25m to 15m, Broker-Dealer from 100m to 75m, Exchange from 1bn to 500m, and both token-issuance categories from 1bn to 300m. Mining was priced for the first time. Five categories did not move.

What went the other way is easy to miss. The draft carried a sentence, immediately after the table, allowing the Authority to grant a restricted licence with reduced minimum paid-up capital subject to customer caps and product restrictions. That sentence does not appear in the notified text, and the phrase "reduced minimum paid-up capital" occurs nowhere in it. The underlying power survives — regulation 7(5) still permits a limited-scope licence — but its explicit link to a lower capital figure is gone. Read together, the notified schedule is friendlier to an applicant who could already clear the old bar and offers nothing new to one who could not.

How long each stage takes

The clocks only start when PVARA confirms in writing that an application is complete — regulation 7(2) — and they stop while further information is outstanding. A firm entering the process today, cleanly, is looking at months rather than weeks before a licence could exist to be verified.

What a licence will actually buy you as a customer

None of this is in force for any platform yet, because no licensee exists. It is worth setting out anyway, because it is the difference the register will eventually mark.

• Client assets segregated. Regulation 33 requires a licensee holding customer assets to keep them segregated and forbids treating them as its own — no use, pledge, encumbrance, lending or rehypothecation except as expressly permitted and with the customer's prior informed explicit consent, recorded.
• Assets available for return. Regulation 33(3) requires arrangements, reconciliations and controls ensuring assets are there to be returned on time. Regulation 33(4) lets PVARA require, for specified categories, that holdings equal 100% of customer liabilities at all times and mirror them in denomination and liquidity.
• Token reserves fully backed. Regulation 34(3) requires an FRT or ART issuer to hold reserve assets equal to 100% of outstanding redemption liabilities at all times, as a segregated reserve. For a fiat-referenced token those reserves must be high-quality liquid assets with redemption at par without undue delay.
• A complaints procedure with deadlines. Regulation 53 requires accessible channels, acknowledgement within 24 hours, and a written update with reasons if a complaint is not resolved within seven working days. Licensees must publish how to complain and the applicable timelines, and the licensee stays responsible even where an agent or group entity delivered the service.
• An escalation route beyond the platform. Where PVARA establishes or recognises an independent dispute-resolution scheme under section 45(2) of the Act, licensees must tell complainants about it and implement its outcomes.
• Records that outlive the dispute. Regulation 10(1)(c) requires books and records sufficient for PVARA to assess compliance and financial position, retained for not less than seven years.
• Fit-and-proper people at the top. Regulation 8 covers controllers, directors, sponsors and the managing director, on integrity, competence, financial soundness and conflicts, on an ongoing basis — with criminal-record checks, regulatory references and interviews available to PVARA.
• A public register. Regulation 9(6) obliges PVARA to maintain and publish an up-to-date public register of licensees.

Operating without a licence carries fines up to PKR 50 million and imprisonment of up to five years under the Virtual Assets Act, 2026.

What is still missing

The regulations are notified and operative. They are not complete, and the gaps matter to anyone trying to plan around them.

• No fee is set anywhere. Regulation 11(1) defers processing, licensing, annual supervisory and renewal fees to Rules that have not been published. Form II asks the applicant to enclose evidence of payment of "PKR [x]" — the placeholder is in the notified instrument.
• No public register exists yet. Regulation 9(6) requires one. Until it is published, every entry on this page comes from press reporting and company announcements, not an official list.
• No prescribed risk disclosures. Section 43(2) of the Act requires them for marketing materials; they have not been prescribed.
• No leverage cap. Across both instruments — 178 pages — no numeric maximum leverage ratio appears. Regulation 13(1) of S.R.O. 1420(I)/2026 leaves the limit to each licensee, "proportionate to its risk profile, Client base, product characteristics and operational capacity". Regulation 11(4) then warns a licensee not to rely on a fixed leverage cap alone as a substitute for a prudent margin framework. The retail protections in that chapter — an appropriateness assessment before offering derivatives to a retail client, an eleven-term client agreement, immediate incident reporting, monthly statements — are real, and owed by nobody today, because no derivatives licensee exists.
• No statement of reasons. PVARA has not published why anything changed between the June draft and the notified text.
• No account of the deadline. PVARA set the 5 September date on its own licensing page and has published nothing since it passed — no count of applications received, no enforcement position, and no correction to that page, which still reads as though the date were ahead.

How to check a "PVARA licensed" claim

Marketing has been running ahead of the facts. A short test, in order:

1. Ask for a licence number. Form III shows that a licence carries one, plus an effective date and the named categories. No number, no licence.
2. Check the category against the service. A licence names specific categories. An advisory licence does not authorise running an exchange.
3. Treat "NOC" and "licence" as different words. They are. So are "approved", "cleared", "registered" and "in the process".
4. Check the register — once regulation 9(6)'s register exists. Until then, no claim of licensure can be verified from any official source, which is itself the answer.
5. Be sceptical of an entity marketing while an application is pending. Under the proviso to regulation 5A(2), a transitional applicant needs PVARA's prior approval to market at all.
6. Ask whether they filed, and when. A transitional provider trading today is relying on regulation 5A(2). If it will not say that it filed a complete application before 5 September, it is not relying on anything.

As of 9 September 2026, any platform describing itself as a licensed PVARA VASP is misdescribing its position.

Where tax fits, and does not

PVARA licenses and supervises. It does not assess tax. Liability on crypto gains in Pakistan is a matter for the Federal Board of Revenue and the Income Tax Ordinance, and it is unaffected by whether the platform you used holds an NOC, a licence, or nothing at all. The two regimes are often conflated in local coverage; they are separate, and a change in one does not move the other.

Timeline

Questions people actually ask

Is crypto legal in Pakistan now?

Providing virtual asset services is lawful only with a licence, and the Act creates the licensing regime. Holding or trading crypto as an individual is not what the Act licenses; it regulates the providers.

Is Binance licensed in Pakistan?

No. Binance is reported to hold a No Objection Certificate issued in December 2025. No company holds a full PVARA licence as of 9 September 2026. Its NOC came from the 2025 NOC Regulations, and that instrument set its own clock: the licensing application was due within three months of the VASP licensing regulations being issued, which points at around 21 November 2026.

The deadline has passed — what now?

Nothing was scheduled to happen to your funds on the day, and nothing did. The deadline obliged providers to have filed, not users to act. What has changed is what a platform's silence now means: a provider still serving Pakistani customers is either a timely filer trading under regulation 5A(2), or is operating unlawfully, and from the outside those look identical, because no register exists to tell them apart. That is a reason to hold less on any platform that will not say which it is — and asking is fair.

Does an NOC mean my money is protected?

No. The client-asset rules in regulation 33 bind licensees. There are none yet.

Can I see the official list of approved companies?

Not yet. Section 21(4) of the Act and regulation 9(6) both require PVARA to publish one; it has not. Note what it will cover: Licensees, with name, licence number, permitted services and regulatory status. Neither instrument requires PVARA to publish who holds an NOC, so the NOC rows on this page may never have an official counterpart. This page will link to the register, and defer to it, the moment it exists.

How much does a licence cost?

The capital requirement is in the table above. The fees are not set — regulation 11(1) leaves them to unpublished Rules.

Can a small startup get in?

Through the sandbox, yes — it is open year-round and is the only supervised route currently available. The reduced-capital relief for restricted licences that appeared in the draft did not survive into the notified text.

How this page is maintained

The status board at the top of this page is generated from a single hand-maintained record, served over an API and rendered identically here and in the CryptoPakistan app. It carries its own last-verified date and its own corrections log, because that date is when the facts were checked rather than when this prose was written.

Entries are drawn from PVARA's published instruments and its own website wherever possible, and from named press reporting where not. Where those two disagree, the page says so rather than picking a side. When PVARA publishes the register required by regulation 9(6), the entries here will be replaced with it.

Corrections are logged, not quietly edited. If something here is wrong, tell us and it will be fixed on the record.

Sources

• PVARA — VASP Licensing
• PVARA — S.R.O. 1419(I)/2026, Pakistan Virtual Asset Services Regulations, 2026 (77 pp)
• PVARA — S.R.O. 1420(I)/2026, Activity Specific Regulations, 2026 (101 pp)
• PVARA — Public Consultation PVARA/CON/001/2026
• PVARA — Advisory PVARA/ADV/001/2026 (26 April 2026)
• Dawn — Pakistan legalises virtual assets
• The Block — Parliament passes Virtual Assets Act
• Cointelegraph — Pakistan clears Binance and HTX to seek local licences
• PVARA — Licensing (retrieved 9 September 2026)
• PVARA — No Objection Certificate Regulations 2025 (PVARA/REG/AML-REG/2025-1, effective 2 December 2025)