PVARA

PVARA's Sandbox Rules Shut Out Speculative Products

PVARA's Sandbox Guidelines 2026 require applicants to confirm their product is not designed for speculation — and put Shariah advisors into the evaluation criteria.

PVARA has published its Sandbox Guidelines 2026, setting out how firms can test virtual asset products in Pakistan under regulatory supervision before committing to a full licence. Two provisions in the document deserve far more attention than they have received.

PVARA's sandbox process: year-round application, screening, 60-working-day evaluation, testing, then exit

The first is an eligibility condition. Applicants must "confirm that the product/service is not designed for speculation, anonymity, or illicit activity." Speculation sits in that sentence alongside anonymity and illicit activity — not as a risk to be managed, but as a disqualifier.

The second appears in the evaluation criteria. Under risk management and compliance, the Authority lists "consultation with Shariah advisors where applicable" as part of how it will assess an application.

Why both provisions matter

Taken together they describe a regulator building a deliberately narrow gate. A trading product whose appeal is price volatility does not obviously clear the first condition. And a formal role for Shariah advisers inside a federal regulator's assessment process is a significant institutional step in a market where the religious permissibility of crypto is actively contested.

We are not going to tell you what is or is not permissible — that question belongs to scholars, and we cover the debate separately. What is reportable is this: PVARA has written Shariah consultation into its own published procedure. That is a fact about the regulator, not a ruling about the religion.

How the sandbox actually works

The guidelines operationalise Sections 42 to 45 of the underlying legislation. The mechanics are unusually specific for a first-issue framework:

Applications are accepted year-round. PVARA calls this an "agile approach" — there are no fixed intake windows.
Sixty working days. Comprehensive evaluation must complete within that period after initial screening, unless the Authority determines otherwise.
Two resubmissions. Incomplete applications are returned for revision, and you get up to two further attempts.
An application fee may be charged — the guidelines reserve the right but do not yet set an amount.
Successful applicants receive a Letter of Approval, then operate under a supervisory agreement with agreed reporting.
PVARA can cap you. It may impose limits on transaction volumes, user numbers or exposure case by case.
No-Action Relief. The Authority may issue a no-action letter stating it does not intend to take enforcement action over specified conduct for the duration of testing.

Testing ends with a completion report due within two weeks, comparing results against the objectives set at inception. From there a participant either transitions toward full licensing or winds down in an orderly way. PVARA can suspend or withdraw approval at any stage — and in serious cases involving consumer detriment, it says it will do so with a public notice.

What you have to submit

The application form is demanding. It asks for a 500–1,000 word description of the innovation, the blockchain and technology stack including whether the ledger is public or permissioned, a cybersecurity strategy covering threat model, key management, audits and incident response, an analysis of the applicable legal and AML obligations, and a risk table spanning financial, operational, cybersecurity, legal, market and reputational risk with mitigants for each.

Applicants must also be fit and proper — no directors or beneficial owners with findings of fraud, financial crime, prior regulatory breaches or unresolved insolvency — demonstrate financial capacity, identify the ultimate beneficial owner, and, if based in Pakistan, demonstrate compliance with Pakistani tax law.

One drafting detail worth noting

Throughout, the guidelines refer to the Virtual Assets Ordinance, 2025 — the instrument that preceded the Virtual Assets Act, 2026 now in force. The substance is unaffected, but it suggests the document was drafted before the Act passed and published without updating the references. Anyone citing section numbers should map them against the Act rather than assume they carry over unchanged.

What this means for Pakistani users

If you are building something, this is the on-ramp. The sandbox is open now, year-round, while full VASP licensing is not. For a Pakistani startup it is the only supervised route currently available.
If your model depends on trading volatility, reconsider. The non-speculation condition is written into eligibility, not buried in guidance.
Tax compliance is a gate, not an afterthought. A Pakistan-based applicant that is not tax-compliant fails on the published criteria.
For ordinary users, nothing changes yet. Sandbox participation is not a licence and not an endorsement. A firm "in PVARA's sandbox" is being tested, not approved.

What we're watching

Whether PVARA publishes the application fee, whether any participant is named publicly, and how "where applicable" is interpreted in practice for Shariah consultation — whether it becomes routine for every asset-backed product or stays reserved for those marketed as Islamic. We track approvals on the PVARA licence tracker.