Stop logging in for a year and your crypto wallet can be frozen. What PVARA's rules say

Key takeaways

• Under PVARA's Virtual Asset Services Regulations, a wallet with no customer transaction or activity, "e.g. login", for a year counts as dormant.
• Before marking it dormant, an exchange must warn you three times: a month, a week and a day ahead.
• A dormant wallet can still receive funds, but you cannot withdraw until you ask, through an authenticated channel, for it to be reactivated.
• Wallets untouched for ten years are to be surrendered to the Strategic Digital Wallet Company. That transfer cannot happen until PVARA issues a procedure that keeps the assets yours and lets you reclaim them.

What counts as dormant

The regulations, notified on 21 August 2026 as S.R.O. 1419(I)/2026, define a "dormant or in-operative wallet" as one "in which no customer initiated transaction (debit or credit) or activity (e.g. login) has taken place during the preceding one year".

Two things follow from the wording. Logging in counts as activity, so a holder who checks the app keeps the wallet active even without trading. And only activity the customer starts counts. A deposit someone else sends you is not, on this definition, your own activity.

The warnings you should get

Regulation 98(7) says an exchange "may" apply dormancy measures. It does not have to. If it does, it "shall send prior notice to the wallet holder through any registered medium". The notices go out "one (1) month, seven (7) days and one (1) day prior to marking the wallet as dormant", and each must explain how to reactivate the wallet.

"Registered medium" means the contact details on file. A phone number or email address you no longer use is where those warnings will go.

What happens once a wallet is dormant

• Money in: allowed. The exchange "may allow credit entries", subject to anti-money-laundering rules.
• Money out: blocked. "Debit transactions/ withdrawals shall not be allowed until the wallet is activated."
• Some debits still go through. The block does not stop debits to recover a liability you owe, permitted fees, government duties or levies, or instructions under a law or a court order.
• Getting it back. The exchange "may activate the dormant wallet upon receipt of a formal request from the customer through any authenticated medium".

The rules do not say how long reactivation takes or which checks an exchange may run first. Expect it to ask you to update your identity documents. Its customer checks under regulation 98 start with your name as on your CNIC or passport, your address and the source of your funds.

Ten years: the Strategic Digital Wallet Company

Regulation 98(8) goes further. Wallets or assets "which have not been operated for the last ten years ... shall be surrendered to Strategic Digital Wallet Company (SDWC)". Wallets in the name of a minor, a government or a court are excluded.

The SDWC appears in PVARA's activity-specific regulations (S.R.O. 1420(I)/2026) as the company, licensed under section 38 of the Virtual Assets Act, that holds crypto for "Sovereign Clients". Those are the federal and provincial governments, the State Bank, PVARA itself and designated public bodies.

The surrender rule does not take effect straight away. It applies "only once an applicable regulatory procedure establishes" six things:

1. the SDWC holds the assets "solely in a custodial capacity and not as Government property";
2. responsibility and liability pass from the exchange;
3. the assets stay segregated, safeguarded, reconciled and recorded;
4. how forks, airdrops, staking rewards and other blockchain events are treated;
5. who bears losses after the transfer;
6. "an effective and continuing right for the Customer to reclaim the assets".

Until that procedure exists, the exchange "shall continue to safeguard the assets for the Customer". We have not found such a procedure on PVARA's site.

What this means for Pakistani users

None of these rules bind anyone yet. They apply to PVARA licensees, and PVARA has licensed no one. An offshore exchange you use today follows its own terms of service on inactive accounts, not these rules.

Once exchanges are licensed, a few habits will matter:

• Keep your contact details current. The three warnings go to the phone number or email you registered.
• Log in at least once a year, even if you are holding for the long term. Under the definition, a login is enough.
• Keep your CNIC and records of where your money came from. Reactivation runs through the exchange's identity checks.
• Tell your family where your crypto is. A wallet left after a death will go quiet. The rules in force say the coins stay the customer's, and the planned ten-year procedure has to include a right to reclaim them. Heirs still need to know the account exists.

A coin held in your own self-custody wallet is outside all of this. No exchange holds it, so no exchange can mark it dormant, and no one else can reach it if the keys are lost.

What we're watching

• PVARA's procedure for transfers to the Strategic Digital Wallet Company, and whether it sets out how owners and heirs reclaim assets.
• Whether licensed exchanges choose to apply dormancy at all, since the rule says "may".
• The first licences, which bring these rules into force for real customers.

Sources

• PVARA, Pakistan Virtual Asset Services Regulations, 2026, S.R.O. 1419(I)/2026: regulations 2A(1)(j), 98(4), 98(7) and 98(8).
• PVARA, Pakistan Virtual Asset Services Activity Specific Regulations, 2026, S.R.O. 1420(I)/2026: regulations 2 and 18.
• PVARA, Legal framework page, read 29 October 2026.