Pakistan's Virtual Assets Act 2026, Explained

Last verified: 25 August 2026.

Pakistan spent years with cryptocurrency in a legal grey zone — not quite banned, not quite permitted, and impossible to build a business around. The Virtual Assets Act, 2026 ended that ambiguity. This is what the law actually does, in plain terms.

What changed

The Act creates Pakistan's first comprehensive legal framework for virtual assets and gives the Pakistan Virtual Assets Regulatory Authority a permanent statutory foundation. PVARA existed before the Act, established in July 2025, but the legislation converted it into a standing federal regulator with real enforcement powers rather than an interim body.

Crucially, the Act treats virtual assets as property. That single classification carries consequences well beyond trading — it affects inheritance, contract disputes, insolvency proceedings and, as we'll come to, tax.

Who now needs a licence

The Act requires all Virtual Asset Service Providers to be licensed before offering services in Pakistan. PVARA lists the categories explicitly:

PVARA's notified regulations set eleven licensed categories in Schedule-I: Advisory Services, Broker-Dealer Services, Custody Services, Virtual Asset Management and Investment Services, Virtual Asset Transfer and Settlement Services, Fiat-Referenced Token Issuance, Asset-Referenced Token Issuance, Exchange Services, Lending and Borrowing Services, Virtual Asset Derivatives Services, and Mining Related Virtual Asset Services.

Ten activity-specific handbooks accompany them — Issuance splits into two priced Schedule-I rows — spanning exchange and custody through to derivatives and mining services.

How licensing works

There are two stages, and conflating them is the most common error in coverage of this law.

Stage one — No Objection Certificate

Open now. An NOC is regulatory clearance allowing a company to register on the Financial Monitoring Unit's goAML portal and incorporate a local entity. PVARA targets a decision within 60 calendar days of a complete submission.

An NOC is not a licence. It permits a company to take the next steps, nothing more.

Stage two — full VASP licence

Open since 21 August 2026. The governing regulations went to public consultation between 11 June and 2 July 2026 and were notified in final form on 21 August 2026, as S.R.O. 1419(I)/2026 and S.R.O. 1420(I)/2026.

The practical consequence: applications are open, but no company currently holds a full PVARA licence. We maintain a running record of who has reached which stage in our PVARA Licence Tracker.

What licensed providers will have to do

The draft regulations set obligations across several areas:

• Fit-and-proper requirements for controllers, directors and senior management
• AML/CFT compliance — identity verification, transaction monitoring, record keeping, suspicious activity reporting, aligned to FATF standards
• Client asset segregation — customer funds kept separate from company funds
• Technology and cybersecurity standards, including operational resilience
• Market conduct and client protection rules

The FATF alignment is not incidental. Pakistan's experience on the FATF grey list between 2018 and 2022 was economically costly, and this framework is visibly built to avoid a repeat.

The penalties

Operating as an unlicensed VASP carries criminal liability: fines up to PKR 50 million and imprisonment of up to five years. PVARA also holds authority to impose penalties, suspend licences, and pursue legal action against non-compliant operators.

What the Act does not do

Worth being clear about the limits:

• It does not make crypto legal tender. The Pakistani rupee remains the only legal tender.
• It does not create deposit protection. Funds held on any platform, licensed or otherwise, carry no state guarantee.
• It does not settle the tax position. No crypto-specific capital gains regime is enacted. A Section 37C is proposed but not law.
• It does not address the Sharia question. That debate runs on a separate track — see our coverage of the scholarly position.
• It does not yet let anyone operate as a licensed exchange, because the licence framework is not open.

What it means if you hold crypto in Pakistan

For an individual holding or trading virtual assets, the Act changes your legal position less than headlines suggest. It regulates service providers, not individual holders. You are not required to obtain anything.

What it does change is the environment: platforms serving Pakistani users are now on a path toward supervision, and the ones engaging with that process are visibly distinguishable from the ones that are not.

What happens next

• The first full licences are granted
• Tax treatment is clarified, whether through Section 37C or otherwise
• Enforcement begins against operators who remain unlicensed

Sources

• PVARA — VASP Licensing framework
• PVARA — S.R.O. 1419(I)/2026, Virtual Asset Services Regulations, 2026
• PVARA — S.R.O. 1420(I)/2026, Activity Specific Regulations, 2026
• PVARA — Public Consultation PVARA/CON/001/2026 (historical record)
• Dawn — Pakistan legalises virtual assets
• The Block — Parliament passes the Virtual Assets Act

Correction, 25 August 2026. This piece listed five licence categories and described the full VASP licence as "not yet operational," with the governing regulations still in draft. The regulations were notified in final form on 21 August 2026 (S.R.O. 1419(I)/2026 and S.R.O. 1420(I)/2026), setting eleven licensed categories in Schedule-I, not five — the original five-category list did not match PVARA's own published materials at any point we can verify and has been replaced above. Full licence applications are open; no company has yet been granted one.