Virtual Assets Act Regulates Businesses, Not Crypto Holders

If you hold or trade crypto in Karachi or Lahore and are wondering whether you are now doing something legal, illegal, or newly regulated, the short answer is: none of those, yet. Pakistan's Virtual Assets Act, 2026 (Act No. XIII of 2026) came into force "at once" under section 1(3). But the Act regulates businesses that provide virtual asset services, not the people who use them.

Who the law actually covers

Section 2(1) of the Act states it applies to "(a) any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan; and (b) any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan" (Virtual Assets Act, 2026, s.2(1)). There is no third category covering individual holders or traders. That is a neutral fact about how the Act is scoped, not a legalisation or a ban — the Act simply does not speak to what an individual does with their own crypto.

Two sets of regulations have since been notified under the Act, covered here when they landed: S.R.O. 1419(I)/2026, the Pakistan Virtual Asset Services Regulations 2026, and S.R.O. 1420(I)/2026, the Pakistan Virtual Asset Services Activity Specific Regulations 2026, both notified and in force from 21 August 2026. Neither repeals or amends the earlier No Objection Certificate (NOC) Regulations 2025, which remain the operative pre-licence regime.

No licence exists yet — for anyone

Pakistan Virtual Assets Regulatory Authority (PVARA), the regulator created by the Act, has not issued a single full VASP licence as of 4 September 2026. Its own licensing page states that applicants "will need to meet the following requirements to obtain a VASP license when full licensing becomes available" (PVARA, licensing, fetched 4 September 2026) — language that describes a future process, not a live one. The Act requires PVARA to "maintain and publish an up-to-date register of Licensees on its official website" once licences exist (Virtual Assets Act, 2026, s.21(4)). No such register was found on any PVARA page checked for this piece: pvara.gov.pk/licensees and pvara.gov.pk/register both returned HTTP 404 on 4 September 2026, and the word "register" appears zero times in the text of PVARA's news page (fetched the same day, 44,046 bytes).

Ahead of full licensing, the only status a virtual asset business can hold is "AML-Registered Services" under clause 2.3 of the NOC Regulations 2025, covering Broker-Dealer, Custody, Exchange and Virtual Asset Derivative Services. A business granted that registration "may provide AML-Registered Services prior to obtaining a license under Section 17 of the Ordinance" (NOC Regulations 2025, cl. 2.3) — the Ordinance being the Virtual Assets Ordinance 2025, which those regulations were written under. It is explicitly a pre-licence status, not a licence itself.

The exchanges: what is and isn't confirmed

Binance says it has AML-Registered status with PVARA. That claim traces to Binance's own blog post, "allows us to begin providing AML-registered cross-border services to Pakistani users" (Binance, 12 December 2025) — not to a PVARA notification or reference number. PVARA's own news page carries one card, dated 12 December 2025, headlined "Pakistan Clears Global Crypto Exchanges Binance, HTX Under New Rules" and saying PVARA "has granted no objection certificates (NOCs) to major global cryptocurrency exchanges including Binance and HTX" — but its "Read Full Article" link points to a third-party news site, arabnews.com, rather than to a PVARA document. Neither exchange has been described by PVARA as "licensed": AML-Registered status is a pre-licence category, and no full licence has been issued to anyone yet.

Bybit, KuCoin and OKX appear zero times each in the text of that news page. Binance and HTX appear twice each, both in the single card above. Any claim that Bybit, KuCoin or OKX holds a PVARA status does not come from PVARA's own news page.

What happens next

PVARA has not published a licensing timetable. The Act sets out the machinery for both NOC applications (s.19) and licence grants (s.21), but the timing of when the first full VASP licence will actually be issued is not stated anywhere in the Act, the two S.R.O.s, or the PVARA pages checked for this piece. A separate compliance deadline under section 70 of the Act is covered in our piece on the licence deadline rather than restated here, given an unresolved date ambiguity in that provision.

For now, an individual in Pakistan who holds or trades crypto is not required to register, obtain a licence, or seek a No Objection Certificate under any of the Act, the two 2026 regulations, or the NOC Regulations 2025 — those obligations attach to businesses, not to personal holders.

Sources

• Virtual Assets Act, 2026 (Act No. XIII of 2026) — PVARA's own copy, https://pvara.gov.pk/documents/Virtual%20assets%20Act%202026%20passed%20by%20NA.pdf — s.1(3), s.2(1), s.19, s.21(4)
• S.R.O. 1419(I)/2026, Pakistan Virtual Asset Services Regulations 2026, notified 21 August 2026 — https://pvara.gov.pk/documents/Pakistan%20Virtual%20Asset%20Services%20Regulations,%202026%20-%20Notified%2021%20August%202026.pdf
• S.R.O. 1420(I)/2026, Pakistan Virtual Asset Services Activity Specific Regulations 2026, notified 21 August 2026 — https://pvara.gov.pk/documents/Pakistan%20Virtual%20Asset%20Services%20Activity%20Specific%20Regulations,%202026%20-%20Notified%2021%20August%202026.pdf
• PVARA No Objection Certificate Regulations 2025, cl. 2.3 — https://pvara.gov.pk/documents/PVARA%20NO%20OBJECTION%20CERTIFICATE%20REGULATIONS.pdf, fetched 4 September 2026
• PVARA licensing page — https://pvara.gov.pk/licensing, fetched 4 September 2026
• PVARA news page — https://pvara.gov.pk/news, fetched 4 September 2026
• Binance, "Binance Secures AML Registration Approval...", https://www.binance.com/en/blog/regulation/2711306533389509227, 12 December 2025