Are You an Issuer? The Control Test in Pakistan's Act

Whether a business counts as an “Issuer” under Pakistan’s Virtual Assets Act, 2026 is not a matter of what it calls itself. It is a matter of control — over supply, over reserves, over governance. Getting this classification wrong matters, because Issuer status brings a distinct set of obligations under Chapters 5 and 7 of the Act that do not apply to a business simply promoting, distributing or building technology for someone else’s token.

This article sets out the control test in section 3(1)(xiii), the four activities its Explanation says do not make you an Issuer, and how section 2(1)(b) narrows the test further.

Who counts as an “Issuer” under the Virtual Assets Act 2026?

Section 3(1)(xiii) defines “Issuer” as:

The legal Person that originates or creates a Virtual Asset and retains primary control over its initial supply, reserve assets (if any) or on-chain governance, and may distribute such Virtual Asset as part of its initial offering, and that bears the ongoing obligations as prescribed by the Authority.

Two elements must both be present. First, origination or creation — the person must be the one that originates or creates the Virtual Asset in the first place. Second, and separately, retained primary control over at least one of three specified things: initial supply, reserve assets, or on-chain governance. Distribution as part of an initial offering is mentioned as something an Issuer “may” do, not as a required element of the definition itself — a person can be an Issuer under section 3(1)(xiii) without personally distributing the token, so long as it originated the asset and retains control over one of the three listed elements.

What are the three control markers that make you an Issuer?

The definition lists three specific things over which “primary control” triggers Issuer status:

• initial supply — control over how many units of the Virtual Asset exist at launch and, implicitly, control over further issuance
• reserve assets, if any — control over the assets backing the token’s value, relevant in particular to Fiat-Referenced Tokens and Asset-Referenced Tokens under sections 31 and 32
• on-chain governance — control over the mechanisms that govern how the protocol or token operates going forward, such as the ability to upgrade contracts, change parameters, or direct the token’s future development

The word “or” between these three markers means control over any single one is sufficient — a person does not need to control all three to be classified as an Issuer. A person who originated a token and retains control over on-chain governance, for instance, could be an Issuer even if the reserve assets, if any exist, sit with an independent third party.

What does “primary control” mean, and why does the word “primary” matter?

The Act does not define “primary control” with further precision, but its inclusion signals that shared or secondary influence is not enough to trigger Issuer status on its own. A person with some influence over governance decisions — through an advisory role, a minority voting stake in a decentralised autonomous organisation, or a technical contribution — does not automatically become an Issuer unless that influence rises to the level of primary control. Where control is genuinely shared between multiple parties without any one party holding a primary position, the Act’s text does not resolve who, if anyone, qualifies as the Issuer, and this is the kind of structure the Authority’s classification power under section 9(1)(f) — allowing it to determine whether a person qualifies as a Virtual Asset Service Provider or an offering falls within scope, based on substantive features rather than form — would likely need to resolve directly.

What four activities does the Explanation say do NOT make you an Issuer?

Section 3(1)(xiii) is followed immediately by an Explanation that carves out specific activities from triggering Issuer status:

A Person is not an Issuer solely because it markets, advertises, promotes, facilitates secondary-Market trading (including third-party brokerage, distribution or exchange), or provides technical development or maintenance services without control over issuance, supply or reserve assets.

Four categories of activity are named: marketing or advertising a Virtual Asset; promoting it; facilitating secondary-market trading, which explicitly includes acting as a third-party broker, distributor or exchange; and providing technical development or maintenance services. Each carve-out is qualified by the same closing condition — “without control over issuance, supply or reserve assets” — meaning the exclusion only holds so long as the person performing these activities does not also hold the control markers described in the main definition.

Does marketing a token make you liable as its Issuer?

Not on its own. A marketing agency, a promotional partner, or an influencer engaged to publicise a Virtual Asset does not become its Issuer purely by virtue of that role, provided it does not also control the token’s supply, reserve assets or governance. This matters directly for section 43(1), which prohibits any person from advertising or marketing a Virtual Asset unless the Issuer holds a valid licence or registration — the marketer’s obligation under that section is to confirm the Issuer is properly licensed, not to become the Issuer itself by performing the marketing function.

The same logic applies to a broker-dealer facilitating secondary trading in a token it did not create, or a development firm building and maintaining smart contract infrastructure for a client’s token. Both are named explicitly in the Explanation as activities that, without more, do not trigger Issuer status. Where any of these parties begin exercising real control over supply, reserves or governance — for example, a development firm that retains an admin key controlling the contract’s parameters — the carve-out stops applying and the control test in the main definition takes over.

How does section 2(1)(b) narrow the Issuer test further?

Section 2(1)(b) sets the scope of the Act’s application to Issuers and states that the Act applies to “any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan.” The phrase “on its own behalf” is significant: it ties the Act’s application to a person acting in its own capacity as Issuer, as opposed to acting purely as an agent or service provider for someone else who holds the actual control described in section 3(1)(xiii). Read together, sections 2(1)(b) and 3(1)(xiii) point to the same underlying principle from two directions — the definition identifies who counts as an Issuer by reference to control, and the scope provision confirms the Act reaches that Issuer specifically where it is acting on its own behalf, in or from Pakistan.

What obligations attach once you are classified as an Issuer?

Once a person meets the section 3(1)(xiii) test, a distinct set of obligations follows under the Act. Section 30(1) restricts who may conduct an Initial Virtual Asset Offering to registered legal entities meeting the Authority’s eligibility criteria. Section 42(1) requires an Issuer offering a Virtual Asset to the public to publish a whitepaper in the prescribed form, and section 42(2) requires ongoing disclosures including reserve attestations. Where the token is a Fiat-Referenced Token or Asset-Referenced Token, sections 31 and 32 impose reserve backing, redemption and audited disclosure requirements specifically on the Issuer. Section 33 further creates a “Significant Issuer” category for those meeting thresholds the Authority prescribes by reference to size, scale, systemic importance, market impact, number of holders and cross-border activity, triggering enhanced reporting, disclosure, governance and risk-management obligations.

What should a business do if its role is genuinely ambiguous?

Where a business performs a mix of activities — some development work, some promotional activity, some involvement in governance decisions — and it is not obvious on which side of the control line it falls, the safest course is to seek the Authority’s own classification rather than assume the Explanation’s carve-outs apply. Section 9(1)(f) gives the Authority express power to classify any offering, issuer or service provider “based on its substantive features, underlying function, method of use, or economic effect, irrespective of the nomenclature, structure, or designation assigned to it.” A business structuring itself to sit deliberately on the exempt side of the Explanation — for instance, nominally handing governance control to a separate entity while retaining practical influence — should expect that substance-over-form power to look through the structure to the underlying control arrangement, as part of any regulatory licensing review.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.