Foreign Crypto Exchange Pakistan: The Market Entry Checklist

If your exchange already has Pakistani users on its books, you are not starting from a blank page. You are starting from a position the framework explicitly contemplates, and the sequence you follow now determines whether you convert an existing user base into a licensed business or lose it.

The Virtual Assets Act, 2026 applies to any Virtual Asset Service Provider that “carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan”. That phrasing is deliberately broad. It does not turn on where your servers sit or where you are incorporated. It turns on where the service is carried on.

This is the checklist for an offshore exchange working out how to enter — or regularise — its position in Pakistan. Every requirement below is traced to a provision in the Act or the PVARA No Objection Certificate Regulations 2025.

Does the Virtual Assets Act 2026 apply to an offshore exchange?

Yes, if you carry on or hold yourself out as carrying on a Virtual Asset Service in or from Pakistan. Under section 2(1)(a) of the Act, scope attaches to the activity’s connection to Pakistan, not the provider’s place of incorporation. Section 4 further permits the Authority to exercise investigation and enforcement powers extraterritorially.

The operative language of section 2(1) is short:

This Act shall apply to— (a) any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan; and (b) any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan.

Two points follow. First, “holds itself out as” captures marketing and solicitation, not just execution. Second, the Act does not yet define the boundary in detail — section 4(2) says the Authority “shall, by Regulations, prescribe the conditions under which a Virtual Asset Service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to Persons in Pakistan.” Those conditions have not been published in the documents we have read. Until they are, an offshore exchange with visible Pakistani onboarding, PKR pairs or local-language marketing should assume it is in scope.

Section 4(3) adds that the Authority will align extraterritorial enforcement with mutual legal assistance treaties and international cooperation frameworks, including FATF and IOSCO. Geography is not a defence.

What is the sequence for a foreign exchange entering Pakistan?

The route runs: NOC application to PVARA → goAML registration of the existing foreign entity → incorporation of a Pakistani company → full licence application under section 17 of the Ordinance framework carried into the NOC Regulations. Under regulation 2.3, four service categories may be provided after the NOC and before the full licence.

Here is the sequence in table form.

Step	What happens	Source
1	Apply for a No Objection Certificate before incorporating anything	Act s.19(1); NOC Regs reg 15.1 (Form A1)
2	PVARA assesses fitness and propriety, AML/CFT framework, governance, financials, technology, risk profile	NOC Regs reg 16.1
3	Decision within a period not exceeding 60 calendar days	NOC Regs reg 17.1
4	Register the foreign entity already serving Pakistan on the FMU goAML portal	NOC Regs reg 11.4, 15.3(a)
5	Incorporate the local company	Act s.19(1); NOC Regs reg 15.3(b)
6	Submit licensing application within three months of issuance of the VASP licensing regulations	NOC Regs reg 15.3(c), 17.1(a)(iv)
7	Local entity assumes the goAML reporting-entity role once licensed	NOC Regs reg 11.5

Step 1 is not optional and not reorderable. Section 19(1) of the Act requires that any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services “shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.” Incorporating first and applying later inverts the statutory order. Our regulatory and licensing practice treats this as the gating item in every foreign-entrant timeline, and the corporate setup workstream does not start until the NOC is in hand.

Which services can you offer before the full licence?

Four. Under regulation 2.3 of the NOC Regulations, Broker-Dealer Services, Custody Services, Exchange Services and Virtual Asset Derivative Services are designated “AML Registered Services”. Once an applicant holds an NOC and has completed goAML registration, those four may be provided in advance of a full licence, subject to conditions imposed by the Authority.

The regulation is explicit about the limit:

For the avoidance of doubt, all other Virtual Asset Services defined under the Ordinance not otherwise constituted as an AML Registered Service may only be provided following the grant of a full license under Section 17, unless otherwise agreed with PVARA.

So Advisory Services, Lending and Borrowing, Management and Investment, Transfer and Settlement, Issuance and Mining-related services sit outside the early window. Schedule I of the Act lists all ten categories; we have walked through each in our guide to the ten PVARA licence categories.

In practice, this phased pathway is the single most commercially significant feature of the framework for an incumbent offshore exchange. It means the exchange, brokerage and custody legs of a typical platform can keep running through the licensing process rather than going dark. The derivatives leg is also inside the window, which is unusual and worth noting. A lending book is not.

What does the transitional provision in section 70 give you?

Section 70 of the Act gives an existing provider six months from commencement to apply for a licence, and permits continued provision of existing services during that period if a complete application has been submitted and interim directives are followed. It is a bridge, not an exemption.

The text:

(1) Any Person providing Virtual Asset Services immediately before the commencement of this Act shall, within six months of such commencement, apply to the Authority for a license under this Act or shall cease to provide such services. (2) After the commencement of this Act, within six months, a Person who has submitted a complete application as per sub-section (1) may continue to provide existing Virtual Asset Services: Provided that such Person fully complies with any interim directives issued by the Authority and continues to adhere to the core obligations of this Act, particularly regarding customer asset protection under AML, CFT and CPF.

Three conditions carry the protection: the application must be complete, interim directives must be complied with fully, and core obligations on customer asset protection and AML/CFT/CPF must be maintained. An incomplete filing is not a filing for this purpose. Section 74 also saves everything validly done under the lapsed Virtual Assets Ordinance, 2025, so an NOC obtained under the Ordinance framework carries forward.

Read section 70 alongside section 50, which prohibits any person from engaging in Virtual Asset Services by way of business in or from Pakistan unless they are a company incorporated in Pakistan and hold a valid licence. Section 54(1) prices wilful unlicensed provision at up to five years’ imprisonment, a fine up to fifty million rupees, or both. The transitional window is the only lawful path between those two poles for an incumbent.

Do you need a resident director in Pakistan?

Yes. Section 20(6) of the Act requires every Licensee to maintain a registered office in Pakistan and to ensure at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority, subject to prescribed conditions.

Every Licensee shall maintain a registered office in Pakistan and ensure that at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority subject to conditions prescribed.

Note the two limbs. Residence alone is insufficient — the resident individual must hold operational and decision-making authority. A nominee with no mandate does not satisfy the wording. Section 3(1)(xv) lists who counts as a Key Individual: directors, Managing Director, CFO, COO, head of internal audit, head of compliance, MLRO, head of risk management, head of information security, and anyone else the Authority designates by written notice.

The conditions attaching to section 20(6) have not been prescribed in the documents before us. Until they are, we treat the safe reading as a genuinely empowered senior person on the ground. We have set out the practical implications in more detail in our analysis of the resident director requirement.

Fitness and propriety applies across the board. Under section 20(1) the Authority determines whether a Controller, Sponsor, CEO and Director is fit and proper; under section 20(2) the criteria apply to all Key Individuals, with the applicant responsible for assessing and maintaining fitness of those not named in sub-section (1) and submitting a written undertaking. Each Key Individual files Form A3 under regulation 6.4 of the NOC Regulations — the Form A3 walkthrough covers what that questionnaire actually asks.

Who registers on goAML — the foreign entity or the local one?

Both, in sequence. Under regulation 11.4 of the NOC Regulations, following issuance of the NOC the foreign applicant whose foreign chapter is already providing VASP services in Pakistan registers on the FMU goAML platform as reporting entity for AML-Registered Services. Under regulation 11.5, once the local entity is incorporated and licensed, it assumes the reporting-entity role.

This is a detail that trips up entrants who assume the local subsidiary handles everything from day one. It does not. The regulation is written for exactly your situation — an offshore platform with an existing Pakistani footprint — and puts the initial reporting obligation on the entity that actually has the customers.

Regulation 11.6 requires the applicant to demonstrate technical readiness to file Suspicious Transaction Reports and Currency Transaction Reports immediately upon goAML registration. Not eventually. Immediately. Our note on FMU goAML registration for VASPs goes through the mechanics; the Financial Monitoring Unit publishes the platform requirements.

What documentation does the NOC application require?

Form A1 under regulation 15.1, plus a substantial evidence pack. The Authority assesses fitness and propriety of Key Individuals and Controllers, adequacy and operational readiness of the AML/CFT framework, governance and internal control, financial soundness, technology architecture and monitoring systems, and the applicant’s inherent and residual ML/TF risk profile.

The core filings:

• Form A1 — application, covering business model, customer types with estimated client numbers per category at the date of application, fiat on-ramp and off-ramp arrangements, stablecoin handling, custodians and payment processors, and cross-border elements
• Form A2 — Controller and Beneficial Owner disclosure, required for both the global entity and the proposed local entity (regulation 7.1 sets the Controller threshold at 20% or more of voting power or share capital)
• Form A3 — Fit and Proper Questionnaire for every Key Individual of both entities
• Form A4 — AML/CFT Framework Submission Statement, signed by CEO and MLRO, certifying the framework is tailored and not a template
• Form A5 — Outsourcing Declaration and Register, signed by the Compliance Officer

Regulation 8.2 lists the framework documents themselves: a Board-approved AML/CFT Policy, CDD and EDD procedures, TFS screening, transaction monitoring, STR/CTR escalation, an enterprise-wide ML/TF risk assessment, recordkeeping and data governance policy (records held a minimum of seven years under regulation 13.1), a training programme, and an outsourcing risk management framework.

Regulation 14.1 restricts outsourcing of AML-critical functions — CDD, EDD, sanctions screening, transaction monitoring, STR/CTR reporting and MLRO responsibilities — unless the applicant conducts due diligence on the provider, maintains oversight, retains audit and inspection rights, and ensures those rights are legally enforceable across borders. For a group running compliance out of a regional hub, that last point needs contractual work before filing, not after.

Documentation standards under regulation 8A.1: English or Urdu, version-controlled, paginated, indexed, searchable electronic format, with written evidence of Board approval where required.

What ongoing obligations attach after the NOC?

Regulation 18.1 requires continuous AML/CFT compliance, notification of material changes to AML compliance, governance, ownership or technology, an Annual AML/CFT Return on Form A6, independent AML audits when directed, active goAML registration, and diligent progress toward a full licence within the Authority’s timeframe.

Regulation 19.1 lists the revocation triggers: false, misleading or incomplete information; breach of AML/CFT obligations; a Key Individual ceasing to be fit and proper; systemic or material AML/CFT failures; and failure to apply for or progress toward a full licence. Regulation 19.2 requires proportionality.

Once licensed, section 22 of the Act adds minimum paid-up capital and financial resources, periodic returns and audited financial statements, prior approval for material change in control or business, and risk-management, compliance and cybersecurity systems including data privacy adherence. Section 24 requires segregation of Customer Assets, and section 24(2) puts them outside the Licensee’s estate on insolvency. Section 27 requires cryptographic proof-of-reserves reconciled against customer liabilities at prescribed intervals, plus an annual audit by a firm of Chartered Accountants approved by the Division concerned.

Tax sits alongside. Section 66 requires every licensed VASP to comply with obligations under the Income Tax Act, 2001 and FBR rules — our tax and banking work and the crypto tax guide cover where that lands. Banking access is a separate practical problem entirely, addressed in our note on VASP bank accounts.

Should you use the sandbox instead?

Only if you need regulatory flexibility to test something genuinely novel. The PVARA Sandbox Guidelines 2026 are built for innovation testing, not for regularising an existing commercial book. The self-assessment checklist in Annexure-A asks directly whether you need regulatory flexibility, and flags as negative any case where “live testing not necessary to answer regulatory or market questions.”

For an incumbent offshore exchange with real users, the NOC route under regulation 2.3 is almost always the correct path — it permits four revenue-generating service lines while licensing proceeds. The sandbox operates on an agile basis with applications accepted year-round, comprehensive evaluation within sixty working days of initial screening, and an undertaking under Annexure-B that includes one-hour notification of material incidents. We compare the routes in sandbox vs NOC vs no-action letter vs full licence.

One further note for foreign applicants to the sandbox: Form I Section E states that where the applicant is not a local company, it will be required to incorporate and evidence tax registration with local tax authorities as and when sandbox approval is granted.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 (as passed by the National Assembly), the PVARA No Objection Certificate Regulations 2025 (Document Code PVARA/REG/AML-REG/2025-1, effective 2 December 2025) and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued — notably the section 4(2) regulations defining when an offshore service is deemed offered to persons in Pakistan, and the conditions attaching to section 20(6) — that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.