How to Get a Crypto Licence in Pakistan

The licensing route in Pakistan runs in a specific order, and the order is the whole point. A promoter who incorporates a company first and approaches the regulator second has not taken a shortcut — they have skipped a statutory step that cannot be reversed by filing later.

This article sets out the sequence as the Virtual Assets Act, 2026 and the PVARA No Objection Certificate Regulations 2025 establish it: what happens at each stage, what you must produce, and which deadlines run from where.

Some numbers in this process do not yet exist. Capital thresholds and fees are deferred to Regulations PVARA has not published. Where that is the case, this article says so rather than supplying a figure.

What are the steps to get a virtual asset licence in Pakistan?

The route has four stages: apply to PVARA for a No-Objection Certificate before incorporating; incorporate a Pakistani company once the NOC is granted; register on the FMU goAML portal; and submit the licence application under section 19(4) of the Virtual Assets Act, 2026. Incorporation cannot come first.

PVARA is the Pakistan Virtual Assets Regulatory Authority. FMU is Pakistan’s Financial Monitoring Unit, and goAML is the platform through which regulated entities file suspicious transaction reports.

Stage	What happens	Governing provision
1	NOC application on Form A1, before incorporation	Act s.19(1)–(3); NOC Regs reg 15.1
2	PVARA assessment, interviews, possible inspection	NOC Regs reg 16
3	Decision within 60 calendar days	NOC Regs reg 17.1
4	goAML registration of the foreign entity	NOC Regs reg 15.3(a), 11.4
5	Incorporation of the local Pakistani company	Act s.19(1); NOC Regs reg 15.3(b)
6	Licence application with prescribed fee and documents	Act s.19(4); NOC Regs reg 15.3(c)
7	Grant, refusal, or provisional/limited-scope licence	Act s.21(1)–(2)
8	Entry on the public register of licensees	Act s.21(4)

Why must the NOC come before incorporation?

Section 19(1) of the Virtual Assets Act, 2026 requires any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services to first apply to PVARA for a No-Objection Certificate, before commencing the process of incorporation. The clearance is pre-incorporation by design.

“…shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.”

— Virtual Assets Act, 2026, section 19(1)

Regulation 15.4 of the NOC Regulations confirms the function: PVARA’s grant of the NOC satisfies the pre-incorporation regulatory clearance required by the Act.

In practice, this reverses the sequence most promoters expect. In other Pakistani regulated sectors you typically incorporate with the Securities and Exchange Commission of Pakistan and then approach the sector regulator. Here, PVARA’s clearance is the precondition to incorporation, not a consequence of it.

Regulation 2.2 explains why the NOC does double duty. Its issuance constitutes both approval for AML Registration on goAML and permission to proceed with incorporation of the local entity. One instrument, two permissions.

What do you need to file for the NOC?

The NOC application is made on Form A1, prescribed in Annex A to the NOC Regulations under regulation 15.1. It has ten sections and requires a substantial evidence pack covering governance, ownership, the AML/CFT framework, technology systems and financial position.

The evidence pack breaks into five groups:

People. Under regulation 5.1, eight Key Individuals must be in place: Chief Executive Officer, Director, Chief Financial Officer, Compliance Officer, Money Laundering Reporting Officer, Head of Internal Audit, Head of Risk Management and Head of Information Security. Each requires a completed Form A3 Fit and Proper Questionnaire, an up-to-date CV and a passport copy. Regulation 5.2 permits the Compliance Officer and MLRO roles to be combined where justified by size and complexity. Form A1 section 3.2 requires these details for both the global entity and the proposed Pakistani entity.

Ownership. Every Controller — any person holding directly or indirectly 20% or more of voting power or share capital, per regulation 7.1 — and every Beneficial Owner must complete Form A2. A complete ownership and control structure chart is required, showing all shareholding layers, all intermediate entities and jurisdictions, and the ultimate natural persons.

AML framework. Form A1 section 5 lists fourteen documents, including a board-approved AML/CFT Policy, CDD and EDD procedures, PEP management procedures, a TFS policy, transaction monitoring procedures, a blockchain analytics methodology, STR/CTR escalation procedures, an enterprise-wide ML/TF risk assessment, a recordkeeping policy covering seven-year retention, a training policy, and an outsourcing register. Form A4, signed by the CEO and MLRO, certifies that the framework is tailored to the business model and “is not a template or generic framework.”

Technology. Form A1 section 6 requires a description of core systems, data centre locations, cloud services with jurisdictional detail, and the AML-relevant systems used for blockchain analytics, identity verification, sanctions screening, transaction monitoring and information security. Section 6.3 requires each to be declared as fully operational, in testing, or under implementation with an expected completion date.

Financials. Form A1 section 8 requires the latest audited financial statements, or management accounts and pro forma financials for a newly incorporated applicant, plus evidence of paid-up capital, external auditor details, and a description of how initial capital and funding were sourced.

Regulation 8A requires all submissions to be in English or Urdu, version-controlled, paginated and indexed, in searchable electronic format, with written evidence of board approval where required.

How long does the process take?

Regulation 17.1 requires PVARA to issue or refuse the NOC within sixty calendar days following assessment. Regulation 15.3(c) then requires the licensing application to be submitted within three months of the issuance of the VASP licensing regulations. No total end-to-end timeline is stated anywhere in the documents.

Two points on the timing that matter for planning:

• The sixty days runs from assessment, not submission. The Regulations do not fix how long the assessment phase itself may take, and do not say what happens if the sixty days lapses without a decision.
• The three-month licensing clock runs from the publication of the VASP licensing regulations, not from the NOC date. An applicant holding an NOC before those regulations exist is not yet on that clock.

Regulation 16 permits PVARA to interview Key Individuals, conduct inspections and request additional information during assessment. Each of these can extend the practical timeline. Our reading is that the sixty-day figure should be treated as a decision window rather than a service standard for the whole process.

What does the licence application require?

Section 19(4) of the Act requires the licence application, made after incorporation, to be in the prescribed form and manner, accompanied by the prescribed fee — which is non-refundable unless PVARA determines otherwise — and such information and documents as may be prescribed or required by PVARA.

The Act does not state the fee. It does not state the minimum capital either: section 25(1) requires a licensee to maintain minimum paid-up capital, liquid assets and financial resources “not less than such amounts as may be prescribed,” and section 25(2) allows PVARA to set higher requirements having regard to the category, size, complexity or risk profile of the licensee.

Section 20 governs suitability at this stage. PVARA determines whether each Controller, Sponsor, Chief Executive Officer and Director is fit and proper against criteria prescribed by Regulations. Under section 20(2), the criteria apply to all Key Individuals, and it is the applicant’s own responsibility to assess and maintain the fitness and propriety of those not named in section 20(1), and to submit a written undertaking confirming compliance and ongoing maintenance.

Section 20(6) adds a permanent structural requirement: every licensee must maintain a registered office in Pakistan and ensure that at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority.

What can PVARA grant, and on what terms?

Under section 21(1), PVARA may grant a licence subject to such terms and conditions as it deems appropriate, or refuse the application with written reasons. Section 21(2) allows a provisional or limited-scope licence on a case-by-case basis. Section 21(3) provides that a licence specifies the permitted services and remains in force unless suspended or revoked.

Three features of the licence are worth understanding before you apply:

• It is service-scoped. The licence names the virtual asset services the holder may undertake. Adding a service is not automatic.
• It has no expiry. Section 21(3) says it remains in force unless suspended or revoked. There is no fixed renewal term in the Act, though section 22(f) requires payment of prescribed renewal fees.
• It is public. Section 21(4) requires PVARA to maintain and publish an up-to-date register of licensees on its website, showing at minimum the name, licence number, permitted services and current regulatory status of each licensee.

Once granted, section 22 imposes six continuing obligations: maintain prescribed capital and financial resources; comply with the Act and all subordinate instruments; submit periodic returns, reports and audited financial statements; obtain prior approval for any material change in control or business; maintain risk management, compliance and cybersecurity systems including data privacy adherence; and pay supervision, renewal and other fees.

What are the common failure points?

The documents identify several grounds on which an application fails or an approval is later withdrawn. Regulation 19.1 and section 23(1) together give a clear picture of what PVARA treats as fatal.

The recurring themes are:

• Incomplete filings. Form A1’s preamble states that incomplete applications may be delayed or returned. Regulation 8A’s documentation standards are a compliance requirement, not formatting advice.
• Inaccurate information. Regulation 19.1(a) makes false, misleading or incomplete information a revocation ground. Section 54(4) of the Act makes a knowingly false or misleading statement in any application, return or document submitted to PVARA punishable with up to three years’ imprisonment, a fine up to twenty million rupees, or both.
• A generic AML framework. Form A4 requires the CEO and MLRO to certify that the framework is tailored to the business model and is not a template.
• A Key Individual failing the fit and proper standard. Regulation 6.3 sets three absolute bars: conviction under AMLA 2010, the Act, or any law involving dishonesty, fraud or financial misconduct; sanction by any regulator in Pakistan or abroad; or bankruptcy or insolvency proceedings, except where duly discharged.
• Stalling after the NOC. Regulation 18.1(f) requires the holder to apply for and progress diligently toward a full licence; regulation 19.1(e) makes failure to do so a revocation ground.

Section 23(1) then sets the grounds on which a granted licence may be varied, suspended or revoked, after written notice and an opportunity to be heard: contravention of the Act, other applicable laws, or licence conditions; insolvency or failure to satisfy fit and proper criteria; ceasing to carry on the licensed service; public interest including consumer protection, market integrity or financial stability; and a licence obtained by fraud, misrepresentation or concealment of material facts.

Where a licence is revoked, section 23(2) requires the licensee to immediately cease providing virtual asset services, and permits PVARA to notify the Securities and Exchange Commission of Pakistan to initiate winding-up or dissolution proceedings.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 and the PVARA No Objection Certificate Regulations 2025 including Annex A Forms A1 to A8, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.