Sandbox

How to Submit a Sandbox Application to PVARA

How to submit a PVARA sandbox application: Form I's six sections, the fee the Authority may charge, the mandatory self-assessment, and the resubmission limit.

Malik Abbas · · 6 min read

Filing into the PVARA sandbox is not a letter and a pitch deck. It is a fixed document, Form I, submitted alongside a separate self-assessment, and reviewed first for completeness before anyone reads it on the merits. Getting the mechanics of submission right is what gets an application past that first gate.

This piece sets out exactly what the Sandbox Guidelines 2026 require at the point of submission: the format, the fee power, the attachments, and what happens if something is missing.

What format must a sandbox application follow?

Every application must use Form I. The Guidelines’ Application submission process section states this without qualification: “Applicant shall submit the sandbox application as per the format specified in Form-I of this document.” There is no alternative format described anywhere in the Guidelines — a covering letter, a business plan, or a pitch document submitted on its own does not satisfy this requirement, whatever it contains.

Form I itself is laid out in six parts, described in the Guidelines’ Overview to the form as intended “to help prepare a strong, compliant, and viable application, especially with respect to virtual assets, blockchain, and cybersecurity risks.” The table below sets out each part and what it demands.

Form I section Core content Attachments required
A. Innovation / VASP Proposition Summary of the innovation, blockchain and technology stack, cybersecurity strategy, regulatory environment, risk management Yes, for most subsections
B. Readiness for Testing Technical readiness, integration and partnerships, operational and financial readiness, consumer safety, product details Mixed — attachments required only for the virtual asset product description
C. Exit Strategy & Scaling Exit or termination strategy, transition to full deployment, communication plan Yes, across all three areas
D. Applicants’ Background Team background, operational history and achievements, funding and support Mixed — attachments required for operational history
E. Applicant Particulars & Technical Details Company or entity information, contact details, application category under Schedule I Yes, across all three areas
F. Evaluation Criteria The six factors PVARA scores the application against, plus a submission checklist Not applicable — this is a reference section, not a submission

Section F is worth reading before drafting the other five. It lists the same six evaluation factors — level of innovation and market relevance, strength of technology and cybersecurity measures, compliance with regulatory and legal requirements, operational capacity and readiness for testing, safeguards for user protection and consumer trust, and clarity of exit and transition strategy — and closes with a submission checklist an applicant can tick off before filing.

Can PVARA charge a fee to apply?

Yes, at the Authority’s discretion. The Guidelines state plainly: “The authority may prescribe application fee, as it may deem appropriate.” The word “may” signals this is a power the Authority holds, not a fee schedule fixed in the Guidelines themselves — no specific amount, currency, or fee structure appears anywhere in the published text. An applicant should confirm the current fee position directly with the Authority before submitting, since the Guidelines leave the figure entirely to PVARA’s discretion and do not commit to publishing it in advance.

What has to be submitted alongside Form I?

A completed self-assessment is a mandatory companion document, not an optional extra. The Guidelines require it in the same breath as Form I itself: “Applicant shall submit the self-assessment along with application as provided in Annexure-A.” Annexure-A is an eight-question checklist covering scope, scalability, technology and security, genuine innovation, consumer and investor benefit, readiness, genuine need for the sandbox, and ML/TF and compliance preparedness — each paired with the specific positive and negative indicators PVARA will be reading for. A companion piece on this site walks through all eight questions with their exact indicators.

What happens once the application is submitted?

Applications go through a documentary completeness check before anything is assessed on the merits. The Guidelines describe this stage directly: applications “will be reviewed for all required documents and information, and shall include all the mandatory information as specified in this guideline.” Only after this check is passed does an application proceed to the Assessment Phase and the sixty-working-day evaluation clock described elsewhere in the Guidelines.

What happens if the application is incomplete?

It is returned, not rejected outright, but only twice. The Guidelines state: “Incomplete applications will be returned with a request for revisions, with up to two resubmissions permitted.” That gives an applicant three attempts in total — the original filing plus two resubmissions — to assemble a complete package. The Guidelines do not state what happens if a second resubmission is also incomplete, and this analysis does not guess at a consequence the text does not describe. A companion piece on this site covers the failure modes behind incomplete and rejected applications in more depth.

Does submission timing affect any of this?

No. The Guidelines operate under what they call the Agile Approach, meaning applications can be filed “at any time during the year.” Nothing about the format requirement, the fee power, the self-assessment requirement, or the two-resubmission limit changes depending on when in the year an applicant files. The only variable timing affects is when the sixty-working-day evaluation clock starts running, which is fixed to the conclusion of initial screening rather than to a calendar date.

What should an applicant do before filing Form I?

Three things follow directly from the text above. First, treat the fee as unconfirmed until checked directly with PVARA, since the Guidelines set no figure. Second, complete Annexure-A honestly before drafting Form I itself — its eight questions preview the same six factors listed in Form I’s own Evaluation Criteria section, so working through it first surfaces gaps while there is still time to fix them. Third, assemble every attachment marked “Y” in the Form I table above before the first submission, since the two-resubmission limit is a hard cap and a documentation gap found late costs one of only three total attempts.

One further point on sequencing. The work that slows a filing down is rarely the form itself — it is assembling the supporting material the form refers to, and reconciling that material so it tells one consistent story. Applicants who draft Form I first and gather documents afterwards routinely find the two do not match, and the reconciliation costs more time than preparing properly would have.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Application submission process section and the Form I overview, sections A through F, of the PVARA Sandbox Guidelines 2026, read as published. Where a figure or consequence is not stated in the Guidelines, that is noted in the text above rather than assumed.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.

Entering Pakistan's crypto market?

CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.

Visit CoinConnect

More analysis