"In or From Pakistan": The Territorial Test for VASPs

Four words decide whether an offshore exchange is inside Pakistan’s regulatory perimeter or outside it. Section 2 of the Virtual Assets Act, 2026 applies the statute to any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service “in or from Pakistan”.

Those words are doing an enormous amount of work. They are not defined in the Act. And the provision that was meant to give them content — section 4(2), which directs the Authority to prescribe when an offshore service is deemed to be offered to persons in Pakistan — points to Regulations that have not yet been issued.

This article sets out what the Act actually says about territorial reach, what is currently determinable from the text, and precisely where the boundary is still undrawn. If you run a platform outside Pakistan with Pakistani users on it, this is the provision that governs your exposure.

What does “in or from Pakistan” mean under the Virtual Assets Act 2026?

The phrase is the statutory trigger for the whole Act. Under section 2(1), the Act applies to any VASP that carries on, or holds itself out as carrying on, a Virtual Asset Service “in or from Pakistan”, and to any Issuer that offers, originates or distributes a Virtual Asset “in or from Pakistan”. The phrase is not defined anywhere in the Act.

The operative wording of section 2(1) is:

(1) This Act shall apply to— (a) any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan; and (b) any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan.

Two distinct limbs sit inside the phrase. “In Pakistan” captures activity conducted within the territory — a company, staff, servers, or customer-facing operations located here. “From Pakistan” captures activity conducted out of Pakistan to persons elsewhere: an operator based in Karachi serving customers in the Gulf is still caught, even with no Pakistani users at all.

Section 1(2) confirms the Act “extends to the whole of Pakistan”, and section 1(3) that it “shall come into force at once”.

Does the Act reach a foreign exchange with no office in Pakistan?

It can. The reach does not depend on physical presence. Section 2(1)(a) also captures a VASP that “holds itself out as carrying on” a Virtual Asset Service in or from Pakistan — holding out, by itself, is enough to bring an entity within scope. Section 4 then gives the Authority express extraterritorial investigation and enforcement powers.

Section 4(1) is unusually broad:

For the purposes of investigation and enforcement under this Act, the Authority may exercise its powers extraterritorially to the fullest extent permitted by law.

Three features of the statutory architecture matter here for offshore operators.

First, holding out is an independent trigger. An exchange that markets to Pakistani users, advertises in Pakistan, or presents itself as available to Pakistani residents may be caught by the “holds itself out” limb even where its actual operations, entity and servers sit elsewhere. The Act does not require completed transactions for this limb.

Second, marketing is separately prohibited. Under section 43(1) of the Act, no person shall advertise or market a Virtual Asset unless the Issuer holds a valid licence or registration under the Act. Section 43(2) requires all marketing materials to carry risk disclosures and comply with such conditions as the Authority prescribes. This bites on promotional conduct regardless of where the platform is incorporated.

Third, the Authority can act against access. Section 61 empowers the Authority to remove, block, or direct the removal or blocking of online material — websites, apps, advertisements, payment links — where on reasonable grounds it promotes, operates, or relates to an unlicensed Virtual Asset Service. Section 61(2) allows those directions to be issued to telecommunication authorities, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars and payment providers. Section 61(5) gives an affected person ten days to submit a representation, to which the Authority must respond in writing within fifteen days.

That last power is the practical one. An offshore operator may be beyond the easy reach of service of process, but its app listing, domain registrar and payment rails frequently are not. We have set out how offshore platforms structure entry lawfully in our analysis of how a foreign crypto exchange enters Pakistan under PVARA.

Where exactly is the boundary undrawn?

The Act itself concedes the gap. Section 4(2) directs the Authority to prescribe, by Regulations, the conditions under which a Virtual Asset Service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to persons in Pakistan. Those Regulations have not been issued. Until they are, the reverse-solicitation boundary is unwritten.

The full text of section 4(2):

In order to facilitate enforcement under this section and the effective regulation of Virtual Asset Services with cross-border implications, the Authority may enter into agreements or arrangements with regulatory authorities and law enforcement agencies in other jurisdictions for mutual assistance, information sharing, and the recognition and enforcement of regulatory decisions, and shall, by Regulations, prescribe the conditions under which a Virtual Asset Service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to Persons in Pakistan.

Note the drafting: “shall, by Regulations, prescribe”. This is not discretionary. The Authority is directed to draw the line. It has not yet done so publicly.

Here is what that leaves unresolved, question by question:

Question	Answered by the Act?	Position today
Is a Karachi-based operator serving only foreign users caught?	Yes — “from Pakistan”	In scope
Is holding out to Pakistani users enough, without transactions?	Yes — s.2(1)(a)	In scope
Does a Pakistani user signing up unprompted put an offshore platform in scope?	No	Undetermined pending s.4(2) Regulations
Does an Urdu-language site or PKR pricing constitute offering to Pakistan?	No	Undetermined
Does accepting PKR fiat rails or local payment providers count?	No	Undetermined
Is there a de minimis user-count or volume threshold?	No	None stated
Does IP-geoblocking Pakistan take you out of scope?	No	Untested

Our reading is that the absence of a reverse-solicitation carve-out is the single largest open question in the Act for offshore platforms. In several comparable regimes, a passive relationship initiated entirely by the customer sits outside the perimeter. Pakistan has not said so. Do not assume it.

What triggers the licensing prohibition once you are in scope?

Once in scope, section 50 is absolute. It prohibits any person from engaging in, or representing themselves as engaging in, any Virtual Asset Services in or from Pakistan unless that person is a company incorporated in Pakistan and holds a valid licence granted by the Authority. Both conditions are cumulative. A foreign licence is not a substitute.

Section 50(1) reads:

No Person shall, by way of business, engage in, or represent themselves as engaging in, any Virtual Asset Services in or from Pakistan, unless that Person:— (a) is a company incorporated under the Companies Act, 2017 or any other law for the time being in force in Pakistan governing the incorporation of companies; and (b) holds a valid license granted by the Authority under this Act.

The consequence of getting this wrong is criminal, not merely administrative. Under section 54(1), whoever wilfully provides an unlicensed Virtual Asset Service is punishable with imprisonment up to five years, a fine up to fifty million rupees, or both. Section 55 extends liability to any director, manager, secretary or similar officer where the offence is committed with their consent, connivance or neglect.

The route in is sequenced. Under section 19(1), any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services must first apply for a No-Objection Certificate before commencing incorporation. Section 19(4) then provides for the licence application following incorporation. The PVARA NOC and SECP registration pathway runs in that order, and the corporate setup work cannot lawfully start before the NOC is in hand.

Which services require a licence is set out in Schedule I, read with section 18. We have broken these down in the 10 PVARA licence categories explained, and there is a fuller treatment in the PVARA licence guide.

How does the NOC regime treat a foreign entity already operating in Pakistan?

The PVARA No Objection Certificate Regulations 2025 contemplate this directly. They refer to “the foreign Applicant (the applicants whose foreign chapter is already providing VASP services in Pakistan)” and require that entity, following issuance of the NOC, to register on the FMU goAML platform as the reporting entity for AML-Registered Services.

Under Regulation 11.4 of those Regulations, the foreign applicant registers on goAML as reporting entity for AML-Registered Services unless otherwise directed by the Financial Monitoring Unit or the Federal Government. Under Regulation 11.5, once the applicant incorporates its local entity in Pakistan, that local entity — after being granted the licence — assumes the reporting-entity role.

Regulation 2.3 designates four services as AML Registered Services for goAML purposes: Broker-Dealer Services, Custody Services, Exchange Services, and Virtual Asset Derivative Services. Critically, where AML Registration is granted, the applicant may provide those four services before obtaining a licence under section 17 of the Ordinance referenced in those Regulations, subject to conditions imposed by the Authority. All other Virtual Asset Services require a full licence first.

Two practical observations. First, the Regulations plainly assume some foreign platforms are already serving Pakistani users — the drafting is an accommodation, not a prohibition. Second, they create real disclosure obligations for the offshore entity: Form A1 requires Key Individual details “for both the global entity being registered on the goAML portal and the proposed local entity in Pakistan”, and Form A2 requires beneficial ownership disclosure for both. The FMU goAML registration process and the post-NOC operational sequence are worth reading together on this point.

Can transitional provisions protect an existing offshore operator?

Only briefly, and only if you move. Section 70(1) requires any person providing Virtual Asset Services immediately before the commencement of the Act to apply for a licence within six months of commencement, or cease providing such services. Section 70(2) permits continued provision of existing services during that window where a complete application has been submitted.

Section 70(2) carries a proviso:

Provided that such Person fully complies with any interim directives issued by the Authority and continues to adhere to the core obligations of this Act, particularly regarding customer asset protection under AML, CFT and CPF.

The transitional window is therefore conditional on three things: a complete application, compliance with interim directives, and continued adherence to customer asset protection and AML obligations. An incomplete filing does not buy time. Section 74 separately preserves anything validly done under the lapsed Virtual Assets Ordinance, 2025.

For firms that want to test the market before committing to a full licence, the sandbox route exists under section 35, and we compare the available paths in sandbox vs NOC vs no-action letter vs full licence. Note that Sandbox Guidelines require a non-local applicant to incorporate locally and evidence tax registration once sandbox approval is granted.

What should an offshore operator do while the boundary is undrawn?

Assume the wider reading and document your position. The Act’s plain text is broad, the extraterritorial power in section 4(1) is expressed to the fullest extent permitted by law, and the clarifying Regulations under section 4(2) are not published. Prudence points one way.

Steps that are defensible on the current text:

• Map your Pakistan-facing conduct honestly. User counts, marketing spend, language localisation, PKR rails, referral partners, app-store availability. Section 61 targets exactly these surfaces.
• Treat “holding out” as live risk. Section 2(1)(a) does not require transactions. Marketing under section 43(1) is prohibited absent a valid licence or registration.
• Decide between exit and entry deliberately. Geoblocking is untested as a defence. Structured entry through the NOC is the only route the Act itself blesses.
• Sequence correctly. NOC first under section 19(1), then incorporation, then licence. Reversing the order is a defect on the face of the file.
• Prepare the banking side early. A licence does not produce a bank account; see crypto banking in Pakistan and our tax and banking work.
• Watch for the section 4(2) Regulations. They will define reverse solicitation. Until published, no one can tell you where the line sits with confidence.

One further point often missed: section 5(1) provides that the Act is in addition to, and not in derogation of, other law, and prevails over inconsistent law other than the Foreign Exchange Regulation Act, 1947. Section 5(2) preserves the primacy of data protection, data governance, cybersecurity, financial secrecy and cross-border personal data transfer provisions. Cross-border operators should read section 39 on data localisation alongside these.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, the PVARA No Objection Certificate Regulations 2025 (Document Code PVARA/REG/AML-REG/2025-1, Version 1.0), and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued — in particular the Regulations directed under section 4(2) defining when an offshore service is deemed offered or marketed to persons in Pakistan — that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.