Is Crypto Legal in Pakistan Under the 2026 Act?

The question “is crypto legal in Pakistan” has had several answers over the past decade, most of them derived from circulars, statements and inference rather than statute. That is no longer the position.

Pakistan now has primary legislation on the subject. The Virtual Assets Act, 2026, as passed by the National Assembly, does not ban virtual assets. It regulates them — which is a different thing, with different consequences for anyone holding, trading in, or building a business around them.

This article sets out precisely what the Act permits, what it restricts, and what it makes a criminal offence.

Is cryptocurrency legal in Pakistan?

Virtual assets are lawful in Pakistan and are now regulated by statute. The Virtual Assets Act, 2026 creates a licensing regime for businesses providing virtual asset services rather than prohibiting virtual assets themselves. However, section 3(1)(xxxi) states expressly that virtual assets are not legal tender.

The distinction matters. A prohibition would make holding or transacting unlawful. A licensing regime makes providing services to others without authorisation unlawful, while leaving the asset class itself lawful to hold and use.

“‘Virtual Asset’ means a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes… For the avoidance of doubt, Virtual Assets are not legal tender.”

— Virtual Assets Act, 2026, section 3(1)(xxxi)

“Not legal tender” means no person is obliged to accept a virtual asset in settlement of a debt. It does not mean the asset is unlawful, and it does not prevent two willing parties from transacting in one.

What does the Act actually regulate?

The Act regulates two categories of actor: Virtual Asset Service Providers carrying on a virtual asset service in or from Pakistan, and Issuers offering, originating or distributing a virtual asset in or from Pakistan on their own behalf. Section 2(1) sets this scope, and it is the whole of it.

Section 2(1) does not extend to individual holders, individual traders acting for themselves, or users of a service. The regulatory burden falls on the intermediary and the issuer.

The businesses caught are those providing any of the ten service categories in Schedule I:

• Advisory Services — personalised recommendations to a specific customer
• Broker-Dealer Services — arranging orders, accepting orders and consideration, proprietary trading, market-making with customer assets, placement for issuers
• Custody and Administration Services — safekeeping virtual assets or private keys for customers
• Exchange Services — crypto-to-fiat, crypto-to-crypto, order matching, order-book maintenance
• Lending and Borrowing Services
• Virtual Asset Derivatives Services
• Management and Investment Services — including discretionary staking for customers
• Transfer and Settlement Services
• Issuance Services
• Mining-related Services involving customer assets or funds

Section 18(b) allows the Federal Government to notify additional services, which are then added to Schedule I.

What is expressly outside the Act?

Section 2(2) excludes six categories from the Act’s application. These are statutory carve-outs, not regulatory concessions, and each carries conditions.

Excluded category	Condition
Closed-ecosystem or closed-loop tokens	Must satisfy seven conditions in s.2(2)(a), including no transferability outside the platform, no fiat convertibility, no external market trading
Securities, derivatives, collective investment schemes, depositary receipts and traditional financial instruments	Must fall within the jurisdiction of the State Bank of Pakistan or the Securities and Exchange Commission of Pakistan
Digital representations of fiat currency issued by a central bank	Includes the State Bank of Pakistan and any foreign central bank or monetary authority
Non-fungible tokens	Not used for payment or investment, and not representing or deriving value from a security, commodity, financial asset or regulated instrument
NFTs and digital collectibles not constituting a virtual asset	Assessed by substance, function or economic effect
Anything PVARA expressly excludes	Open-ended residual power under s.2(2)(f)

Three further exemptions sit inside the definitions rather than in section 2(2):

• Pure mining. Section 37(2) states that pure mining, by itself, does not constitute a virtual asset service requiring a licence. Mining involving customer assets or funds does.
• Proprietary trading. Schedule I item 2 exempts a person dealing solely on its own account that does not execute customer orders and does not hold or control customer assets.
• Non-custodial software. Schedule I item 3 excludes the mere provision of software, hardware or infrastructure enabling a customer to retain exclusive control over their own private keys.

What is a criminal offence under the Act?

Section 50 makes it an offence to provide virtual asset services by way of business in or from Pakistan without both Pakistani incorporation and a valid PVARA licence. Sections 51 to 53 prohibit unauthorised token offerings, market manipulation and insider trading, and uncollateralised algorithmic tokens. Section 54 sets the penalties.

The full penalty schedule:

Conduct	Provision	Maximum
Providing an unlicensed virtual asset service, wilfully	s.54(1)	5 years and/or Rs 50 million
Conducting an Initial Virtual Asset Offering in contravention of the Act	s.54(2)	3 years and/or Rs 25 million
Market manipulation or insider trading, natural person	s.54(3)(a)	3 years and/or Rs 25 million
Market manipulation or insider trading, legal person	s.54(3)(b)	3× profit gained or loss avoided; or up to 15% of preceding year’s turnover
Knowingly making a false or misleading statement to PVARA	s.54(4)	3 years and/or Rs 20 million
Obstructing an officer of PVARA	s.54(5)	2 years and/or Rs 10 million
Wilfully failing to comply with a PVARA order or decision	s.54(6)	1 year and/or Rs 25 million
Wilfully refusing information to an authorised officer	s.57(3)	1 year and/or Rs 1 million

Section 53 deserves separate mention because it is a flat prohibition on a product type. No person may issue, offer or market a virtual asset whose primary mechanism for maintaining value is algorithmic and not fully or adequately collateralised, unless specifically permitted by Regulations and subject to prescribed safeguards.

Section 43(1) is similarly broad in reach: no person shall advertise or market a virtual asset unless the Issuer holds a valid licence or registration under the Act. That obligation falls on the person doing the advertising, not only on the issuer.

Section 55 extends liability to individuals. Where an offence is committed by a body corporate with the consent, connivance or neglect of any director, manager, secretary or similar officer, that person is deemed to have committed the offence.

What happens to businesses already operating?

Section 70(1) gives any person providing virtual asset services immediately before the Act’s commencement six months to apply to PVARA for a licence, or cease providing those services. Section 70(2) permits a person who has submitted a complete application within that period to continue providing existing services during the process.

The continuation right in section 70(2) is conditional. It applies only where the person fully complies with any interim directives issued by PVARA and continues to adhere to the core obligations of the Act, particularly regarding customer asset protection and AML, CFT and CPF.

Two limits on that relief are worth reading carefully:

• The application must be complete. An incomplete filing does not engage section 70(2).
• The protection covers existing services. It is not a licence to add new service lines during the window.

Separately, PVARA has published the No Objection Certificate Regulations 2025, which establish a pre-incorporation NOC route and permit AML-registered applicants to provide four service categories — exchange, broker-dealer, custody and derivatives — before a full licence issues. How that permission interacts with section 50 is not explained in either document, and we would not treat it as settled without written confirmation from PVARA.

What enforcement powers exist beyond prosecution?

PVARA holds substantial administrative powers that operate without a criminal trial. Section 59 provides administrative sanctions, section 60 permits emergency intervention for up to thirty days, and section 61 permits the blocking of websites, applications, advertisements and payment links connected to unlicensed services.

The administrative sanctions in section 59(1) are:

• A written reprimand or public censure
• A directive requiring the person to cease or remedy the contravention
• A financial penalty up to the maximum prescribed by the Rules
• Suspension or revocation of any licence
• Disqualification of any person from holding office or a position of responsibility in a licensee

Section 59(4) states that PVARA may impose a fine up to twenty-five million rupees for any contravention of the Act.

Section 61 is the provision most relevant to offshore operators. PVARA may remove or block, or direct the removal or blocking of, any online material — websites, apps, advertisements, payment links — that promotes, operates or relates to an unlicensed virtual asset service. Directions may be issued to telecommunication authorities, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars and payment providers. A person aggrieved may make a representation within ten days, and PVARA must respond in writing within fifteen days.

Appeals against PVARA orders run to the Virtual Assets Appellate Tribunal under section 63, within thirty days of communication of the order, and from there to the Supreme Court of Pakistan under section 65, within thirty days.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, including Schedule I, and from the PVARA No Objection Certificate Regulations 2025, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.