A crypto exchange that runs its own trading desk alongside a customer order book has a structural conflict built into its business model from day one. So does a custodian whose directors also hold a large personal position in one of the assets it safekeeps, or an advisory arm that recommends products issued by an affiliated entity. Section 44 of the Virtual Assets Act, 2026 does not ban these business models outright, but it does impose a specific, ongoing duty on every licensee to identify, manage and disclose the conflicts they create — and it sets a clear priority rule for when a conflict cannot be fully resolved.
This matters for anyone structuring a Pakistani virtual asset business, not only for the compliance function that will eventually operate the policy. Conflicts that are foreseeable at the design stage — a group structure with an affiliated market maker, a lending desk sitting next to a custody business — are far cheaper to manage through structure than through disclosure alone once the business is already licensed and operating.
What exactly does section 44 require a licensee to do?
Section 44 states:
“A Licensee shall identify, manage, and disclose conflicts of interest and shall not place its own interests above those of its customers, in accordance with detailed requirements on policies, disclosure, and management as may be prescribed by the Authority by Regulations.”
Read carefully, this is a three-part duty — identify, manage, disclose — layered on top of a standalone prohibition: a licensee must not place its own interests above those of its customers. The three-part duty describes a process a licensee has to run continuously. The prohibition describes an outcome that no amount of disclosure alone can excuse if it is actually breached.
What counts as a “conflict of interest” under the Act?
The Act does not define the term for the purposes of section 44, and no Regulations detailing its scope had been issued in the material reviewed here. In the absence of a statutory definition, the ordinary sense of the phrase — a situation where a licensee’s own financial or business interest could reasonably influence how it treats a customer — is the working standard until PVARA prescribes something more specific.
Some conflict scenarios are visible directly from the structure of the Act’s licensing categories under Schedule I. A virtual asset service provider offering both broker-dealer services and exchange services under the same licence, for example, sits on both sides of a trade in a way a pure exchange does not. A licensee providing custody services while also running proprietary trading has an incentive tension between safeguarding a customer’s assets and its own trading book. Neither structure is prohibited by the Act — but each is a candidate conflict a licensee should expect to have to identify and manage under section 44, whatever PVARA’s eventual Regulations say in detail.
What does “shall not place its own interests above those of its customers” actually forbid?
This is the operative safeguard in section 44, and it reads as an outcome-based rule rather than a process rule. Even a licensee that has identified, documented and disclosed a conflict in full compliance with its policies can still breach this clause if, in a specific instance, it actually favours its own position over a customer’s. Disclosure manages a conflict; it does not license a licensee to act on it against a customer’s interest.
This sits alongside a related, broader duty in section 41(1): a licensee “shall conduct its business honestly, fairly and professionally and in accordance with the best interests of its customers and in a manner that upholds the integrity of the market.” Section 44’s customer-primacy rule can be read as a specific application of that general standard to the conflicts context, rather than a separate, freestanding obligation.
Who decides what “managing” a conflict looks like in practice?
Section 44 leaves the detailed content to Regulations PVARA is empowered but not yet shown to have issued, covering “policies, disclosure, and management.” Until those Regulations arrive, a licensee has to build its own conflicts framework against the plain words of section 44 itself. In our reading, a defensible starting framework covers the following elements, whether or not PVARA’s eventual Regulations require every one of them by name:
- A written conflicts-of-interest policy approved at board level, mirroring the governance pattern the Act uses elsewhere — for instance, the AML/CFT policy requirement discussed in the PVARA No Objection Certificate Regulations, which similarly requires board-approved frameworks rather than informal practice.
- A conflicts register logging identified conflicts, the business unit affected, and the management steps taken — creating the audit trail a supervisor is likely to ask for during an on-site inspection.
- Escalation to a named individual — likely the compliance officer or a designated key individual role, given how central named accountability is to the Act’s governance provisions generally.
- Customer-facing disclosure at the point a conflict becomes relevant to a transaction, rather than only in a general terms-of-service document a customer is unlikely to read closely.
- Periodic review of the register and policy, since a conflict that is manageable at a licensee’s current scale may not remain so as the business grows.
| Governance element | Where the Act’s pattern comes from | Confidence level |
|---|---|---|
| Board-approved written policy | Section 44 + governance pattern across Act | Reasonably certain |
| Named individual with escalation authority | Key Individual definition, section 3(1)(xv) | Reasonably certain |
| Conflicts register / audit trail | Inspection powers, section 9(2)(e) | Likely expected |
| Detailed disclosure format and thresholds | Section 44’s Regulations | Not yet prescribed |
What happens if a licensee breaches the customer-primacy rule?
Section 44 has no standalone penalty of its own, so a breach is enforced through the Act’s general sanctions machinery. Section 59(1) allows PVARA to impose a written reprimand or public censure, a directive to cease or remedy the conduct, a financial penalty up to the prescribed maximum, suspension or revocation of the licence, or disqualification of an individual from holding a position of responsibility at a licensee. Section 23(1)(a) also lists contravention of “any provisions of this Act” — which includes section 44 — as a ground on which PVARA may vary, suspend or revoke a licence outright, after written notice and an opportunity to be heard.
Because section 44 places the customer-primacy duty on the licensee as an entity, a serious or repeated breach is a licence-level risk, not merely a matter for the individual staff member involved in a particular transaction. This is worth weighing against the cost of building a proper conflicts framework early: the framework is cheaper than the exposure it prevents.
How should this shape day-one governance for a new licensee?
Anyone building the compliance function for a Pakistani virtual asset business should treat section 44 as a design constraint on the business model itself, not only a policy document to be drafted after incorporation. A group structure that puts an affiliated market maker, a proprietary trading arm or an in-house token issuance business alongside a customer-facing licensee creates conflicts that a policy can manage but cannot make disappear. Building the conflicts register and escalation path into the operating model from the outset — rather than treating it as paperwork to satisfy an application checklist — is the difference between a framework that works under supervision and one that exists only on paper until the first customer complaint tests it.
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect