Ongoing Disclosure and Reserve Attestations Under Section 42

Publishing a whitepaper is only the opening disclosure for an issuer operating under Pakistan’s Virtual Assets Act, 2026. Section 42(2) imposes a continuing duty to keep disclosing material information, including reserve attestations, for as long as the offering runs. This article sets out what that ongoing duty covers, how it differs from the separate proof-of-reserves obligation that licensees carry, and where the Act layers extra requirements onto larger issuers.

What ongoing disclosure duty does section 42(2) impose on issuers?

Section 42(2) states it in a single sentence:

“Issuers shall make ongoing disclosures of material information including reserve attestations in the manner and frequency prescribed by Regulations.”

Three things follow from that wording. First, the obligation is continuing — “ongoing” — not a one-off filing alongside the whitepaper. Second, “material information” is broader than reserves; reserve attestations are named as one example within it, not the whole of it. Third, the actual manner and frequency of disclosure is left to Regulations that had not been issued in the source material reviewed for this analysis. An issuer cannot yet point to a fixed reporting calendar in the Act itself.

Section 42(4) adds a related duty on the Authority rather than the issuer: PVARA “shall prescribe, by Regulations, mandatory risk disclosures, periodic reporting requirements and disclosure templates applicable to Issuers and Licensees.” Note that this rule-making duty extends to both issuers and licensees generally, while section 42(2)’s ongoing disclosure duty is addressed to issuers specifically.

What is a reserve attestation, and how does it differ from proof-of-reserves under section 27?

The Act uses “reserve attestation” in section 42(2) and, separately, requires “audited reserve disclosures” for specific token types under sections 31 and 32. It also imposes a distinct “proof-of-reserves” obligation on licensees generally under section 27. These are related concepts that sit in different chapters and should not be treated as interchangeable.

	Section 42(2) reserve attestation	Section 27 proof-of-reserves
Who it applies to	Issuers	Licensees
Chapter	Chapter 7 — Market Conduct, Consumer Protection	Chapter 4 — Prudential Requirements, Safeguarding and Custody
What it involves	Ongoing disclosure of reserve position as part of material information	“Cryptographic proof-of-reserves reconciled against its liabilities to customers,” furnished to the Authority at prescribed intervals
Audience	Public / customers, per market conduct disclosure duties	The Authority, as a supervisory submission

Section 27(1) requires a licensee to “furnish to the Authority, at such intervals as may be Prescribed by Regulations, cryptographic proof-of-reserves reconciled against its liabilities to customers.” Section 27(2) separately requires an annual audit by a firm of chartered accountants approved by the Cabinet Division, which must include “a verification of the segregation of Customer Assets as required under section 24.” In practice, an entity that is both an issuer and a licensee — which will be common, since most issuers offering tokens through their own platform will also hold a Schedule I licence — carries both duties at once: public-facing reserve attestations under section 42(2), and a supervisory proof-of-reserves submission under section 27. These can draw on the same underlying reserve data, but they are addressed to different audiences and serve different purposes, so a compliance framework should not assume one filing satisfies both.

Do fiat-referenced and asset-referenced token issuers face extra reserve disclosure rules?

Yes, on top of the general section 42(2) duty. Chapter 5 of the Act sets specific issuance requirements for two categories of token:

Fiat-Referenced Tokens. Section 3(1)(ix) defines a Fiat-Referenced Token as one that “purports to maintain a stable value relative to a single Official Currency of any country and is redeemable at par value by its issuer.” Section 31(1) requires any such issuer to maintain, among other things, “hundred percent reserve backing, with High-Quality Liquid Assets (HQLA) or other assets as prescribed for fiat referenced token, held as a segregated reserve,” redemption at par value without undue delay, and “audited reserve disclosures as prescribed by the Authority.”

Asset-Referenced Tokens. Section 3(1)(i) defines an Asset-Referenced Token more broadly, as one representing “ownership rights, claims, or economic interests… in respect of one or more underlying assets, or… designed to maintain a stable value by reference to such underlying assets.” Section 32(1) requires a reserve of the underlying assets held in custody, “audited reserve disclosures as prescribed by the Authority,” and confirms in section 32(2) that the token “shall at all times be fully backed by the underlying assets” and “shall not be backed or derive its value from other Virtual Assets.”

Both provisions layer an “audited reserve disclosure” requirement on top of the general ongoing disclosure duty in section 42(2). An issuer of a stablecoin or a tokenised gold-backed asset-referenced token should expect the heaviest version of the reserve disclosure obligation in the Act, not the baseline one.

Do “significant issuers” face heavier ongoing disclosure obligations?

Potentially, yes. Section 33(1) allows PVARA to designate an issuer as a “Significant Issuer” where it “meets the thresholds and criteria prescribed by Regulations, having regard to size, scale, systemic importance, market impact, number of holders, and cross-border activity.” Section 33(2) then requires Significant Issuers to be registered with the Authority and to comply with “enhanced requirements, including reporting, disclosure, governance, and risk management, as prescribed in Regulations.”

No thresholds for what makes an issuer “significant” had been published in the material reviewed here, so an issuer cannot currently self-assess against a fixed number of holders or transaction volume. What is clear from the text is the direction of travel: scale increases the disclosure burden under this Act, rather than the framework applying a single flat standard to every issuer regardless of size.

What happens if an issuer fails to make required disclosures?

The Act’s general sanctions regime applies, since section 42 does not carry its own standalone penalty clause. Section 59(2) allows PVARA to impose administrative sanctions on issuers specifically, “with such modifications as are appropriate” from the sanctions available under section 59(1) — reprimand, a directive to remedy, a financial penalty, or, where the issuer also holds a licence, suspension or revocation of it. Section 54(4) separately makes it a criminal offence to “knowingly, make any false or misleading statement in any application, return or document submitted to the Authority,” punishable by up to three years’ imprisonment or a fine of up to twenty million rupees, or both — a provision that would bite on a false reserve attestation submitted to PVARA even outside the ordinary disclosure-failure route.

What should issuers build now, ahead of the disclosure Regulations?

Three practical steps:

• Separate the reserve attestation workstream from the proof-of-reserves workstream internally, even where they draw on the same reserve data, since one is a market disclosure and the other a supervisory submission under section 27.
• Build reserve reporting to the Chapter 5 standard if issuing a fiat-referenced or asset-referenced token, since the audited reserve disclosure duty there is heavier than the general section 42(2) baseline.
• Track holder numbers and transaction volume from launch, so that if PVARA later designates the issuer a Significant Issuer under section 33, the enhanced reporting build is not starting from zero.

An issuer weighing its overall capital requirement and reporting resourcing should treat ongoing disclosure as a standing operational cost of running a public offering under this Act, not a task completed once the whitepaper is published.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.