Passing the fit and proper gate gets a sandbox applicant through the first of four eligibility limbs in PVARA’s Sandbox Guidelines 2026. The next two limbs — operational readiness, and a comprehensive regulatory and risk assessment — are where most of the actual drafting work in a sandbox application sits, because they ask for a working governance and control framework, not a statement of intent.
This article works through both limbs in detail: what the Guidelines require, and what each requirement means for the documents an applicant needs to have ready before submitting.
What does “operational readiness” mean in the Sandbox Guidelines?
Operational readiness is the second of the four eligibility limbs, and the Guidelines describe it as the applicant needing to “demonstrate operational readiness to participate in the Sandbox.” This is broken into five sub-requirements: a testing plan, risk management and consumer protection measures, a complete governance structure with an accompanying risk assessment and internal control mechanism, a sandbox exit plan, and readiness for scalability.
Unlike the fit and proper limb, which is assessed as a pass or fail against disqualifying history, operational readiness is assessed on the quality and completeness of what the applicant actually submits — closer to a due diligence review than a checklist.
What must the testing plan cover?
The Guidelines require “a clearly defined testing plan (objectives, duration, KPIs, and target users).” Each of these four elements is named individually, which signals that PVARA expects them addressed as discrete sections rather than folded into a general narrative: what the test is trying to prove, how long it will run, the key performance indicators used to judge it, and which category of users the product will be tested on.
This testing plan requirement in the eligibility criteria mirrors, and is expanded on, in Form I of the Guidelines, where “Readiness for Testing” is its own labelled part of the application, requiring evidence of technical readiness, integration and partnership details, operational and financial readiness, and consumer safety measures.
What risk management and consumer protection measures are required?
The Guidelines require measures “including data security, dispute resolution, and safeguarding consumer assets.” These three named areas are the minimum the Guidelines call out explicitly, but they sit inside a longer list of internal control expectations bundled into the same operational readiness limb, covering:
- enterprise risk assessment;
- identity verification, including detailed KYC and screening of both originator and beneficiary;
- a complaint handling mechanism;
- policies and procedures for handling and segregating client money and virtual assets;
- a liability management framework to safeguard clients from fraud;
- flagging and reporting of suspicious transactions;
- addressing technology risk, including system controls, cybersecurity, and protection of the private key; and
- complete risk disclosure to clients, and compliance with cross-border supervision and information-sharing protocols where applicable.
Read together, this list is close in substance to the AML/CFT framework PVARA requires of a full licensee applying for a no objection certificate — enterprise-wide risk assessment, CDD and screening procedures, and a documented escalation process. A firm that has already built this framework for a full licensing track has done most of the work this operational readiness limb asks for.
What does “complete governance structure” require, and why does the UBO matter?
The Guidelines specify a “complete governance structure (clearly identifiable Ultimate Beneficial Owner) along with risk assessment and internal control mechanism.” Naming the ultimate beneficial owner (UBO) explicitly, inside the governance requirement, ties directly back to the fit and proper limb — PVARA cannot assess whether a controller or sponsor is fit and proper if it cannot first identify who ultimately owns and controls the applicant.
Form I’s own applicant particulars section reinforces this by requiring the applicant’s entity information, executives, and VASP status, and by requiring — for an applicant that is not a local company — evidence of local incorporation and tax registration “as and when sandbox approval is granted.” Governance readiness for the sandbox therefore has a structural, not just a paperwork, dimension: an offshore applicant needs a plan for standing up a Pakistani entity, even though full incorporation is only triggered by approval rather than by the application itself.
What must the exit plan and scalability readiness show?
The operational readiness limb requires “a sandbox exit plan specifying transition to full authorization or orderly wind-down,” and separately, “readiness for scalability (technical, financial, and human).” These are forward-looking requirements — PVARA is asking the applicant to plan, at the point of application, for both possible outcomes of a successful and an unsuccessful test.
Form I’s Part C, on exit strategy and scaling, expands on this with three named sub-areas: the exit or termination strategy itself, including conditions for stopping the test and returning assets safely; the steps required for scaling up or transitioning to full deployment, including the technological and financial requirements that come with it; and a communication plan for informing users of disclosures, duration and termination notices. The scalability requirement’s three dimensions — technical, financial and human — mean an applicant should be able to show it has thought about infrastructure capacity, funding runway, and staffing beyond the pilot, not only the initial test cohort.
What must the comprehensive regulatory and risk assessment cover?
The third eligibility limb, distinct from operational readiness, requires the applicant to “conduct and submit a comprehensive regulatory and risk assessment, addressing cybersecurity, data privacy, and operational risks” and separately, “market risk and systemic risks.” This is a narrower, more clearly bounded requirement than the readiness limb, naming five specific risk categories rather than a general framework.
The fourth and final eligibility limb sits alongside this: the applicant must “ensure compliance with applicable legal framework, and confirm that the product/service is not designed for speculation, anonymity, or illicit activity.” That confirmation is a direct statement PVARA expects the applicant to make about the nature of the product itself, not only about its controls.
How does PVARA actually evaluate readiness once submitted?
Readiness is not assessed in isolation from the sandbox’s Key Evaluation Criteria, applied during the evaluation phase. Under “Feasibility and Exit Strategy,” the Guidelines list “technical and operational readiness, including team expertise,” “clear testing parameters,” and “exit plans (winding down if unsuccessful or transitioning to licensing if successful)” as the evaluation points — the same substance as the eligibility limb, now reframed as scoring criteria. The Guidelines also note that the Authority “may impose limits on transaction volumes, user numbers, or exposure on a case-to-case basis,” which is one of the practical levers PVARA uses to manage risk on an applicant whose readiness is judged adequate but not yet proven at scale.
Financial strength and tax law compliance are assessed as separate criteria alongside readiness — the applicant must demonstrate the financial capacity to run the proposed business model, and, if based in Pakistan, compliance with applicable tax law.
Related reading
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect