Pakistan's Virtual Assets Act 2026: The Complete Guide

Pakistan now has a dedicated statute for virtual assets. The Virtual Assets Act, 2026, as passed by the National Assembly, creates a new regulator — the Pakistan Virtual Assets Regulatory Authority — and gives it the power to licence, supervise and prosecute across the entire virtual asset sector.

The Act runs to twelve chapters, 74 sections and one schedule. It is a licensing statute, a prudential statute, an anti-money-laundering statute and a criminal statute in a single instrument. For anyone operating a crypto exchange, a custody service, a brokerage or a token issuance in Pakistan, it is now the controlling law.

This guide sets out what the Act does, chapter by chapter, and identifies the provisions that carry immediate operational consequences.

What is the Virtual Assets Act 2026?

The Virtual Assets Act, 2026 is Pakistan’s primary legislation governing virtual assets and the businesses that provide services in them. It establishes the Pakistan Virtual Assets Regulatory Authority (PVARA), makes licensing mandatory for virtual asset services, and creates criminal offences for operating without a licence.

Section 1 is unusually direct on timing. The Act extends to the whole of Pakistan and, under section 1(3), “shall come into force at once.” There is no phased commencement and no appointed-day mechanism. The obligations in the Act took effect on commencement, subject only to the transitional relief in section 70.

The preamble states two purposes: establishing a dedicated authority to ensure investor protection, transparency and market integrity; and providing a legal framework to combat money laundering, terrorist financing and proliferation financing involving virtual assets in accordance with international standards.

Who does the Act apply to?

Section 2(1) applies the Act to two categories: any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan; and any Issuer that offers, originates or distributes a Virtual Asset in or from Pakistan on its own behalf.

The phrase “in or from Pakistan” matters. It captures a business operating out of Pakistan and serving foreign customers, as well as an offshore business serving Pakistani customers. Section 4(2) reinforces this by requiring PVARA to prescribe, by Regulations, the conditions under which a service conducted outside Pakistan will or will not be deemed to be offered to persons in Pakistan.

“This Act shall apply to— (a) any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan; and (b) any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan.”

— Virtual Assets Act, 2026, section 2(1)

Section 2(2) then carves out six categories, including closed-loop tokens meeting seven specified conditions, instruments already within the jurisdiction of the State Bank of Pakistan or the Securities and Exchange Commission of Pakistan, central bank digital currencies, and certain non-fungible tokens.

What are the twelve chapters of the Act?

The Act is organised into twelve chapters, each dealing with a distinct regulatory function. The table below maps the structure so you can locate any obligation quickly.

Chapter	Sections	Subject
I	1–5	Preliminary: title, scope, definitions, extraterritorial reach, relationship with other laws
2	6–17	The Authority: establishment, composition, functions, powers, funding, audit, code of conduct
3	18–23	Licensing: service categories, NOC, applications, fit and proper, grant, revocation
4	24–29	Prudential requirements: customer asset segregation, capital, custody, proof of reserves
5	30–33	Token issuance: offerings, fiat-referenced tokens, asset-referenced tokens, significant issuers
6	34–40	Cybersecurity, sandbox, mining, data localisation, data segregation
7	41–45	Market conduct: fair dealing, disclosure, marketing, conflicts, complaints
8	46–49	AML, CFT and CPF: AMLA 2010 application, travel rule, reporting, data privacy
9	50–53	Prohibitions: unlicensed services, unauthorised offerings, market abuse, algorithmic tokens
10	54–61	Enforcement: criminal offences, investigation, sanctions, emergency powers, blocking
11	62–65	Appeals: the Virtual Assets Appellate Tribunal and the route to the Supreme Court
12	66–74	Miscellaneous: tax, rule-making, transitional provisions, savings

Schedule I sits behind section 18 and lists the ten categories of virtual asset service that require a licence.

What does the Act require you to do before you incorporate?

Under section 19(1), any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services must first apply to PVARA for a No-Objection Certificate, before commencing the process of incorporation. The NOC comes first; the company comes second.

This inverts the usual sequence. In most Pakistani regulated sectors, a promoter incorporates with the Securities and Exchange Commission of Pakistan and then approaches the sector regulator. Section 19 requires pre-incorporation clearance. A promoter who incorporates first has not simply been inefficient — they have skipped a statutory step.

The licence application then follows incorporation, under section 19(4), accompanied by the prescribed fee (which is non-refundable unless PVARA determines otherwise) and the prescribed information and documents.

What are the ongoing obligations of a licensee?

Section 22 imposes six continuing obligations that apply “at all times” to every licensee. These are not application-stage requirements; they are conditions of holding the licence.

• Maintain the prescribed minimum paid-up capital and financial resources
• Comply with the Act and all Rules, Regulations, directives and guidelines issued by PVARA
• Submit periodic returns, reports and audited financial statements as prescribed
• Obtain prior approval for any material change in control or business
• Maintain risk management, compliance and cybersecurity systems, including adherence to data privacy standards
• Pay supervision, renewal and other prescribed fees

Chapter 4 layers prudential duties on top. Section 24(1) requires customer assets to be held in segregated accounts at all times. Section 24(2) removes customer assets from the licensee’s estate on insolvency, notwithstanding any other law. Section 24(3) imposes a fiduciary duty. Section 24(4) prohibits rehypothecation, lending or pledging of customer assets without the customer’s explicit, informed and revocable written consent.

What happens if you operate without a licence?

Section 50(1) prohibits any person from engaging in virtual asset services by way of business in or from Pakistan unless that person is both a company incorporated in Pakistan and holds a valid PVARA licence. Section 54(1) makes wilful contravention punishable with imprisonment up to five years, a fine up to fifty million rupees, or both.

The enforcement architecture is broader than the criminal penalty. The principal exposures are:

Provision	Conduct	Maximum exposure
s.54(1)	Unlicensed virtual asset service	5 years and/or Rs 50 million
s.54(2)	Unauthorised initial virtual asset offering	3 years and/or Rs 25 million
s.54(3)(a)	Market abuse or insider trading (natural person)	3 years and/or Rs 25 million
s.54(3)(b)	Market abuse (legal person)	3× profit gained or loss avoided; or 15% of annual turnover
s.54(4)	False or misleading statement to PVARA	3 years and/or Rs 20 million
s.54(5)	Obstructing an officer of PVARA	2 years and/or Rs 10 million
s.54(6)	Wilful non-compliance with a PVARA order	1 year and/or Rs 25 million

Alongside these, section 59 gives PVARA administrative sanctions ranging from public censure to licence revocation and disqualification from office. Section 60 permits emergency suspension of services or asset freezes for up to thirty days. Section 61 empowers PVARA to block websites, applications, advertisements and payment links connected to unlicensed services.

What has the Act left to be written?

A large part of the operative detail is deferred. The Act repeatedly uses the formula “as may be prescribed,” meaning prescribed by Rules made by the Federal Government under section 67 or by Regulations made by PVARA under section 68.

In practice, this means the following figures do not appear anywhere in the Act and cannot yet be planned against with precision:

• Minimum paid-up capital for any licence category (section 25 defers entirely)
• Application, licence, supervision and renewal fees (sections 19(4), 22(f))
• The travel rule transfer threshold (section 47(1))
• The definition of High-Quality Liquid Assets for stablecoin reserves (section 3(1)(x))
• Thresholds for Significant Issuer status (section 33(1))
• Proof-of-reserves reporting frequency (section 27(1))
• The monetary threshold for the independent dispute-resolution scheme (section 45(2))

In practice, an applicant should treat the Act as establishing the obligations and the subordinate instruments as establishing the numbers. Our reading is that capital planning in particular cannot be finalised until PVARA publishes the relevant Regulations, and any figure circulating before then should be treated as unverified.

How much time do existing operators have?

Section 70(1) gives any person providing virtual asset services immediately before commencement six months from commencement to apply for a licence, failing which they must cease providing those services.

Section 70(2) allows a person who has submitted a complete application within that six-month period to continue providing existing services, provided they fully comply with any interim directives issued by PVARA and continue to adhere to the core obligations of the Act, particularly on customer asset protection and AML, CFT and CPF.

Two points are worth flagging. First, the relief attaches to a complete application — an incomplete filing does not start the clock. Second, section 70(2) protects “existing” services, not new ones launched during the window.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.