Penalties Under Pakistan's Virtual Assets Act 2026

The Virtual Assets Act 2026 is not a light-touch statute. It carries prison terms of up to five years, fines reaching fifty million Rupees, and a turnover-based penalty for corporate market abuse that has no fixed ceiling at all.

Most operators entering Pakistan read the licensing chapter and stop there. That is a mistake. The enforcement chapter tells you what the Authority can actually do to you, and it tells you which failures the legislature considered serious enough to criminalise rather than merely fine.

This article sets out every penalty in the Act, in the two places they live: section 54 (criminal offences, tried in court) and section 59 (administrative sanctions, imposed by the Authority). Everything below is drawn from the Act as passed by the National Assembly.

What are the penalties under the Virtual Assets Act 2026?

The Act creates two penalty regimes. Criminal offences under section 54 carry imprisonment of up to five years and fines of up to fifty million Rupees, tried by a court on a report from an authorised officer of the Authority. Administrative sanctions under section 59 are imposed by the Authority directly and include reprimands, directives, financial penalties of up to twenty-five million Rupees, licence suspension or revocation, and disqualification from office.

The distinction matters enormously in practice. An administrative sanction is a regulatory decision you appeal to the Virtual Assets Appellate Tribunal. A criminal conviction requires a prosecution, a special public prosecutor, and a court. They are not alternatives — section 54(6) expressly contemplates both running together for the same conduct.

What are the criminal offences and their maximum penalties?

Section 54 of the Act sets out six criminal offences. Each has its own ceiling. The most serious — providing an unlicensed Virtual Asset Service — carries up to five years’ imprisonment or a fine up to fifty million Rupees, or both.

Conduct	Section	Imprisonment	Fine ceiling
Wilfully providing an unlicensed Virtual Asset Service	54(1)	up to 5 years	up to Rs 50 million
Conducting an Initial Virtual Asset Offering in contravention of the Act, Rules and Regulations	54(2)	up to 3 years	up to Rs 25 million
Market manipulation or insider trading (natural person)	54(3)(a)	up to 3 years	up to Rs 25 million
Market manipulation or insider trading (legal person)	54(3)(b)	—	see below
Knowingly making a false or misleading statement in any application, return or document submitted to the Authority	54(4)	up to 3 years	up to Rs 20 million
Obstructing an officer of the Authority in the exercise of powers under the Act	54(5)	up to 2 years	up to Rs 10 million
Wilfully failing to comply with any order or decision of the Authority	54(6)	up to 1 year	up to Rs 25 million

Note the drafting on each: “imprisonment for a term up to X, or with fine up to Y, or with both”. The court has discretion across the whole range. These are maxima, not tariffs.

A separate offence sits outside section 54. Under section 57(3), a person who wilfully refuses to provide information required by an authorised officer is punishable with imprisonment for a term up to one year, or a fine up to one million Rupees, or both. That is the smallest monetary ceiling in the Act — and the easiest to trigger during an inspection.

How is a company punished for market manipulation?

Where a legal person contravenes section 52 — the prohibition on market manipulation and insider trading — the fine is calculated from the money involved, not from a fixed schedule. Section 54(3)(b) provides for a fine of three times the profit gained or loss avoided. Where that figure cannot be determined, the fine may not exceed 15% of the body corporate’s total annual turnover in the preceding financial year.

“(b) in the case of a legal person, with fine or three times the amount of any profit gained or loss avoided as a result of the contravention. If the amount of profit gained or loss avoided cannot be determined, a fine not exceeding 15% of the total annual turnover of the body corporate in the preceding financial year.”

This is the only penalty in the Act with no absolute ceiling. For a mid-sized exchange, 15% of turnover dwarfs the Rs 50 million maximum for unlicensed operation. Our reading is that this provision is where the real financial exposure sits for any licensed exchange operator running an order book, and it is the strongest argument for investing early in surveillance and conflict-of-interest controls rather than treating market conduct as a documentation exercise.

Section 52 itself prohibits three insider behaviours: using inside information to trade for yourself or others, recommending or inducing trading based on inside information, and unlawfully disclosing inside information. Section 52(3) states that the Authority shall issue guidelines and regulations specifying the type of manipulative behaviour. Those guidelines have not been published as at the date of this analysis, so the operative boundary of “manipulative behaviour” remains to be filled in.

Who else can be held liable — can directors go to prison?

Yes. Section 55 of the Act makes officers of a body corporate personally liable. Where an offence is committed by a company with the consent, connivance or neglect of any director, manager, secretary or similar officer, that person is deemed to have committed the offence themselves.

“Where an offence under this Act is committed by a body corporate with the consent, connivance or neglect of any director, manager, secretary or similar officer, such Person shall be deemed to have committed the offence.”

The word doing the work here is “neglect”. Consent and connivance require knowledge. Neglect does not. An officer who should have known, and whose failure to supervise allowed the offence, falls inside the section. That is a materially wider net than a knowledge-based standard, and it should shape how you document board oversight, escalation lines and committee minutes from day one.

This links directly to the fit and proper regime and to the design of your governance structure at incorporation. Under section 20(4) of the Act, fit-and-proper criteria are continuing in nature and any person subject to them must notify the Authority of any matter affecting their fitness and propriety. A conviction, or even an investigation, is such a matter.

What administrative sanctions can PVARA impose without going to court?

Under section 59(1), where the Authority is satisfied that a person has contravened the Act, Rules, Regulations, directions, circulars or other regulatory requirements, it may impose one or more of five sanctions directly. Section 59(4) sets a fine ceiling of twenty-five million Rupees for any contravention of the Act.

The five sanctions are:

• a written reprimand or public censure;
• a directive requiring the person to cease or remedy the contravention;
• a financial penalty up to the maximum amount prescribed by the Rules;
• suspension or revocation of any licence issued under the Act; or
• disqualification of any person from holding any office or position of responsibility in a Licensee.

Three features deserve attention. First, section 59(2) extends the same sanctions, “with such modifications as are appropriate”, to Issuers — so a stablecoin or asset-referenced token issuer is exposed on the same terms as a service provider. Second, section 59(3) allows the Authority to impose administrative sanctions where a Virtual Asset Service Provider or Issuer contravenes any other law applicable in Pakistan, in accordance with Regulations. A tax or data-protection failure can therefore become a PVARA matter.

Third, note the interaction between subsections (1)(c) and (4). Subsection (1)(c) refers to a penalty “up to the maximum amount prescribed by the Rules”; subsection (4) states a figure of twenty-five million Rupees. The Rules referred to in subsection (1)(c) have not been notified as at the date of this analysis. Until they are, the twenty-five million figure in subsection (4) is the only stated cap in the Act itself. Verify the current position with the Authority before relying on either.

Section 59(5) adds that the court may order restitution, disgorgement of profits or such other relief as it deems appropriate — a remedy that sits with the court rather than the Authority.

Can PVARA shut me down or block my website?

Yes, on two separate powers, and neither requires a conviction first.

Section 60 gives the Authority emergency intervention powers. In the event of a systemic threat, market manipulation, fraud, cybersecurity breach, or other serious risk to customers or market integrity, the Authority may issue an order temporarily suspending specified Virtual Asset Services or freezing related assets, for a period not exceeding thirty days.

Section 61 addresses unlicensed activity online. The Authority may remove, block, or direct the removal or blocking of any online material — websites, apps, advertisements, payment links — where on reasonable grounds it promotes, operates or relates to an unlicensed Virtual Asset Service, or contravenes the Act, Rules or Regulations. Directions may go to telecommunication authorities, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars and payment providers.

Two procedural protections apply. Under section 61(3), all orders must be in writing, state reasons and statutory basis, and be communicated to the affected person. Under section 61(5), an aggrieved person may submit a representation within ten days, and the Authority must respond in writing within fifteen days. That is a short window, and it explains why foreign exchanges planning market entry should have local counsel instructed before, not after, a direction lands.

Marketing is a separate trap. Under section 43(1), no person shall advertise or market a Virtual Asset unless the Issuer holds a valid licence or registration under the Act. That prohibition binds any person — including affiliates and promoters — not only the Issuer. Anyone building a launch or KOL campaign in Pakistan needs to confirm the licence position first.

How are these offences investigated and prosecuted?

Only an authorised officer of the Authority may investigate offences under the Act, under section 56. That officer must obtain a search and seizure warrant from a court of competent jurisdiction under section 57(1), and then exercises the powers of an officer in charge of a police station under the Code of Criminal Procedure, 1898.

The procedural chain, drawn from sections 54 to 58:

1. An authorised officer of the Authority investigates (section 56).
2. A warrant is obtained from a competent court for search and seizure (section 57(1)).
3. No court may take cognizance of an offence except on a written report by an authorised officer of the Authority (section 57(4)).
4. Prosecution is conducted by a special public prosecutor appointed by the Federal Government (section 58(1)).
5. The court follows Chapter XXII-A of the Code of Criminal Procedure, 1898, and disposes of matters as expeditiously as possible (section 58(3)).
6. Hearings may not be adjourned except for sufficient cause recorded, and for no more than fourteen days at a time (section 58(4)).
7. The Federal Government may designate one or more Special Courts for offences under the Act (section 54(8)).

Under section 54(7), offences are investigated, tried and punished in accordance with the Code of Criminal Procedure, 1898 and the Qanun-e-Shahadat Order, 1984, unless the Act provides otherwise.

How do I appeal a penalty?

Under section 63 of the Act, any Virtual Asset Service Provider, Licensee or other person aggrieved by an order of the Authority may appeal to the Virtual Assets Appellate Tribunal within thirty days of the date the order was communicated. Section 64(2) requires the Tribunal to decide an appeal within three months of presentation.

The Tribunal comprises a presiding officer — a retired High Court judge, or an advocate with at least ten years’ practice — plus two members, one a technical expert and one a financial expert, each with at least ten years’ experience in law, technology, finance or economics (section 62(2)). For the purpose of deciding an appeal, the Tribunal is deemed to be a civil court with powers under the Code of Civil Procedure, 1908, including enforcing attendance, compelling production of documents and issuing commissions (section 64(3)).

Section 64(4) applies the civil standard of proof, in a summary manner. Section 62(1) is important: no court may take cognizance of a legal dispute under the Act to which the Tribunal’s jurisdiction extends. From the Tribunal, section 65 allows an appeal to the Supreme Court of Pakistan within thirty days.

What does this mean for an operator entering Pakistan?

The practical takeaway is that the highest-probability offences are not the dramatic ones. Nobody sets out to manipulate a market. But section 54(4) — knowingly making a false or misleading statement in any application, return or document submitted to the Authority — attaches to every form you file, including the NOC application and its annexes. Three years and twenty million Rupees for a misstatement in a submission is a serious deterrent against optimistic drafting.

Section 54(6) is the other quiet risk: wilfully failing to comply with any order or decision of the Authority carries up to one year and up to twenty-five million Rupees, and the Authority may also impose administrative penalties. Regulatory correspondence is not optional reading.

Finally, note section 70. Any person providing Virtual Asset Services immediately before commencement must, within six months, apply for a licence or cease to provide such services. Section 70(2) allows continued operation on a complete application, provided the person fully complies with interim directives and continues to adhere to core obligations, particularly on customer asset protection under AML, CFT and CPF. Miss that window and you are inside section 54(1) — the five-year offence. If you are weighing your route in, whether sandbox, NOC or full licence, the transitional clock is the first thing to date. Tax obligations under section 66 run in parallel and are enforced separately by the Federal Board of Revenue, which is why tax and banking readiness belongs in the same workstream. The PVARA licence guide sets out the sequence.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act 2026 as passed by the National Assembly — principally Chapters 9, 10 and 11, sections 43, 50 to 65, and sections 66 and 70 — read as published. Where practice is not yet settled or guidance has not been issued, that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.