Section 4 of the Virtual Assets Act, 2026 is short — three subsections — and easy to skim past on a first read of the Virtual Assets Act. It should not be skimmed. It is the provision that tells a foreign exchange, a foreign-based promoter, or an offshore service marketing into Pakistan whether distance from Islamabad is any kind of shield.
For anyone running a foreign crypto exchange or servicing Pakistani customers from abroad, section 4 is the provision that answers the question “can PVARA actually reach me.” The short answer, on the text, is yes for enforcement purposes — but the section also shows where that reach still depends on Regulations that have not yet been written.
What does section 4(1) actually grant PVARA?
Section 4(1) provides that, “for the purposes of investigation and enforcement under this Act, the Authority may exercise its powers extraterritorially to the fullest extent permitted by law.” That is a broad grant in principle, but it is bounded by a real constraint written into the same sentence: “to the fullest extent permitted by law.”
That phrase matters more than it looks. It does not create a new, unlimited power for PVARA to act inside another country’s borders. It authorises PVARA to use whatever extraterritorial enforcement tools are already lawful — under Pakistani law, international law, and the domestic law of the jurisdiction where the target is located. In practice, that means the real limits on section 4(1) sit outside the Act itself, in whatever mutual legal assistance and enforcement-cooperation frameworks actually exist between Pakistan and the jurisdiction in question.
Who does this apply to?
Anyone caught by the Act’s scope of application, regardless of where they are physically incorporated. Section 2(1)(a) applies the Act to “any Virtual Asset Service Provider that carries on, or holds itself out as carrying on, a Virtual Asset Service in or from Pakistan,” and section 2(1)(b) applies it to any Issuer that offers, originates or distributes a Virtual Asset “in or from Pakistan.” Neither test requires local incorporation — a platform based entirely offshore but marketing to Pakistani customers can fall inside scope on the “in or from Pakistan” wording alone.
Section 4 is the enforcement counterpart to that scope test. Where section 2 decides whether the Act applies to you at all, section 4 decides how far PVARA can chase a violation once it does.
How does PVARA actually enforce across a border?
Section 4(2) gives the Authority two distinct tools, and defers a third piece of detail to Regulations.
- Cooperation and mutual assistance agreements. The Authority “may enter into agreements or arrangements with regulatory authorities and law enforcement agencies in other jurisdictions for mutual assistance, information sharing, and the recognition and enforcement of regulatory decisions.” This is the mechanism by which a PVARA enforcement order could, in principle, be recognised and acted on by a foreign regulator.
- Regulations defining when a foreign service counts as “targeting” Pakistan. The same subsection requires the Authority to “prescribe the conditions under which a Virtual Asset Service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to Persons in Pakistan.” This is the detail that will, in practice, decide whether a foreign platform with some Pakistani users but no active marketing effort is inside or outside scope — and it has not yet been published. Until it is, the honest position for any offshore platform is that the boundary line is not yet knowable with precision, only the broad “in or from Pakistan” test in section 2.
Section 4(3) then ties this back to established international frameworks: the Authority “shall, where applicable, align its extraterritorial enforcement practices with mutual legal assistance treaties and international cooperation frameworks, including those of the Financial Action Task Force and International Organization of Securities Commissions (IOSCO).” In practice, this signals that PVARA’s cross-border reach is meant to run through recognised channels rather than unilateral action, which should reassure a compliant operator while still leaving genuine enforcement teeth for a non-compliant one.
How does this interact with domestic inter-agency cooperation?
Section 17 is worth reading alongside section 4 because the two provisions cover different territory. Section 17(1) requires PVARA to cooperate and share supervisory and enforcement information with the State Bank of Pakistan, the Securities and Exchange Commission of Pakistan, the Financial Monitoring Unit, the Federal Investigation Agency, the Federal Board of Revenue, and other competent domestic bodies. Section 17(2) then addresses the cross-border version of that same cooperation, but with an added condition: PVARA “may, with the prior approval of the Federal Government, enter into cooperation arrangements or information-sharing arrangements with foreign regulatory or supervisory authorities.”
| Provision | Covers | Condition |
|---|---|---|
| Section 4(2) | Cross-border agreements specifically for enforcement of this Act | None stated beyond the Authority’s own decision |
| Section 17(2) | Broader cross-border cooperation and information-sharing arrangements | Prior approval of the Federal Government |
| Section 17(3) | Domestic inter-agency coordination mechanisms | None stated |
The Act does not explain how these two cross-border powers relate to each other where they might overlap — whether a section 4(2) enforcement agreement also needs section 17(2)’s prior Federal Government approval, or whether the two operate independently. On the text alone, that is genuinely unclear, and we would not want to guess at an answer that isn’t stated.
Where does extraterritorial reach actually bite in practice?
Chapter 10’s enforcement toolkit gives section 4 practical teeth well beyond formal court proceedings. Section 61 lets the Authority “remove, block, or direct the removal or blocking of any online material (e.g., websites, apps, ads, payment links)” where it relates to an unlicensed Virtual Asset Service, and section 61(2) makes clear these directions can go to “telecommunication authorities, Virtual Asset Service Providers, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars, payment providers, or any person facilitating such material.” That is a domestic-infrastructure lever that works regardless of where the target entity is incorporated — it does not require reaching the offshore entity at all, only the Pakistan-facing points of access.
Section 60 adds emergency intervention powers: where there is a systemic threat, market manipulation, fraud or cybersecurity breach, the Authority “may issue an order temporarily suspending specified Virtual Asset Services or freezing related assets for a period not exceeding thirty days.” Together with section 61, this gives PVARA meaningful reach over a foreign platform’s Pakistan-facing footprint even before any cross-border mutual assistance agreement under section 4(2) has been concluded with the platform’s home regulator.
What should a foreign or offshore-structured VASP take from this?
A short, practical list:
- “Not incorporated in Pakistan” is not the same as “outside PVARA’s reach.” The scope test in section 2 and the enforcement power in section 4(1) do not depend on where the entity sits.
- The precise boundary for “offered or marketed to Persons in Pakistan” is not yet defined. Section 4(2)’s Regulations on this point have not been published, so treat any current activity aimed even loosely at Pakistani users as a live compliance question, not a settled one.
- Website and app blocking under section 61 is a real, near-term risk independent of cross-border enforcement cooperation — it targets domestic access points, not the foreign entity itself.
- Cross-border enforcement cooperation under section 4(2) is meant to run through recognised international channels per section 4(3), which argues for engaging PVARA proactively through a proper licence application or NOC rather than assuming distance provides cover.
- The criminal penalties in section 54 — up to five years’ imprisonment or fines up to fifty million rupees for wilfully providing an unlicensed Virtual Asset Service — apply regardless of where the offer originates, once the “in or from Pakistan” test is met.
Does this affect Pakistani customers of an unlicensed foreign platform?
Not directly under section 4, which is aimed at the service provider, not the customer. But the practical consequence for a Pakistani business or individual using such a platform is real: an entity operating without a valid licence is exposed to the section 60 and 61 intervention powers at any time, which can mean sudden loss of access, frozen customer assets, or a platform disappearing from Pakistan-facing infrastructure with little warning. That risk sits alongside, and is separate from, the banking and tax exposure a Pakistani user carries regardless of the platform’s regulatory status.
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect