Reserve Custodians Under Pakistan's Virtual Assets Act

Reserve backing only protects token holders if the assets backing the token are actually held somewhere safe, by someone accountable. The Virtual Assets Act, 2026 addresses that directly through section 28, which regulates the custodian holding reserve assets rather than only the Issuer who promises they exist.

This article sets out what section 28 requires, how it connects to the Act’s definition of “Segregated Reserve,” and what is still left to Regulations.

What does section 28 of the Virtual Assets Act 2026 say about reserve custodians?

Section 28 requires a custodian of reserve assets to comply with requirements, oversight and inspection standards prescribed by Regulations. The section itself is short and reads in full:

A custodian of reserve assets shall comply with such requirements, oversight and inspection standards as may be prescribed by Regulations.

The provision does not set out the standards itself. Instead it establishes that whoever physically holds reserve assets — for a fiat-referenced token or an asset-referenced token — falls within the Authority’s supervisory reach, even where that custodian is a separate legal person from the Issuer itself.

Who is a “reserve custodian” under the Act?

The Act does not define “reserve custodian” as a standalone term, but the definition of “Segregated Reserve” in section 3(1)(xxvi) describes the role. It states that a Segregated Reserve is:

A pool of reserve assets that is kept separate from the Issuer’s own assets, held in the name of the Issuer, or in a trust or special vehicle for the benefit of token holders, and under custody, with independent custodian or regulated financial institution, approved by the authority, so that the Issuer or its creditors cannot claim the assets.

Read together with section 28, this means the entity holding reserve assets on behalf of an Issuer — whether that is an independent custodian or a regulated financial institution — must be approved by the Authority and must meet the requirements, oversight and inspection standards the Authority prescribes by Regulations. The definition also gives the Authority power to prescribe additional requirements regarding the types of assets, custody arrangements, audits, attestations, disclosures and other safeguards applying to that reserve.

Does the reserve custodian have to be a separate entity from the Issuer?

The wording of section 3(1)(xxvi) is our reading, not a settled point: the phrase “under custody, with independent custodian or regulated financial institution, approved by the authority” reads most naturally as requiring the reserve to sit with a custodian independent of the Issuer, or with a regulated financial institution, rather than being self-custodied by the Issuer. The Act does not state expressly whether an Issuer that also holds a custody licence under Schedule I could act as custodian of its own reserve. Given the purpose of the provision — ensuring the Issuer or its creditors cannot claim the reserve assets in an insolvency — a structure where the Issuer directly holds its own reserve without an independent layer sits uneasily with the stated goal, even if the text does not close the door outright. Applicants proposing to self-custody reserve assets should raise this question with the Authority directly rather than assume it is permitted.

Does a reserve custodian need its own VASP licence?

The Act does not state this explicitly. Schedule I item 3, Custody and Administration Services, covers the safekeeping or administration of Virtual Assets or private cryptographic keys on behalf of customers, pursuant to their instructions. Reserve assets backing a token are not, in the ordinary sense, “customer” holdings in the way section 3(1)(vi) defines a Customer — they are assets backing the token’s value for the benefit of all token holders collectively, held under the Segregated Reserve structure. Whether a reserve custodian must independently hold a full custody licence under Schedule I, or whether its obligations flow solely through section 28 and the Regulations attaching to it, is not settled by the text. Our reading is that the Authority is likely to require reserve custodians to meet standards functionally similar to Schedule I custody obligations, given that section 28 references “oversight and inspection standards,” language that mirrors the custody standards set out in section 26 for Licensees generally. Confirmation of this point should come from the Regulations rather than from inference.

How does this apply differently to fiat-referenced and asset-referenced tokens?

Section 31, governing Fiat-Referenced Tokens, requires hundred percent reserve backing with High-Quality Liquid Assets or other prescribed assets, held as a segregated reserve. Section 32, governing Asset-Referenced Tokens, requires a reserve of the underlying assets, prescribed for the token type, held in custody in accordance with Regulations. Both sections point back to the same Segregated Reserve mechanism and, by extension, to the section 28 custodian standards. Neither section prescribes a different custody standard for one token type over the other on the face of the Act — both rely on Regulations to fill in the detail, and both engage section 28 once a third-party custodian is holding the reserve.

What obligations flow from section 28 that an Issuer should plan for now?

An Issuer structuring its reserve arrangements ahead of the Regulations should treat the following as reasonably certain requirements, given the direction of section 28 and the Segregated Reserve definition:

• selecting a custodian or regulated financial institution capable of meeting Authority approval, rather than assuming any bank or custodian will qualify by default
• building the reserve structure so the assets are demonstrably beyond the reach of the Issuer’s own creditors, consistent with the stated purpose of section 3(1)(xxvi)
• preparing for inspection access, since section 28 explicitly contemplates “inspection standards” rather than only reporting obligations
• coordinating custody arrangements with the proof-of-reserves and audit obligations under section 27, which require the Licensee to reconcile reserves against liabilities even where a third party physically holds the assets
• documenting the custodian’s own governance and financial soundness, since the Authority’s approval standard for a reserve custodian is likely to examine the custodian’s own fitness, not only its systems

What is still missing until the Regulations are published?

Three things are not yet settled by the Act itself and depend entirely on Regulations that had not been published at the time of writing: the specific requirements a reserve custodian must meet to obtain Authority approval, the detailed content of the “oversight and inspection standards” referred to in section 28, and whether self-custody of reserve assets by the Issuer is permitted in any circumstances. Firms building a Fiat-Referenced Token or Asset-Referenced Token programme should treat the custodian relationship as a core piece of the licence application, not a detail to finalise after the licence is granted, given that section 30(1) restricts an Initial Virtual Asset Offering to entities that meet the eligibility criteria the Authority prescribes, and reserve custody arrangements are a natural part of that assessment.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.