Risk, Compliance and Financial Strength in Sandbox Assessment

Innovation is only one of five headings the PVARA Sandbox Guidelines 2026 group under Key Evaluation Criteria. The other four test whether a sandbox applicant can actually be trusted to operate safely, wind down cleanly, and fund itself through the testing period. Together they form the risk side of the assessment, sitting alongside the innovation test covered in a companion piece on this site.

This piece works through Risk Management and Compliance, Feasibility and Exit Strategy, Financial Strength, and Tax Law Compliance in the order the Guidelines list them.

What does “Risk Management and Compliance” cover in sandbox assessment?

Three distinct reviews grouped under one heading. The Guidelines list them as: “Review of systemic, operational, and ML/TF/PF risks. Evaluation of cybersecurity, data protection, and consumer protection frameworks. Consultation with Shariah advisors where applicable.” Each of the three sentences is a separate line of enquiry — systemic and operational risk on one side, technical and consumer-facing controls on another, and religious-compliance consultation on a third — rather than one combined test.

What is the ML/TF/PF risk review, and what does it sit alongside?

A review of money-laundering, terrorist-financing and proliferation-financing risk, paired in the same sentence with systemic and operational risk. ML/TF/PF is the Guidelines’ own abbreviation for money laundering, terrorist financing and proliferation financing — three distinct illicit-finance risks the Authority reviews together. The Guidelines do not describe a separate ML/TF/PF questionnaire beyond what is already required in Annexure-A’s own compliance-preparedness question and the risk management documentation described in the eligibility criteria; this evaluation factor is where that same material is formally scored rather than self-assessed.

What do “cybersecurity, data protection, and consumer protection frameworks” add beyond the ML/TF/PF review?

A separate technical and consumer-facing standard. Where the ML/TF/PF review looks at illicit-finance exposure, this line evaluates the applicant’s actual controls — the technical architecture protecting the platform, the handling of personal data, and the protections in place for the people using the product during testing. This overlaps closely with the cybersecurity and consumer-safety indicators in the Annexure-A self-assessment, and with the custody and data-security obligations described in the eligibility criteria that apply before an application is even filed.

When are Shariah advisors consulted?

Only “where applicable,” a condition the Guidelines do not further define. The text gives no criteria for when a proposition is considered to trigger Shariah consultation — whether that turns on the product type, the underlying asset, or some other feature of the business model is not stated. An applicant proposing a product with an Islamic finance dimension should expect this consultation may apply, but the Guidelines leave the trigger to the Authority’s own determination rather than setting an objective test in the published text.

What does “Feasibility and Exit Strategy” test, separate from risk?

Whether the applicant can actually run the test and stop it cleanly. The Guidelines list three elements: “Technical and operational readiness, including team expertise. Clear testing parameters. Exit plans (winding down if unsuccessful or transitioning to licensing if successful).” The exit plan requirement is explicitly two-sided — the Guidelines require a plan for both outcomes, not just the successful one. An applicant that has only planned for a successful transition to full licensing, without describing how it would wind down cleanly if the test fails, has not met this factor as the Guidelines describe it.

Can PVARA cap transaction volumes or user numbers during testing?

Yes. Immediately after the exit-plan requirement, the Guidelines add: “The Authority may impose limits on transaction volumes, user numbers, or exposure on a case-to-case basis.” This is a standing power attached to the Feasibility and Exit Strategy heading rather than a fixed rule applied uniformly — the Guidelines describe it as case-by-case, meaning the specific limits, if any, are set for each participant individually rather than published as a general schedule. An applicant should not assume a sandbox slot comes with unlimited scale during the testing period; the Authority retains discretion to constrain volume, user count, or overall exposure regardless of what the applicant originally proposed.

What does “Financial Strength” require?

A single, broadly stated test: “Demonstration of financial capacity to undertake the proposed business model.” The Guidelines do not specify a minimum capital figure, a required financial ratio, or a prescribed form of evidence — no paid-up capital threshold or liquidity requirement appears under this heading, in contrast to the more detailed capital requirements that apply to full VASP licensees. What the applicant must show is capacity proportionate to what it has itself proposed doing, assessed against the scale and risk of that specific proposition rather than against a fixed benchmark set in the Guidelines.

What tax compliance is required, and does it apply to applicants based outside Pakistan?

Tax Law Compliance applies specifically to applicants based in Pakistan. The Guidelines state: “The applicant must demonstrate compliance with applicable tax laws in Pakistan, if based in Pakistan.” The conditional phrasing matters — a foreign applicant not based in Pakistan is not brought within this specific evaluation factor by its wording, though such an applicant would separately need to address the incorporation and tax registration requirements described elsewhere in Form I once a sandbox approval is actually granted. This factor as evaluated up front is narrower: it tests the tax standing of an applicant already based in Pakistan, at the point of application.

How do these four criteria connect to the outcome of the Assessment Phase?

They sit alongside the Innovation and Market Impact factor as the full set the Guidelines group under Key Evaluation Criteria, and the Guidelines describe the outcome for the group as a whole rather than scoring each heading separately in public: “After the detailed assessment and evaluation, the Authority shall issue a Letter of Approval (LoA) to the successful applicants subject to the terms and conditions as may be approved by the Authority.” A companion piece on this site covers the sixty-working-day timeline this evaluation runs against, and the terms-and-conditions structure that follows a successful outcome.

What should an applicant take from these four criteria together?

Prepare each heading as a separate deliverable rather than one combined “compliance” section. Risk Management and Compliance, Feasibility and Exit Strategy, Financial Strength, and Tax Law Compliance test four different things — illicit-finance and consumer-protection controls, operational and exit readiness, financial capacity proportionate to the proposal, and tax standing for Pakistan-based applicants — and a strong answer under one heading does not substitute for a gap under another. The exit-plan requirement in particular is worth double-checking, since it is the one element in this group that explicitly demands planning for failure as well as success.

Related reading

• PVARA Exchange License: Capital, Rules & Obligations 2026
• PVARA Transfer & Settlement License: Crypto Payments 2026
• PVARA Licensing Process: NOC to Full Licence, Step by Step
• The PVARA Licensing Gold Rush: Pakistan’s Crypto Frontier

About this analysis

This analysis was prepared by the CoinConnect research desk from the Risk Management and Compliance, Feasibility and Exit Strategy, Financial Strength, and Tax Law Compliance headings under the Key Evaluation Criteria section of the PVARA Sandbox Guidelines 2026, read as published. Where the Guidelines leave a trigger or threshold undefined — including the Shariah consultation trigger and the financial-capacity standard — that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.