Rules vs Regulations: Who Makes What Under the Act

The Virtual Assets Act, 2026 uses the words “Rules” and “Regulations” as separate defined terms with separate makers. Read casually they look interchangeable. They are not, and the distinction determines where most of the detail you actually need is going to come from.

Almost every operative threshold in this Act — capital, reserves, reporting intervals, technical standards — is deferred to one instrument or the other. Knowing which one tells you who to watch and roughly how long to wait.

What is the difference between Rules and Regulations?

Rules are made by the Federal Government. Regulations are made by the Authority in consultation with the Cabinet Division. Both are subordinate instruments made under the Act, and the Act defines each in a single line.

Section 3(1)(xxv) defines “Rules” as Rules made under the Act. Section 3(1)(xxiv) defines “Regulations” as Regulations made under the Act. The definitions themselves are circular; the substance is in the empowering provisions.

	Rules	Regulations
Made by	The Federal Government	The Authority
Additional step	Notification in the official Gazette	Consultation with the Division concerned
Empowering section	Section 67	Section 68
Typical content	Framework and governance matters	Operational and technical detail

Where does each power come from?

Section 67 provides that the Federal Government “may by notification in the official Gazette, make Rules, as deemed necessary for the implementation of and to carry out the purposes of this Act”.

Section 68 provides that the Authority “may make Regulations in the consultation with Division concerned as deemed necessary for the implementation of and for carrying out the purposes of this Act”.

The wording is nearly identical in purpose and different in three respects: who exercises the power, whether Gazette notification is specified, and whether consultation is required. Rules go through the Gazette. Regulations go through the Cabinet Division.

Both are broad grants. Neither section, as drafted, limits the subject matter of the instrument beyond “the purposes of this Act”.

What does “Prescribed” mean, and why does it appear everywhere?

Section 3(1)(xxiii) defines “Prescribed” as prescribed by Rules or Regulations made under the Act.

That single definition is the reason this distinction matters commercially. Wherever the Act says a requirement is “as may be prescribed”, it is telling you two things at once: the detail does not exist in the statute, and it could arrive through either instrument.

You will meet this constantly. High-Quality Liquid Assets are “as may be prescribed by Regulations” under section 3(1)(x). Proof-of-reserves intervals are prescribed by Regulations under section 27(1). Reserve custodian standards are prescribed by Regulations under section 28. The budget procedure is prescribed through Rules under section 15(1).

For an operator, the practical reading of “prescribed” is: this number is not knowable from the Act, and you should not assume one. Where a business plan depends on a threshold that has not been prescribed, that is a genuine open item to raise with PVARA, not a gap to fill with an estimate from another jurisdiction.

Why does the distinction matter in practice?

Three reasons, in ascending order of importance.

It tells you who to ask. A question about an operational standard belongs with the Authority. A question about something reserved to the Federal Government does not, and asking the wrong body wastes weeks.

It tells you how quickly detail can change. Regulations require consultation with the Cabinet Division but sit with the Authority, which is closer to the market. Our reading is that operational detail is therefore more likely to be revised as the market develops, while framework matters set by Rules will move more slowly. That is an inference from the structure rather than something the Act states.

It tells you where to look for what is missing. Most of what a business needs to model — capital, reserves, reporting cadence, technical requirements — sits in Regulations rather than Rules, because that is where operational detail naturally belongs.

What does section 3(2) add?

It solves a problem that would otherwise catch out anyone reading the Act on its own.

Section 3(2) provides that words not defined in the Act but defined in the State Bank of Pakistan Act, 1956, the Securities Act, 2015, the Anti-Money Laundering Act, 2010, or the Companies Act, 2017 have the meanings assigned in those Acts, unless the context otherwise requires.

So the definitional universe is larger than section 3(1). Before treating a term as undefined — and therefore arguably open to interpretation — check those four statutes. This matters particularly for AML terminology, where the Anti-Money Laundering Act, 2010 does substantial definitional work that the Virtual Assets Act does not repeat.

What should an operator do with this?

• Treat every “prescribed” as an open question. Log them. They are the real gaps in your compliance plan, and there are many.
• Do not import thresholds from other jurisdictions. A capital figure from the UAE or Singapore is not evidence of what Pakistan will prescribe.
• Watch the Gazette for Rules and the Authority for Regulations. Different sources, different cadence.
• Read the four borrowed statutes before concluding a term is undefined.

For a business assessing whether the framework is ready to build against, the honest position is that the Act is the skeleton and much of the operational muscle is still to be written. That is not a criticism — it is normal for a new regime — but it should shape how firmly you commit to numbers in a business case, and it argues for keeping the licensing route decision under review rather than settling it early.

Where a model depends heavily on a not-yet-prescribed figure, the sandbox route is worth weighing, and the sequencing of SECP registration, banking and the licence application should assume some requirements will arrive after you have started.

Which instrument will set the capital and reserve numbers?

Regulations, on the evidence of how the Act defers them — and this is the answer most business plans actually need.

Take High-Quality Liquid Assets. Section 3(1)(x) defines HQLA as “such high-quality liquid assets as may be prescribed by Regulations”. The Act names the concept and declines to populate it. The same pattern appears across the prudential provisions:

Requirement	Where the detail sits
High-Quality Liquid Assets	Regulations, per s.3(1)(x)
Proof-of-reserves intervals	Regulations, per s.27(1)
Reserve custodian standards	Regulations, per s.28
Customer compensation mechanism	Regulations, per s.29
Segregated Reserve safeguards	Regulations, per s.3(1)(xxvi)
The Authority’s budget procedure	Rules, per s.15(1)

The pattern is consistent: matters affecting how a licensee operates go to Regulations; matters affecting how the Authority itself is governed go to Rules.

For anyone building a financial model, this has a blunt implication. The numbers that determine whether the business is viable in Pakistan — how much capital, held in what form, verified how often — are almost all in the Regulations column, and therefore sit with the Authority subject to Cabinet Division consultation.

That is worth knowing before you commit to a launch date. It also argues for engaging with the Authority early rather than waiting for publication: where a threshold has not been prescribed, the only reliable source on its likely shape is the body that will prescribe it.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.