A sandbox approval is not a fixed-term guarantee. The Sandbox Guidelines 2026 give the Pakistan Virtual Asset Regulatory Authority (PVARA) two distinct powers to interrupt a live test, and they sit at very different levels of severity. One is a pause. The other is public.
Founders reading the Guidelines for eligibility and Form I often skip past section 13 because it describes what happens when things go wrong, not how to apply. That is a mistake. A testing plan that does not account for suspension risk is an incomplete testing plan, and PVARA’s evaluators are told to check for exactly that under the feasibility and exit-strategy criteria.
What can trigger suspension or withdrawal of sandbox approval?
PVARA can act at any stage where it has “possible reasons to believe” a participant has failed to adhere to the details agreed or the conditions imposed during the review and selection stage. That threshold is deliberately low — a belief based on possible reasons, not a proven breach — because the sandbox is a supervised, not self-certified, environment.
The Guidelines state this in section 13, headed “Suspension or revocation of approval”:
“At any stage, where Authority has possible reasons to believe that the participant has failed to adhere to the details agreed or the conditions imposed during the review and selection stage: the Authority can temporarily suspend the testing and approval until the matter in question has been fully clarified; the Authority can completely withdraw the approval with a public notice in case a serious discrepancy has been observed related to consumer detriment or any other serious matter.”
The trigger language covers two things: deviation from what was agreed at approval (the parameters, limits and undertakings fixed at onboarding) and deviation from conditions imposed during review. In practice, this means the terms attached to the Letter of Approval are not background paperwork — they are the yardstick PVARA measures the participant against for the life of the test.
What is the difference between suspension and withdrawal?
Suspension is temporary and investigative; withdrawal is final and public. The Guidelines set out both as separate powers in the same sentence, and the difference in each one’s trigger and consequence matters for how a participant should respond.
| Suspension | Withdrawal | |
|---|---|---|
| Trigger | Possible reasons to believe a failure to adhere to agreed terms or imposed conditions | A serious discrepancy related to consumer detriment or any other serious matter |
| Duration | Until the matter is fully clarified | Permanent — the approval is withdrawn |
| Public notice | Not specified | Required, per the text of section 13 |
| Effect on testing | Testing and approval paused | Sandbox participation ends |
Suspension is the containment step — PVARA stops the test while it works out what happened. Withdrawal is the conclusion PVARA reaches once it has decided the matter is serious and consumer-facing. The Guidelines do not describe an intermediate step between the two, and they do not set a maximum duration for a suspension. A participant under suspension has no guideline-stated right to a fixed clarification timeline; our reading is that this is left to case-by-case handling by the Authority, and a participant should press for a clear timeline in any correspondence rather than assume one applies.
What counts as a “serious discrepancy related to consumer detriment”?
The Guidelines do not define this phrase further, and no threshold, monetary figure or incident category is given. This is a genuine gap in the published text: the trigger for the most severe sandbox sanction is left to the Authority’s judgement on the facts of each case.
What can be read from the surrounding Guidelines is the frame PVARA is likely to apply. The eligibility criteria require participants to demonstrate “risk management and consumer protection measures (including data security, dispute resolution, and safeguarding consumer assets)” at the application stage, and the Annexure-B undertaking commits every participant to ensure “the highest standard of protection, fairness, and transparency” and to refrain from “any practice that may result in consumer harm, financial loss, misleading information, or unfair treatment.” A discrepancy that touches any of those commitments — a custody failure, a misleading disclosure, an unresolved complaint pattern — sits squarely inside the phrase’s likely reach, even though the Guidelines stop short of listing examples. Where a participant is unsure whether an incident meets the threshold, the safer course is to treat the one-hour incident notification duty in the undertaking as the operative trigger, not to wait and assess severity internally first.
Does the participant get a chance to respond before suspension?
The published text of section 13 does not describe a notice-and-hearing process before either power is exercised, and no separate procedure is set out elsewhere in the Guidelines for this specific power. This is different from the Virtual Assets Act, 2026, where the general power to vary, suspend or revoke a full licence under section 23 requires “written notice and after providing an opportunity of being heard.” The sandbox is a lighter-touch, faster-moving regime than full licensing, and section 13 is written without that same procedural language.
Our reading is that the Authority retains broad discretion to act quickly once it has “possible reasons to believe” a failure has occurred, consistent with the supervisory-agreement structure of the sandbox described in the Guidelines’ own definitions. A participant should not assume a hearing is guaranteed before a suspension takes effect. This is exactly the kind of point worth confirming directly with PVARA, or building into the Annexure-B negotiation, before signing the undertaking — not after a suspension notice arrives.
What obligations continue during a suspension?
The undertaking a participant signs under Annexure-B does not carve out an exception for a suspended state, and several of its duties are ongoing by their own terms. Record-keeping, confidentiality of consumer data, and the duty to notify PVARA of material incidents within one hour do not appear to lapse simply because testing has been paused.
Obligations that plausibly survive a suspension, based on the undertaking’s own wording:
- Maintaining proper records “during testing period for reviews by Authority anytime.”
- Notifying the Authority within one hour of any material incident, risk event, or compliance breach, and following up with a detailed report within 48 hours.
- Keeping consumer data secure, confidential, and available for access, correction or deletion requests.
- Retaining transaction records and books of account, which the undertaking fixes at seven years regardless of the sandbox’s outcome.
A participant that treats a suspension as a full-stop on all obligations is reading past what the undertaking actually says. Compliance and reporting duties are the parts of the sandbox least likely to pause.
What happens after withdrawal — can the participant reapply?
The Guidelines are silent on reapplication. There is no stated cooling-off period, no bar on a future application from the same entity, and no described route to appeal a withdrawal within the Sandbox Guidelines themselves. The Virtual Assets Act, 2026 establishes a Virtual Assets Appellate Tribunal at section 62, with jurisdiction over orders of the Authority and a thirty-day window to appeal under section 63 — but the Guidelines do not state whether a sandbox withdrawal is the kind of “order” that falls within the Tribunal’s jurisdiction, and that question has not, to our knowledge, been tested.
What is explicit is the reputational consequence. A withdrawal under section 13 is accompanied by a public notice, which is a different order of exposure to a quiet non-renewal or an internally managed suspension. A public notice naming a participant and tying the withdrawal to consumer detriment reaches customers, partners and banking counterparties simultaneously with the regulator’s own decision. Any corporate setup work done in anticipation of scaling out of a sandbox test should factor in that a withdrawal is not a private, recoverable event in the way a licence refusal under the ordinary application process can be.
How should a testing plan account for suspension risk?
Build the suspension and withdrawal power into the exit strategy required under Form I Part C, not as an afterthought but as a named scenario with its own response steps. The Guidelines already require applicants to describe “conditions for stopping test, winding down operations safely, asset return” — a suspension or withdrawal is precisely the condition that section should anticipate.
Practical steps worth building into that plan:
- Assign internal ownership for the one-hour incident notification duty before testing begins, so a live incident does not stall on who is authorised to notify PVARA.
- Keep the Letter of Approval’s specific terms and conditions in a document the compliance team checks against operational reality on a fixed schedule, not only when a query arrives from PVARA.
- Prepare a consumer-communication template in advance, in case a public withdrawal notice requires a coordinated response to customers and counterparties within hours rather than days.
- Treat any request from PVARA for clarification during the “possible reasons to believe” stage as the last opportunity to avoid escalation to withdrawal, and respond with full transparency rather than a minimal answer.
None of this substitutes for regulatory and licensing advice specific to a live matter. Section 13 is short, and its brevity is the risk: it leaves the Authority wide discretion and leaves the participant with correspondingly few guarantees.
Related reading
- PVARA Exchange License: Capital, Rules & Obligations 2026
- PVARA Transfer & Settlement License: Crypto Payments 2026
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, the PVARA No Objection Certificate Regulations and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect