Sandbox

The Agile Approach: Applying to the Sandbox Any Time

Why the PVARA sandbox has no fixed application rounds, what the Agile Approach actually promises, and what it does not change about the assessment timeline.

Malik Abbas · · 6 min read

Many regulatory sandboxes around the world run on cohorts — a fixed window opens once or twice a year, applications are compared against each other, and a batch of participants is admitted together. PVARA’s Sandbox Guidelines 2026 deliberately reject that model. They describe what they call an “Agile Approach,” and the practical effect is that there is no calendar to wait for.

This article explains exactly what the Agile Approach commits PVARA to, what it does not change, and what the timing implications are for a firm deciding when to submit.

What is the “Agile Approach” under the Sandbox Guidelines?

The Guidelines define Agile Approach as “a process under which Applicants may submit applications at any time during the year for consideration by the Authority.” This is a defined term in its own right, sitting in the Guidelines’ definitions section alongside Applicant, Participant and Exit — which signals PVARA intended it as a structural feature of the sandbox, not just a passing description.

The operative rule is restated in the Guidelines’ section on frequency of accepting applications: “The Sandbox shall operate in an agile manner, the applicants can submit applications related to the scope envisaged under the Ordinance or as notified by the Authority, for consideration in the sandbox environment across the year.” Two things are worth noting in that sentence: applications are accepted across the year without a fixed window, and the scope of what can be applied for is tied either to what the Ordinance envisages, or to whatever the Authority separately notifies — leaving PVARA room to expand or narrow the sandbox’s scope by notice rather than by amending the Guidelines themselves.

Why does PVARA not run fixed application rounds?

The Guidelines do not state a reason for choosing the agile model over a cohort model. What can be read directly from the Guidelines’ stated objectives is that the sandbox exists partly “to define clear procedures for application intake, application assessment, onboarding, supervision, monitoring, and exit of Sandbox participants” and “to ensure that testing activities are conducted under appropriate oversight” — objectives that are about process integrity for each application, not about comparing applicants against each other in a batch.

Our reading is that an agile, rolling-intake model is a natural fit for a sandbox whose evaluation criteria — fit and proper standing, operational readiness, a comprehensive risk assessment — are pass/fail and individually assessed rather than ranked competitively. A cohort model makes sense when the regulator is choosing a fixed number of winners from a larger pool; nothing in the Guidelines suggests PVARA is capping the number of sandbox participants at any one time, so there is no batch to wait for.

Does applying at any time change what PVARA actually requires?

No. The Agile Approach describes a submission timetable, not a lighter or accelerated assessment standard. The same eligibility criteria apply on any day of the year: fit and proper standing, demonstrated operational readiness, a comprehensive regulatory and risk assessment, and compliance with the applicable legal framework. The same Form I, and the same Annexure-A self-assessment checklist, are required regardless of submission date.

The assessment clock is also unaffected by timing. Once an application clears initial screening, “the comprehensive evaluation must be completed within sixty (60) working days from the conclusion of the initial screening unless the Authority determines that there is reasonable cause to extend timeline.” That sixty-working-day period runs from the same trigger — completion of screening — no matter what time of year the original application was submitted.

What does the completeness and resubmission rule mean for timing?

Before an application reaches the sixty-working-day evaluation clock, it has to clear an initial completeness check. The Guidelines state that applications “will be reviewed for all required documents and information,” and that “incomplete applications will be returned with a request for revisions, with up to two resubmissions permitted.” This cap is the part of the process most likely to actually cost an applicant time, regardless of when in the year they apply — three attempts to get the paperwork complete, and no fourth chance described in the Guidelines.

Because there is no fixed intake date to aim for, there is also no penalty in the Guidelines for an incomplete first submission beyond the resubmission cap itself — an applicant is not competing against a deadline shared with other applicants, only against its own completeness. In practice this favours submitting once genuinely ready over rushing to meet an artificial date, since rushing has no benefit under an agile model and the resubmission cap has real teeth.

Does the Agile Approach affect what an applicant can apply for?

The frequency provision ties eligible applications to “the scope envisaged under the Ordinance or as notified by the Authority.” This means the timing flexibility of the Agile Approach sits alongside a scope boundary that PVARA controls separately, through notification. An applicant proposing a product or service outside whatever scope PVARA has most recently notified may find timing is not the limiting factor at all — scope is. Firms should check PVARA’s current notifications on sandbox scope before assuming the “any time” framing means “any product.”

What should an applicant actually do with this timing flexibility?

The practical implication of the Agile Approach is that there is no reason to hold a sandbox application back for a perceived “next round” — none exists. Equally, there is no advantage to submitting early if the testing plan, governance structure, risk assessment and exit plan required under the eligibility criteria are not yet genuinely complete, since an incomplete application simply consumes one of the two permitted resubmissions without buying any queue position.

The Guidelines’ agile framing is best read as removing one variable from a sandbox applicant’s planning — the calendar — while leaving every substantive requirement, and the sixty-working-day evaluation period once screening is cleared, exactly as demanding as it would be under a cohort model.

For a firm that is choosing between the sandbox and a direct application for a full VASP licence, the Agile Approach also removes a common excuse for delay. Under a cohort model, a firm that missed a window might reasonably wait for the next one before finishing its documentation. Under the Guidelines’ rolling intake, that reasoning does not apply — there is never a “next window” to wait for, only the applicant’s own state of readiness. Firms weighing entry timing more broadly, including whether to test in the sandbox first or apply directly for a licence, should read this alongside the wider comparison of PVARA’s licensing routes, since the agile timetable is one input into that decision, not the whole of it.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.

Entering Pakistan's crypto market?

CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.

Visit CoinConnect

More analysis