The Division Concerned: Who Sits Above PVARA

Most operators reading the Virtual Assets Act, 2026 for the first time treat PVARA as the beginning and the end of the regulatory relationship. It is not. Sitting above the Authority is a body the Act calls the “Division concerned”, and it appears at three points that matter commercially.

Understanding who sits above your regulator tells you where a rule actually comes from, who can change it, and how long that change is likely to take. It also tells you which decisions your regulator can make alone and which require sign-off elsewhere.

What is the “Division concerned” under the Act?

Section 3(1)(viii) defines it in one line: the Division concerned “means the Cabinet Division as defined in the Rules of Business, 1973”. The Cabinet Division is the federal executive department that services the Cabinet and the Prime Minister’s Office. It is not a financial regulator, and it is not a specialist virtual asset body.

That choice is deliberate and it is worth pausing on. Pakistan already has sector regulators with deep financial expertise — the State Bank and the Securities and Exchange Commission. The Act does not place PVARA under either of them. It places PVARA under the Cabinet Division, which sits at the centre of federal government rather than inside the financial sector.

Where does the Cabinet Division actually appear in the Act?

At three points, each with a different function:

• Regulation-making. Section 68 provides that the Authority may make Regulations “in the consultation with Division concerned” as deemed necessary to implement the Act.
• Audit approval. Section 27(2) requires a Licensee to have its operations audited annually by a firm of Chartered Accountants “approved by the Division concerned”.
• Reporting. Section 15(7) requires the Authority to submit an annual report to the Prime Minister “through the concerned Division” within ninety days of the close of each financial year.

Two of those three touch you directly as a licensed business. The third shapes the environment you operate in.

Why does the audit approval matter to a licensee?

Because it narrows your choice of auditor, and that choice sits on the critical path.

Section 27(2) does not say a Licensee must appoint any firm of Chartered Accountants. It says the firm must be approved by the Division concerned. The audit itself is not a formality either — the same subsection requires it to include “a verification of the segregation of Customer Assets as required under section 24”.

In practice this creates a dependency most entrants do not plan for. Your annual audit is not simply a professional services purchase you can arrange on your own timetable with your existing global auditor. It depends on a government-approved list, and the Act does not state in its own text how a firm joins that list or where the list is published.

Our reading is that this will be addressed through Regulations or administrative notification rather than in the Act itself. Until it is, the practical step is to ask the Authority directly which firms currently satisfy section 27(2) before you commit to an auditor as part of your corporate setup. Verify the current position with PVARA rather than assuming your existing auditor qualifies.

How does the consultation requirement affect regulation-making?

Section 68 gives the Authority the power to make Regulations, but conditions it on consultation with the Division concerned. Section 67 deals with Rules separately, and gives that power to the Federal Government.

That split has a practical consequence. Regulations are where the operative detail of this framework will live — capital thresholds, proof-of-reserves intervals, reserve custody standards, and the technical requirements referenced throughout the Act as “prescribed by Regulations”. Every one of those has to pass through a consultation step with a central government department before it takes effect.

For an operator, this cuts two ways:

1. Detail arrives more slowly than it would from a standalone regulator. If your business model depends on a threshold that has not yet been prescribed, plan for the wait rather than assuming imminent publication.
2. Once made, the detail carries more weight. A Regulation that has been through Cabinet Division consultation is less likely to be reversed casually.

Where you are choosing between the licensing routes available under the Act, the pace of regulation-making is a real input into that decision.

Does this make PVARA less independent?

The Act does not say so, and the structure is not unusual. What the reporting line in section 15(7) establishes is accountability, not day-to-day control: an annual report to the Prime Minister, routed through the Cabinet Division, within ninety days of the financial year end, including audited financial statements and performance against approved objectives.

That is an accountability mechanism for the Authority’s own governance and finances. It is not a mechanism by which the Cabinet Division supervises individual licensees. Nothing in section 15(7) gives the Division a role in your licence application, your supervision, or any enforcement action against you.

The honest summary is that the Cabinet Division shapes the rules and approves the auditors, while the Authority regulates the market. Those are different functions, and conflating them leads operators to lobby in the wrong direction.

What should an operator take from this?

Three practical points, all of which affect sequencing rather than strategy:

• Confirm your auditor before you need one. Section 27(2) approval is not something to discover during your first audit cycle. Raise it early, alongside your other SECP and banking arrangements.
• Do not expect all detail at once. Regulations require consultation. Where the Act says “as may be prescribed”, treat the absence of a figure as a genuine gap rather than an oversight, and ask rather than assume.
• Direct regulatory questions to the Authority. The Cabinet Division’s role is upstream. Questions about your own licence, your customer assets obligations, or your ongoing compliance belong with PVARA.

Where a business is weighing whether Pakistan’s framework is stable enough to commit to, the governance structure is a reasonable input. A regulator reporting annually to the Prime Minister and consulting a central division on its Regulations is a more constrained body than one operating alone — which cuts against rapid rule changes in either direction.

What can a licensee learn from the Authority’s annual report?

More than most operators expect, which is why section 15(7) is worth reading as an intelligence source rather than a governance footnote.

The subsection specifies what the report must contain: audited financial statements, performance against approved objectives, and “such other matters as the Authority may consider necessary for transparency and accountability”. It must reach the Prime Minister, through the Cabinet Division, within ninety days of the financial year end.

For a business operating under this regime, three things follow:

• Performance against objectives is a stated disclosure. Where the Authority reports on what it set out to achieve, that is a public signal about supervisory priorities for the coming year.
• Ninety days is a firm outer limit. It gives you a predictable point in the calendar at which the Authority’s own position becomes visible.
• The scope is partly discretionary. The “such other matters” limb means content can expand, and what the Authority chooses to disclose is itself informative.

None of this is a compliance obligation on you. But a regulator that publishes annually against stated objectives is one whose direction can be read, and reading it is cheaper than guessing. Operators tracking their ongoing compliance burden should treat the report as a standing diary entry.

We should note the limit of what the Act says here. Section 15(7) requires submission to the Prime Minister; it does not state that the report is published to the market. Whether it becomes publicly available is not addressed in the text supplied, and should be confirmed with the Authority rather than assumed.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.