Sandbox

The One-Hour and 48-Hour Incident Rules in PVARA's Sandbox

The two incident-notification deadlines every PVARA sandbox participant signs up to, what each report must contain, and how they differ.

Malik Abbas · · 6 min read

Routine progress reports during a sandbox test are negotiated between the participant and PVARA. Incidents are not. Buried in Annexure-B — the format of undertaking every approved sandbox participant signs — are two fixed deadlines that apply the moment something goes wrong, regardless of what reporting schedule the participant agreed for ordinary progress updates.

This piece sets out both deadlines, what each report must contain, and why the distinction between them matters for how a participant actually responds when an incident happens.

What incident-notification duties does a sandbox participant sign up to?

Two separate ones, with two separate clocks. Annexure-B requires the participant to undertake that it “shall notify within one hour, the Authority, of any material incident, risk event, or compliance breach, detailing the extent of the breach and the remediation measures undertaken,” and that it “shall submit a detailed incident report to the Authority within 48 hours of identifying the issue, outlining nature and scope of the incident, steps taken to contain and resolve the issue and measures to prevent recurrence.” The one-hour duty is an immediate flag; the 48-hour duty is a fuller written report that follows it.

What triggers the one-hour notification duty?

Any “material incident, risk event, or compliance breach” — three categories, not a narrow definition limited to cybersecurity. The Guidelines do not define “material” for this purpose, so the threshold for what counts as material is left to the participant’s own judgement in the first instance, subject to the Authority’s own view once notified. In practice, our reading is that a sandbox participant should treat this duty as covering anything that would reasonably concern a regulator overseeing a live test — not only a data breach or system outage, but also a compliance failure such as a lapse in the AML controls the participant undertook to maintain.

What must the one-hour notice actually contain?

Two specific things, according to the undertaking’s own wording: “detailing the extent of the breach and the remediation measures undertaken.” This is not simply an alert that something happened — it is a notice that already states how far the problem reaches and what the participant has already done about it. A bare message saying an incident has occurred, without any indication of scope or the remediation steps already taken, falls short of what the one-hour clause describes.

What is the deadline for the fuller incident report, and what must it cover?

Forty-eight hours “of identifying the issue” — not forty-eight hours from the one-hour notice, which matters if there is any gap between the two. The detailed report must outline three things: “nature and scope of the incident, steps taken to contain and resolve the issue and measures to prevent recurrence.” Where the one-hour notice is a snapshot at the moment of discovery, the 48-hour report is a fuller account covering containment, resolution and forward-looking prevention.

How do the two incident deadlines compare?

  One-hour notice 48-hour report
Trigger Any material incident, risk event or compliance breach The same incident, once identified
Clock starts When the incident occurs When the issue is identified
Content Extent of the breach and remediation measures undertaken so far Nature and scope, containment and resolution steps, and prevention measures
Purpose Immediate flag to the Authority Fuller written account

Read together, the two clauses describe an escalating disclosure: notify immediately with what is known and what is already being done, then follow with a complete account once the issue has been worked through.

Does this replace the agreed progress-reporting schedule for routine updates?

No. The Testing/Experimentation section of the Guidelines lets the participant and the Authority agree the content, format and frequency of routine progress reports before testing begins. The one-hour and 48-hour duties sit in Annexure-B, a separate document — the signed undertaking — and apply specifically to incidents, risk events and compliance breaches, not to the ordinary course of a testing period. A participant with an agreed monthly reporting cadence is still bound by the one-hour and 48-hour clocks the moment something goes wrong; the two obligations run in parallel, not as substitutes for one another.

What happens after an incident report is filed?

The Guidelines do not spell out a fixed Authority response tied specifically to these two clauses. What they do describe elsewhere is the Authority’s general power, where it has reason to believe a participant has failed to adhere to agreed terms, to suspend testing temporarily until a matter is clarified, or to withdraw approval entirely with public notice where there is serious consumer detriment. A material incident disclosed under these clauses is a plausible trigger for that broader suspension power, though the Guidelines do not state that every incident report automatically leads to suspension — that determination sits with the Authority’s assessment of the specific incident.

Does the incident duty overlap with a participant’s separate AML reporting obligations?

They run alongside each other rather than replacing one another, for a participant that also holds AML registration. The PVARA No Objection Certificate Regulations 2025 require a registered applicant to implement “controls to screen all customers, beneficial owners, counterparties and transactions against domestic and United Nations sanctions lists,” and to “immediately freeze assets of designated persons and report such freezes to FMU and any other designated authority” — obligations owed to the Financial Monitoring Unit under those Regulations, separate from the sandbox undertaking’s one-hour and 48-hour clocks owed to PVARA under Annexure-B. A sandbox participant that is also AML-registered may find a single underlying event — a sanctions hit, for instance — triggers both reporting chains at once, on their own separate deadlines, to two different recipients.

What should a sandbox participant build into its incident-response process?

  • Set an internal escalation path that can produce a notice to the Authority within one hour of a material incident being identified internally, not one hour of it first occurring.
  • Draft the one-hour notice template in advance so it can state scope and remediation steps immediately, rather than being drafted from scratch under time pressure.
  • Track the 48-hour clock from the moment the issue is identified, and confirm internally when identification actually happened — this is the trigger the undertaking uses, not the moment the incident began.
  • Keep the routine progress-reporting cadence and the incident-notification duties as separate workstreams with separate owners, since they run on different clocks and serve different purposes.
  • Treat “compliance breach” as squarely within scope alongside technical incidents — this duty is not limited to cybersecurity events.

About this analysis

This analysis was prepared by the CoinConnect research desk from Annexure-B (the format of undertaking) and the Testing/Experimentation section of the PVARA Sandbox Guidelines 2026, together with the sanctions-screening provisions of the PVARA No Objection Certificate Regulations 2025, read as published. Where the Guidelines leave a term such as “material” undefined, or do not state a fixed Authority response to an incident report, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.

Entering Pakistan's crypto market?

CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.

Visit CoinConnect

More analysis