Anyone dealing with a Pakistani virtual asset business — a bank weighing an account, a customer sending funds, a foreign exchange evaluating a local partner — eventually has to answer one question: is this entity actually licensed, and for what? Section 21(4) of the Virtual Assets Act 2026 answers that question by requiring a public record, rather than leaving it to a company’s own marketing claims.
This piece sets out what the register must contain, where it sits in the Act’s broader licensing scheme, and how a counterparty should actually use it.
What is the PVARA register of licensees?
It is a public record that the Pakistan Virtual Assets Regulatory Authority (PVARA) is legally required to maintain and publish on its own website, listing every entity holding a licence under the Act. Section 21(4) states the obligation directly:
“The Authority shall maintain and publish an up-to-date register of Licensees on its official website. The register shall include, at a minimum, the name, license number, permitted services and current regulatory status of each Licensee.”
The register is not a courtesy or a marketing page. It is a statutory duty placed on PVARA itself, sitting inside section 21 — the same section that governs how licences are granted, refused and scoped.
What must the register show, at a minimum?
Four fields, by the plain text of section 21(4): the licensee’s name, its licence number, the services it is permitted to undertake, and its current regulatory status. The word “minimum” matters — PVARA may publish more than this, but these four items are the floor the Act sets, and a register missing any one of them would not meet the statutory requirement.
| Required field | What it tells a counterparty |
|---|---|
| Name | Confirms which legal entity actually holds the licence |
| Licence number | A unique reference that can be checked against documents the licensee presents |
| Permitted services | Which Schedule I service categories the licensee may lawfully perform |
| Current regulatory status | Whether the licence is active, or has been varied, suspended or revoked |
The Act does not prescribe a specific format, update frequency, or technical means of publication beyond “up-to-date” and “on its official website.” Those operational details are left to PVARA to determine, and are worth checking directly against PVARA’s own published register rather than assumed from the statute alone.
Why does the register list “permitted services” rather than a single licence type?
Because a licence under the Act is not a blanket authorisation. A licensee is only authorised for the specific virtual asset services named in its own licence — one of ten categories set out in Schedule I to the Act, covering advisory services, broker-dealer services, custody and administration, exchange services, lending and borrowing, virtual asset derivatives, management and investment services, transfer and settlement, issuance services, and mining-related services.
Because that scoping rule exists, “permitted services” being a mandatory register field is not incidental — it is the practical mechanism by which the public can check what a licensee is actually authorised to do, rather than assuming a “VASP licence” is a single uniform status covering everything.
How do I verify a counterparty using the register?
Check the counterparty’s name and licence number against the register directly, rather than relying on a certificate the company presents or a claim made on its website. The most reliable sequence is:
- Ask the counterparty for its exact registered legal name and PVARA licence number.
- Look that name and number up on PVARA’s published register.
- Confirm the specific Schedule I service the counterparty is offering you appears among its permitted services.
- Check the current regulatory status field — an entity whose licence has been suspended or revoked is not a going concern for the purpose of that transaction, regardless of what it claims elsewhere.
A bank, exchange, or customer that skips this check and relies instead on a PDF certificate or a logo on a website is trusting a document PVARA has no obligation to keep current — the Act’s currency obligation attaches to the register, not to anything the licensee itself distributes.
Does the register only cover full licensees, or does it include NOC holders too?
Section 21(4) is worded around “Licensees” — a defined term in the Act meaning a person who holds a licence. An entity that has only received a no-objection certificate (NOC), and has not yet progressed to a full licence, is not yet a Licensee in that sense. The Act’s register obligation, as drafted, does not extend to NOC holders as a separate category. In practice, this means the register answers “is this entity fully licensed” rather than “has this entity started the process” — an NOC-stage entity may be entirely legitimate and still not appear on the section 21(4) register, because it has not yet reached the status the register is built to track.
What if a company claims to be “PVARA licensed” but does not appear on the register?
That is a direct red flag, not a technicality. Section 50 prohibits any person from engaging in virtual asset services in or from Pakistan without holding a valid licence granted by PVARA, and section 54(1) makes wilfully providing an unlicensed virtual asset service a criminal offence carrying imprisonment up to five years, a fine up to fifty million rupees, or both. A company that markets itself as licensed while absent from the statutory register is either misrepresenting its status or the register has not yet been updated — and a prudent counterparty should treat the discrepancy as a reason to pause, not a formality to overlook, until it is resolved directly with PVARA.
Does listing on the register mean PVARA endorses the licensee’s business?
The Act does not say that, and nothing in section 21(4) suggests it. The register’s function, on its text, is disclosure of licensing status — name, number, permitted services, and current standing — not a quality endorsement or a guarantee of the licensee’s financial soundness. PVARA’s other supervisory powers under the Act, including inspection, ongoing reporting requirements, and administrative sanctions, operate separately from the register and continue to apply to a listed licensee for as long as it holds a licence.
What should a counterparty do with a register check?
Treat it as a first gate, not the whole diligence exercise.
A register check answers one narrow question well: is this entity licensed, and for which services. It cannot tell you whether the licensee is solvent, whether its systems are sound, or whether it is currently the subject of supervisory action that has not yet resulted in a change of status.
Three practical habits follow:
- Check at the point of contracting, not at introduction. Status can change between a first meeting and a signed agreement, and it is the position on the day you commit that matters.
- Match the entry to the entity you are actually contracting with. A group may hold a licence in one company and contract through another. The register lists the licensed entity, not its affiliates.
- Keep a dated record of the check. If a dispute later turns on what you knew and when, a screenshot with a date is worth more than a recollection.
The Act does not impose a diligence obligation on counterparties in these terms; this is ordinary commercial prudence rather than a statutory requirement, and it is our view rather than the Act’s.
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act 2026 as passed by the National Assembly — principally section 21(4), together with section 21(3), Schedule I, section 50 and section 54(1) — read as published. Where PVARA’s own operational detail for the register (format, update cadence, publication mechanics) is not fixed by the Act text, that is stated above rather than assumed.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect