The PVARA Sandbox Undertaking: Every Obligation in Annexure-B

Approval into the PVARA sandbox is not the end of the paperwork. Before testing starts, every approved participant must sign the Annexure-B undertaking — a document that binds the participant to a long list of unconditional and irrevocable commitments, several with tight deadlines attached.

Founders sometimes treat the undertaking as a formality that follows the real work of the Form I application. It is not. Annexure-B is where the operational, financial and legal exposure of running a live sandbox test actually gets fixed in writing, and it is worth reading in full before signature — not after.

What is the Annexure-B undertaking, and when is it signed?

Annexure-B is the format of undertaking a sandbox applicant must submit once its application is approved, addressed to the Pakistan Virtual Asset Regulatory Authority (PVARA). Section 8 of the Sandbox Guidelines 2026 states the requirement plainly:

“On approval of application, the participant shall submit an undertaking as per Annexure B.”

The document itself is drafted as a formal instrument — naming the applicant, its incorporation basis, and its registered office — and opens by recording that the applicant “having met the requirements as determined by the Authority in accordance with the Guidelines intends to participate in the Sandbox to test its innovative product/service/business model/delivery mechanism in Virtual Asset products and services in a controlled environment.” Every clause that follows is introduced as something the applicant “unconditionally and irrevocably undertakes and agrees.”

What are the core operating obligations in the undertaking?

The undertaking opens with the basic ground rules of sandbox participation: operate within the parameters PVARA sets, follow Pakistani law, and keep consumer protection and data-security measures in place. In the undertaking’s own words, the participant agrees that it:

• “shall operate within the sandbox as per the parameters set by the Authority”;
• “shall adhere to the applicable laws, rules and regulations in Pakistan”;
• “shall ensure consumer protection, ML/TF/PF, data security, and risk management measures are in place”; and
• “shall ensure retention and confidentiality of consumer data as per Virtual Assets Ordinance 2025.”

That last clause references the “Virtual Assets Ordinance 2025” by name, which has since lapsed and been replaced by the Virtual Assets Act, 2026. Section 74 of the Act preserves anything accrued under the Ordinance as valid under “the corresponding provisions of this Act,” so our reading is that this obligation carries forward under the Act’s own data-related provisions, including section 40’s requirements on segregation and protection of sensitive information. The undertaking’s text has not, to our knowledge, been republished with the updated reference.

What reporting and access rights does the participant give PVARA?

The undertaking gives PVARA extensive visibility into the participant’s operations for the life of the test: signed progress reports, complete access to core systems, and a standing right to trace transactions. In full, the participant agrees that it:

• “shall submit information and progress reports to the Authority signed by competent authority as designated by CEO and as per agreed format and timelines during the testing stage”;
• “shall allow complete access to the Authority to its core reporting/accounting/significant software”;
• “shall maintain proper records during testing period for reviews by Authority anytime”; and
• “shall allow the Authority to validate the transaction and trace the flow of funds.”

“Complete access” to core software is a broad commitment, and it is not qualified by advance notice or a defined review window elsewhere in the undertaking. A participant should build this access requirement into its technical architecture from day one of the test, rather than treat it as a request to be accommodated later.

What are the incident notification deadlines?

The undertaking’s incident clock is unusually tight, and it runs in two stages. The participant agrees that it:

• “shall notify within one hour, the Authority, of any material incident, risk event, or compliance breach, detailing the extent of the breach and the remediation measures undertaken”; and
• “shall submit a detailed incident report to the Authority within 48 hours of identifying the issue, outlining nature and scope of the incident, steps taken to contain and resolve the issue and measures to prevent recurrence.”

One hour to notify, 48 hours to report in detail. Neither deadline is qualified by business hours, and the undertaking does not describe an exception for incidents discovered outside normal working time. An incident-response plan for a sandbox participant needs a named, always-reachable point of contact for this clause to be workable in practice — not just a policy document describing the process.

What financial protections must the participant put in place?

Two clauses in the undertaking put direct financial obligations on the participant: insurance for client losses, and an indemnity protecting PVARA itself. The participant agrees that it:

• “shall obtain insurance coverage to indemnify clients against any losses that may be incurred as a result of fraud or gross negligence”; and
• “indemnifies and holds harmless the Authority from any claims arising due to participation in the sandbox. The participant agrees and acknowledges that the Authority may, at any appropriate time, impose such terms and conditions, as it determines appropriate, for the limits of liability.”

The insurance clause is not scoped to a minimum coverage amount in the published text — the Guidelines leave the adequacy of coverage to the participant’s own judgement, subject to whatever conditions PVARA later imposes under the second clause. This is a genuine gap worth flagging rather than assuming a figure: an applicant should not treat any particular coverage level as compliant without confirming it against PVARA’s expectations directly, since the undertaking gives the Authority open discretion to set “limits of liability” terms at any appropriate time.

On what grounds can PVARA terminate the undertaking?

Termination can happen on notice, or immediately on specific grounds. The undertaking states that the participant agrees and acknowledges:

“that the Authority may terminate its participation in the Regulatory Sandbox by giving written notice at least 15 days prior to the termination date, or immediately in the following circumstances: Breach of the testing plan; Deployment of the proposition is expected to have negative consequences for the consumers and/or overall financial stability or failure to provide requested information; Public interest.”

Termination route	Notice required
Ordinary termination	At least 15 days’ written notice
Breach of the testing plan	Immediate
Expected negative consequences for consumers or financial stability, or failure to provide requested information	Immediate
Public interest	Immediate

This sits alongside, but is not identical to, the separate suspension and withdrawal power in section 13 of the Guidelines, which lets PVARA act on “possible reasons to believe” a participant has failed to adhere to agreed terms. The undertaking’s termination clause and the Guidelines’ suspension clause describe overlapping but not identically worded grounds, and a participant facing either should not assume the procedural protections of one apply automatically to the other.

What data protection duties does the participant owe test users?

The undertaking sets out specific, individually enforceable data rights for test users, separate from the general confidentiality duty owed to PVARA. The participant agrees that it:

• “shall ensure that Test Users’ personal and financial data is kept secure, confidential, and protected against unauthorized access, breaches, or misuse”; and
• “agrees that the Test Users shall have the right to access, correct, or request deletion of their personal data at any time.”

That second commitment is an operational requirement, not just a policy statement — a participant needs a working mechanism for a test user to actually exercise access, correction and deletion rights during the test, not merely a stated intention to honour such requests if made.

What records must the participant keep, and for how long?

The undertaking fixes a seven-year retention period, independent of how long the actual test runs. It states the participant “shall retain all the transaction record and maintain proper book of account for a period of 7 years.” This runs alongside the tax and financial-record duties in the Act itself — section 66 requires every licensed virtual asset service provider to comply with obligations under the Income Tax Act, 2001, and the undertaking’s own clause commits the participant to fulfil “all tax obligations and maintain complete financial records as required by law” and to refrain from “any tax evasion.” Our tax and banking service page covers how these obligations are typically structured for a Pakistan-facing entity.

What happens at the end of a successful test?

The undertaking commits the participant, in advance, to the licensing pathway that follows a successful sandbox outcome — it does not leave that as an open question to be negotiated later. The participant agrees:

“that if the product or service is deemed successful, its rollout shall be subject to license/approval by the Authority and compliance with regulatory requirement, as issued from time to time”

and separately

“to seek license or authorization from the Authority to operate commercially after successful conclusion of its participation in the sandbox, and comply with necessary regulatory requirements.”

The undertaking also confirms that PVARA “is under no obligation to amend regulatory framework or introduce new regulatory provisions to accommodate the product or service” — success in the sandbox does not create a right to a bespoke regulatory outcome. A participant planning for a successful exit should be building toward the ordinary licence application process in parallel with testing, not treating sandbox success as self-executing authorisation.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, the PVARA No Objection Certificate Regulations and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.