Approval into the PVARA sandbox does not end an applicant’s paperwork — it starts a new document. Once an application is approved, section 8 of the Sandbox Guidelines 2026 requires the participant to sign an undertaking in the form set out at Annexure-B, and that document is where most of the day-to-day legal exposure of being a sandbox participant actually sits.
This article goes through Annexure-B obligation by obligation, grouped by theme, so a participant knows precisely what it is agreeing to before it signs.
What is the Annexure-B undertaking, and when must it be signed?
The Annexure-B undertaking is a formal declaration a sandbox applicant must sign once its application is approved, committing it to a long list of operational, reporting and compliance obligations for the life of its participation. Section 8 of the Guidelines states simply: “On approval of application, the participant shall submit an undertaking as per Annexure B.” It is executed in favour of PVARA, addressed to the Authority “established under Section 6 of the Virtual Assets Ordinance, 2025”, and signed by an authorised official with witnesses.
The undertaking opens by recording that the applicant has met PVARA’s requirements and intends “to participate in the Sandbox to test its innovative product/service/business model/delivery mechanism in Virtual Asset products and services in a controlled environment.” Everything that follows is described as agreed “unconditionally and irrevocably” — there is no partial or negotiated acceptance built into the form.
What operational and compliance obligations does the undertaking impose?
The undertaking commits the participant to operate strictly within PVARA’s approved parameters, to follow Pakistani law, and to keep consumer protection, anti-money laundering and data security controls running throughout testing. The relevant clauses are:
- “It shall operate within the sandbox as per the parameters set by the Authority.”
- “It shall adhere to the applicable laws, rules and regulations in Pakistan.”
- “It shall ensure consumer protection, ML/TF/PF, data security, and risk management measures are in place.”
- “It shall ensure retention and confidentiality of consumer data as per Virtual Assets Ordinance 2025.”
- “It shall fulfill all tax obligations and maintain complete financial records as required by law, and shall not engage in or facilitate any tax evasion.”
These sit on top of, rather than replace, the eligibility criteria an applicant already had to satisfy to be approved. A participant working through its regulatory and licensing obligations should treat the undertaking as a continuation of the same standard it applied under, not a fresh or lighter one.
What reporting and access obligations does the participant sign up to?
The undertaking gives PVARA a standing right to see, in real time, almost everything about how the participant’s tested product is running, backed by two tight incident deadlines. The core reporting and access clauses:
| Obligation | Deadline / standard |
|---|---|
| Submit progress reports, signed by a person designated by the CEO | “as per agreed format and timelines during the testing stage” |
| Notify the Authority of any material incident, risk event or compliance breach | within one hour |
| Submit a detailed incident report | within 48 hours of identifying the issue |
| Allow the Authority complete access to core reporting/accounting/significant software | Continuous |
| Validate transactions and trace the flow of funds, at the Authority’s request | Continuous |
| Maintain proper records for review by the Authority at any time | Continuous |
| Retain all transaction records and books of account | 7 years |
The one-hour notification clock is the tightest deadline in the entire Sandbox Guidelines, and it sits alongside a wider obligation “to allow the Authority to validate the transaction and trace the flow of funds” and to give “complete access” to core systems on demand — a standard of transparency well beyond what most virtual asset service provider arrangements require outside the sandbox.
What financial protections does the participant have to put in place for consumers?
The undertaking requires the participant to carry insurance against its own fraud or gross negligence and to indemnify PVARA against claims arising from its participation — protections that run in favour of consumers and the Authority, not the participant itself. The two clauses:
“It shall obtain insurance coverage to indemnify clients against any losses that may be incurred as a result of fraud or gross negligence.”
“It indemnifies and holds harmless the Authority from any claims arising due to participation in the sandbox. The participant agrees and acknowledges that the Authority may, at any appropriate time, impose such terms and conditions, as it determines appropriate, for the limits of liability.”
Neither clause names a minimum sum insured or a cap on the indemnity — both are left to PVARA’s discretion, described only as terms and conditions the Authority may impose “as it determines appropriate”. A participant should confirm the actual figures with PVARA at approval stage rather than assuming a market-standard policy will satisfy the undertaking as written.
What termination and exit obligations does the participant accept?
The undertaking gives PVARA the right to end a participant’s sandbox testing on 15 days’ notice by default, or immediately for three named triggers, and separately commits the participant to follow whatever exit path the Authority or the test results dictate. The termination clause:
“It agrees and acknowledges that the Authority may terminate its participation in the Regulatory Sandbox by giving written notice at least 15 days prior to the termination date, or immediately in the following circumstances: Breach of the testing plan; Deployment of the proposition is expected to have negative consequences for the consumers and/or overall financial stability or failure to provide requested information; Public interest.”
This termination right sits alongside, but is distinct from, the Authority’s separate power under section 13 of the Guidelines to suspend or withdraw sandbox approval entirely — the undertaking’s three immediate triggers are broader than the “serious discrepancy” threshold that section 13 sets for withdrawal, so a participant can face termination under the undertaking in circumstances that would not, on their own, meet the higher bar for a section 13 withdrawal.
Beyond termination itself, the participant also agrees to:
- “abide by and execute the exit strategy in accordance with the decision of the Authority and/or its own assessment of the test results at Exit Stage”;
- treat any successful rollout as “subject to license/approval by the Authority and compliance with regulatory requirement, as issued from time to time”;
- accept that the Authority “is under no obligation to amend regulatory framework or introduce new regulatory provisions to accommodate the product or service”; and
- “cease all sandbox activities upon expiration (if the testing is unsuccessful) or as required by the Authority.”
What consumer-facing and dispute-resolution duties does the undertaking create?
The undertaking requires the participant to give test users the highest standard of protection and fair treatment, to keep their data secure and give them control over it, and to resolve disputes in good faith with recourse to the Pakistani courts as a last resort. In the participant’s own words, it agrees:
- to “ensure that all consumers involved in test are afforded the highest standard of protection, fairness, and transparency throughout the Test period”;
- not to “engage in any practice that may result in consumer harm, financial loss, misleading information, or unfair treatment”;
- to “implement adequate risk mitigation measures, including but not limited to fraud prevention, dispute resolution, and transaction security”;
- that test users “shall have the right to access, correct, or request deletion of their personal data at any time”; and
- to “in good faith, attempt to resolve all disputes or conflicts arising of its participation in the sandbox”, with unresolved disputes “referred to competent court in Pakistan.”
The undertaking also requires consent for PVARA to disclose non-identifying information about the participation publicly, and closes with a general acceptance that “the decision of Authority is final.”
Related reading
- PVARA Exchange License: Capital, Rules & Obligations 2026
- PVARA Transfer & Settlement License: Crypto Payments 2026
- PVARA Licensing Process: NOC to Full Licence, Step by Step
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, the PVARA No Objection Certificate Regulations and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect