The Statutory Basis for the PVARA Sandbox

Every regulatory sandbox needs an anchor in primary law before it can operate. In Pakistan that anchor is a single, short section of the Virtual Assets Act, 2026, expanded into a working framework by a separate instrument: the Sandbox Guidelines 2026 issued by the Pakistan Virtual Asset Regulatory Authority (PVARA).

Founders evaluating whether to test a product inside the sandbox often start with the eligibility criteria or the application form. Before either of those matters, it is worth knowing where the sandbox’s authority actually comes from, because that answers a more basic question: can PVARA change the rules of the sandbox later, and on what basis.

This article traces the statutory chain from the Act down to the Guidelines, and sets out the seven objectives the Guidelines say the sandbox exists to achieve.

What gives PVARA the legal power to run a sandbox?

Section 35 of the Virtual Assets Act, 2026 is the enabling provision. Section 35(1) states that the Authority “may establish a regulatory sandbox to facilitate controlled testing of innovative Virtual Asset products or services, in the manner prescribed by Regulations.” That single sentence is the entire statutory basis for the sandbox’s existence.

Section 35(2) then delegates the operational detail: “Eligibility, application procedures, supervisory arrangements, risk limits, duration and exit requirements shall be prescribed by Regulations.” In other words, the Act does not itself set out who can apply, how long testing lasts, or how a participant exits — it authorises PVARA to write those rules separately. The Sandbox Guidelines 2026 are that separate instrument.

Section 35(3) adds a further power: the Authority “may issue guidance, no-objection statements or no-action communications in accordance with Regulations.” This is the legal root of the no-action relief that sandbox participants can receive during testing.

Two other sections of the Act support the sandbox indirectly. Section 9(2)(k) lists, among the Authority’s general powers, the ability to “operate regulatory sandboxes in a transparent and accountable manner.” Section 14(2)(j) allows the PVARA Fund — the Authority’s own budget — to include “charges for services rendered by the Authority, including sandbox participation and other prescribed services,” which is the statutory basis for any sandbox application fee.

Why do the Sandbox Guidelines cite a different law than the Act?

The Sandbox Guidelines 2026 are drafted against the Virtual Assets Ordinance, 2025, not the Act. Their introduction states plainly that they “operationalize the mandate conferred upon the Authority under Sections 42 to 45 of the Virtual Assets Ordinance, 2025.” Every defined term in the Guidelines — Sandbox, Applicant, Exit, No-Action Relief — cross-references an Ordinance section number in the 42–45 range, not the Act’s section 35.

This matters because the Act is the current governing statute, and the Ordinance it replaced does not appear anywhere in the Act’s text as a live cross-reference. What the Act does provide is a savings clause. Section 74 of the Act states that, notwithstanding the lapse of the Virtual Assets Ordinance, 2025, “anything done, action taken, appointment made, notification or order issued, or right, privilege, obligation or liability accrued under the said Ordinance shall be deemed to have been validly done, taken, made, issued or accrued under the corresponding provisions of this Act.”

Our reading is that section 74 is what keeps the Sandbox Guidelines alive and enforceable under the Act, with the Ordinance’s sections 42–45 read across to the Act’s section 35. But the Guidelines themselves have not been reissued with updated section numbers, and the Act does not name a specific correspondence table between the two instruments. Anyone relying on a particular Ordinance section number quoted inside the Guidelines should treat it as a historical citation rather than a live one, and confirm PVARA’s current position before acting on it.

What are the seven objectives of the sandbox under the Guidelines?

The Guidelines set out the sandbox’s objective in a single passage headed “Objective,” listing seven distinct aims. Together they read less like marketing language and more like a checklist the Authority intends to be held to.

The seven objectives, in the Guidelines’ own order, are:

1. To implement the mandate of the Authority under Sections 42–45 of the Virtual Assets Ordinance, 2025, by establishing and operating a Sandbox.
2. To provide a structured framework that enables responsible testing of innovative Virtual Asset products and services in a controlled environment.
3. To promote financial innovation while ensuring investor protection, financial stability, and market integrity.
4. To identify risks associated with innovative products in the Virtual Assets eco-system, in local and global context, and develop appropriate risk mitigation mechanisms.
5. To define clear procedures for application intake, application assessment, onboarding, supervision, monitoring, and exit of Sandbox participants.
6. To ensure that testing activities are conducted under appropriate oversight with due regard to risk management and consumer protection.
7. To coordinate and collaborate with relevant regulatory authorities operating in domestic or other jurisdictions.

The Guidelines’ introduction frames this list as an attempt to balance “the promotion of innovation with the need for investor protection, financial stability, market integrity, and risk management.” Objective four is worth noting on its own: it commits PVARA to weighing risk “in local and global context,” which signals that the Authority intends to benchmark applicants against international precedent, not only against Pakistan’s own market. Objective seven similarly points outward, anticipating coordination with foreign regulators where a sandbox applicant has cross-border elements — a theme that also runs through the Act’s provisions on inter-agency cooperation.

How does the sandbox sit inside PVARA’s wider mandate?

The sandbox is one tool among several the Act gives PVARA to pursue its stated purpose of licensing, regulating and supervising virtual asset activity while attracting investment into Pakistan. Section 9(1)(d) of the Act lists “promote responsible innovation, digital financial inclusion and the development of compliant Virtual Asset markets” among the Authority’s core objectives, and the sandbox is the clearest mechanism for delivering that objective without exposing the market to an untested product at full licensing scale.

In practice, this means the sandbox is not a standalone regime with its own separate philosophy. It is one expression of the same licensing framework that governs every virtual asset service provider (VASP) in Pakistan — the same fit and proper standard, the same AML expectations, and ultimately the same requirement to hold a full licence if the product succeeds. A firm considering the sandbox route alongside a direct application for a no objection certificate should treat both as doors into the same building, not as alternative regulatory philosophies.

What does the statutory basis not give you?

Section 35 authorises PVARA to run a sandbox; it does not itself grant any applicant a right to enter one, a right to a particular outcome, or immunity from the rest of the Act. The prohibitions in Chapter 9 of the Act — including the bar on unlicensed virtual asset services — continue to apply outside the specific, approved scope of a sandbox arrangement. Obligations under the Anti-Money Laundering Act, 2010 are not suspended by sandbox participation; if anything, the Sandbox Guidelines layer additional AML expectations onto participants, including enterprise risk assessment and screening for both originator and beneficiary of a transaction.

It is also worth being precise about what “guidance, no-objection statements or no-action communications” under section 35(3) actually are. A no-action communication is a statement of the Authority’s present enforcement intention, not a change to the law itself. It can be withdrawn on written notice. Nothing in section 35 converts a sandbox arrangement into a licence, and nothing in it obliges PVARA to grant a licence at the end of a successful test.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.