A foreign exchange holding a licence from a well-regarded overseas regulator is not automatically entitled to serve Pakistani customers. Nor is a Pakistani-incorporated company automatically entitled to run a crypto exchange simply because it exists as a legal entity. Section 50(1) of the Virtual Assets Act, 2026 requires both conditions at once, and a business that satisfies only one of them is still operating unlawfully under the Act.
This two-limb structure is easy to state and surprisingly easy to get wrong in practice, particularly for foreign entities used to a single-licence model in their home jurisdiction, and for local founders who treat incorporation as the finish line rather than the starting point of the licensing journey.
What exactly does section 50(1) prohibit?
Section 50(1) states:
“No Person shall, by way of business, engage in, or represent themselves as engaging in, any Virtual Asset Services in or from Pakistan, unless that Person:- (a) is a company incorporated under the Companies Act, 2017 or any other law for the time being in force in Pakistan governing the incorporation of companies; and (b) holds a valid license granted by the Authority under this Act.”
The word “and” joining limbs (a) and (b) is the key drafting feature. This is a conjunctive test, not an alternative one. A person satisfying only limb (a) — a Pakistani-incorporated company with no PVARA licence — is caught by the prohibition just as much as a person satisfying only limb (b), if that were even possible, since a licence under the Act is in practice only issued to a company that has already gone through Pakistani incorporation.
Why does the Act require Pakistani incorporation as a separate limb, rather than treating the licence alone as sufficient?
Incorporation under limb (a) establishes the legal entity PVARA can actually supervise, hold accountable and, if necessary, pursue for enforcement within Pakistan’s own courts and administrative system. A virtual asset service provider operating purely as a foreign entity, with no Pakistani legal presence, sits largely outside the reach of PVARA’s ordinary supervisory tools even if it held a foreign licence recognised elsewhere. Section 20(6) reinforces this same logic from a different angle: it requires every licensee to maintain a registered office in Pakistan and to have at least one key individual ordinarily resident in Pakistan with operational and decision-making authority. Incorporation without that resident presence would not fully satisfy the Act’s underlying supervisory intent, even before reaching the separate licence requirement.
Section 19(1) also makes clear that incorporation is not meant to happen first, independently of PVARA: “Any Person intending to incorporate a company… with the primary objective of engaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.” So limb (a)’s incorporation is itself expected to follow PVARA clearance, not precede or substitute for it.
Why does a licence alone, without local incorporation, fail to satisfy the prohibition?
Because section 21, which governs the grant of a licence, operates within a framework built around section 20’s fit-and-proper and governance requirements, which in turn assume a Pakistani corporate entity as the licence holder. A foreign company cannot obtain a section 21 licence while remaining unincorporated in Pakistan, because the application process under section 19(4) is explicitly framed as following incorporation: “An application for a license, following incorporation of the company, shall be made to the Authority in such form and manner as may be prescribed.” The two limbs are therefore not just legally conjunctive on paper — they are sequenced by the Act’s own application process, with incorporation as a precondition to the licence application itself, not a parallel, independent track.
What are the practical scenarios where a business fails one limb but not the other?
Three scenarios illustrate how the two-limb structure catches different failure modes:
| Scenario | Limb (a) satisfied? | Limb (b) satisfied? | Result under section 50(1) |
|---|---|---|---|
| Foreign exchange with an overseas licence, no Pakistani entity, actively serving Pakistani customers | No | No (foreign licence is not “a license granted by the Authority”) | Prohibited |
| Pakistani company incorporated for a general commercial purpose, later starts offering crypto trading without applying for a PVARA licence | Yes | No | Prohibited |
| Company that obtained PVARA’s No-Objection Certificate, incorporated in Pakistan, but has not yet been granted the full licence under section 21 | Yes | Not yet | Prohibited until licence is granted |
| Pakistani-incorporated, PVARA-licensed entity operating within its permitted service scope under section 21(3) | Yes | Yes | Compliant |
The middle row is worth dwelling on. A regulatory sandbox participant or an AML-registered applicant under PVARA’s No Objection Certificate Regulations may lawfully provide a narrower set of AML-registered services before the full licence is granted, under the specific conditions those instruments set. But that is a distinct, narrower authorisation created outside section 50(1) itself, not a general exception to the two-limb rule for ordinary commercial operation.
What is the penalty for breaching section 50(1)?
Section 54(1) sets the criminal exposure:
“Whoever, willfully, provides an unlicensed Virtual Asset Service shall be punishable with imprisonment for a term up to five years, or with fine up to fifty million Rupees, or with both.”
This is among the heaviest penalties in the Act’s entire enforcement chapter, and it applies regardless of which limb of section 50(1) the person failed to satisfy — the offence is framed around providing an unlicensed service, not around which specific precondition was missing. Section 55 extends this exposure to individuals: where the offence is committed by a body corporate “with the consent, connivance or neglect of any director, manager, secretary or similar officer, such Person shall be deemed to have committed the offence.” A director who allows an unlicensed operation to continue is not shielded by the corporate structure.
Beyond the criminal route, section 61(1) gives PVARA a direct administrative power to “remove, block, or direct the removal or blocking of any online material… if, on reasonable grounds, it promotes, operates, or relates to an unlicensed Virtual Asset Service.” Section 61(2) extends that direction to hosting providers, app stores, payment providers and advertising networks, not only to the operator itself — meaning the commercial infrastructure supporting an unlicensed business can be cut off directly, independently of any criminal prosecution.
How should a foreign VASP think about entering the Pakistani market, given this two-limb test?
A foreign exchange or service provider planning to serve Pakistani customers has to plan for both limbs from the outset, in the correct order: apply for PVARA’s No-Objection Certificate before incorporation, complete incorporation under the Companies Act, 2017 once the NOC is granted, and only then submit the full licence application under section 19(4). Treating incorporation as a formality to complete quickly, ahead of or separate from PVARA engagement, risks building a company that satisfies limb (a) on paper while leaving limb (b) unresolved for months — during which the underlying commercial activity, if it has already started, is squarely within section 54(1)’s five-year, fifty-million-rupee exposure.
Anyone advising a group on market entry into Pakistan should treat the two limbs as sequential gates rather than a single compliance checkbox, since the Act’s own application process — NOC first, incorporation second, licence application third — is built to enforce exactly that order.
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect