The Virtual Assets Act 2026, Section by Section

Most summaries of the Virtual Assets Act, 2026 cover the licensing chapter and stop. That leaves two-thirds of the statute unexamined, including customer asset insolvency, website blocking, appellate jurisdiction and the state wallet company.

This is a complete map: every section of the Act, in order, with what it does. Where a section defers its substance to Rules or Regulations, that is noted — a large part of the Act works this way, and knowing which provisions are complete and which are placeholders is the difference between a workable compliance plan and a guess.

How is the Act structured?

The Virtual Assets Act, 2026 contains twelve chapters and 74 sections, followed by Schedule I and a Statement of Objects and Reasons. Chapters I to 3 establish scope, the regulator and licensing. Chapters 4 to 9 impose substantive obligations. Chapters 10 to 12 handle enforcement, appeals and transition.

Chapter	Title	Sections
I	Preliminary	1–5
2	PVARA	6–17
3	Licensing and Issuance	18–23
4	Prudential, Safeguarding, Custody	24–29
5	Fiat- and Asset-Referenced Tokens	30–33
6	Cybersecurity, Sandbox, Innovation	34–40
7	Market Conduct	41–45
8	AML, CFT and CPF	46–49
9	Prohibitions	50–53
10	Enforcement and Penalties	54–61
11	Appeals	62–65
12	Miscellaneous	66–74

What do Chapters I to 3 establish?

Chapters I to 3 cover sections 1 to 23. They define what the Act applies to, create PVARA and set out how it is governed and funded, and establish the licensing regime including the pre-incorporation No-Objection Certificate requirement.

Chapter I — Preliminary (sections 1–5)

• s.1–s.2 — Short title, extent and commencement: the Act extends to the whole of Pakistan and comes into force at once. It applies to VASPs carrying on services and Issuers offering assets “in or from Pakistan”. Section 2(2) carves out six categories: closed-loop tokens meeting seven conditions, SBP- and SECP-regulated instruments, central bank digital currencies, non-payment non-investment NFTs, digital collectibles not constituting virtual assets, and anything PVARA expressly excludes.
• s.3 — Definitions. Thirty-three defined terms, plus a provision importing definitions from the State Bank of Pakistan Act 1956, the Securities Act 2015, the Anti-Money Laundering Act 2010 and the Companies Act 2017.
• s.4–s.5 — Extraterritorial application and the relationship with other laws. PVARA may act extraterritorially for investigation and enforcement, must prescribe when offshore services are deemed offered into Pakistan, and must align with FATF and IOSCO frameworks. The Act prevails over inconsistent laws except the Foreign Exchange Regulation Act 1947, but data protection, data governance, cybersecurity, financial secrecy and cross-border personal data laws prevail over the Act.

Chapter 2 — The Authority (sections 6–17)

• s.6–s.8 — Establishment, composition and procedure of PVARA.
• s.9 — Objectives, functions and powers: nine functions in 9(1), fourteen powers in 9(2).
• s.10–s.13 — Delegation, the Chairperson, the Managing Director, and staff.
• s.14–s.16 — The PVARA Fund; budget and audit by the Auditor General; the code of conduct.
• s.17 — Inter-agency cooperation with SBP, SECP, the Financial Monitoring Unit, the Federal Investigation Agency and the Federal Board of Revenue.

Chapter 3 — Licensing (sections 18–23)

• s.18–s.19 — Service categories are those in Schedule I plus any notified and added. An NOC is required before incorporation; the licence application follows incorporation, with a prescribed non-refundable fee.
• s.20 — Fit-and-proper criteria for Controllers, Sponsors, CEOs and Directors, extended to all Key Individuals; continuing in nature; registered office and resident Key Individual required.
• s.21–s.22 — Grant, refusal, provisional and limited-scope licences; the licence specifies permitted services and remains in force unless suspended or revoked; a public register is required; six ongoing obligations apply to licensees.
• s.23 — Variation, suspension and revocation: five grounds, right to be heard, referral to SECP for winding up.

What obligations do Chapters 4 to 9 impose?

Chapters 4 to 9 cover sections 24 to 53 and contain the substantive duties: prudential and custody requirements, token issuance rules, technology and data obligations, market conduct standards, AML duties, and four express prohibitions.

Chapter 4 — Prudential, safeguarding and custody (sections 24–29)

• s.24 — Customer asset segregation at all times; assets excluded from the licensee’s insolvency estate notwithstanding any other law; fiduciary duty; no rehypothecation without explicit, informed, revocable written consent.
• s.25 — Minimum paid-up capital, liquid assets and financial resources — amounts deferred to Regulations. PVARA may set higher requirements by risk profile and may grant risk-based exemptions.
• s.26–s.28 — Custody standards covering secure custody, operational resilience and disaster recovery, with technical standards deferred; cryptographic proof-of-reserves at prescribed intervals; annual audit by a firm of Chartered Accountants approved by the Division concerned, including verification of segregation; reserve custodians subject to prescribed oversight.
• s.29 — Enabling power for a customer compensation or safeguard mechanism. Discretionary; nothing established yet.

Chapter 5 — Tokens and offerings (sections 30–33)

• s.30 — Only legal entities registered in Pakistan meeting prescribed criteria may conduct an Initial Virtual Asset Offering.
• s.31–s.32 — Fiat-Referenced Tokens require 100% reserve backing in HQLA or prescribed assets held as a segregated reserve, par redemption without undue delay, audited disclosures, compliance programmes and insolvency priority. Asset-Referenced Tokens must be fully backed at all times and expressly may not be backed by, or derive value from, other virtual assets.
• s.33 — Significant Issuers: thresholds deferred to Regulations; registration and enhanced obligations.

Chapter 6 — Cybersecurity, sandbox and innovation (sections 34–40)

• s.34–s.36 — Cybersecurity and operational resilience; the regulatory sandbox, with eligibility, risk limits, duration and exit deferred to Regulations, plus guidance and no-action communications; blockchain adoption oversight and harmonisation with other regulators.
• s.37 — Mining. Pure mining unlicensed; mining involving customer assets licensable; registration framework possible above thresholds of scale, energy use or hash rate.
• s.38 — Strategic Digital Wallet Company: a wholly government-owned vehicle for state custody and wallet infrastructure, barred from serving private persons.
• s.39–s.40 — Data localisation, with offshore storage permitted subject to safeguards but PVARA able to require immediate localisation on national security, financial stability, consumer protection or enforcement grounds; and data segregation across five categories of sensitive information, including private keys and identifiable transaction data.

Chapter 7 — Market conduct (sections 41–45)

• s.41 — Duty of integrity and fair dealing.
• s.42 — Issuer obligations: whitepaper, ongoing material disclosure, reserve attestations, mandatory risk disclosure templates. PVARA may exempt categories.
• s.43 — No person may advertise or market a virtual asset unless the Issuer is licensed or registered; marketing must carry risk disclosures.
• s.44–s.45 — Conflict-of-interest identification, management and disclosure, with customer interests taking priority; internal complaint handling, and an independent dispute-resolution scheme PVARA may establish below a prescribed threshold.

Chapter 8 — AML, CFT and CPF (sections 46–49)

• s.46 — Licensed VASPs deemed financial institutions for the Anti-Money Laundering Act, 2010; STR reporting to the Financial Monitoring Unit; record-keeping; internal controls and a compliance officer. Supervisory framework aligned to FATF standards.
• s.47 — Travel rule: originator and beneficiary information on transfers at or above a threshold PVARA prescribes, consistent with FATF Recommendations.
• s.48–s.49 — Secure reporting channels and, where required, automated supervisory interfaces; strict limits on the collection, use and sharing of customer data, with explicit, informed and revocable consent for non-essential processing.

Chapter 9 — Prohibitions (sections 50–53)

• s.50 — No unlicensed virtual asset services; Pakistani incorporation and a licence both required.
• s.51 — No Initial Virtual Asset Offering except in accordance with the Act.
• s.52–s.53 — No market manipulation or abuse, insider trading, inducement or unlawful disclosure of inside information; and no algorithmic tokens that are not fully or adequately collateralised, unless permitted by Regulations.

What do Chapters 10 to 12 provide?

Chapters 10 to 12 cover sections 54 to 74. They establish criminal offences and penalties, investigation and prosecution machinery, administrative sanctions, emergency and blocking powers, a dedicated appellate tribunal, and the transitional and savings provisions.

• s.54 — Criminal offences. Unlicensed service: up to 5 years and/or Rs 50 million. Unauthorised offering, market abuse by a natural person, and false statements to PVARA: 3 years each, with fines of Rs 25 million, Rs 25 million and Rs 20 million. Market abuse by a legal person: three times profit gained or loss avoided, or up to 15% of preceding-year turnover. Obstruction: 2 years and/or Rs 10 million. Non-compliance with an order: 1 year and/or Rs 25 million. Special Courts may be designated.
• s.55 — Officers of bodies corporate personally liable where the offence involved their consent, connivance or neglect.
• s.56–s.57 — Only an authorised officer of PVARA may investigate. That officer must obtain a warrant from a court of competent jurisdiction for search and seizure, then exercises the powers of an officer in charge of a police station. Wilful refusal to provide information: up to 1 year and/or Rs 1 million. No court may take cognizance except on an authorised officer’s written report.
• s.58 — Prosecution by a special public prosecutor; Chapter XXII-A CrPC procedure; adjournments capped at fourteen days.
• s.59–s.60 — Administrative sanctions: reprimand or public censure, remedial directive, financial penalty, licence suspension or revocation, disqualification from office, with s.59(4) stating a fine up to Rs 25 million for any contravention. Emergency intervention permits suspension of specified services or freezing of assets for up to thirty days.
• s.61 — Blocking of websites, apps, advertisements and payment links; directions to intermediaries, app stores, search engines, registrars and payment providers; ten days to make a representation, fifteen days for PVARA to respond.
• s.62–s.65 — The Virtual Assets Appellate Tribunal, comprising a presiding officer who is a retired High Court judge or a ten-year advocate, plus a technical expert and a financial expert, on three-year terms with retirement at sixty. Appeal lies within thirty days of communication of the order; the Tribunal must decide within three months and is deemed a civil court; a further appeal lies to the Supreme Court of Pakistan within thirty days.
• s.66–s.69 — Tax compliance under the Income Tax Act, 2001 and FBR rules; Rules made by the Federal Government and Regulations by PVARA in consultation with the Division concerned; PVARA personnel deemed public servants under the Pakistan Penal Code.
• s.70 — Transitional: existing providers have six months from commencement to apply or cease; a complete application permits continued provision of existing services subject to interim directives and core obligations.
• s.71–s.73 — Federal Government policy directives, which must not impede operational autonomy; annual and special reports laid before Parliament within ninety days and published online; a removal-of-difficulties power exercisable within six months of commencement.
• s.74 — Savings: acts done under the lapsed Virtual Assets Ordinance, 2025 deemed valid under corresponding provisions of the Act.

What does Schedule I contain?

Schedule I sits behind section 18 and lists ten categories of virtual asset service, each with a statutory description: Advisory, Broker-Dealer, Custody and Administration, Exchange, Lending and Borrowing, Derivatives, Management and Investment, Transfer and Settlement, Issuance, and Mining-related Services.

“The following constitute Virtual Asset Services and shall be subject to licensing and regulation under this Act:— (a) all services as specified in Schedule I; and (b) any other service as may be notified by the Federal Government and subsequently included in Schedule I of this Act.”

— Virtual Assets Act, 2026, section 18

Three categories carry exemptions inside their own definitions: Broker-Dealer excludes pure proprietary trading, Custody excludes non-custodial software, and Mining-related Services excludes mining for own account.

The Statement of Objects and Reasons closing the Act records the policy rationale, including the development of Shariah-compliant virtual asset services aligned with international standards.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, including Schedule I and the Statement of Objects and Reasons, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.