Virtual Assets Act 2026: When Did It Come Into Force?

Most questions we field about Pakistan’s virtual asset framework are about capital, licence categories or banking. The question that should come first, and rarely does, is simpler: on what date did the law start to bite, and what happened to everything done under the instrument it replaced?

That matters commercially. A commencement date fixes the clock on the transitional window for businesses already trading. It determines whether a No Objection Certificate issued in December 2025 still has legal effect. And it decides whether an offence provision was in force on the day a transaction happened.

The Virtual Assets Act 2026 deals with all three in two short provisions — section 1 and section 74 — and neither is drafted with the generosity a foreign operator might hope for.

When did the Virtual Assets Act 2026 come into force?

The Act commenced immediately on enactment. There is no phased start, no appointed-day mechanism and no transition period built into the commencement clause itself. Section 1(3) of the Virtual Assets Act 2026 states the position in six words:

“It shall come into force at once.”

That single sub-section carries more weight than its length suggests. Many Pakistani statutes commence “on such date as the Federal Government may, by notification in the official Gazette, appoint” — which lets the executive stagger the start of different chapters. The Act does not do this. Every chapter, including the prohibitions in Chapter 9 and the criminal offences in Chapter 10, took effect at the same moment.

Two points of honesty about dates. First, the text we have read is the Bill as passed by the National Assembly. It does not itself record a date of assent or a Gazette publication date, and we will not invent one. Second, because commencement is expressed as “at once” rather than by reference to a notified day, the operative date is the date of enactment rather than anything the Authority separately publishes. Verify the enactment date against the Pakistan Virtual Asset Regulatory Authority and the official Gazette before you rely on it in a legal opinion. Our own reading of the licensing architecture built on top of it is set out in the PVARA licence guide.

Where does the Act apply, and to whom?

The Act extends to the whole of Pakistan under section 1(2), and applies by activity rather than by the location of a company’s letterhead. Section 2(1) captures any Virtual Asset Service Provider carrying on — or holding itself out as carrying on — a Virtual Asset Service “in or from Pakistan”, and any Issuer offering a Virtual Asset in or from Pakistan.

“In or from” is the phrase that does the work. An offshore exchange with Pakistani users is not automatically outside the perimeter simply because its servers and staff are elsewhere. Section 4(1) then goes further:

“For the purposes of investigation and enforcement under this Act, the Authority may exercise its powers extraterritorially to the fullest extent permitted by law.”

Section 4(2) requires the Authority to prescribe, by Regulations, the conditions under which a service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to persons in Pakistan. Until those Regulations are issued, the boundary is a matter of interpretation rather than a bright line. This is the provision that shapes how a foreign crypto exchange enters Pakistan, and why a “we don’t target Pakistan” position needs to be evidenced rather than asserted.

Section 2(2) then carves out categories that fall outside the Act altogether, including closed-loop tokens meeting all seven conditions in section 2(2)(a), instruments within the jurisdiction of the State Bank of Pakistan or the Securities and Exchange Commission of Pakistan, central bank digital representations of fiat, and certain non-fungible tokens. We have looked at two of those carve-outs in detail in our notes on the closed-loop token exemption and the NFT exemption.

What happened to the Virtual Assets Ordinance 2025?

It lapsed, and the Act preserves everything done under it. Section 74 of the Act is a savings provision that treats prior acts as if they had been done under the Act:

“Notwithstanding the lapse of the Virtual Assets Ordinance, 2025 (VII of 2025), anything done, action taken, appointment made, notification or order issued, or right, privilege, obligation or liability accrued under the said Ordinance shall be deemed to have been validly done, taken, made, issued or accrued under the corresponding provisions of this Act.”

Read that clause carefully, because it cuts both ways. Rights and privileges survive — so does liability. An obligation that accrued under the Ordinance is now an obligation under the Act, and an act that gave rise to liability under the Ordinance does not become unenforceable because the Ordinance expired.

Section 74 works through the concept of “corresponding provisions”. It does not publish a mapping table. That is a practical problem, because PVARA’s early instruments cite Ordinance section numbers that have moved in the Act. Based only on the section numbers cited inside the PVARA instruments we have read, the correspondence appears to be:

Subject matter	Cited in PVARA instruments (Ordinance)	Virtual Assets Act 2026
Establishment of the Authority	Section 6(1)	Section 6
Pre-incorporation NOC	Section 15	Section 19
Fit and proper criteria	Section 16	Section 20
Grant of full licence	Section 17	Section 21
Categories of services	Schedule I	Section 18 and Schedule I
Regulatory sandbox	Sections 42–45	Section 35

We have not seen the Ordinance text itself, so treat this as inference from the citations rather than an authoritative concordance. If you are drafting a submission, cite the Act provision and note the Ordinance equivalent your evidence was originally prepared against.

Does an NOC or sandbox approval issued under the Ordinance still count?

Yes. On the face of section 74, a No Objection Certificate, sandbox Letter of Approval, no-action letter, appointment or condition issued under the Ordinance is deemed to have been validly issued under the Act. Holders do not need to reapply because the Ordinance lapsed.

The PVARA No Objection Certificate Regulations 2025 carry an effective date of 2 December 2025 and were made against the Ordinance. Those Regulations, and the Sandbox Guidelines 2026, refer to the parent instrument inconsistently — sometimes as “the Ordinance”, sometimes as “the Act”. Section 74 is what makes that untidiness harmless.

What survives, in our reading, includes:

• NOCs already granted, together with the conditions attached to them — under the NOC Regulations, regulation 17.1, those conditions include goAML registration, incorporation of a local entity, and permission to provide the four “AML Registered Services” (Exchange, Broker-Dealer, Custody and Derivatives) ahead of a full licence.
• The three-month licensing deadline in regulation 15.3(c) of the NOC Regulations, which requires the licensing application to be submitted within three months of issuance of the VASP licensing regulations.
• Fit and proper assessments completed on Key Individuals and Controllers via Forms A3 and A2, which regulation 16.1 says may be evaluated or re-evaluated at the licensing stage.
• Ongoing obligations under regulation 18.1, including the Annual AML/CFT Return on Form A6 and maintenance of active FMU goAML registration.

What does not survive automatically is any assumption that the Act’s substantive requirements match the Ordinance’s word for word. Anyone holding an NOC should re-read their file against the Act — particularly the definitions of Controller in section 3(1)(v) and Customer Assets in section 3(1)(vii). This is exactly the ground covered in our post-NOC operational playbook.

What must a business already providing services do now?

Apply within six months of commencement, or stop. Section 70(1) of the Act is unambiguous on the obligation and blunt on the alternative:

“Any Person providing Virtual Asset Services immediately before the commencement of this Act shall, within six months of such commencement, apply to the Authority for a license under this Act or shall cease to provide such services.”

Section 70(2) then provides limited cover for those who file. A person who has submitted a complete application may continue to provide existing services, provided they fully comply with any interim directives issued by the Authority and continue to adhere to the core obligations of the Act, “particularly regarding customer asset protection under AML, CFT and CPF”.

Three practical observations. First, the protection attaches to a complete application — an incomplete filing is not a shield, which is why document readiness matters more than speed. Second, the words “existing Virtual Asset Services” mean the window is not an opportunity to launch new lines; scope creep during the transition is a self-inflicted enforcement risk. Third, section 70(2) is drafted as “within six months” without stating whether the safe harbour ends at six months or continues until the application is determined. Our reading is that the intent is continuity pending determination, but the text does not say so, and this should be confirmed with the Authority.

The consequence of getting this wrong is set out in section 54(1):

“Whoever, willfully, provides an unlicensed Virtual Asset Service shall be punishable with imprisonment for a term up to five years, or with fine up to fifty million Rupees, or with both.”

Note also section 50, which requires both incorporation in Pakistan under the Companies Act, 2017 and a valid PVARA licence. Incorporation alone is not a defence, and a licence cannot be held by a foreign entity — which is why SECP registration and corporate setup sit at the front of any credible sequence. Where the business model is genuinely novel, the sandbox route under section 35 may be the better first step.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, the PVARA No Objection Certificate Regulations and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.