What a VASP Licence Actually Permits Under the Act

A licence under the Virtual Assets Act 2026 is not a general permission to operate a crypto business in Pakistan. Section 21(3) scopes it precisely — a licensee is authorised to undertake the specific virtual asset services named in its own licence, nothing more — and gives that licence an open-ended term rather than a fixed expiry date. Both features shape how a licensee should think about its authorisation from day one.

What exactly does section 21(3) say?

The provision reads: “A license granted to a Virtual Asset Service Providers shall specify the Virtual Asset Services that it is permitted to undertake and shall remain in force unless suspended or revoked.” Two separate rules sit inside that sentence: a scoping rule, and a duration rule.

Why is a VASP licence scoped service by service, not blanket?

Because the Act requires every licence to name the specific virtual asset services the holder may carry on. Schedule I to the Act lists ten categories of virtual asset service: advisory services, broker-dealer services, custody and administration services, exchange services, lending and borrowing services, virtual asset derivatives services, virtual asset management and investment services, virtual asset transfer and settlement services, virtual asset issuance services, and mining-related virtual asset services.

A licensee authorised for exchange services is not, by virtue of that licence alone, authorised to also offer custody, lending or derivatives — each of those sits in a different Schedule I category, and section 21(3) requires the licence itself to specify which ones apply. This has a direct practical consequence: a business planning to expand its service line-up in Pakistan needs a licence that names the new category, not an assumption that a broad existing licence already covers it.

Feature of section 21(3)	Practical meaning
“shall specify the Virtual Asset Services”	The licence document itself lists exactly which Schedule I categories are permitted
No blanket authorisation	Services outside the licence’s stated scope are not covered by it
Expansion requires updating the licence	Offering a new category is not addressed by the existing document alone

Does a licence expire, or does it run indefinitely?

It runs indefinitely, subject to two exceptions. Section 21(3) states the licence “shall remain in force unless suspended or revoked” — there is no fixed term, renewal date or automatic expiry built into the provision itself. The only two ways a licence stops being in force are suspension and revocation, both of which are governed by section 23, not by the mere passage of time.

This sits alongside an apparent tension worth noting directly: section 22(f) requires a licensee to “pay such supervision, renewal or other fees as may be prescribed” as an ongoing obligation. The Act does not explain how a “renewal” fee interacts with a licence that has no fixed term to renew. Our reading is that “renewal” here most plausibly refers to a periodic fee obligation rather than a literal re-issuance of the licence, but the Act does not state this explicitly, and this is a genuine ambiguity rather than a settled point.

What can bring a licence to an end?

Section 23(1) lists the grounds on which PVARA may vary, suspend or revoke a licence, after written notice and an opportunity to be heard:

• The licensee has contravened the Act, another applicable law, or any term or condition of its licence.
• The licensee is insolvent or no longer satisfies the fit and proper criteria.
• The licensee has ceased to carry on the virtual asset service for which it is licensed.
• Action is necessary or expedient in the public interest, including consumer protection, market integrity, or financial stability.
• The licence was obtained by fraud, misrepresentation, or concealment of material facts.

Where a licence is revoked, section 23(2) requires the licensee to immediately stop providing virtual asset services, and allows PVARA to notify the Securities and Exchange Commission of Pakistan (SECP) to begin winding-up or dissolution proceedings under the Companies Act 2017.

What happens if a licensee provides a service its licence does not cover?

The Act does not address this scenario expressly within section 21(3) itself. What is clear from elsewhere in the Act is that section 50 prohibits any person from engaging in virtual asset services in or from Pakistan without holding “a valid license granted by the Authority” — and since section 21(3) ties a licence’s validity to the specific services it names, our reading is that providing a Schedule I service outside a licence’s stated scope carries real exposure under section 50 and the criminal penalty in section 54(1) for wilfully providing an unlicensed virtual asset service. This is our inference from reading the two sections together, not a conclusion the Act states outright, and a licensee planning to add a new service line should treat it as a licensing question for PVARA, not an operational decision to make unilaterally.

Can a licensee challenge a suspension or revocation?

Yes. Section 62 establishes a Virtual Assets Appellate Tribunal, and section 63 gives any virtual asset service provider, licensee, or other person aggrieved by a PVARA order the right to appeal to the Tribunal within thirty days of the date the order was communicated. Section 64 sets out the appeal process itself, including the documents and fees required, and requires the Tribunal to decide the appeal within three months of it being filed. The Tribunal is treated as a civil court for the purposes of the appeal, with powers to compel attendance, demand documents and examine witnesses, and its determinations carry the same force as a civil court decree. A further appeal from the Tribunal’s decision lies to the Supreme Court of Pakistan, within thirty days of that decision.

This means that suspension or revocation under section 23, which directly ends or narrows what a licence in force under section 21(3) permits, is not the final word — a licensee that considers PVARA’s decision wrong in law or in fact has a defined route to challenge it, on a fixed and relatively fast statutory timeline, rather than being left with revocation as an unappealable outcome.

Where can the public check what a licence actually covers?

Section 21(4) requires PVARA to “maintain and publish an up-to-date register of Licensees on its official website,” containing at minimum the name, licence number, permitted services and current regulatory status of each licensee. This register is the practical answer to “what is this VASP actually licensed to do” — rather than relying on a company’s own marketing, the register ties directly back to the scoping rule in section 21(3), since “permitted services” is one of the fields PVARA is required to publish.

For a counterparty, bank, or customer assessing whether a Pakistani virtual asset service provider is operating within its licence, checking the published register against the specific service being offered is the direct route to an answer, rather than assuming a “VASP licence” is a single uniform status.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act 2026 as passed by the National Assembly — principally section 21(3) and (4), Schedule I, and sections 22, 23, 50 and 54 — read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.