What Is a VASP Under the Virtual Assets Act 2026?

The term VASP appears throughout Pakistan’s virtual asset framework — in the Act, in the No Objection Certificate Regulations, and in every form an applicant will file. It carries a precise statutory meaning, and that meaning determines who must be licensed.

The definition itself is one sentence. What makes it difficult is that three of its four components are undefined elsewhere in the Act, and the boundary in each case is drawn by exemptions scattered across Schedule I and section 37.

This article takes the definition apart limb by limb, then sets out what follows once a business falls inside it.

What is a VASP?

Under section 3(1)(xxxiii) of the Virtual Assets Act, 2026, a Virtual Asset Service Provider is any Person who, as a business, provides one or more Virtual Asset Services to third parties on a professional basis. All four elements must be present: a person, acting as a business, providing a listed service, to third parties, professionally.

“‘Virtual Asset Service Provider’ means any Person who, as a business, provides one or more Virtual Asset Services to third parties on a professional basis.”

— Virtual Assets Act, 2026, section 3(1)(xxxiii)

Two supporting definitions complete it. Section 3(1)(xxii) defines Person as a natural or legal person — so an individual can be a VASP, not only a company. Section 3(1)(xxxii) defines Virtual Asset Services as the categories set out in section 18, which in turn points to the ten categories in Schedule I.

Section 3(1)(xvi) then defines a Licensee simply as a person who holds a licence under the Act. VASP and Licensee are not synonyms: a VASP is a factual category, a Licensee is a status. An unlicensed VASP is still a VASP — it is just an offending one.

What does each limb of the test mean?

The four limbs operate as filters. A business falls outside the definition if it fails any one of them, and the exemptions in the Act are drafted to disapply specific limbs rather than the definition as a whole.

Limb	Source	What it excludes
A Person	s.3(1)(xxii)	Nothing — covers natural and legal persons
As a business	s.3(1)(xxxiii)	One-off, incidental or non-commercial activity
One or more Virtual Asset Services	s.3(1)(xxxii), s.18, Schedule I	Any activity not in the ten categories
To third parties	s.3(1)(xxxiii)	Activity conducted solely for oneself
On a professional basis	s.3(1)(xxxiii)	Casual or amateur provision

“As a business” is not separately defined. It is the limb that separates a commercial operation from private activity. Section 50(1) uses the same formulation — “by way of business” — when creating the prohibition, so the two provisions align.

“To third parties” is the limb that carries most of the statutory exemptions. The proprietary trading exemption in Schedule I item 2 and the pure mining exclusion in section 37(2) both operate by removing the third-party element.

“On a professional basis” overlaps with “as a business” but is not identical. The Advisory Services category in Schedule I item 1 uses the same phrase in its own definition, which suggests it is doing independent work: the recommendation must be given professionally, not merely commercially.

Who is a VASP and who is not?

A business is a VASP where it provides any Schedule I service to third parties as a commercial activity. It is not a VASP where it acts solely for its own account, mines for itself, or supplies only non-custodial technology. These three exclusions are written into the statute, not inferred.

The three statutory exclusions:

• Proprietary trading. The exemption to Schedule I item 2 states that a person dealing solely on its own account, which does not execute orders on behalf of customers and does not hold or control customer assets, is not carrying on broker-dealer services. All three conditions must hold simultaneously.
• Pure mining. Section 37(2) provides that pure mining, by itself, does not constitute a virtual asset service requiring a licence. The same subsection provides that mining involving customer assets or funds is a virtual asset service and does require licensing.
• Non-custodial technology. Schedule I item 3 excludes the mere provision of software, hardware or infrastructure that enables a customer to retain exclusive control over their own private keys.

A fourth exclusion applies to issuers rather than service providers. The Explanation to section 3(1)(xiii) states that a person is not an Issuer solely because it markets, advertises, promotes, facilitates secondary-market trading including third-party brokerage, distribution or exchange, or provides technical development or maintenance services, without control over issuance, supply or reserve assets.

Note what that Explanation does not do. It protects a person from being classified as an Issuer. It does not protect a person who facilitates secondary-market trading from being classified as a VASP — facilitating trading is broker-dealer or exchange activity under Schedule I in its own right. The two classifications are independent.

Is a VASP the same thing as an Issuer?

No. A VASP provides services to third parties under section 3(1)(xxxiii). An Issuer, under section 3(1)(xiii), originates or creates a virtual asset and retains primary control over its initial supply, reserve assets or on-chain governance. The Act regulates both, but through different provisions and different obligations.

Section 2(1) makes the split explicit. Subsection (a) applies the Act to VASPs carrying on a service; subsection (b) applies it to Issuers offering, originating or distributing a virtual asset on their own behalf.

The obligations differ accordingly:

Obligation	Applies to VASPs	Applies to Issuers
Licensing under s.50	Yes	Where providing Schedule I item 9 services
Customer asset segregation, s.24	Yes	Where holding customer assets
Whitepaper publication, s.42(1)	No	Yes, for public offerings
Reserve backing, s.31 and s.32	No	Yes, for FRTs and ARTs
Ongoing disclosure and reserve attestations, s.42(2)	No	Yes
AMLA 2010 obligations, s.46	Yes, deemed financial institutions	Yes, s.46(2) applies to both
Administrative sanctions, s.59	s.59(1)	s.59(2), with appropriate modifications

The categories are not mutually exclusive. An exchange that also issues its own token is both, and carries both sets of duties. Schedule I item 9 — Issuance Services — brings creation, issuance, initial offering, administration and ongoing management of virtual assets within the licensable perimeter, which means most issuers operating commercially will also require a licence.

What obligations attach once you are a VASP?

Falling within the definition triggers the full compliance stack: incorporation and licensing under section 50, the ongoing obligations in section 22, prudential and custody duties in Chapter 4, market conduct duties in Chapter 7, and anti-money-laundering duties in Chapter 8.

The immediate consequences are:

Corporate form. Section 50(1)(a) requires the VASP to be a company incorporated under the Companies Act, 2017 or another Pakistani incorporation law. Section 3(1)(xxii) permits a natural person to be a VASP as a matter of definition, but section 50 means a natural person cannot lawfully operate as one.

Local presence. Section 20(6) requires every licensee to maintain a registered office in Pakistan and to ensure that at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority.

Governance. Section 3(1)(xv) lists ten Key Individual positions, each subject to fit-and-proper assessment under section 20. Regulation 5.1 of the PVARA No Objection Certificate Regulations 2025 sets a list of eight for NOC applicants, which differs from the Act’s list — the two should be read together rather than treated as interchangeable.

AML status. Section 46(1) deems licensed VASPs to be financial institutions for the purposes of the Anti-Money Laundering Act, 2010, importing the full set of obligations under that Act. Section 46(2) requires every VASP and Issuer to report suspicious transactions to the Financial Monitoring Unit, maintain customer due diligence and transaction records, and establish internal controls including the appointment of an AML, CFT or CPF compliance officer.

Customer assets. Section 24 requires segregation at all times, removes customer assets from the insolvency estate notwithstanding any other law, imposes a fiduciary duty, and prohibits rehypothecation, lending or pledging without the customer’s explicit, informed and revocable written consent.

What happens if you operate as an unlicensed VASP?

Section 50(1) prohibits providing virtual asset services by way of business in or from Pakistan without both Pakistani incorporation and a valid licence. Section 54(1) makes wilful contravention punishable with imprisonment up to five years, a fine up to fifty million rupees, or both.

The exposure is not limited to prosecution. Three administrative powers operate independently of any criminal proceeding:

• Section 59 permits public censure, remedial directives, financial penalties, licence suspension or revocation, and disqualification from holding office in a licensee. Section 59(4) states a fine up to twenty-five million rupees for any contravention.
• Section 60 permits an order temporarily suspending specified virtual asset services or freezing related assets for up to thirty days, in the event of systemic threat, market manipulation, fraud, cybersecurity breach or other serious risk.
• Section 61 permits PVARA to block or direct the blocking of websites, applications, advertisements and payment links relating to unlicensed services, with directions issuable to telecommunication authorities, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars and payment providers.

Section 55 extends criminal liability to individuals. Where an offence is committed by a body corporate with the consent, connivance or neglect of any director, manager, secretary or similar officer, that person is deemed to have committed the offence.

For businesses already operating when the Act commenced, section 70(1) allows six months to apply for a licence or cease. Section 70(2) permits continued provision of existing services where a complete application has been submitted within that period, provided the person complies with any interim directives and continues to adhere to the core obligations of the Act, particularly on customer asset protection and AML, CFT and CPF.

In practice, the classification question is worth resolving early and in writing. Section 9(1)(f) allows PVARA to determine whether a person qualifies as a Virtual Asset Service Provider based on substantive features, underlying function, method of use or economic effect, irrespective of the designation the business has assigned itself. A self-classification that rests on how a service is described rather than what it does will not survive that provision.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, including Schedule I, and from the PVARA No Objection Certificate Regulations 2025, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.