Most sandbox rejections are not mysterious. The PVARA Sandbox Guidelines 2026 name the specific signals that count against an application, in the same self-assessment checklist that names what counts in its favour. This piece works through those negative indicators, the procedural limit on fixing an incomplete submission, and what can happen to an approval after it has already been granted.
Read alongside our companion piece on the eight self-assessment questions, this is the failure side of the same document.
What are the named negative indicators in the sandbox self-assessment?
Annexure-A of the Sandbox Guidelines pairs each of its eight key questions with specific negative indicators, not vague warnings. The table below lists each one exactly as it appears in the Guidelines.
| Key question | Negative indicator |
|---|---|
| Scope | Not related to Virtual Asset Services or the related eco-system |
| Business Scalability | Weak or stagnant user adoption; reliance on niche or unsustainable demand (e.g. speculative hype only) |
| Technology & Security | Weak cybersecurity indicators, no audits, or reliance on unverified smart contracts; lack of safeguards to ensure custody of consumer’s funds in case of cyber intrusions |
| Genuine Innovation | Numerous similar models already exist in Pakistan; minor tweaks to an existing product/services or business model related to virtual assets |
| Consumer & Investor Benefit | Limited transparency, cost inefficient; poses high risks of consumer loss or market instability; no clear risk mitigation strategies (e.g. for hacks, price manipulation, or data privacy) |
| Readiness | No clarity on compliance with ML/TF, KYC, cybersecurity, or custody rules; lack of technical or financial readiness; no consumer protection measures in place; concept only on paper yet |
| Genuine Need for Sandbox | Live testing not necessary to answer regulatory or market questions |
| ML/TF & Compliance Preparedness | Weak or no AML/KYC framework; high risk of misuse for money laundering, terrorism financing, or fraud |
Several of these indicators describe genuinely different failure modes even within the same row. Under Business Scalability, for instance, “weak or stagnant user adoption” is a product that has not found demand, while “reliance on niche or unsustainable demand” is a product that has found the wrong kind of demand — hype that will not survive the testing period. An applicant preparing a submission should treat each negative indicator as a separate question, not a single box to avoid.
Which negative indicator is the most common reason applications fail?
The Guidelines do not rank the eight questions or state which negative indicator is most frequently the deciding factor — that information is not published, and this analysis does not speculate on it. What the text does make clear is that “concept only on paper yet,” under Readiness, is stated in unusually blunt terms compared with the other indicators. Where most negative indicators describe a weakness in an otherwise real proposition — weak adoption, an incomplete security programme — this one describes the absence of an operating plan altogether: no testing plan with objectives, success criteria, timelines, and risk controls actually prepared, as the positive indicator for the same question requires.
What happens if an application is submitted incomplete rather than rejected on the merits?
Incompleteness is treated separately from a substantive rejection under the Guidelines’ Application submission process. That section is direct about the consequence: “Incomplete applications will be returned with a request for revisions, with up to two resubmissions permitted.” This gives an applicant three attempts in total to submit a complete application — the original submission plus two resubmissions — before the practical route back into the process is exhausted. The Guidelines do not state what happens after a second resubmission is also returned incomplete, and that gap is not filled elsewhere in the text as published.
This limit applies to completeness of the submission — the presence of all required documents and information specified in the Guidelines — rather than to the substantive merits of the proposition. An application that is complete but weak on, say, Genuine Innovation is not covered by the two-resubmission mechanism in the same way; it proceeds to the Assessment Phase and is judged on the Key Evaluation Criteria rather than being returned for a documentation fix.
Can a sandbox approval be withdrawn after it has already been granted?
Yes. Approval is not a fixed status once the Letter of Approval is issued. The Guidelines’ Suspension or revocation of approval section gives the Authority two distinct powers, both triggered by the same underlying test: “where Authority has possible reasons to believe that the participant has failed to adhere to the details agreed or the conditions imposed during the review and selection stage.” That trigger — failure to adhere to agreed details or imposed conditions — is broader than a single named negative indicator; it reaches back to whatever the participant committed to at approval, including the testing plan, KPIs, and risk controls described in Form I.
What is the difference between suspension and full withdrawal of approval?
The Guidelines set out two separate responses, graded by severity:
- Temporary suspension — the Authority “can temporarily suspend the testing and approval until the matter in question has been fully clarified.” This is framed as a holding measure pending clarification, not a final outcome.
- Complete withdrawal — the Authority “can completely withdraw the approval with a public notice in case a serious discrepancy has been observed related to consumer detriment or any other serious matter.” Withdrawal is reserved for a “serious discrepancy,” and the Guidelines specifically name consumer detriment as one trigger for it, alongside an open-ended “any other serious matter” that is not itself defined.
The public notice requirement attached to full withdrawal is a meaningful distinction from suspension, which carries no equivalent publicity requirement in the text. In our reading, this signals that withdrawal is treated as a matter of public record in a way that a temporary, clarification-pending suspension is not.
Does a mid-testing failure connect back to the original self-assessment?
The Guidelines do not draw this connection explicitly, but the substance overlaps closely. A participant suspended or withdrawn for consumer detriment, for example, is likely to be failing the same Consumer & Investor Benefit indicators — “poses high risks of consumer loss,” “no clear risk mitigation strategies” — that Annexure-A asks an applicant to self-assess before ever submitting Form I. Where the Completion Report and ongoing testing-period reporting required by the Guidelines surface the same weaknesses the self-assessment was designed to catch early, that is, in our reading, the self-assessment checklist failing to do the job it was designed for, rather than a separate category of failure.
Related reading
- PVARA Exchange License: Capital, Rules & Obligations 2026
- PVARA Transfer & Settlement License: Crypto Payments 2026
- PVARA Licensing Process: NOC to Full Licence, Step by Step
- The PVARA Licensing Gold Rush: Pakistan’s Crypto Frontier
- PVARA Custody License: Safeguard Customer Crypto 2026
- goAML Registration for VASPs: Who Registers, and When
- PVARA Management & Investment License: Crypto Funds 2026
- The Virtual Assets Act 2026, Section by Section
About this analysis
This analysis was prepared by the CoinConnect research desk from the PVARA Sandbox Guidelines 2026, principally the Annexure-A self-assessment checklist, the Application submission process section, and the Suspension or revocation of approval section, read as published. Where the Guidelines do not rank the negative indicators by frequency or state a consequence for a second failed resubmission, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect