Who Needs a PVARA Licence in Pakistan?

The licensing question is the first one every operator asks, and it is the one most often answered badly. The answer is not “anyone doing crypto.” It is a structured test with three moving parts: whether you are providing a listed service, whether you are doing so as a business, and whether you are doing so in or from Pakistan.

Get any one of those wrong and you either build a compliance programme you did not need, or you commit an offence carrying up to five years’ imprisonment.

This article works through the test as the Virtual Assets Act, 2026 sets it out, and identifies the exemptions that are written into the statute rather than inferred from it.

Who needs a PVARA licence?

Under section 50(1) of the Virtual Assets Act, 2026, any person who, by way of business, engages in or represents themselves as engaging in any Virtual Asset Service in or from Pakistan must be both a company incorporated in Pakistan and the holder of a valid licence granted by PVARA. Both conditions must be met, not one.

PVARA is the Pakistan Virtual Assets Regulatory Authority, established under section 6 of the Act as the body responsible for licensing, regulating and supervising virtual asset service providers and issuers.

“No Person shall, by way of business, engage in, or represent themselves as engaging in, any Virtual Asset Services in or from Pakistan, unless that Person:- (a) is a company incorporated under the Companies Act, 2017 or any other law for the time being in force in Pakistan governing the incorporation of companies; and (b) holds a valid license granted by the Authority under this Act.”

— Virtual Assets Act, 2026, section 50(1)

Note the structure. A licensed foreign company is not compliant, because it fails limb (a). A Pakistani company without a licence is not compliant, because it fails limb (b). The Act requires a Pakistani corporate vehicle holding a Pakistani licence.

What is the three-part test for licensability?

A business needs a licence where all three of the following are true: it provides at least one service listed in Schedule I to the Act; it does so as a business, on a professional basis; and it does so in or from Pakistan. Failing any one limb takes the business outside the licensing requirement.

The three limbs come from different sections and must be read together:

1. The service limb. Section 18 provides that Virtual Asset Services are those specified in Schedule I, plus any other service notified by the Federal Government and subsequently added to Schedule I. Schedule I lists ten categories.
2. The business limb. Section 3(1)(xxxiii) defines a Virtual Asset Service Provider as “any Person who, as a business, provides one or more Virtual Asset Services to third parties on a professional basis.” A one-off, non-professional, or purely personal activity does not meet this.
3. The territorial limb. Section 2(1)(a) applies the Act to a provider carrying on, or holding itself out as carrying on, a service “in or from Pakistan.”

The words “holds itself out” in section 2(1)(a) and “represent themselves as engaging in” in section 50(1) are significant. Marketing a service you do not yet provide can bring you within scope.

Which ten services require a licence?

Schedule I to the Act lists ten categories of virtual asset service. Each is defined in the Schedule itself, and several carry express exemptions within the definition.

#	Service category	Core trigger
1	Advisory Services	Personalised recommendations to a specific customer
2	Broker-Dealer Services	Arranging or facilitating orders, accepting orders and consideration, proprietary trading, market-making using customer assets, placement or distribution for issuers
3	Custody and Administration Services	Safekeeping of virtual assets or of private keys on behalf of customers
4	Exchange Services	Crypto-to-fiat, crypto-to-crypto, order matching and execution, maintaining an order book
5	Lending and Borrowing Services	Facilitating, arranging, intermediating or directly providing virtual asset lending
6	Virtual Asset Derivatives Services	Offering, facilitating, executing, clearing, trading or arranging derivatives transactions
7	Management and Investment Services	Fiduciary or agency management of another person’s virtual assets, including discretionary staking
8	Transfer and Settlement Services	Transfer, transmission or settlement between parties or wallets on behalf of customers
9	Issuance Services	Creation, issuance, initial offering, administration and ongoing management of virtual assets
10	Mining-related Services	Mining operations providing services to third parties involving customer assets or funds

Section 18(b) allows the Federal Government to notify further services, which are then added to Schedule I. The list is therefore expandable by executive action rather than requiring fresh primary legislation.

Who is exempt from licensing?

Three exemptions are written expressly into the statutory text: pure proprietary trading, pure mining for one’s own account, and the provision of non-custodial software or hardware. Each is a defined carve-out within the relevant definition, not a general discretion.

Proprietary trading. The exemption to Schedule I item 2 states that a person dealing solely on its own account, which does not execute orders on behalf of customers and does not hold or control customer assets, is not carrying on broker-dealer services. All three conditions must hold. Adding a single customer order, or taking custody of a single customer’s assets, removes the exemption.

Pure mining. Section 37(2) provides that pure mining, by itself, does not constitute a virtual asset service requiring a licence under section 18 and Schedule I. But the same subsection provides that mining operations involving customer assets or funds shall be treated as virtual asset services and require licensing. Section 37(3) separately allows PVARA to establish a registration or declaration framework for mining operators exceeding thresholds of scale, energy use or hash rate — so a miner may be registrable even while remaining unlicensable.

Non-custodial software. Schedule I item 3 excludes “the mere provision of software, hardware or infrastructure that enables a customer to retain exclusive control over their own private keys.” The operative word is exclusive. A wallet provider that retains any means of access is likely to be providing custody.

A fourth carve-out sits in the definition of Issuer at section 3(1)(xiii). Its Explanation states that a person is not an Issuer solely because it markets, advertises, promotes, facilitates secondary-market trading, or provides technical development or maintenance services without control over issuance, supply or reserve assets.

Does the Act reach offshore businesses?

Yes. Section 2(1) applies the Act to services carried on “in or from Pakistan,” which captures an offshore provider serving Pakistani customers. Section 4(1) allows PVARA to exercise its powers extraterritorially to the fullest extent permitted by law for the purposes of investigation and enforcement.

The precise boundary is not yet drawn. Section 4(2) requires PVARA to prescribe, by Regulations, the conditions under which a virtual asset service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to persons in Pakistan. Those Regulations are the instrument that will determine whether, for example, a globally accessible website with Pakistani users is caught.

Until they are published, the position is unsettled. What is clear is the enforcement toolkit already available. Section 61(1) allows PVARA to block or direct the blocking of websites, applications, advertisements and payment links relating to unlicensed services, and section 61(2) allows those directions to be issued to telecommunication authorities, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars and payment providers.

Section 4(3) requires PVARA to align its extraterritorial enforcement practices with mutual legal assistance treaties and international cooperation frameworks, including those of the Financial Action Task Force and the International Organization of Securities Commissions.

What should you do if you are unsure?

Two provisions matter if your classification is genuinely uncertain, and they point in opposite directions.

Section 9(1)(f) empowers PVARA to assess, determine and classify any virtual asset, service, activity, offering, issuer or service provider based on its substantive features, underlying function, method of use or economic effect — “irrespective of the nomenclature, structure, or designation assigned to it.” Structuring around a label will not work. Where the asset exhibits characteristics falling within the mandates of the State Bank of Pakistan or the Securities and Exchange Commission of Pakistan, PVARA must consult them.

Section 35(3), by contrast, allows PVARA to issue guidance, no-objection statements or no-action communications in accordance with Regulations. This is the constructive route for a genuinely novel model, and it sits alongside the regulatory sandbox established under section 35(1).

In practice, the questions worth answering before you conclude you are out of scope are:

• Do you hold, or can you technically access, any customer asset or private key?
• Do you accept orders, consideration or instructions from any third party?
• Do you make recommendations that take account of a specific person’s circumstances?
• Do you market to, or accept users from, Pakistan?

A yes to any of these makes the exemptions harder to sustain. Our reading is that the exemptions in the Act are drafted narrowly and conjunctively, and should be treated as narrow.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, including Schedule I, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.