Pakistan crypto exchange licence (PVARA): the technical requirements

A crypto exchange serving people in Pakistan needs a licence from the Pakistan Virtual Assets Regulatory Authority (PVARA) under the Virtual Assets Act, 2026. Section 50 bars anyone from providing virtual asset services in or from Pakistan unless it is a company incorporated in Pakistan holding a PVARA licence; section 54 makes wilful unlicensed service punishable by up to five years in prison, a fine of up to PKR 50 million, or both. The detailed rules arrived on 21 August 2026: the Pakistan Virtual Asset Services Regulations, 2026 (S.R.O. 1419(I)/2026) and the Activity Specific Regulations, 2026 (S.R.O. 1420(I)/2026).

This article maps the system requirements to a control, the evidence PVARA may review and a likely owner. It is a technical reading, not legal advice. “s.” refers to the Act, “Reg.” to the Services Regulations, “Custody Reg.” and “Exchange Reg.” to the Activity Specific Regulations.

From the Virtual Assets Ordinance to the 2026 Act: where does the regime stand?

Date	What happened
6 April 2018	SBP’s BPRD Circular No. 03 of 2018 tells banks and payment operators to refrain from dealing in virtual currencies
14 March 2025	Pakistan Crypto Council launched under the Finance Minister, with the SBP governor and SECP chairman on its board
8 July 2025	Virtual Assets Ordinance, 2025 promulgated; PVARA created
12 December 2025	NOCs to Binance and HTX under the NOC Regulations 2025, “not a blanket approval” according to PVARA’s chairman
27 February 2026	Senate passes the Virtual Assets Bill, 2025, after extending the Ordinance once
6 March 2026	The National Assembly’s acts list dates the Virtual Assets Act, 2026 (Act No. XIII of 2026); section 1(3) puts it in force at once. We could not open the Gazette copy, so confirm the assent date with counsel
April 2026	SBP’s BPRD Circular Letter No. 10 of 2026 replaces the 2018 circular for PVARA-licensed firms: 14 April per PVARA and Dawn, 21 May on the SBP page
21 August 2026	Both regulations notified after a June consultation; application portal opens
5 September 2026	NOC deadline for firms operating on or before 5 March 2026
13 October 2026	PVARA’s chairman reports 75 applications

Section 70 gives anyone providing virtual asset services immediately before the Act six months to apply or cease; PVARA’s licensing page states it as: “Transitional Persons — operating since March 5, 2026 or before, must submit an NOC application by September 5, 2026, or cease operations.” A transitional firm that filed a complete NOC application may continue its existing services while PVARA decides, under interim directives and with prior approval for any marketing (Reg. 5A); for a new entrant, an NOC authorises no service (Reg. 6(4)). We found no extension notice. PVARA’s news page carried nothing newer than December 2025 on 2 November 2026; the chairman spoke of about 70 applications on 11 September and of 75 on 13 October 2026, calling licensing “the next priority”. The FAQ promises a public register of licensees; we found none.

Who regulates what?

• PVARA licenses and supervises. Its board includes the SBP governor, the SECP chairperson and the chairman of the National AML/CFT Authority (s. 7). Appeals go to a Virtual Assets Appellate Tribunal within 30 days (ss. 62, 64). Advisory PVARA/ADV/001/2026 of 26 April 2026 requires prior authorisation for any pilot or partnership that enables virtual asset services in Pakistan.
• The State Bank of Pakistan kept banks away from crypto from 2018. Circular Letter No. 10 of 2026 lets banks open accounts for PVARA-licensed VASPs after verifying the licence, with separate Client Money Accounts: rupee-denominated, non-remunerative, no cash, never collateral. NOC holders get limited-purpose accounts only. Virtual assets are not a means of payment for domestic commerce without SBP approval (Reg. 3(6)).
• The SECP registers the company; securities, derivatives and collective investment schemes stay outside the Act (s. 2(2)(b)). Its 2020 position paper and 2020 directive on virtual currencies predate PVARA.
• The FMU receives suspicious transaction reports through goAML; licensees are deemed financial institutions under the Anti-Money Laundering Act, 2010 (s. 46).

Which licence, and how much capital?

Schedule I to the Act lists ten categories; the Regulations split token issuance in two, so PVARA’s licensing page shows eleven. A licence covers only the categories it names (Reg. 5(4)). Minimum paid-up capital (Services Regulations, Schedule I), at PKR 276.75 to the dollar on 30 October 2026:

Category	Paid-up capital (PKR)	About (USD)
Exchange; Lending and Borrowing; Derivatives; Mining-related	500,000,000 each	1.81 million
Fiat- or Asset-Referenced Token Issuance	300,000,000 each	1.08 million
Custody; Management and Investment; Transfer and Settlement	200,000,000 each	723,000
Broker-Dealer	75,000,000	271,000
Advisory	15,000,000	54,000

Capital must be maintained at all times; PVARA sets the treatment of combined categories (Reg. 31). Net liquid assets must cover 1.2 times adjusted monthly operating expenses (Reg. 32). Professional indemnity and commercial crime insurance must be in force before regulated activity starts (Reg. 36). Fees are “as published in the Rules” (Reg. 11); on 2 November 2026 we found no fee schedule.

An exchange that holds customers’ keys should ask counsel whether it also needs the Custody category: Exchange Reg. 15 applies the custody safeguarding rules to client assets held “on a standalone or incidental basis”, while the Act’s custody definition excludes software that leaves the customer in exclusive control of their own keys.

How do you apply?

1. NOC to licence (Track B). A new entrant applies for a No-Objection Certificate before incorporating (s. 19(1)); a transitional firm filed the same application under Reg. 5A. PVARA decides within 60 days of a complete application; the NOC lasts three months, extendable once by three (Reg. 6). The applicant then incorporates, registers with the FMU and applies for the licence within the NOC’s validity; PVARA decides within 90 days of confirming in writing that the file is complete, extendable by 60 (Reg. 7). Both applications use Form I.
2. Sandbox to licence (Track A). Under section 35 and the Sandbox Guidelines 2026: evaluation within 60 working days, a Letter of Approval with limits set case by case, a completion report and a possible no-action letter. A participant that completes testing may apply for a licence without an NOC (Reg. 7(6)).
3. Holders of a 2025 NOC apply directly for a licence (Reg. 7(7)).

Every licensee is a Pakistani company with at least three directors, a third of them independent unless PVARA allows otherwise, a registered office in Pakistan and a resident key individual with decision-making authority (s. 20(6); Regs. 10(4), 20). Directors and the managing director need PVARA’s approval before taking office; fit-and-proper tests reach controllers at 20%, sponsors and ultimate beneficial owners (Schedule II). Full foreign ownership is allowed.

Form I’s business plan must state the custody model, in the form’s own words “self-custody (Applicant-controlled keys)”, third-party or hybrid, with omnibus or segregated wallets, and where onboarding, monitoring, key management and support are performed. Part F lists 35 documents, from a Technology Infrastructure Design and a Key and Wallet Management Policy to a Wind-Down Plan, and Travel Rule controls are demonstrated “during licensing” (Reg. 100(9)).

What controls and evidence will PVARA look for?

The first column paraphrases the requirement with its citation. The other columns are our implementation recommendation, drawn from building exchange, wallet and custody software that has run in production since 2024 and from technical files prepared for licence applications. They are not legal requirements. “Operator” is the licensed company and the role inside it; “vendor” is what the software supplier should deliver.

Requirement (citation)	Control in the platform	Evidence	Owner
Customer assets segregated and outside the insolvency estate; no lending, pledging or staking without explicit, revocable written consent (s. 24; Regs. 33, 109; Custody Regs. 5, 11)	Separate client and house wallets; ledger tags; consent flag per client	Wallet map; consent records	Operator: CTO, compliance; vendor: wallet structure, consent gating
Client money in designated accounts at an SBP-licensed bank, paid in by the next business day, reconciled daily where it moves daily (Regs. 104–107; SBP Circular Letter No. 10)	Bank statement import; three-way reconciliation	Reconciliation reports; bank’s acknowledgement	Operator: finance; vendor: import and reconciliation
Client virtual assets reconciled daily, unresolved discrepancies reported after 24 hours; cryptographic proof of reserves validated independently every six months; annual audit of segregation (s. 27; Regs. 87(3), 111, 112; Custody Reg. 9)	Ledger-against-chain reconciliation per asset; signed liability snapshot with on-chain balances	Daily reports; break log; validation reports	Operator: treasury, finance; vendor: reconciliation and export
Key management with documented approvals, segregation of duties for signers and auditable key access; custodians: hot, warm and cold tiers, most client assets offline “where appropriate”, MPC or multisig, no single person or system able to move client assets, backups apart from keys (Reg. 61; Custody Regs. 7–8; s. 40)	M-of-N approvals by amount band; hot ceiling per asset; whitelists with delays; signer revocation	Key and Wallet Management Policy; ceremony records; approval logs	Operator: CISO; vendor: policy engine, tiers
Board-approved cybersecurity policy filed at licensing; an Information Security Officer or CISO; penetration tests at appropriate intervals and after material changes; independent review of material smart contracts (Regs. 58(7), 59, 62, 66)	2FA on every console role; deny-by-default permissions; test calendar tied to releases	Policy; test reports; remediation status	Operator: CISO; vendor: controls, supports testing
Tested BCDR plan with disaster-recovery sites and contingency for chain and banking-rail outages; cyber or BCDR events notified within 24 hours, updated within five working days, final report within 30 days (Regs. 65, 67; Exchange Reg. 17)	Standby site; encrypted backups; timed restore drills; incident register with clocks	Drill report; incident register	Operator: CTO, CISO; vendor: standby design
Records for seven years or the AML Act period, whichever is longer, including order and trade data; secure reporting channels and, where required, automated interfaces for PVARA; monthly disclosure of liquidity sources (s. 48; Regs. 10, 86, 88, 102; Exchange Reg. 21)	Append-only store with addresses, hashes and timestamps; read-only regulator role; reports from the ledger	Retention policy; restore test; report samples	Operator: CTO, compliance; vendor: log, export, reports
Surveillance for wash trading, spoofing and layering; orders beyond price and volume thresholds rejected; halts; settlement within 24 hours unless an alternative cycle is notified; listing “without prior product approval by the Authority” against published standards; section 53, “Prohibition on Algorithmic tokens” (Regs. 57, 63; Exchange Regs. 6, 9–11, 13, 16–18)	Self-trade prevention; surveillance alerts; price collars; halts; settlement clock; listing file per asset	Alert register; halt log; listing assessments	Operator: compliance; vendor: matching engine, surveillance, asset registry
CDD, STRs to the FMU via goAML, an MLRO, sanctions screening; Travel Rule from the PKR equivalent of USD 1,000 with originator and beneficiary data, unhosted-wallet controls and annual counterparty due diligence (ss. 46, 47; Regs. 93, 98–101)	KYC before deposits; name and address screening; withdrawal held until Travel Rule data is sent; counterparty register	KYC decision log; screening hits; message and rejection logs	Operator: MLRO; vendor: tiers, hooks, capture and export
Principal activity and core custody functions not outsourced; wallet-infrastructure providers only in a support role, regulated somewhere acceptable to PVARA, with SOC 2 Type II or equivalent; prior approval for critical functions; register (Regs. 10(5)–(6), 37–43; Custody Reg. 15)	Third-party register: hosting, KYC, analytics, software vendor	Register; agreements	Operator: CEO; vendor: supplier terms

Where may data and servers live?

The texts we read set no general rule to host servers in Pakistan. Section 39 lets a licensee store or process data abroad, subject to data-protection, cybersecurity and cross-border transfer laws and to safeguards “as shall be prescribed by Regulations”, while PVARA may require localisation of specific datasets for national security, financial stability, consumer protection or enforcement. Regulation 60(3) repeats the permission; we found no prescribed safeguards yet. Hosting abroad is an outsourcing arrangement to register, with PVARA’s access to information preserved (Reg. 37(2)(d)): a question for counsel, not a prohibition.

What should the software hand the applicant ready-made?

The legal half of the file is yours and your counsel’s; what regulators ask for explains the technical sections. For PVARA, the applicant should be able to produce:

1. A system description with environments, data flows, third parties and hosting locations, so the Technology Infrastructure Design, the outsourcing register and Form I cite the same facts.
2. A key-management and wallet-tier design that no single person can defeat, with split backups and signer revocation. Our custody software is self-hosted only, with M-of-N approvals, whitelists with delays and ledger-against-chain reconciliation.
3. Proof-of-reserves exports an auditor can re-run for the six-monthly validation under Regulation 112.
4. Exchange controls: pre-trade thresholds, surveillance alerts, halts, a 24-hour settlement clock and per-asset disclosure data; see the exchange software and the compliance page.
5. AML and Travel Rule plumbing: KYC tiers, screening hooks, withdrawal holds until Travel Rule data is sent, and an export for your Travel Rule provider; see what to do when the counterparty cannot receive.
6. A deployment that fits the outsourcing chapter. The deployment page lists the self-hosted options; for Pakistan plan on hardware or a cloud account you control, and register the hosting provider either way.

What should an operator do now?

1. Settle your status with counsel. If you served Pakistani customers before 5 March 2026 and did not file by 5 September 2026, section 50 applies now.
2. Open the bank conversation early; the Client Money Account terms shape your fiat ledger.
3. Write the Key and Wallet Management Policy against Custody Regulations 7 and 8, then prove it with a ceremony record and approval logs.
4. Run one daily reconciliation and one proof-of-reserves export before PVARA asks.
5. Rehearse an incident against the 24-hour, five-day and 30-day clocks.

Pakistan PVARA licence FAQ

What are the PVARA licence requirements for a crypto exchange?

A company incorporated in Pakistan with at least three PVARA-approved directors, a third of them independent, PKR 500 million of paid-up capital, net liquid assets of 1.2 times monthly operating expenses, insurance, a registered office and a resident key individual, FMU registration, and the 35 Form I documents, including the policies in the table above.

How much capital does a Pakistan crypto exchange licence require, and what are the fees?

Paid-up capital is PKR 500 million, about USD 1.8 million at end-October 2026 rates; Custody is PKR 200 million and Broker-Dealer PKR 75 million. Capital is not a fee: fees are to be published in Rules, and we found none on 2 November 2026.

What is the difference between a PVARA NOC and a licence?

An NOC is a preliminary approval to incorporate and register with the FMU; it lasts three months and, for a new entrant, permits no service. The licence follows a separate application decided within 90 days of completeness. Firms operating before the Act may continue only if they filed a complete NOC application by 5 September 2026.

Has PVARA issued any licences yet?

On 2 November 2026 we found no public announcement of a licence granted and no register of licensees on pvara.gov.pk. Binance and HTX hold NOCs from December 2025, and PVARA’s chairman reported 75 applications on 13 October 2026.

What happened to the Virtual Assets Ordinance, 2025?

The Ordinance of 8 July 2025 created PVARA; the Senate extended it once, and parliament replaced it with the Virtual Assets Act, 2026 in March 2026. Section 74 preserves everything done under the Ordinance, including earlier NOCs and sandbox arrangements (Reg. 5A(4)).

How BitPolaris helps

BitPolaris builds the exchange, wallet and custody software, in production since 2024. The exchange has a 53-screen operations console with roles and an exportable audit log, KYC tiers with Sumsub or Didit, sanctions screening hooks and Travel Rule data capture with an export for your Travel Rule provider; it does not send Travel Rule messages itself. Custody is self-hosted only, across nine chains, with hot, warm and cold tiers, M-of-N approvals per asset and amount band, address whitelists with a 24-hour delay on new addresses, continuous ledger-against-chain reconciliation and signed proof-of-reserves exports. That supports a model in which the licensee operates the core custody functions itself; counsel assesses the treatment under Custody Regulation 15, including whether PVARA treats a software supplier as a wallet-infrastructure provider under 15(7). Our white-label cloud option for the exchange runs on EU servers; assess it under Regulations 37 to 43 and section 39.

The Licence Technical Pack covers the documents: Lite at €1,250 one-time, Pro at €6,300 one-time and Regulator Q&A at €1,450 a month, excluding VAT (1 November 2026). Pro maps MiCA, the Central Bank of Armenia, SPK and VARA as standard; a Pakistan scope has to be agreed with us before you buy. We are not a law firm and do not file applications; you and your counsel do. The pack is not an audit and does not replace the penetration tests, the proof-of-reserves validation or the annual audit. Installing our software does not make anyone compliant or licensed.

Sources

1. Virtual Assets Act, 2026, as passed by the National Assembly, PVARA copy, read 1 November 2026
2. National Assembly of Pakistan, Acts list: “The Virtual Assets Act, 2026 (Act No. XIII of 2026)”, dated 6 March 2026, read 2 November 2026
3. PVARA, Pakistan Virtual Asset Services Regulations, 2026, S.R.O. 1419(I)/2026, 21 August 2026, read 1 November 2026
4. PVARA, Pakistan Virtual Asset Services Activity Specific Regulations, 2026, S.R.O. 1420(I)/2026, 21 August 2026, read 1 November 2026
5. PVARA, No Objection Certificate Regulations 2025, effective 2 December 2025, read 1 November 2026
6. PVARA, Sandbox Guidelines 2026, read 1 November 2026
7. PVARA, Licensing, FAQ, Regulations and News pages, read 1 and 2 November 2026
8. PVARA, Public consultation PVARA/CON/001/2026, 11 June to 2 July 2026, read 1 November 2026
9. PVARA, Advisory PVARA/ADV/001/2026, 26 April 2026, read 1 November 2026
10. State Bank of Pakistan, BPRD Circular Letter No. 10 of 2026, read 2 November 2026; PVARA’s post and Dawn, 15 April 2026 date it 14 April 2026, while the SBP page carries 21 May 2026
11. State Bank of Pakistan, BPRD Circular No. 03 of 2018, 6 April 2018, read 2 November 2026
12. SECP, Position Paper: Regulation of Digital Asset Trading Platforms, November 2020, and Directive: Prohibited Dealing in Virtual Currencies/Tokens, August 2020, read 2 November 2026
13. Dawn, Pakistan Crypto Council officially launched, 15 March 2025, read 1 November 2026
14. Dawn, Digital asset drive gathers pace as SBP engages PVARA, 19 December 2025, read 1 November 2026
15. Dawn, Senate passes Virtual Assets Bill to formalise crypto regulator, 28 February 2026, read 1 November 2026
16. Arab News PK, Pakistan passes Virtual Assets Act 2026, 6 March 2026, read 2 November 2026
17. Arab News PK, Pakistan launches crypto testing framework, 20 February 2026, read 1 November 2026
18. Dawn, Crypto pilots need prior approval: PVARA, 28 April 2026, read 1 November 2026
19. Arab News PK, Pakistan launches licensing regime for virtual asset service providers, 22 August 2026, read 1 November 2026
20. Dawn, Crypto operators given September 5 deadline to seek NOCs, 23 August 2026, read 1 November 2026
21. Business Recorder, Pakistan’s virtual asset authority weighs withdrawing SBP’s crypto ban, 26 August 2025, read 1 November 2026
22. Geo News, Binance, HTX NOCs ‘not blanket approval’, says PVARA chief, 14 December 2025, read 1 November 2026
23. Business Recorder, 70 major global exchanges seek licences: Bilal, 11 September 2026, read 2 November 2026
24. Profit by Pakistan Today, 75 firms apply for virtual asset licences, 13 October 2026, read 2 November 2026
25. Business Recorder, Dollar’s rate in interbank market, 31 October 2026, read 1 November 2026
26. ABS & Co, Pakistan’s Virtual Assets Act, 2026: Legal Architecture of the PVARA Licensing Regime, 12 May 2026, read 1 November 2026
27. E-Square Legal, PVARA Licensing: NOC, Capital, Timelines, 8 October 2026, read 1 November 2026