PVARA Explained: What It Is, When It Was Formed and How Crypto Licensing Works in Pakistan

Why this guide exists

Three questions keep coming to me, in almost the same words.

What is PVARA? Is crypto legal now? And which app is “approved”?

The honest answer is that most of what you read online is either a news headline from last year or a 50 page guide written by lawyers for exchanges.

So I sat down with the Act, both sets of regulations and PVARA’s own website, and wrote the version I would give a student or a small founder: what PVARA is, when it was formed, how its licensing works step by step, and what it changes for you.

I am Muhammad Ismail. This guide is education, not legal, tax or financial advice. Everything here was read on the official documents on 10 November 2026, and the Act and regulations always win over any summary, including mine.

PVARA at a glance

Short on time? Here is the whole regulator in one table.

What is PVARA, in simple words?

Think of PVARA as the SECP or the State Bank, but for crypto.

Before it existed, nobody in Pakistan had the legal job of deciding who may run a crypto exchange, how customer coins must be kept, or what happens to a platform that cheats people. Now one authority does.

The Act says PVARA is a body corporate that is “autonomous in the performance of its functions”. On its website PVARA describes itself as responsible for “licensing, supervising, and regulating” virtual assets and virtual asset service providers.

Its powers under the Act include:

• issuing, changing, suspending and cancelling licences
• setting standards for capital, conduct, cybersecurity and data protection
• inspecting licensed companies on site and monitoring them off site
• imposing penalties and asking courts for civil or criminal remedies
• running a regulatory sandbox for new products
• working with foreign regulators and law enforcement

What counts as a “virtual asset”?

The Act defines a virtual asset as “a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes”.

Then it adds a line every Pakistani should remember: “Virtual Assets are not legal tender.” Bitcoin is not rupees, and no shop has to accept it.

What PVARA does not do

This is where most confusion starts.

• It does not approve coins. PVARA’s FAQ is direct: a notification about listing a token “does not constitute approval of the virtual asset”, and the exchange stays responsible for what it lists.
• It does not guarantee your money. A licence means a company met the entry rules. It is not insurance on your trade.
• It does not cover everything digital. The Act leaves out closed loop tokens that only work inside one app, and it leaves securities and other products that are already regulated under other laws to their own regulators.

When was PVARA formed? The full timeline

PVARA did not appear in one day. It took about 17 months from the first policy body to working licensing rules.

The ordinance date is reported by Profit, which notes that an ordinance lasts only 120 days. That is why an Act of Parliament was needed. Arab News reported the passing of the Act on Friday 6 March 2026, and crypto.news carried the state news agency’s report on the portal.

Quick fact: the Act says it “shall come into force at once”. Existing operators were given six months, which is where the 5 September 2026 deadline comes from.

Who runs PVARA?

A regulator is only as strong as the people on its board. Section 7 of the Act fixes who sits on it.

Members who are not there because of their office serve three years and can get one more term. The Authority must meet at least twice a year.

Why does this matter to you? Because the State Bank and the SECP both sit at the same table. Crypto rules, banking rules and securities rules are meant to be decided together, not against each other.

Who needs a PVARA licence?

Here is the rule in one sentence, from PVARA’s FAQ: no person may, by way of business, provide any virtual asset service “in or from Pakistan” unless it is a company incorporated in Pakistan that holds a valid PVARA licence.

Three points make this wider than it sounds.

1. Foreign platforms are covered. An activity counts as “in or from Pakistan” when it targets, promotes to or onboards people in Pakistan, including through a website or app, payment rails or services in rupees.
2. One category does not unlock another. A custody licence does not let you run an exchange. Each activity needs its own category.
3. Marketing counts. Under section 43 of the Act, nobody may advertise or market a virtual asset unless the issuer is licensed, and all marketing must carry risk disclosures.

Do ordinary users need a licence?

The licensing rule is written for businesses, “by way of business” in the regulator’s words. The Act’s scope section applies to service providers and to issuers of virtual assets.

What that means for you as a user is a separate question, and I cover it in my guide on whether crypto is legal in Pakistan.

Is crypto mining licensed?

Pure mining, by itself, is not a licensed service under section 37 of the Act. Mining that involves customer assets or customer funds is treated as a virtual asset service and does need a licence. PVARA may also create a registration system for large mining operators.

The 11 PVARA licence categories and their capital

Every licence is issued for one or more categories. Each has its own minimum paid-up capital, set in Schedule I of the Services Regulations.

Quick fact: Rs 500 million is Rs 50 crore. That single number tells you who this framework is built for: well funded companies, not a two person startup with an app.

How to get a PVARA licence: step by step

This is the part most people get wrong, so I will go slowly. PVARA’s FAQ gives the outline in three steps, and the regulations add the timelines.

Step 1: Apply for a No Objection Certificate

You start by applying to PVARA for an NOC on Form I of the Services Regulations, through the application portal on the licensing page.

• Decision time: PVARA must grant the NOC, with conditions, or refuse it with written reasons within 60 days of a complete application.
• Validity: 3 months from issue. It can be extended once, by up to 3 more months, if you apply before it expires.
• What it allows: only the next steps. It does not let you serve a single customer.

Step 2: Incorporate the company in Pakistan

After the NOC, you incorporate a company under the Companies Act, 2017 for the purpose of providing virtual asset services.

• Directors: at least 3.
• Foreign ownership: allowed. PVARA’s FAQ says the Act and regulations “do not require any Pakistani shareholding or cap foreign ownership”.
• Other registrations: PVARA’s licensing page lists registration with the Financial Monitoring Unit at this stage.

Step 3: Apply for the licence

Inside the NOC’s validity period, you apply for one or more licence categories with the documents in the Annexure to Form I and the non-refundable processing fee.

• Decision time: 90 days from a complete application. PVARA can extend this by up to 60 days for complex or novel cases.
• The clock can stop: if PVARA asks for more information, the time is paused until you provide it.
• If refused: PVARA must give written reasons and a chance to respond, and you can appeal under the Act.

Step 4: Get your people approved

Directors and the managing director cannot take office until PVARA approves them as fit and proper. PVARA must decide within 30 business days of a complete application.

The board needs independent directors, normally at least one third of it.

Step 5: Start operating, and keep complying

A licence can state a date by which you must start business. After that come annual supervisory fees, reporting, audits and inspections. Stopping the licensed service for a continuous year is a ground for suspension.

Pro tip for founders: add the timelines before you plan a launch. 60 days for the NOC, time to incorporate, then 90 to 150 days for the licence. A realistic plan is the best part of a year, and that is if every document is complete the first time.

What goes into the application?

The Annexure to Form I is long. In plain words, PVARA wants to see six things.

How much does a PVARA licence cost?

Here I have to be honest: the fee amounts are not in the regulations. They say fees will be “as published in the Rules”, and the forms still show the processing fee as “PKR [x]”. I could not find a published fee schedule on PVARA’s website on 10 November 2026.

What is certain is the capital. The fee is on top of the minimum paid-up capital in the table above, and processing fees are non-refundable.

The other door: the regulatory sandbox

There is a second route. A company with an innovative product can apply to test it in PVARA’s sandbox under supervision, within an agreed scope, duration and customer limit.

A company that completes the sandbox successfully can apply for a licence directly, without a separate NOC. PVARA is clear that the sandbox “does not create an entitlement to a licence”.

NOC vs licence vs sandbox: what is the difference?

These three words are mixed up in almost every headline. One table fixes it.

Warning: if a platform tells you it is “PVARA approved” because it has an NOC, that is not what an NOC means. PVARA announced NOCs for Binance and HTX in December 2025, and its own FAQ says an NOC does not constitute a licence.

Has anyone received a PVARA licence yet?

This is the question I get most, so here is exactly what I could and could not confirm on 10 November 2026.

• PVARA’s regulations say the Authority “shall maintain and publish an up-to-date public register of Licensees”, and the Act says that register goes on its official website.
• I could not find that register on pvara.gov.pk. The addresses I tried for a register returned “page not found”.
• PVARA’s news page lists the December 2025 NOCs for Binance and HTX. It does not list a full licence.
• I found no press report of a full licence being granted. New NOC applications are still being filed: TechX reported one by a Norwegian and Pakistani joint venture on 9 November 2026.

So my position is simple. Until PVARA publishes a register, do not believe any platform that calls itself licensed unless it shows you a licence number you can verify with PVARA.

How to check a platform yourself

1. Look for the public register on pvara.gov.pk.
2. Check the platform’s own website. Every licensee must publish its legal name, registered office in Pakistan, licence number and the categories it is licensed for.
3. If either is missing, treat the platform as unlicensed.

I keep the latest position on my Pakistan crypto rules tracker, so check there before you act on an old article.

What PVARA’s rules mean for ordinary users

You may never apply for a licence. These rules still matter, because they decide how a licensed company must treat you.

• Your assets must be kept separate. A licensee must hold customer assets in segregated accounts, apart from its own. The Act says they do not become part of the company’s estate if it goes insolvent.
• No lending your coins without consent. A licensee may not lend, pledge or reuse customer assets without the customer’s explicit, informed and revocable written consent.
• A duty to act in your interest. The Act places a fiduciary duty on licensees when dealing with customer assets.
• Clear fees and risks in writing. The client agreement must set out fees, spreads and commissions, the material risks, and how your assets are safeguarded.
• Complaints with deadlines. A licensee must acknowledge a complaint within 24 hours, and if it is not resolved within seven working days, send a written update with reasons.
• KYC and record keeping. Licensed companies are treated as financial institutions under the Anti-Money Laundering Act. They must verify customers, report suspicious transactions to the Financial Monitoring Unit and, according to PVARA’s regulations page, keep records for at least 10 years.

My recommendation: these protections only exist with a licensed company. Until a licensed option is available to you, keep any crypto exposure small enough that losing access to it would not hurt you, and never send money to a person or account you found through a social media group.

What are the penalties under the Virtual Assets Act?

Section 54 of the Act sets the criminal penalties. I have put them in one table.

For each offence the court can give prison, the fine, or both. Companies guilty of market abuse can be fined three times the profit made or loss avoided.

PVARA also has softer tools. It can issue a public censure, order a company to stop, impose a financial penalty, suspend or cancel a licence, and disqualify a person from holding office in a licensed company.

And it can go after the advertising. Section 61 lets PVARA remove or block online material, including websites, apps, ads and payment links, that promotes an unlicensed service. Those orders can go to telecom authorities, app stores, search engines, ad networks and payment providers.

How do banks fit in?

For years banks in Pakistan stayed away from crypto because of a 2018 State Bank circular.

That changed on 14 April 2026. As reported by Profit and TechJuice, a new State Bank circular letter allows banks to open accounts for PVARA licensed companies after verifying the licence with PVARA. Customer money must sit in separate rupee accounts, and NOC holders get limited purpose accounts only.

I could not open the State Bank’s own copy of the circular, so I am relying on those two news reports here.

Warning: this circular is about banks serving licensed companies. It is not a green light for buying crypto from strangers through your personal bank account or mobile wallet. That route can still get an account frozen, and I do not recommend it.

How to complain to PVARA

PVARA runs a grievance portal on its complaints page. You can report four kinds of problems:

• suspected fraud or scams by a virtual asset service provider
• a company operating without PVARA authorisation
• misconduct by a licensed provider
• other regulatory concerns

PVARA says it acknowledges a complaint within 2 business days, and that a full investigation may take 30 to 60 days. You get a reference number to track it, and complaints are confidential.

If you have already lost money, read my scam complaint help page as well. It lists the other places to report, because a regulator’s complaint is not the same as a police case.

What is still unclear

No honest guide to PVARA can pretend everything is settled. These are the gaps I found.

• Fees: the processing, licensing and annual fees are not published.
• The register: promised in the regulations, not visible on the website when I checked.
• First licences: none confirmed.
• Tax: the Act is about licensing, not tax. Press reports said the 2026 to 27 budget introduced no new crypto tax.
• Dispute scheme: the Act lets PVARA set up an independent dispute resolution scheme for smaller claims. I found no announcement of one.

Checklist: before you trust a crypto platform in Pakistan

• It names the Pakistani company behind it, with a registered office in Pakistan
• It shows a PVARA licence number and the categories it is licensed for
• You have checked that number with PVARA, not only on the platform’s own page
• It does not call an NOC a licence
• Its fees and risks are written down before you deposit
• It has a complaints process with timelines
• Nobody is asking you to send money to a personal account

To run this checklist in a minute, use my free PVARA checker. It gives a green, amber or red result with the rule behind each answer, and founders can use its licence planner for capital and decision dates.

PVARA FAQ

PVARA is new, the rules are long, and the first licences are still ahead of us. The simple version is this: a regulator now exists, a licence is the only thing that makes a crypto business legal here, and an NOC is not that licence. If you want the basics next, read my guides on how to buy crypto in Pakistan and crypto trading in Pakistan, or send me your question through Ask Ismail.

Keep reading

Related articles

Crypto · 19 min readVAAP Launches in Pakistan: What the Alliance Is and Is NotRead article →Crypto · 16 min readHow to Buy Crypto in Pakistan Legally in 2026: Rules, Options and RisksRead article →Crypto · 13 min readIs Crypto Legal in Pakistan? What the 2026 Law Really SaysRead article →