Pakistan has opened its virtual-asset licensing portal, moving exchanges, custodians, token issuers and transfer providers into an application process under the country’s Virtual Assets Act, 2026.
The Pakistan Virtual Assets Regulatory Authority, or PVARA, says it is accepting applications for regulatory-sandbox admission, no-objection certificates and full virtual asset service provider licences. Companies that were providing virtual-asset services on or before March 5, 2026 must submit an NOC application by September 5 or cease operations, according to the regulator’s licensing page.
That deadline applies to what PVARA calls “Transitional Persons.” The official page says the requirement comes from Section 70 of the Act. Pakistan’s state-run Associated Press of Pakistan reported, citing a PVARA release, that continuing to operate after the deadline without an application would constitute an offence.
NOC, sandbox and full licence are different stages
The portal presents two routes into the full licensing regime. The sandbox route is designed for firms testing an innovative virtual-asset product under supervision. It moves from application and admission through controlled testing and an exit assessment before a firm applies for a VASP licence.
The NOC route is intended for firms preparing to establish a licensed entity in Pakistan. PVARA describes a sequence that begins with an NOC application and preliminary approval, followed by regulatory compliance work, local incorporation and then a full licence application.
An NOC should therefore not be treated as a full operating licence. Similarly, sandbox admission would authorize testing within an agreed scope, duration and customer limits rather than unrestricted commercial activity. Those distinctions matter for counterparties deciding whether a provider is merely entering the process or has completed it.
Payments and stablecoin activities are explicitly covered
PVARA’s licensing page lists exchange, custody, broker-dealer, lending, derivatives, asset-management and advisory services among the regulated activities. It also expressly includes virtual-asset transfer and settlement services, asset-referenced token issuance and fiat-referenced token issuance.
The regulator defines transfer and settlement services as moving virtual assets between addresses or accounts and settling those transfers. It describes fiat-referenced token issuance as issuing tokens intended to maintain a stable value against one fiat currency. Those categories place crypto payment flows and fiat-linked stablecoin issuance directly within the published licensing perimeter rather than treating them only as exchange activity.
For payment companies, the practical consequence is that the regulated role will depend on what a firm actually does. A business that transfers tokens, safeguards customer assets and operates an exchange could need authorization across more than one category; PVARA says applicants may apply for one or more categories.
Local presence and control requirements shape market entry
The full-licence requirements shown by PVARA include registration as a Pakistani company, category-based minimum paid-up capital, fit-and-proper checks for directors and key personnel, an anti-money-laundering and counter-terrorist-financing program, cybersecurity controls and business-continuity arrangements.
The regulator says the AML/CFT program must include customer identification, transaction monitoring and suspicious-activity reporting. These are listed requirements for obtaining a VASP licence when full licensing becomes available; the page does not say that submitting an NOC application by itself satisfies them.
Associated Press of Pakistan also reported that the framework would require licensed providers to segregate customer holdings from company assets and prohibit lending or pledging those holdings without written consent. That safeguard was attributed to PVARA Chairman Bilal Bin Saqib.
The framework gives firms a defined path into Pakistan’s virtual-asset market, but an open portal is the start of supervision rather than evidence that every applicant is approved. Providers and business customers will still need to distinguish application submission, NOC issuance, sandbox admission and a completed full licence when assessing regulatory status.