Service overview
Custody Services involve holding or controlling client virtual assets or relevant keys and demand specialised safeguarding.
PVARA differentiates the initial NOC, incorporation in Pakistan, and final licensing for one or more authorised services. An NOC is not an operating licence, and each chosen licence class has its own safeguarding, capital, competence and activity rules.
Who is eligible for Virtual Asset Custody Services Licence?
A prospective custodian must meet the licensing category's custody security, governance, technology, segregation and resilience requirements. For a licence in this category, Schedule I to the Pakistan Virtual Asset Services Regulations, 2026 prescribes minimum paid-up capital of PKR 200,000,000. Under the published framework the VASP applicant company must have at least three directors, with applicable independent-director and fit-and-proper controls.
Custodians must demonstrate safe control of private keys, segregated customer assets, incident response and the higher Schedule I custody capital. A wallet development vendor is not necessarily a licensable custodian.
For VASP licences, paid-up capital, eligible company form, director qualifications and actual regulated activity must be tested separately for the chosen licence class. A PVARA NOC does not grant permission to operate.
Documents and information for Virtual Asset Custody Services Licence
Prepare the following information for virtual asset custody services licence. The relevant regulator may require further forms or certified evidence, depending on the applicant and chosen procedure.
- Custody technology and key management
- Wallet architecture
- Insurance/risk policies
- Beneficial ownership
- AML controls
- Incident response and reconciliation plan.
- Evidence of subscribed and paid-up capital, with supporting attestation for the applicable PVARA licensing category
How can I obtain Virtual Asset Custody Services Licence in Pakistan? — step-by-step guide
- 01Identify the appropriate application route and eligibility
First determine whether the proposed applicant and activity fall within this procedure. A prospective custodian must meet the licensing category's custody security, governance, technology, segregation and resilience requirements. For a licence in this category, Schedule I to the Pakistan Virtual Asset Services Regulations, 2026 prescribes minimum paid-up capital of PKR 200,000,000. Under the published framework the VASP applicant company must have at least three directors, with applicable independent-director and fit-and-proper controls. Review the separate conditions and exclusions in the eligibility section before submitting any form or payment.
- 02Prepare the application documents and evidence
Start with the particulars listed for this service: Custody technology and key management; Wallet architecture; Insurance/risk policies; Beneficial ownership; AML controls; Incident response and reconciliation plan.; and the remaining items in the documents section. Ensure the names, applicant identity and documents are consistent. The authority may require further supporting material under its current checklist.
- 03Check the current regulator instructions before filing
Refer to the regulator resource identified on this page (PVARA published 2026 licensing tracks ↗). Reconfirm the currently prescribed forms, online or physical submission method, supporting evidence, fee and any current amendments. Do not assume that historic processing times or fees remain applicable.
- 04Define who controls client private keys
Document custodial wallets, signing permissions, asset segregation and responsibility for client loss.
- 05Arrange PVARA NOC and licensed corporate vehicle
Prepare owners, minimum paid-up capital, directors and safeguarding/technology architecture.
- 06Submit Custody Services licence application
Demonstrate key management, cyber audit, segregation, reconciliation, incident recovery and insurance/risk programmes as required.
- 07Operate controlled custody after licensing
Maintain client asset reporting, security testing and incident escalation.
- 08Keep the approval record and track ongoing obligations
After the authority has made its decision, retain the acknowledgement, correspondence, evidence of approval and any conditions attached to it. Maintain segregation, reconciliation, incident reporting, independent controls and client asset protection. Check whether separate approvals, renewals or reporting duties apply to the actual business.
Use the current regulator checklist to confirm that every listed item is still required and that any activity-specific conditions have been met. The items below are drawn from the document requirements identified on this page, not a representation that the checklist is exhaustive.
- Custody technology and key management
- Wallet architecture
- Insurance/risk policies
- Beneficial ownership
- AML controls
- Incident response and reconciliation plan.
- Evidence of subscribed and paid-up capital, with supporting attestation for the applicable PVARA licensing category
Before signing or paying, reconcile the particulars across Custody technology and key management and Wallet architecture; check the applicant and business classification, identify the person authorised to submit, and retain a copy of the final application and official correspondence. Official instructions control if the portal or law has changed.
Regulator resource: PVARA published 2026 licensing tracks
After registration or approval
Maintain segregation, reconciliation, incident reporting, independent controls and client asset protection.
VASP custody: protection and control of customer assets and private keys
Primary-source research. The following procedural analysis is based on the identified government or regulator sources. Confirm enacted amendments, applicable forms, fees and filing requirements on the date of submission. A consultation draft is not operative law merely because it has been published. This note does not represent final legal-editor certification of the entire guide.
Determine who controls the assets
PVARA's Custody Services category covers safekeeping, holding or controlling virtual assets or the means of access to them on behalf of others. Evaluate who possesses private keys, can authorize transfers, recover assets or enforce withdrawal instructions. A technology vendor that never controls customer assets is not necessarily the same as a regulated custodian, but the actual service—not the marketing label—determines the perimeter.
Prudential capital and licence scope
The Services Regulations' current Schedule I sets PKR 200 million minimum paid-up capital for Custody Services. An integrated exchange or transfer provider may need other categories or different capital and safeguards. The application must meet Pakistani incorporation and governance requirements and follow PVARA's effective licensing pathway.
Custody controls and safeguards
Prepare wallet/key governance, segregation and reconciliation of clients' assets, signing and approval controls, physical and cyber security, backup and recovery, cold/hot wallet policies, third-party custodians, access authorisations, audits and treatment of insolvency or failed transfers. Review actual Activity Specific Regulations for mandatory detail before asserting a particular technique suffices.
Accountability after licence
Keep auditable customer consent, wallet addresses, liabilities, incidents, withdrawals, asset movements and suspicious activity records. A custody licence does not automatically grant exchange, brokerage, lending or asset management permissions. The company must observe its approved categories and restrictions and protect assets throughout the licence term.
Official legal and regulatory sources
Governing law & official references
Virtual Assets Act, 2026; Pakistan Virtual Asset Services Regulations, 2026; and Pakistan Virtual Asset Services Activity Specific Regulations, 2026.
The links below lead to government or official regulatory sources relevant to this service. Use the currently consolidated Act, regulations, statutory checklist and official portal when making an application.
How Chambers can assist
Chambers can review the legal route, identify regulatory constraints, prepare or review the supporting corporate and legal documents, manage the prescribed submission and correspond with the competent authority where instructed. The scope of the engagement will be determined by the applicant’s particular circumstances.
For an initial enquiry, identify the proposed activity, applicant entity and current stage, and provide the available documents indicated above. Please avoid sending confidential or identity-sensitive records through an unencrypted first contact.
Common questions about Virtual Asset Custody Services Licence
Who is eligible for Virtual Asset Custody Services Licence in Pakistan?
A prospective custodian must meet the licensing category's custody security, governance, technology, segregation and resilience requirements. For a licence in this category, Schedule I to the Pakistan Virtual Asset Services Regulations, 2026 prescribes minimum paid-up capital of PKR 200,000,000. Under the published framework the VASP applicant company must have at least three directors, with applicable independent-director and fit-and-proper controls.
What documents are needed for Virtual Asset Custody Services Licence?
Custody technology and key management; Wallet architecture; Insurance/risk policies; Beneficial ownership. Additional requirements can apply to the actual business or regulator.
How can I obtain Virtual Asset Custody Services Licence in Pakistan?
Define who controls client private keys: Document custodial wallets, signing permissions, asset segregation and responsibility for client loss. Arrange PVARA NOC and licensed corporate vehicle: Prepare owners, minimum paid-up capital, directors and safeguarding/technology architecture. Submit Custody Services licence application: Demonstrate key management, cyber audit, segregation, reconciliation, incident recovery and insurance/risk programmes as required. Operate controlled custody after licensing: Maintain client asset reporting, security testing and incident escalation.
This guide is general information, not advice on your facts. Check the applicable law, notifications, updated regulator checklists and jurisdiction before acting. The authority alone determines eligibility, acceptance and approval; no outcome or processing period is guaranteed.