The exchange is a regulated venue, not simply a website
An exchange business is defined by what it does for customers, not by the language used in a product pitch. The Pakistan Virtual Asset Services Activity Specific Regulations, 2026 contemplate operation of a trading venue, order book, matching system, swap facility or comparable arrangement as Exchange Services. The regulatory analysis should identify who sets trading rules, decides which virtual assets are admitted, matches orders, settles transactions and communicates with customers. A developer licensing matching software to another entity may be in a different position from the operator which holds itself out as the venue. The distinction must be supported by actual contracts and control of the system. A platform using several legal entities cannot avoid the licensing perimeter by allocating the application interface to one company and critical dealing functions to another without examining the regulated activities of each.
Permissions must correspond with the service stack
PVARA's licensing schedule treats Exchange Services, Broker-Dealer Services, Custody Services and Virtual Asset Transfer and Settlement Services as distinct categories. An exchange may also arrange transfers, custody or dealing on account; whether those elements require another authorisation cannot be determined simply because they appear inside a single customer journey. Regulation 5 of the Services Regulations and the General Activity Specific Regulations prevent a licence holder from extending one authorisation into a different category without the appropriate basis. An application should list each function, who performs it, whether it is offered independently and which licence conditions govern it. Outsourcing to an affiliate or foreign infrastructure provider does not necessarily remove the operator's legal responsibility. The function map should remain usable by the regulator after platform features change.
Trading rules form part of the customer bargain
The Exchange Services Regulations envisage published trading rules, governance and systems that address access, participation, matching, suspensions, delisting and market integrity. The rulebook should specify how an order is entered, amended, cancelled and executed, and at which point an execution becomes final under the platform's contracts. It should explain priority, error correction, price controls, trading halts, rejected orders and the status of customer positions when the system fails. The operator should be able to demonstrate how exceptions are decided without favouring an affiliated market maker or selected customers. Where discretion is retained, its limits and documented exercise matter. Unclear rules convert technology incidents into contractual disputes and can hinder investigation of manipulation or self-dealing.
Listing a token is not government endorsement
The notified Exchange Services Regulations address admission, listing standards and the ability of the Authority to intervene where necessary. PVARA's official explanatory material emphasizes that notification of a listing does not constitute regulatory approval of the token. A platform should therefore avoid presenting a listed asset as safe or state-guaranteed. Its listing committee should consider issuer information, liquidity, technical functionality, concentrations of ownership, conflicts of interest and legally prohibited or restricted assets. If the venue creates a promotional campaign for an asset it lists, the extent of its own economic interest should be disclosed. Procedures must also deal with post-listing changes, forks, compromised contracts, suspension and delisting. Investor-facing risk warnings cannot substitute for the exchange's responsibility to operate a defensible listing process.
Separate orders, funds, keys and claims
Where the platform also holds virtual assets or the means of controlling them, safeguarding is a substantive operational question. Customers need to know whether coins are retained in segregated wallets, omnibus arrangements or a third-party custodian, and how claims are recorded against those holdings. The exchange should reconcile customer entitlements and its actual asset balances, retain transaction histories and establish restrictions on using customer assets. Security arrangements should cover multi-person approvals, key management, incident response, backup and business continuity. A customer agreement cannot be assumed to override applicable safeguarding requirements. If an exchange makes financial promises against customer holdings, the resulting activity may also implicate lending, investment or other licence categories. The regulatory classification and the private law governing customer interests must be analysed together.
Banking arrangements are a separate permission question
The State Bank's BPRD Circular Letter No. 10 of 2026 permits banking relationships with PVARA-licensed VASPs subject to verification, due diligence and prescribed account controls. It replaced the earlier banking circular on virtual currencies but did not remove all restrictions on banks themselves. Client money accounts for authorised VASP transactions are subject to segregation and limitations, including restrictions on commingling and specified uses of the balances. The exchange should reconcile these bank controls with its trading settlement and refund processes. An NOC may allow a limited-purpose account to assist with licensing formalities, not ordinary customer trading. Foreign-exchange compliance, suspicious transaction monitoring and ongoing customer risk profiling remain part of the bank's responsibilities. Neither a bank account nor a commercial contract can be presented as substitute evidence of PVARA licensing.
Surveillance and conflicts require independent oversight
A trading venue can face market abuse through wash trading, spoofing, related-party activity, concentrated token ownership and misleading volume statistics. An adequate oversight model should distinguish monitoring alerts from substantiated findings, preserve evidence and create a documented escalation process. If the operator or an affiliated entity makes markets, conflicts need particular attention because it may possess privileged information about customers and listing decisions. Transaction data, order logs and communications should be retained in forms that permit investigation. The compliance function should be empowered to challenge product or trading teams when commercial incentives conflict with customer protection. The goal is not to prohibit every commercial conflict automatically, but to identify, control and disclose those conflicts as required by the applicable regulation.
Technology failures have legal consequences
The legal file should address interruption of matching, delayed settlement, double crediting, erroneous market data, wallet outages, compromised administrative credentials and cyber incidents. Every incident raises distinct questions: were orders accepted before the failure, how are pending transactions treated, what records exist, who may reverse entries and what customer notification duties apply? Business continuity planning should include circumstances in which a cloud provider or affiliate is unavailable. Critical outsourcing arrangements require proper contractual access, audit and exit provisions under the Services Regulations. A statement that blockchain transactions are irreversible does not resolve an exchange's contractual duties to a customer when the exchange itself processed an incorrect instruction or misrepresented a transfer.
Cross-border customer acquisition must be examined
PVARA's Services Regulations expressly contemplate virtual-asset services carried on in or from Pakistan, including conduct directed at persons in the country. A foreign exchange should not assume that locating its servers or company overseas is decisive where it advertises to Pakistani customers, offers PKR features or actively onboards local users. The structure needs a territorial analysis and a clear account of the jurisdictions in which functions are performed. Conversely, a locally licensed firm seeking to market abroad must examine the law in destination jurisdictions. Restrictions on access, geolocation controls and customer eligibility are relevant only if they correspond with actual business practices. A contractual disclaimer cannot repair deliberate solicitation inconsistent with the licensing position.
A practical pre-launch governance record
The board should receive a documented activity map, approval schedule, customer asset model, trading-rule manual, token listing policy, conflicts register, AML programme, information-security assessment and incident response plan. Business continuity tests should reflect realistic stresses, including sudden delisting of a significant asset, loss of an outsourced custodian and a material pricing error. Product claims should be reviewed against the actual regulatory status and customer agreements. The application, internal controls and website must tell the same story. Where a material change is proposed after licensing, assess whether PVARA approval or notification is required before the feature is offered. The conclusion to draw is not that every risk can be eliminated, but that risks should be classified, assigned to accountable personnel and governed by enforceable documents.
The legal position depends on the activity and the record.
Classification, permissions and evidence should be reviewed together.
DISCUSS A MATTERGeneral legal analysis only; not advice on a particular transaction.