The permission question comes before incorporation
The first issue for a proposed virtual-asset business is not which application form can be completed most quickly. It is whether the firm intends to carry on a Virtual Asset Service in or from Pakistan, and precisely which service. An exchange, an adviser, a custodian and an issuer expose customers to different risks; an applicant cannot make these distinctions disappear by calling its offering a technology platform. Section 2 of the Virtual Assets Act, 2026 sets a territorial framework, while the Pakistan Virtual Asset Services Regulations, 2026 apply it to regulated activities. The decisive inquiry concerns the commercial conduct: who invites customers, receives instructions, controls assets, sets transaction terms, earns fees and assumes duties. In a group with a foreign parent, licensing also requires an accurate account of which entity performs each function and where customer-facing activity occurs.
The three stages are not interchangeable
PVARA describes two principal entry routes: a supervised sandbox pathway and a preliminary No Objection Certificate followed by a full licence application. The NOC is an assessment of preliminary suitability; Regulation 6(4) expressly states that it does not itself constitute a licence to carry on any Virtual Asset Service. The NOC pathway ordinarily involves an application, preliminary assessment, establishment of the required Pakistani corporate vehicle and a further licensing application. A successful sandbox participant may apply for a licence without a separate NOC, subject to Regulation 7(6), but successful testing is not a promise of authorisation. A founder who describes an NOC as a licence risks misleading customers and investors, even if incorporation, investment and technology development are underway. Product marketing must reflect the permission actually held.
Deadlines, completeness and procedural protection
The notified Services Regulations distinguish the time taken to decide a complete application from time spent waiting for missing information. Regulation 6(3) provides for a decision on an NOC within sixty days of receipt of a complete application; Regulation 6(5) addresses its three-month validity and a possible further extension on timely application. Regulation 7 provides a ninety-day decision period for a complete licence application, with a possible extension of up to sixty days in the circumstances specified by the regulation. These periods should not be treated as unconditional launch dates. Written confirmation of completeness, additional information requests and any reasons recorded for extension are relevant to the chronology. Before refusing an application or imposing materially adverse conditions, the Authority's hearing and reasons requirements must also be considered. An applicant should preserve acknowledgments and all correspondence rather than rely on an informal estimate.
Select licence categories against actual services
Schedule I to the Act and the notified licensing framework identify different categories including advisory, broker-dealer, custody, exchange, lending and borrowing, derivatives, management and investment, transfers and settlement, fiat-referenced issuance, asset-referenced issuance and mining-related services. The categories do not operate as generic fintech permissions. Regulation 5 and the Activity Specific Regulations make the scope of the authorisation consequential: an operator licensed to advise is not automatically authorised to hold client keys or execute orders. A custody function embedded in a brokerage or an exchange may require separate analysis even where the customer sees a single application. Ancillary functions require attention to whether they are subordinate, independently marketed or separately remunerated. A licensing memorandum should contain a function-by-function map, rather than a list of attractive licence labels.
Capital and governance are operating obligations
The minimum paid-up capital requirements vary significantly by licence category. Schedule I to the Services Regulations gives distinct thresholds for advisory, broker-dealer, custody, token issuance and exchange activities. Capital is only one part of the financial resources analysis: liquidity, stress planning, three-year financial projections and the treatment of customer assets also matter. A capital contribution by a sponsor is not the same as an ability to use client money for operating expenses. The Authority evaluates directors, controllers and key individuals through fit-and-proper considerations, and the application must disclose the corporate and ownership structure. The firm's governance arrangements should show credible oversight of risk, technology and compliance, not simply identify names for statutory forms. Changes in control and appointments may create later approval obligations after licensing.
The business plan must describe how customers and assets move
The Annexure to Form I calls for meaningful information about products, target markets, customer types, geographical channels, custody arrangements and the location of key operations. A useful business plan should therefore explain whether the firm holds private keys, uses third-party custody, relies on omnibus wallets or maintains individual arrangements. It should trace customer instructions, fiat movements, virtual-asset settlements and the escalation of failed transfers. For a cross-border group, it should distinguish group outsourcing from the regulated provider's own duties. An application that accurately describes architecture is more defensible than one which promises broad innovation but leaves essential operational questions unanswered. Contracts with cloud providers, custodians and distribution affiliates should correspond with the model submitted to the regulator.
Safeguarding and AML controls cannot wait for launch
The Services Regulations impose continuing requirements concerned with customer assets, conduct, technology, governance and AML/CFT/CPF compliance. The Anti-Money Laundering Act, 2010 and associated requirements must be considered alongside the virtual-asset framework. Transaction monitoring, sanctions screening, customer due diligence, the Travel Rule and record preservation are practical systems, not merely policy headings. A responsible applicant should determine who handles onboarding exceptions, how alerts are resolved, how suspicious activity is escalated and how assets can be restored after a technology incident. Outsourcing a monitoring provider or wallet infrastructure does not extinguish regulatory accountability. Equally, a cyber-security audit does not by itself establish that beneficial ownership, financial resources or client disclosures comply with the applicable rules.
Banking access has its own safeguards
The State Bank of Pakistan's BPRD Circular Letter No. 10 of 2026, dated 14 April 2026, replaced BPRD Circular No. 03 of 2018. It permits relevant SBP-regulated entities to open accounts for PVARA-licensed VASPs subject to specified controls, and limited-purpose accounts for entities holding an NOC to complete licensing formalities. For authorised VASP transactions, the circular addresses separate client money accounts and the prohibition on commingling client and VASP money. It also restricts how those accounts can be used. This is not a general permission for banks to trade virtual assets for their own account; the circular preserves separate restrictions and bank-level compliance duties. A VASP's authorisation and its banking arrangements therefore must be documented as separate workstreams, including ongoing customer due diligence and foreign-exchange compliance.
Handling refusals, change and enforcement
A refused application should be approached by identifying the statutory or regulatory ground, the applicant's representations and the relevant procedure for reconsideration or appeal. It is rarely useful to begin with a broad allegation of unfairness before obtaining the decision and its reasons. Changes in ownership, executive management, activity, technology outsourcing or the intended custody model may affect the licence conditions, and should not be implemented on the assumption that the original approval covers every expansion. Where an operator has already commenced unauthorised activities, the legal assessment must separately consider cessation, customer asset treatment, reporting and potential regulatory exposure. No published article can determine the appropriate response without the actual correspondence, service description and chronology. The essential discipline is to reconcile permission, current conduct and future business plans before a further representation is made.
A defensible instruction file
The work product should contain an activity-classification memorandum, a clean corporate diagram, the relevant schedule of licence categories, a regulatory application timetable, financial and prudential evidence, and a contract register for critical technology and custody arrangements. It should also identify matters that fall outside the virtual-asset permission, including potential banking, securities and property issues. Documents ought to be reviewed against the final notified instruments rather than earlier consultation drafts or the superseded 2025 NOC regulations. The most productive question for directors is not whether the application is ready to submit. It is whether the proposed company can truthfully demonstrate the controls, personnel, financial resources and operating arrangements which its licence category requires throughout the life of the business.
Advice begins with legal classification.
Review the underlying assets, permissions, parties and documents before proceeding.
DISCUSS A MATTERGeneral legal information only; not legal advice on an individual transaction.