A sandbox is a supervised test, not an alternative market licence
The Pakistan Virtual Asset Regulatory Authority offers a regulatory sandbox route for innovative virtual-asset products and services. Its purpose is to permit controlled testing under regulatory supervision, not to create an unrestricted commercial market outside the licensing system. Section 35 of the Virtual Assets Act, 2026 provides the statutory foundation for a sandbox and contemplates prescribed eligibility, procedures, supervision, risk limits, duration and exit arrangements. PVARA's published licensing pathway describes admission, testing within agreed scope, duration and customer limits, exit and then a separate licence application. These stages should be treated as distinct legal events. A startup may be technically capable of serving thousands of customers while its sandbox permission authorises a much narrower experiment. Product capacity does not enlarge the permission granted.
The activity must be classified before the experiment is designed
The starting point is the activity rather than the technology. A proposed application might match orders, custody customer keys, arrange transfers, issue fiat-referenced tokens or give personalised investment advice. Schedule I to the Act and the notified Services Regulations allocate these functions to different licence categories. The same user journey can involve several regulated activities, and a sandbox application should describe each one, including outsourced functions and cross-border group roles. A prototype that merely demonstrates a user interface presents a different legal profile from a live test that receives customer funds and settles transactions. The application should therefore contain a transaction-flow diagram, identify the legal person facing each customer, and distinguish simulated activity from activity involving real money or virtual assets. Without that map, even a carefully written testing plan may understate the permission it requires.
Written admission conditions define the actual perimeter
A public announcement that a firm has been “accepted into the sandbox” is not a substitute for the operative approval or supervisory agreement. PVARA describes testing within agreed parameters, including scope, duration and customer limits. The correct analysis requires the written admission decision and all subsequent variations or directions. Those documents may specify which product can be tested, who may participate, the geographic market, financial exposure, reporting arrangements and the circumstances in which testing must stop. It would be unsound to invent a universal numerical customer cap or a fixed testing term without examining the current binding instrument and the individual permission. A board should require a signed schedule of conditions before any live transaction is enabled and should make those conditions operationally enforceable in the platform.
Testing boundaries need controls in the software itself
A limit stated in a regulatory letter is of little practical value if the platform cannot enforce it. A supervised test should translate the approved population, product features and exposure limits into access controls, account flags, transaction checks and exception reporting. Where the approved test is confined to a named customer group, the onboarding system should prevent unrestricted registration. Where exposure is capped, controls should address cumulative balances, failed transactions and manual overrides rather than checking only the face value of an individual order. Management should also document who may change a limit, how emergency suspension works and what happens if a threshold is breached. These are proposed operational safeguards, not a claim that a single prescribed technical architecture applies to every sandbox participant. Their function is to make compliance with the actual written permission demonstrable.
Customer consent and disclosures should match the test
Customers in a controlled experiment should not be led to believe they are using an ordinary fully licensed exchange or that PVARA guarantees the product. The Services Regulations distinguish an NOC from a full licence, and the sandbox pathway is separately described as supervised testing. A customer-facing document should identify the legal provider, the experimental nature of the product, material custody and technology risks, fees, withdrawal arrangements and the process for complaints. Where losses may arise from market movements, smart-contract defects, settlement failure or the conduct of a third-party custodian, the allocation of responsibility must be intelligible rather than buried in a generic disclaimer. Disclosures should also explain any restriction on participation, transaction size or duration imposed by the permission. Consent cannot cure conduct outside the regulatory scope, but accurate disclosure is indispensable to responsible testing.
Safeguarding cannot be postponed until full authorisation
A sandbox experiment may involve real customer assets even if the operator has not reached the full licensing stage. The legal analysis must therefore examine who controls the assets and what obligations attach to that control. A custody diagram should show private-key arrangements, omnibus or segregated wallet structures, the role of sub-custodians, reconciliation frequency and recovery procedures after an incident. Where client fiat passes through a bank, the account structure and permitted uses require separate assessment. AML, CFT and CPF duties, sanctions screening and suspicious-activity escalation cannot be treated as optional simply because a product is described as innovative. The applicable requirements depend on the activity and permission, but a sandbox participant should be able to show the regulator how customer money and records are protected during both ordinary testing and an abrupt termination.
A sandbox does not displace the State Bank's banking rules
The State Bank of Pakistan's BPRD Circular Letter No. 10 of 2026 replaced its 2018 circular on virtual currencies on 14 April 2026. It provides conditional account arrangements for PVARA-licensed VASPs and limited-purpose accounts for entities holding PVARA NOCs to complete licensing formalities. The circular does not confer a general banking or payments permission on every sandbox participant. It also prohibits SBP-regulated entities from investing, trading or holding virtual assets using their own funds or customer deposits, and preserves their AML and foreign-exchange responsibilities. A sandbox proposal involving rupee settlement, a banking partner or cross-border remittance must therefore be assessed with the bank's compliance team and any other competent regulator. PVARA's willingness to supervise a test should not be represented as an automatic authorisation of the banking leg.
The test should produce evidence a regulator can examine
The strongest sandbox application identifies what cannot yet be established through ordinary desktop testing and explains how a controlled pilot will answer that question. It should define measurable outcomes: settlement accuracy, wallet recovery time, failed-transaction rates, security incidents, complaint patterns, liquidity under stress and the effectiveness of transaction monitoring. Testing data should distinguish genuine customer events from simulated results and record the response to exceptions. The operator should maintain a dated change log for code deployments, smart-contract upgrades, access permissions and outsourced services. If a material failure occurs, the record should show when it was detected, who authorised containment, how customers were informed where appropriate, and whether PVARA received the required notice. These records are also evidence of governance quality when the later full licence application is considered.
Exit planning is a substantive legal obligation
A credible sandbox proposal begins with its exit, not merely its launch. At the end of the approved test, the operator may need to stop the activity, seek a variation, or apply for full licensing after satisfying the applicable conditions. Customers may still hold assets or have unsettled claims when testing ends. Contracts should therefore describe withdrawal windows, transaction reversals where technically possible, disputed balances, data retention and the handling of outstanding instructions. The firm should identify who pays for an orderly wind-down and whether critical service providers must remain available after the pilot closes. A software feature can be switched off instantly; the associated legal and customer obligations cannot. PVARA's official pathway expressly treats sandbox exit as a separate stage, and the outcome of testing does not by itself determine that the company may commence unrestricted operations.
Regulation 7(6) provides a route, not a promise
The notified Pakistan Virtual Asset Services Regulations, 2026 contain an important provision for successful sandbox participants. Under Regulation 7(6), a participant that completes testing to PVARA's satisfaction may apply directly for a licence under Regulation 7 without obtaining a separate preliminary NOC under Regulation 6. The provision expressly says that sandbox participation does not create an entitlement to a licence. The Authority may take testing outcomes and compliance history into account, and the applicant must still satisfy the full requirements applicable to its proposed licence categories. This means a successful technology demonstration cannot replace scrutiny of capital, governance, controllers, cybersecurity, customer protection or AML controls. A commercial launch date should be conditional on the actual grant of the relevant licence, not on the anticipated end of the test.
No-action communications are a different legal instrument
Section 35(3) of the Act contemplates guidance, no-objection statements and no-action communications in accordance with regulations. PVARA's advisory of 26 April 2026 also directs proposed pilots and virtual-asset partnerships to engage early through available regulatory routes. These instruments should not be conflated. A statement that the regulator does not intend to take a specified enforcement step is not necessarily a licence, an exemption from all other law or approval of unrelated conduct. The legal effect depends on the precise wording, the statutory power invoked and any time or activity limits. A business that holds a no-action communication for one testing arrangement should not present it as permission for a different token, a new customer market or a third-party exchange service. Counsel should review the actual document rather than its marketing summary.
Contracts and public announcements need careful sequencing
A startup may need agreements with a bank, cloud provider, wallet custodian, market maker or technology vendor before testing can begin. Those agreements should distinguish preparatory work from the date regulated services may lawfully start. Conditions precedent can require PVARA admission, any other relevant approvals, agreed customer protections and operational readiness. Termination clauses should address a refusal, expiry, breach of testing conditions or an adverse supervisory direction. PVARA's April 2026 advisory warns that announcements of virtual-asset pilots and partnerships, including stablecoin initiatives, can create regulatory risks where prior engagement or authorisation is absent. A public memorandum of understanding is not a substitute for permission. The communications team should therefore use the exact regulatory status, identify unresolved approvals and avoid language suggesting that the state guarantees the proposed product.
The board should decide whether the sandbox is necessary
Not every virtual-asset venture benefits from a sandbox. A conventional exchange model with established controls may be better suited to the ordinary NOC and full-licence route; a genuinely novel settlement or custody architecture may justify a supervised test. The board should record the innovation being tested, why ordinary licensing cannot answer the relevant uncertainty, the risks imposed on participants, the financial resources committed to the pilot and the criteria for stopping it. The decision should also identify which services remain prohibited until a full licence is granted. A sandbox is valuable when it produces disciplined evidence under a defined permission. It becomes a regulatory hazard when the company treats admission as a public-launch certificate or a device for indefinitely deferring full authorisation.
Regulatory status depends on the instrument.
Assess the operative permission, actual services and supporting evidence before taking a commercial step.
DISCUSS A MATTERGeneral legal information only; not advice on an individual transaction.