Running a crypto exchange, wallet, custody service or token platform in or from Pakistan now requires a formal licence from the Pakistan Virtual Assets Regulatory Authority (PVARA) under the Virtual Assets Act, 2026. Operating without one is a legal offence.
MAH & Co. helps crypto and blockchain businesses choose the right application route, set up a compliant Pakistani company, prepare the licensing file and stay compliant after approval.
For years, crypto activity in Pakistan operated in a legal grey area. The Virtual Assets Act, 2026 changed this by creating a full licensing and supervision framework. PVARA can issue, suspend and revoke licences, inspect licensed firms and take enforcement action, and the Act applies to services provided in or from Pakistan.
Licensing brings VASPs into a wider compliance framework that covers governance, technology, market conduct, client asset protection and anti-money laundering and counter-terrorist financing (AML/CFT) controls, in line with FATF standards.
Crypto exchanges and trading platforms
Custodians and wallet providers
Token issuers and token offering platforms
Brokerage and investment platforms for virtual assets
Mining operations that handle customer assets or serve third parties professionally
Foreign exchanges and fintech firms serving Pakistani users
Incorporation under the Companies Act, 2017, shareholder and beneficial owner details, and director information.
A clear description of the virtual asset services offered, target users, fee structure and risk profile.
KYC and onboarding procedures, transaction monitoring, sanctions screening, record keeping and a designated compliance officer.
System architecture, cybersecurity controls, wallet and key management, and incident response plans.
Custody arrangements, segregation of client assets and safeguards for customer funds.
Risk management, conflict of interest, complaints handling, outsourcing and ongoing reporting arrangements.
Licensing strategy and pathway selection
NOC, VASP licence and sandbox applications
Company incorporation, SECP and NTN registration
AML/CFT, KYC and compliance manuals
Terms of service, privacy and custody documents
Liaison and follow-up with PVARA
Market entry for foreign exchanges and fintech firms
Post-licence compliance and regulatory advice
Barristers and High Court advocates with corporate and regulatory experience
Experience with SECP, PSX and capital market licensing
One team for incorporation, licensing and compliance
Offices in Karachi and Islamabad
Clear communication and transparent fees
Online and in-person consultations
Yes. Under the Virtual Assets Act, 2026, businesses providing virtual asset services in or from Pakistan must be licensed by PVARA, and unlicensed activity is an offence.
The Pakistan Virtual Assets Regulatory Authority (PVARA) is the federal regulator that licenses and supervises virtual assets and Virtual Asset Service Providers.
A NOC is an initial approval that acts as temporary authorisation while the full licence application is reviewed. A VASP licence is the full authorisation to provide virtual asset services under PVARA supervision.
Foreign firms can apply, but full commercial authorisation generally requires a locally incorporated company under the Companies Act, 2017 and compliance with PVARA's requirements.
Plain mining may fall outside licensing, but mining that involves customer assets or funds, or services provided to third parties on a professional basis, is treated as a virtual asset service and requires a licence.
Licensed firms must maintain AML/CFT controls, governance and risk systems, technology security, client asset protection and regular reporting, and remain open to PVARA inspections.
Use the appointment form, WhatsApp at +92 345 8231881, or call our Karachi office. Consultations are available in person or online.