Existing crypto firms in Pakistan now have until Sept. 5 to apply for a no-objection certificate. Miss the window and you stop operating. That is the message from PVARA, the country’s new virtual asset regulator, which opened its licensing portal over the weekend.
The deadline landed in a press release carried by the Associated Press of Pakistan on Saturday. Any company providing virtual asset services on or before March 5 must file an application. Operating past Sept. 5 without one “will constitute an offense,” the regulator said. The net is wide: exchanges, custody providers, broker-dealers, lending platforms, derivatives venues, asset managers, token issuers and mining-related services all fall under the framework.
Binance and HTX are already partway through the door. PVARA issued preliminary no-objection certificates to Binance and HTX in December 2025, clearing both exchanges to set up local subsidiaries and begin assembling full license applications. With regulations now formally notified, that process can move forward.
The legal backbone came together fast. Parliament passed the Virtual Assets Act in March, establishing PVARA as the statutory regulator. The State Bank of Pakistan followed by allowing banks to open accounts for licensed providers, including segregated client-money accounts.
Two licensing routes exist. A sandbox pathway lets firms test products under PVARA supervision before pursuing a full license. A no-objection certificate targets companies preparing to incorporate locally. Either way, licensed providers must keep customer holdings separate from their own assets. They cannot lend or pledge those funds without written consent. Client money stays walled off from operating capital.
“The licensing window is officially open, creating a clear pathway for businesses to enter Pakistan’s regulated virtual asset market, with defined standards for consumer protection, governance, compliance and market integrity,” PVARA said on LinkedIn.
The framework stretches well beyond custody. Governance, market-conduct, cybersecurity, operational-resilience and anti-money-laundering and counter-terrorism-financing requirements are all codified. The rules were shaped by a public consultation that ran from June 11 through July 2.
What remains unanswered: penalties. The release calls non-compliance an offense but lists no fines. No criminal sanctions are spelled out. How many existing providers must now scramble to file? The regulator did not say.
