Pakistan Crypto Firms Face Sept. 5 Cutoff Under New Licensing Rules

Pakistan’s New Rules Set a September 5 Cutoff

The new regulations were notified under the Virtual Assets Act, 2026. They establish the rulebook for licensing, governance, market conduct, technology and cyber resilience, customer protection, and AML/CFT/CPF controls. PVARA’s consultation record describes ten activity-specific licence categories, ranging from exchange and custody to derivatives and mining-related services.

For a transitional provider, the NOC is the first step, not a permanent safe harbor. Regulation 5A says a provider active immediately before the Act’s commencement can keep providing existing services while its complete NOC application is pending, but PVARA can impose limits on onboarding, products, transaction volumes or custody arrangements to protect customers or market integrity.

The regulator can grant or refuse a complete NOC application within 60 days. The NOC then allows a company to establish a Pakistan entity for a licence application; the document expressly says it does not authorize the applicant to conduct a virtual-asset service. A full licence application has a stated 90-day decision period that PVARA may extend by up to 60 days where consultation with other authorities is needed.

This structure is more consequential than a registration form. A firm that wants to add a service outside the licence categories listed on its licence needs another authorization. It also changes the compliance bar from an informal market-presence question to a supervised local operating model, including the fit-and-proper status of controllers and senior personnel.

Customer Assets Cannot Be Treated as Company Funds

The regulations require a VASP that holds, controls, safeguards or administers customer assets to keep them segregated from its own. It cannot treat those assets as company property or use, pledge, encumber, lend, rehypothecate or otherwise dispose of them except where the rules expressly permit it.

That wording is a concrete customer-protection test, not a guarantee against losses. Providers must maintain arrangements for timely returns, reconciliations and safeguarding controls, but the regulation does not insure account balances or promise recovery after a platform failure. It also requires disclosures about safeguarding arrangements and the material risks of custody, technology and asset-price volatility.

The framework puts Pakistan alongside jurisdictions that are trying to turn custody practices into enforceable rules rather than exchange marketing claims. Canada’s digital-asset custody framework similarly focuses on governance and protection of client property, while the operational details and oversight mechanism differ.

The State Bank of Pakistan’s April 14 circular adds a banking boundary. Banks may open limited-purpose accounts for NOC holders to complete licensing formalities, but virtual-asset transactional activity requires a PVARA licence, independent licence verification and due diligence. The circular also requires separate Pakistani-rupee client-money accounts where applicable and bars banks from using their own funds or deposits to invest, trade or hold virtual assets.

What Exchanges and Users Should Watch Next

The first checkpoint is September 5: whether active providers submit complete NOC applications, and whether PVARA issues any interim restrictions on customers, services or custody. The public record does not yet identify which companies are in the process, so a user should look for a statement from the provider and PVARA rather than rely on social-media claims.

The second is the conversion from NOC to licence. A preliminary approval may let a firm establish its local presence and keep an existing service alive during review, but it does not mean that every product, currency rail or new customer campaign has been approved. PVARA can also restrict marketing while a transitional application is pending.

The third is enforcement transparency. PVARA says it has powers to suspend licences, impose penalties and act against unauthorized operators. What matters for users is whether the authority publishes a register of licensed firms, conditions, restrictions and enforcement decisions in a form that can be checked before depositing assets.

Pakistan is not alone in moving from broad policy to service-specific obligations. Vietnam’s new penalties for unlicensed crypto services show how deadlines become real only when regulators explain the permitted activity, the compliance route and the consequences for firms that stay outside it.

Crypto sentiment was still in Greed territory as the regulations took effect: Alternative.me’s Crypto Fear and Greed Index read 73 on August 24.

Pakistan’s September 5 deadline is therefore not a blanket finding that every current crypto service is illegal. It is a transition point: existing providers need a complete NOC application to remain in the regulated pathway, while users need evidence of the provider’s status, the service it is authorized to offer and the safeguards around their funds.