Pakistan Opens PVARA Crypto Licensing Portal: September 5 Deadline for Existing VASPs
Pakistan's Virtual Assets Regulatory Authority (PVARA) activated its licensing portal on 23 August 2026, converting what had been a legislative framework into a live enforcement regime. Any company that was providing virtual asset services on or before 5 March 2026 now has until 5 September 2026 to submit a no-objection certificate (NOC) application through the PVARA portal. Operating past that date without having filed will be treated as a regulatory offence. For accounting firms, auditors, and CFOs serving the Pakistani digital asset market, this is a compliance trigger that needs to be acted on now, not after the deadline passes.
What PVARA Has Actually Opened
PVARA's licensing portal is the operational layer on top of the virtual asset regulations that the authority notified earlier this year. According to a press release published through the Associated Press of Pakistan, the portal gives businesses a defined pathway to enter Pakistan's regulated market with clear standards covering consumer protection, governance, compliance, and market integrity.
Two licensing pathways
PVARA has structured the route to a full licence into two distinct tracks, and it is important that firms understand which applies to their situation.
The first is the NOC pathway. This is the route for companies that are preparing to incorporate in Pakistan or that are already operating and need to regularise their status. An NOC is not the same as a full operating licence: it is the precondition for incorporation and the first formal sign-off that PVARA will engage with a given firm's application. Crucially, existing VASPs must have submitted their NOC application by 5 September 2026 or cease serving the market entirely.
The second is the regulatory sandbox pathway. Firms that want to test new products or services before committing to full incorporation can apply to operate within a supervised sandbox. This allows PVARA to oversee live testing before a firm seeks a full licence, reducing the risk that products reach Pakistani consumers before their compliance posture is verified.
Covered activities
The regulatory framework is deliberately broad in scope. PVARA's remit covers virtual asset exchanges, custody services, broker-dealer operations, lending, derivatives, asset management, token issuance, and mining-related services. Firms that thought they might fall outside the perimeter because they do not operate a spot exchange should review whether any of their activities touches these categories before concluding they are not caught.
How Pakistan Reached This Point
The September deadline does not arrive without significant regulatory groundwork. Pakistan's parliament established PVARA as the statutory regulator for the virtual asset sector, and the State Bank of Pakistan subsequently issued guidance to licensed VASPs covering requirements that include segregated client-money accounts. The framework that went live this week is therefore the culmination of a legislative and consultation process rather than a surprise intervention.
PVARA ran a public consultation on its proposed framework between 11 June and 2 July 2026, giving industry participants an opportunity to shape the final rules. The framework that emerged from that process reflects the submissions received and represents the authority's considered position on how Pakistan's virtual asset market should be regulated.
PVARA had also already granted preliminary approvals to a small number of exchanges, allowing them to establish local subsidiaries and prepare full licence applications. Those preliminary approvals can now advance to formal licence applications through the portal that has just gone live. This means some firms are further along the process than others, but even those with preliminary approvals must still navigate the NOC and full licensing steps.
For broader context on how Pakistan's move fits into the global wave of VASP licensing activity during this period, see our coverage of global crypto policy shifts in Q2 2026.
Client-Money and Governance Requirements
The substantive obligations that PVARA has attached to a licence are extensive and have direct consequences for how a VASP's books are maintained and audited.
Segregation of client assets
Licensed providers will be required to keep customer holdings completely separate from their own assets. They cannot lend or pledge customer assets without written consent from the customer. This is a hard legal requirement, not a best-practice recommendation, and it has immediate implications for how client funds are classified on a VASP's balance sheet and how those balances are verified during an audit.
For accounting firms conducting engagements with Pakistani VASPs, segregation is both a compliance question and a financial statement question. If client assets are not properly ring-fenced in the entity's accounting records, an auditor will need to consider whether the financial statements give a true and fair view of the firm's own financial position versus its custodial obligations. Crypto accounting software configured for digital asset businesses needs to be capable of distinguishing proprietary holdings from client-held assets at the wallet and ledger level.
Governance and operational resilience
Beyond asset segregation, PVARA's framework requires licensed VASPs to demonstrate adequate governance structures, acceptable market conduct standards, cybersecurity controls, and operational resilience arrangements. These are not box-ticking exercises: PVARA will need to be satisfied at the application stage that the firm has these in place, and they will presumably be subject to ongoing supervision once a licence is granted.
AML and counter-terrorism financing controls
The framework includes anti-money laundering and counter-terrorism financing (AML/CFT) controls as a licensing prerequisite. Given that Pakistan has historically faced challenges in this area with international standard-setters, it is reasonable to expect that PVARA will apply these requirements with rigour. Firms whose AML programmes were designed for lower-risk jurisdictions or less regulated markets will need to assess whether their existing controls are adequate for the Pakistani licensing standard.
Accounting firms and compliance teams supporting VASP clients should also review our detailed breakdown of VASP due diligence and AML onboarding frameworks to understand what a regulator-grade programme looks like in practice.
Accounting and Tax Implications for Firms and CFOs
The activation of PVARA's licensing portal creates a discrete set of tasks for accounting professionals working with Pakistani VASP clients or with international firms that have exposure to the Pakistani market.
Immediate compliance tasks for accounting firms
The September 5 deadline is less than two weeks from publication of this article. Any client that has been operating a virtual asset business in Pakistan and has not yet filed an NOC application needs to do so immediately. The accounting firm's role in this context is likely to include gathering the financial records and governance documentation that the application will require, confirming that client-money segregation is accurately reflected in the books, and potentially providing attestation or sign-off in support of the application.
Firms should also begin considering what ongoing reporting obligations a PVARA licence will attach. Regulators in comparable jurisdictions typically require periodic financial returns, AML compliance reports, and in some cases audited financial statements prepared to a specified standard. Engaging with the PVARA portal now, before those requirements are formally published, will give firms a head start on configuring their workflows.
Digital asset accounting software considerations
The client-money segregation requirement in particular has implications for how VASPs' general ledgers are structured. Digital asset accounting software used by Pakistani VASPs or their accounting agents will need to be capable of maintaining clear separation between proprietary and client assets at the transaction level, producing reports that demonstrate this segregation to a regulator, and generating audit trails that cover the full lifecycle of a client asset from deposit through to withdrawal or transfer.
If the crypto bookkeeping software currently in use cannot produce segregated reporting at the wallet or sub-account level, the firm will need to either configure it to do so or replace it before PVARA's ongoing supervision requirements come into force. Auditors should verify this capability as part of any engagement with a newly licensed Pakistani VASP.
Cross-border considerations for international firms
The framework explicitly covers overseas VASPs serving the Pakistani market, not just domestically incorporated entities. An international exchange or digital asset platform that has Pakistani users should take legal advice on whether its activities bring it within PVARA's perimeter. If they do, the September 5 deadline applies regardless of where the firm is incorporated. For CFOs at international firms, the question of whether Pakistan exposure creates a licensing obligation is now a live one that needs a documented answer.
What Comes Next
PVARA's portal opening is the start of an enforcement phase, not the end of a policy debate. Firms that miss the September 5 deadline will be operating in breach of Pakistan's virtual asset regulations, which carries legal risk for the entity and potentially for its directors and officers. Those that apply on time will enter a review process whose timeline and detailed criteria are not yet fully public.
The two-track structure (sandbox and NOC) suggests PVARA is trying to accommodate both established businesses and innovative startups, which is a more nuanced approach than some emerging-market regulators have taken. But nuance does not reduce the urgency of the immediate deadline.
Pakistan's regulatory framework is one of a series of country-level licensing regimes that came into force or advanced materially during the first half of 2026. Accounting firms with multi-jurisdictional digital asset practices should treat it as part of a broader pattern that requires a consistent approach to client onboarding, documentation, and ongoing compliance monitoring across markets.
Source: Cointelegraph
Frequently Asked Questions
What is the September 5, 2026 deadline?
Any virtual asset service provider that was operating in Pakistan on or before 5 March 2026 must submit a no-objection certificate application to the PVARA licensing portal by 5 September 2026. Missing the deadline and continuing to operate will constitute a regulatory offence under Pakistan's virtual asset framework.
Does the deadline apply to overseas firms serving Pakistani users?
Yes. PVARA's framework covers both domestically incorporated entities and overseas VASPs that serve the Pakistani market. International firms with Pakistani users should seek legal advice on whether their activities trigger a licensing obligation and act before the September 5 date if they do.
What is the difference between an NOC and a full PVARA licence?
A no-objection certificate is the first formal step in the licensing process. It confirms that PVARA is prepared to engage with a firm's application and is typically a prerequisite for local incorporation. A full licence follows after the firm has satisfied all of PVARA's substantive requirements, including governance, AML/CFT controls, cybersecurity, and client-money segregation.
What does the client-money segregation rule mean in practice for accountants?
PVARA requires licensed VASPs to keep customer assets entirely separate from their own, with no lending or pledging of those assets without written customer consent. For accountants and auditors, this means the VASP's general ledger must clearly distinguish proprietary holdings from custodial balances, and any audit or compliance review will need to verify that segregation at the account and wallet level.
What activities are covered by PVARA's licensing requirement?
The framework covers a wide range of virtual asset activities: spot exchanges, custody, broker-dealer services, lending, derivatives, asset management, token issuance, and mining-related services. Firms that do not operate a spot exchange but that conduct any of these other activities should assess whether they fall within the perimeter before concluding no licence is needed.