In March 2026, Pakistan’s National Assembly passed the Virtual Assets Act, 2026 (the Act), formally establishing the Pakistan Virtual Asset Regulatory Authority (PVARA) as the country’s dedicated regulator for virtual assets. Pakistan’s stance toward crypto assets has shifted from broad prohibition to active exploration. The passage of the Act marks Pakistan’s formal entry into a new era of compliance-based supervision and sets an important benchmark for virtual-asset regulation in South Asia. This article reviews the core provisions of the Virtual Assets Act, 2026, outlines Pakistan’s crypto-tax and regulatory landscape, analyzes the significance of the Act for Pakistan, and offers compliance takeaways for market participants.
On July 8, 2025, Pakistan promulgated the Virtual Assets Ordinance, 2025, which had already put in place a relatively comprehensive legal framework for virtual-asset regulation. The Virtual Assets Act, 2026 does not create an entirely new system from scratch. Rather, it converts that ordinance from a temporary legal instrument into formal legislation and further refines a number of specific provisions.
The Act contains twelve chapters. It covers the licensing and market entry of Virtual Asset Service Providers, segregation of customer assets, anti-money laundering and counter-terrorist financing, dedicated rules for stablecoins and the tokenization of real-world assets, market conduct, administrative sanctions, and criminal liability, forming a full regulatory chain from licensing to enforcement.
Chapter 2 of the Act (section 6) formally establishes the Pakistan Virtual Asset Regulatory Authority (PVARA). It is set up as an autonomous regulatory body with perpetual succession and independent legal personality. Its key powers mainly include (sections 7-9): licensing, regulating, and supervising Virtual Asset Service Providers and Issuers; assessing, determining, and classifying digital assets on a substance-over-form basis to determine the applicable regulatory treatment; setting and enforcing conduct, AML, CFT, and other anti-illicit-finance requirements; imposing administrative sanctions, revoking licenses, and referring matters for criminal proceedings; and entering into cooperation or mutual-assistance arrangements with domestic and foreign regulators to facilitate information-sharing and coordinated action.
Chapter 3 of the Act sets out the licensing framework for Virtual Asset Service Providers. The key provisions include (sections 18-23):
(1) Scope of regulated services: this includes Advisory Services, Broker-Dealer Services, Custody and Administration Services, Exchange Services, Lending and Borrowing Services, Virtual Asset Derivatives Services, Virtual Asset Management and Investment Services, Virtual Asset Transfer and Settlement Services, Virtual Assets Issuance Services, and Mining-related Virtual Asset Services.
(2) Application process: an applicant must first apply to PVARA for a No-Objection Certificate. After completing company incorporation, it must then apply for a formal license.
(3) Fit-and-proper criteria: Controllers, Sponsors, Chief Executive Officers, Directors, and other Key Individuals must satisfy the fit-and-proper criteria prescribed by PVARA, and these requirements apply on an ongoing basis.
(4) License types: PVARA may grant a formal license and may also, on a case-by-case basis, grant a provisional or limited-scope license.
(5) Public register: PVARA maintains and publishes a register of Licensees on its official website, including the name, license number, permitted services, and current regulatory status of each Licensee.
Chapter 1 of the Act defines a Virtual Asset (sections 2-3) as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, while excluding digital representations of fiat currency, securities, or other financial assets regulated under other laws, except where they are represented, issued, or transferred using distributed ledger technology. The Act also makes clear that Virtual Assets are not legal tender. At the same time, whether a regulated Virtual Asset, a regulated Virtual Asset Service Provider, or a qualifying service provider falls within scope is to be assessed on the basis of its substantive features, underlying function, method of use, or economic effect, regardless of its name or legal structure. PVARA is expressly empowered to make such assessments and determinations, and to consult with other relevant regulators where necessary. Accordingly, the Act clearly adopts a substance-over-form regulatory principle in matters such as asset characterization and licensing status.
The Act imposes a set of general obligations on Virtual Asset Service Providers, mainly including: (1) licensed operation and continuing compliance. For example, they must maintain the statutory minimum paid-up capital and financial resources, submit periodic returns and financial statements, and obtain prior approval for material changes in control or business; (2) segregation of customer assets. Customer Assets must be kept separate from proprietary assets in segregated accounts, and may not be rehypothecated, lent, pledged, or otherwise encumbered without valid written consent; appropriate key-management controls must also be implemented; and (3) AML and CFT obligations, including customer due diligence, suspicious transaction reporting, and record-keeping. In addition, the Act contains specific provisions for business models such as the issuance of Fiat-Referenced Tokens and Asset-Referenced Tokens, virtual-asset custody services, and mining-related activities.
Chapter 10 further clarifies the types of misconduct and the applicable penalties (sections 54-61). For example, providing an unlicensed Virtual Asset Service is punishable by up to five years’ imprisonment and a fine of up to PKR 50 million. Where there is a systemic threat, market manipulation, fraud, a cybersecurity breach, or any other serious risk to customers or market integrity, the Authority may issue an order temporarily suspending specified Virtual Asset Services or freezing related assets. In addition to criminal prosecution and the Authority’s emergency intervention powers, violations of the Act may also trigger administrative sanctions such as monetary penalties and license revocation.
Pakistan’s regulation of crypto assets has followed a clear path from broad prohibition to gradual opening-up. In 2018, the State Bank of Pakistan issued a ban prohibiting financial institutions from participating in virtual-currency transactions, leaving crypto assets in a legal gray area. At that stage, there was no dedicated legislation, and private transactions were largely conducted through informal channels. As the global crypto market expanded and domestic digitalization needs grew, an absolute ban became increasingly difficult to sustain. In 2023, the State Bank of Pakistan launched a feasibility study on a central bank digital currency. In 2024, the government began systematic research on stablecoins and real-world-asset tokenization applications, laying practical groundwork for later legislation. During this phase, the regulatory stance shifted from a blanket ban to a more pragmatic approach of study and standardization. In 2025, the Pakistan Crypto Council (PCC) was formally established to advance the institutional development of the crypto industry at the government level. In July 2025, the Virtual Assets Ordinance, 2025 for the first time put in place a relatively comprehensive regulatory framework for virtual assets. In March 2026, the Virtual Assets Act, 2026 was formally passed, and PVARA became the standing regulator, marking the beginning of a new era of compliant operations.
Pakistan has now developed a tiered regulatory structure in which the Pakistan Virtual Asset Regulatory Authority (PVARA) serves as the lead regulator, while the State Bank of Pakistan (SBP) and the Securities and Exchange Commission of Pakistan (SECP) participate within their respective mandates. Specifically, the Act assigns PVARA the core responsibilities of licensing, regulating, and supervising Virtual Assets and Virtual Asset Service Providers, with AML, CFT, and cybersecurity requirements serving as major regulatory levers, and with a clear emphasis on alignment with international standards. For tokens with securities attributes, the SECP retains its existing regulatory jurisdiction. Matters involving foreign exchange control and payment systems require coordination with the SBP. In terms of institutional powers, PVARA holds rulemaking, licensing, administrative enforcement, and investigative powers. Section 9 of the Act expressly empowers PVARA to assess, determine, and classify any Virtual Asset, and to consult with the SBP, the SECP, and other authorities where appropriate. This means that whether an asset falls within scope, and which authority should regulate it, is to be determined through inter-agency coordination under a substance-over-form approach.
On the tax side, Pakistan has not yet enacted a standalone tax regime specifically for crypto assets. Instead, it currently brings them within the existing tax system. The Act provides that every Virtual Asset Service Provider licensed under the Act shall comply with the obligations imposed under the Income Tax Act, 2001 and any Rules or Regulations issued by the Federal Board of Revenue. In the absence of dedicated tax rules, crypto-related income may in practice be categorized and taxed within the existing income-tax framework based on the relevant facts and the nature of the income, but the precise classification and tax computation will still depend on subsequent legislation, official guidance, and case-specific circumstances. Public reporting also indicates that the Federal Board of Revenue is consulting on legislative and policy approaches to crypto taxation.
Although the Virtual Assets Act, 2026 has only recently taken effect, it has made Pakistan’s crypto-regulatory landscape clearer than ever before. For market participants seeking to enter the Pakistani market, this is a key policy window for strengthening their compliance frameworks.
For Issuers, the first task is to assess, based on the substantive features, underlying function, method of use, or economic effect of the relevant asset, whether it falls within the Virtual Asset regime or is in substance subject to another regulatory framework, such as securities regulation. That determination will define the applicable compliance perimeter. If the asset falls within the virtual-asset regime, the Issuer must then satisfy the specific requirements applicable to that asset type. The issuance of a Fiat-Referenced Token requires 100% reserve backing and a redemption mechanism at par without undue delay. The issuance of an Asset-Referenced Token requires a fully backed reserve of the underlying assets. Algorithmic tokens, as a rule, may not be issued unless specifically permitted by Regulations and subject to the prescribed safeguards.
For Virtual Asset Service Providers, one especially important point is the transitional arrangement in section 70. Providers that were already offering Virtual Asset Services before the Act came into force must submit a full license application within six months after commencement. Before a formal license is granted, they may continue their existing services during the application period only if they have submitted a complete application and continue to comply with the Act’s core obligations, particularly those relating to customer asset protection and AML, CFT, and CPF compliance. Otherwise, they face the risk of having to cease operations.
For investors, the public register of Licensees provides a practical way to verify the licensing status of trading platforms, custodians, and other service providers. Before using a platform, investors can check the PVARA website to confirm whether the provider holds a valid license and thereby reduce asset-related risks. Investors should also strengthen their tax-compliance awareness, stay alert to policy developments relating to crypto transactions, and retain complete records of transaction time, counterparty, price, quantity, and other relevant details for future reporting or tax-filing purposes.
In essence, the significance of Pakistan’s Virtual Assets Act, 2026 lies not in creating an entirely new regulatory regime, but in placing the previously developed framework on a formal and lasting statutory footing, and in using PVARA as a dedicated authority to turn legal text into actual supervision and implementation. For both industry participants and investors in Pakistan’s crypto market, a clearer regulatory framework brings both opportunity and challenge. It strengthens protection for asset security and data privacy, while allowing businesses to evaluate compliance costs and business models within clearer regulatory boundaries. At the same time, as Pakistan’s virtual-asset regulation moves into its next phase, market participants will face a new and higher bar in their compliance response.
FinTax offers crypto accounting suite, tax calculator and professional tax consulting services.
