A new digital order

On July 8, Pakistan quietly took one of its boldest regulatory steps yet: enacting the Virtual Assets Ordinance, 2025.

With a stroke of the president’s pen, over half a decade of crypto confusion gave way to legal clarity. In its place stands an ambitious new framework that not only legalises virtual asset services but also establishes one of Pakistan’s most muscular financial regulators: the Pakistan Virtual Assets Regulatory Authority or PVARA.

The PVARA is unlike any civilian financial regulator Pakistan has seen. While it performs familiar functions like licensing, supervision, and enforcement, it does so with unprecedented teeth. Armed with sweeping civil and criminal authority, the PVARA can impose penalties of up to Rs100 million or five per cent of a VASP’s annual turnover. Its decisions are insulated from interference, appeals lie only to the Supreme Court and its powers extend to search, seizure, testimony compulsion and direct criminal prosecution.

The ordinance has been given overriding effect, superseding any conflicting laws, except in foreign exchange matters, where the State Bank will continue to retain its authority. With a board composed of the country’s most powerful economic actors, including the governor of the State Bank and the federal secretaries for finance, law and IT, it appears the PVARA will have the final word on nearly all matters relating to virtual assets, governing from the core of the state’s financial and economic machinery.

The ordinance defines a ‘virtual asse’ as any digitally represented value that can be traded, transferred, or used for payment or investment. This includes cryptocurrencies, stablecoins, asset-backed tokens and security tokens. However, not all digital assets are covered: tokens limited to closed ecosystems (such as in-game currencies or loyalty points) and non-financial NFTs (like digital art) are explicitly excluded.

At the same time, the law has been careful not to allow digital wrappers to bypass established financial regulation, recognising that not all virtual assets are created equal. Accordingly, when a token confers rights akin to shares, debt or other financial instruments, it does not escape capital markets scrutiny. These ‘security tokens’ continue to fall within the ambit of the Securities Act, 2015, remaining subject to oversight by the SECP as well as the PVARA.

From token exchanges to digital custody and lending, the ordinance casts a wide regulatory net over Pakistan’s virtual asset ecosystem. While the licensing framework is uniform in structure, capital requirements vary by service category.

The path to becoming a licensed VASP involves three key steps: first, securing a No Objection Certificate (NOC) from the PVARA; second, incorporating a company under the Companies Act, 2017; and third, submitting a complete license application to the PVARA (along with the prescribed fees), including the company’s constitutional documents, a business plan, particulars of its controllers and if the applicant intends to deal in security tokens, proof of compliance with the Securities Act, 2015. The PVARA must acknowledge applications within seven days, though the law is silent on decision timelines. Notably, while the law requires licensing fees, it does not specify how the funds will be utilised.

But getting licensed is just the beginning. VASPs must maintain a physical presence in Pakistan, have at least one resident decision-maker, and meet capital and compliance obligations across the board. They must also adhere to AML/CTF rules, publish transparent white papers, file returns and undergo regular audits. Custodians face stricter rules: segregating client assets, securing private keys and proving reserves via cryptographic audits. Token issuers pegged to fiat or assets must hold high-quality liquid reserves (like cash or government bonds), in segregated accounts, under custodians approved by the PVARA and the State Bank.

To foster innovation, the law introduces a regulatory sandbox: a controlled testing ground for new products. Participants submit detailed proposals outlining benefits, risks, mitigation strategies, and exit plans. If accepted, they can operate in a supervised trial for up to 18 months; after which they must either apply for a full license or exit the market.

The arrival of a legal framework is a necessary first step, but not a guarantee of progress. Whether this law delivers on its promise will depend on its practical implementation: the speed and clarity of licensing, the inclusiveness of the ecosystem and the depth of expertise guiding it. Much will rest on the composition and intent of the PVARA’s leadership.

Will the board bring together the technical, legal, and commercial acumen needed to foster a credible regulatory environment? Or does its high-level political makeup signal a different ambition – to centralise control and gatekeep an industry whose financial potential is increasingly difficult to ignore?

In a country where effective regulators often become inconvenient ones, the real test may be whether the PVARA was built to empower or to control. Whether that proves to be a strength or a vulnerability will define the future of crypto in Pakistan.

The writer is an Islamabad-based lawyer and partner at HKN, Legal Practitioners and Advisers. She is a graduate of King’s College London and can be reached at: mariam12saleem@gmail.com