Pakistan's Virtual Assets Act 2026, passed by the Senate on 27 February 2026 and by the National Assembly shortly after, established the Pakistan Virtual Asset Regulatory Authority (PVARA) as the country's licensing, regulatory and supervisory body for virtual asset service providers. By August 2026, PVARA had opened its licensing portal and the State Bank of Pakistan had confirmed how licensed and NOC-holding virtual asset providers can access the banking system. This article sets out what the framework requires and the October 2026 step to bring PVARA within the Anti-Money Laundering Act framework.
What the Virtual Assets Act 2026 and PVARA licensing establish
PVARA, first established under a 2025 presidential ordinance and then formalised by the Act, notified detailed licensing regulations and opened its licensing portal on 22 August 2026, establishing 10 licence categories covering exchanges, custody, broker-dealer services, advisory, lending and borrowing, derivatives, asset management, transfer and settlement, and issuance and mining-related services. Each category carries requirements for conduct, prudential standards, technology and AML/CFT compliance.
Existing virtual asset service providers operating before the Act were required to submit applications for a No-Objection Certificate by 5 September 2026 under section 70 of the Act, with continued unlicensed operation after that date constituting an offence. PVARA's chairman has also stated the framework requires licensed providers to segregate customer holdings from their own assets and prohibits lending or pledging customer assets without written consent.
How PVARA-licensed entities connect to the banking system
The State Bank of Pakistan issued BPRD Circular Letter No. 10 of 2026 on 14 April 2026, replacing its 2018 prohibition on dealing in virtual currencies and authorising banks to open accounts for PVARA NOC-holders and licensed VASPs and their customers. Banks are required to independently verify PVARA licences before onboarding any such entity, and to use segregated, Pakistani rupee-denominated client money accounts for VASP transactions, which cannot be used as collateral and must not be commingled with other funds. Entities holding only a PVARA NOC, rather than a full licence, may open limited-purpose accounts, with full banking services reserved for fully licensed providers.
Banks remain subject to their existing AML/CFT obligations under SBP's AML/CFT/CPF Regulations throughout, including enhanced due diligence, risk profiling and suspicious transaction reporting to the Financial Monitoring Unit, regardless of a customer's PVARA licensing status.
PVARA and the wider AML framework
In late October 2026, press reports said the National Executive Committee on AML/CFT approved proposals to bring PVARA within the framework of the Anti-Money Laundering Act, 2010, alongside a rise in the bank currency transaction reporting threshold from Rs2 million to Rs3 million. If implemented, that places virtual asset service providers more explicitly inside the reporting and supervision structure that already applies to banks and other regulated entities. The reports describe committee approvals, so firms should confirm the official notification and its effective date.
Institutions should treat the framework as still developing. Licensing conditions, banking rules and AML Act coverage have each moved within months, and monitoring designs for virtual asset counterparties should be reviewed as each change is confirmed.
What this means for monitoring design
For banks now able to serve PVARA-licensed entities, the practical monitoring task is building a distinct due diligence and ongoing monitoring layer for VASP client money accounts, given their segregated status and the requirement to verify licensing status independently rather than relying on the customer's own representation. For virtual asset service providers themselves, AML/CFT compliance is now an explicit condition of each of PVARA's 10 licence categories, not an optional add-on, and monitoring design should be built into a licence application rather than retrofitted afterwards.
