Licensed by the Fifth of September: What the Virtual Assets Act, 2026 Now Asks of Every Pakistani Exchange, Custodian and Broker

On 26th May 2026 these chambers wrote in these pages that Pakistan had governed an entire asset class for eight years by circular, and that what was then urgently required was that the Pakistan Virtual Assets Regulatory Authority frame and publish its licensing and supervision rules without the delay which had attended the parent law. That has now happened, and it happened quickly. On 21st August 2026 two statutory instruments were notified under the Virtual Assets Act, 2026, being the Pakistan Virtual Asset Services Regulations, 2026 (S.R.O. 1419(I)/2026) and the Pakistan Virtual Asset Services Activity Specific Regulations, 2026 (S.R.O. 1420(I)/2026); on 22nd August 2026 the Chairman of the Authority, Bilal bin Saqib, announced them in a televised address and said that there is now “a clear framework, a licensing process, and a legal front door”; and the application portal opened the same week.

The front door has a closing time. It is 5th September 2026, it is four days away as this is written, and it is not a policy date but a statutory one.

What Section 70 actually requires

Section 70 of the Virtual Assets Act, 2026 speaks to the person who was already in the market when the law arrived. Any person who was providing “Virtual Asset Services” on or before 5th March 2026, a “Transitional Person” in the language of the Authority’s own published pathway, must lodge an application for a “No Objection Certificate” by 5th September 2026, and must otherwise cease operations; and a person who continues to provide “Virtual Asset Services” thereafter without having entered the process commits an offence. The punishment the Act attaches to unlicensed activity is imprisonment for a term up to five years, or a fine up to fifty million Rupees, or both.

Two things follow which are easily missed by a firm reading the newspapers rather than the statute. The first is that the obligation is triggered by a date in the past and not by the size of the business, hence a small peer-to-peer desk which was serving Pakistani customers in February 2026 is a “Transitional Person” on precisely the same footing as an international exchange. The second is that what the date of 5th September 2026 demands is the lodging of an application, and nothing more; therefore a firm which is nowhere near ready to be licensed is not thereby excused from applying, and a firm which does apply has not thereby been licensed.

The count is eleven, not ten

Every report of the notification, from Arab News on 23rd August 2026 to the wire coverage which followed it, described ten licence categories: exchange, custody, broker dealer, advisory, lending and borrowing, derivatives, asset management, transfer and settlement, issuance, and mining. The Authority’s own licensing page, setting out the “Licence Categories” in Schedule I to the Act, lists eleven. The difference is that the press has collapsed into a single line of “issuance” what the Schedule states as two distinct categories, being Asset-Referenced Token Issuance Services, meaning the issue of tokens which purport to hold a stable value by reference to another asset, basket or right, and Fiat-Referenced Token Issuance Services, meaning the issue of tokens referenced to a single fiat currency.

This is not pedantry, since an applicant applies for one or more “Licence Categories” and is authorised only for what it has applied for. A Pakistani issuer which reads the count of ten, applies on “issuance” and later finds that its product is referenced to a basket rather than to the Rupee has applied on the wrong limb of a schedule which distinguishes the two on their face. The remaining nine are Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, Virtual Asset Derivatives Services, Virtual Asset Management and Investment Services, Virtual Asset Transfer and Settlement Services, and Mining Related Virtual Asset Services. A firm that runs an order book, holds client coin and quotes a price on its own account is doing three of them and not one.

The certificate is not the licence

The Act provides three ways in. The “No Objection Certificate” under Section 19 is a preliminary clearance, which the Authority states it aims to issue within sixty calendar days of a complete submission. The licence under Section 21 is the substantive authorisation and it names the “Virtual Asset Services” the holder may provide. The regulatory sandbox under Section 35 is a supervised test for an innovative product, and it leads to a licence only through its own exit criteria.

The published pathway for an existing operator runs in five steps, and the “No Objection Certificate” is the first of them. After it comes registration with the Financial Monitoring Unit, then incorporation of a subsidiary in Pakistan under the Companies Act, 2017 (Act XIX of 2017), and only then the licence application itself. Since the sixty day period runs from a complete submission rather than from the date of filing therefore a thin application lodged on 5th September 2026 stops the statutory clock and starts nothing else; and since local incorporation and a separate registration with a separate authority both stand between the certificate and the licence therefore no firm which begins this work in September 2026 will be trading under licence in October.

The licence and the compliance are two different things

The Crypto Times, writing on 24th August 2026 on the terrorist financing exposure of the new market, put the objection in one sentence: “A formal licence does not automatically make an ecosystem compliant.” That is right as a matter of law and not merely as commentary, because the anti-money laundering duties of a licensed provider are owed under a different statute and to a different body.

The duty to report a suspicious transaction arises under the Anti-Money Laundering Act, 2010 (Act VII of 2010) and runs to the Financial Monitoring Unit, which is why the Authority’s own pathway makes registration with that Unit a separate step and why Section 17 of the Virtual Assets Act, 2026 obliges the Authority to cooperate with the Unit on supervisory and enforcement information. It attaches on suspicion and not on conclusion, hence a compliance department which waits until it can say that a transfer was unlawful has spent the reporting window deliberating. The Authority’s published anti-money laundering and counter-terrorism financing expectations add customer due diligence before onboarding, real time transaction monitoring, sanctions screening against national and international lists, and the retention of transaction and customer records for a minimum of ten years, which for a business founded in 2021 means reconstructing five years of records it may never have kept in a form a supervisor can read.

Behind all of it stands Recommendation 15 of the Financial Action Task Force, which requires that “Virtual Asset Service Providers” be licensed or registered and supervised, and Recommendation 16, the travel rule, on the draft revised Guidance to which these chambers filed comments on 7th August 2026. Pakistan sat on the grey list of the Task Force from June 2018 until 21st October 2022, and Recommendation 15 was one of only two Recommendations still rated partially compliant when the Basel Institute on Governance published its country briefing on 15th December 2022. A licensing regime notified in August 2026 answers the first half of that Recommendation. The second half, supervision, is answered by inspections and by files, not by a portal.

What the fifth of September costs the firm that misses it

By BPRD Circular Letter No. 10 of 2026 of 14th April 2026 the State Bank of Pakistan permitted regulated banks to open and maintain accounts for providers licensed by the Authority and for their customers, and thereby undid for licensed providers the prohibition which BPRD Circular No. 03 of 2018 of 6th April 2018 had imposed on the whole class. The consequence for the firm which lets 5th September 2026 pass is therefore twofold and the second half is the sharper one: it is not only exposed to a criminal provision, it is also outside the only route into the Pakistani banking system that this regime has opened, since that route is expressed by reference to licensed providers.

For the firm which has not yet moved, the work of the next four days is narrow and can be stated exactly. Fix the date on which the business first provided any of the eleven “Licence Categories” to a person in Pakistan, since that single fact decides whether it is a “Transitional Person” at all. Identify every category it touches on the Schedule and not on its own description of itself. Lodge the application for the “No Objection Certificate” by 5th September 2026 even where the corporate limb is unfinished, since the statute asks for the application by that date and asks for completeness only for the running of the sixty day period. Open the Financial Monitoring Unit registration in parallel rather than in sequence. And begin keeping records to the ten year standard from the first day of the process, because the supervisor who eventually asks for them will ask about the period before the licence as readily as about the period after it.

The Authority has announced no extension of 5th September 2026 and has published none. Very unfortunately, the firms most likely to miss it are the ones which spent eight years being told that a circular had already made them illegal, and which therefore learned to treat the state’s instruments as noise. The instrument in field today is an Act of Parliament with a criminal provision attached, hence that habit needs serious reconsideration, and it needs it this week.