Virtual assets and the new regulatory architecture: where crypto stands in Pakistan now

For seven years, the legal position on crypto in Pakistan could be stated in one sentence: the State Bank had told the banks not to touch it. That sentence is no longer enough. Between early 2025 and mid-2026 the federal government built, at speed, a regulatory architecture for virtual assets — a policy council, a licensing authority, and a statute. The old prohibition has not been repealed. The two regimes now sit side by side, and businesses need to know which one governs what they do. This briefing states the position as we understand it in May 2026.

The 2018 perimeter, still standing

In April 2018 the State Bank of Pakistan issued a circular directing banks, microfinance banks, payment system operators and payment service providers not to deal in virtual currencies or tokens, and not to facilitate their customers in transacting in them [BPRD Circular No. 03 of 2018 — CITATION TO BE VERIFIED]. The circular did not criminalise holding crypto. It cut crypto off from the regulated banking channel. That is why, for years, Pakistanis traded on offshore exchanges through peer-to-peer arrangements, and why no bank would open an account for a crypto business.

As of May 2026, we are not aware of a formal withdrawal of that circular [TO BE VERIFIED BY REVIEWING LAWYER]. Until the State Bank speaks, a regulated financial institution that processes crypto flows remains exposed, and businesses should assume the banking perimeter still holds except where the new licensing regime expressly opens it.

The turn: 2025

The policy reversal came quickly. In early 2025 the federal government constituted the Pakistan Crypto Council under the Finance Ministry to steer digital-asset policy. In mid-2025 the government announced the allocation of substantial surplus electricity to bitcoin mining and data centres, and announced an intention to hold a state bitcoin reserve — an announcement that drew questions from the IMF given Pakistan's programme commitments [STATUS OF RESERVE AND POWER ALLOCATION — TO BE VERIFIED BY REVIEWING LAWYER].

The legal centrepiece followed: an ordinance promulgated in July 2025 establishing the Pakistan Virtual Assets Regulatory Authority, commonly called PVARA [VIRTUAL ASSETS ORDINANCE 2025 — CITATION AND CURRENT ENACTMENT STATUS TO BE VERIFIED]. Because an ordinance lapses under Article 89 of the Constitution unless Parliament enacts it or the National Assembly extends it, the first question for any client is whether the instrument has since been passed as an Act, re-promulgated, or allowed to lapse. That status should be confirmed on the day of any decision, not assumed [TO BE VERIFIED BY REVIEWING LAWYER].

What the new authority does

Subject to that caveat, the framework as promulgated does four things.

First, it defines virtual assets and virtual asset service providers broadly, tracking the Financial Action Task Force vocabulary: exchange between virtual assets and fiat, exchange between virtual assets, transfer, custody, and participation in issuance.

Second, it makes carrying on virtual-asset business without a licence unlawful, and gives PVARA the power to license, supervise and sanction providers [SCOPE OF OFFENCES AND PENALTIES — TO BE VERIFIED].

Third, it provides transitional tools — a regulatory sandbox and a mechanism for no-action relief — that let a business test a product before the full rulebook exists [TO BE VERIFIED].

Fourth, it layers in Shariah governance and an appellate route against the Authority's decisions [COMPOSITION AND FORUM — TO BE VERIFIED].

What the framework does not yet do is equally important. As of May 2026 we have not seen a complete licensing rulebook, a fee schedule, or a public register of licensed providers [TO BE VERIFIED]. A business "waiting for its PVARA licence" is, for now, a business operating in a gap — and the gap is where enforcement risk lives.

The rules that never went away

Three older regimes continue to apply to virtual-asset activity regardless of PVARA.

Foreign exchange. Buying crypto from abroad requires sending value out of Pakistan, and the Foreign Exchange Regulation Act 1947 and the State Bank's FE Manual permit outward remittances only for authorised purposes through authorised dealers. Purchase of virtual assets is not, to our knowledge, an authorised purpose as of May 2026 [TO BE VERIFIED]. Informal channels — hawala, hundi, peer-to-peer netting — carry their own criminal exposure under the foreign exchange and anti-money-laundering laws.

Anti-money-laundering. The Anti-Money Laundering Act 2010 applies to property derived from predicate offences whatever its form, and FATF standards require virtual asset service providers to be brought in as reporting entities. Whether Pakistani VASPs have yet been formally designated as reporting entities under the Act should be confirmed [TO BE VERIFIED BY REVIEWING LAWYER]. Either way, unexplained crypto wealth invites the same scrutiny as unexplained cash.

Tax. There is no exemption for crypto gains. The Federal Board of Revenue treats income as taxable under the ordinary heads of the Income Tax Ordinance 2001, and undisclosed holdings can be treated as unexplained income or assets under section 111. Whether a dedicated rate or reporting regime for virtual assets has been enacted in the most recent Finance Act should be checked before filing [TO BE VERIFIED].

Enforcement in the meantime

Prosecutions touching crypto in Pakistan have so far tended to be fraud cases — investment schemes and exchange scams charged under the Prevention of Electronic Crimes Act 2016 and the Pakistan Penal Code. The 2025 amendment to PECA replaced the FIA's cybercrime wing with a new investigation agency, the National Cyber Crime Investigation Agency, so the investigator across the table has changed even where the offences have not. For businesses, the practical risk is less a novel crypto offence than an old offence — cheating, criminal breach of trust, money laundering — committed through a new instrument.

What this means for you

If you hold virtual assets personally, disclose them in your wealth statement and keep records of acquisition and funding; the tax exposure from silence is worse than the tax from disclosure. If you run or plan a virtual-asset business, confirm the current status of the 2025 framework before committing capital — whether the ordinance stands as an Act, whether licensing has opened, and whether a sandbox application is available — and do not accept customer funds before you have a licence or written no-action comfort. If you are a bank, EMI or payment provider, treat the 2018 circular as binding until the State Bank formally says otherwise. If you are paying for crypto from Pakistan, use only channels the FE Manual permits; there are currently few or none, and the workaround is the offence. And if a counterparty offers settlement in virtual assets, price the AML and foreign-exchange risk into the decision, in writing, before you agree. The architecture is new. The old walls are still standing inside it.