Miss Pakistan's crypto deadline and it's a criminal offense

Pakistan has given crypto firms a two-week window to decide whether they still have a legal business in the country. Miss the September 5, 2026 filing date, and continuing to serve Pakistani users stops being a compliance gap and becomes a criminal offense.

What Is the September 5, 2026 PVARA Deadline, Exactly?

The September 5, 2026 deadline is the statutory cutoff by which any firm that was already providing virtual asset services to Pakistani users on or before March 5, 2026 must submit a No Objection Certificate (NOC) application to the Pakistan Virtual Assets Regulatory Authority (PVARA) — or cease operating. Section 70 of the Virtual Assets Act, 2026 defines these incumbent firms as "Transitional Persons," and the obligation applies identically to Pakistan-domiciled operators and to overseas exchanges serving Pakistani customers .

Quick Answer: Crypto firms serving Pakistani users before March 5, 2026 must file a PVARA No Objection Certificate application by September 5, 2026 or shut down. Operating without filing is a criminal offense carrying up to five years' imprisonment or a Rs. 50 million fine under the Virtual Assets Act, 2026.

PVARA has left no ambiguity about the nature of the date. In its announcement, the authority stated plainly: "Operating without submitting an application after that date is an offense" . That framing matters because it distinguishes the deadline from a grace period. Firms that file on time may keep operating under a transitional supervisory process while PVARA reviews their documentation; firms that do not file are simply unlicensed operators from September 6 onward.

The penalty ceiling under the Act is up to five years' imprisonment or a fine of Rs. 50 million for unlicensed virtual asset activity . Note the disjunction — imprisonment is an available sanction, not merely a theoretical backstop attached to a monetary fine.

The compressed timeline explains why many operators were caught flat-footed:

• March 5, 2026 — the Virtual Assets Act, 2026 commences, establishing PVARA as a permanent federal statutory regulator and fixing the Transitional Person eligibility date .
• April 14, 2026 — State Bank of Pakistan Circular No. 10 of 2026 permits banks to serve PVARA-licensed VASPs, ending the 2018 banking restriction .
• June 11 – July 2, 2026 — public consultation on the draft regulations (reference PVARA/CON/001/2026) .
• Late August 2026 — regulations notified and the licensing portal opens, covering Sandbox, NOC and full VASP Licence tracks; reported August 24, 2026 .
• September 5, 2026 — NOC filing deadline for Transitional Persons.

PVARA framed the speed as deliberate. "In under six months, Pakistan has moved from primary legislation to notified regulations and an open licensing process," the authority said in its press release, distributed via the Associated Press of Pakistan . The practical consequence for incumbents is a filing window of roughly two weeks between the portal opening and the cutoff — which is the entire reason the rest of this guide focuses on triage rather than optimisation.

One structural detail changes the calculus for newcomers: the September 5 date binds only Transitional Persons. Firms that were not already serving Pakistani users before March 5, 2026 face no equivalent cutoff and may submit Sandbox or NOC applications whenever they are ready to meet the requirements .

Are You a 'Transitional Person'? The Decision Checklist

A "Transitional Person" is any firm that was already providing virtual asset services to users in Pakistan on or before March 5, 2026, the commencement date of the Virtual Assets Act, 2026, and it is the single label that decides whether September 5 is your problem. Section 70 of the Act creates the category, and it draws no line between a Karachi-incorporated exchange and an offshore platform with Pakistani account holders (source: Cointelegraph, 2026-08). Run three tests before you decide anything else.

Test 1 — Were you serving Pakistani users before March 5, 2026? The activity list is broad: exchange, custody, brokerage, advisory, lending and borrowing, derivatives, asset management, transfer and settlement, token issuance, and mining or validation infrastructure all sit inside the framework's ten licence categories . The decisive fact is where your users are, not where your entity is registered. PVARA has stated the obligation applies evenly to domestic operators and to overseas firms serving Pakistani users (source: Dawn, 2026-08). If you geo-block Pakistan today but did not on March 4, 2026, treat yourself as in scope until counsel tells you otherwise.

Test 2 — If yes, file an NOC application before September 5, 2026. That filing is what buys you continuity: firms that submit on time keep operating under a transitional supervisory process while PVARA reviews their documentation . The submission, not the approval, is the deadline. PVARA's language leaves little room for interpretation — "Operating without submitting an application after that date is an offense" (source: The Express Tribune, 2026-08). The exposure behind that sentence is up to five years' imprisonment or a fine of Rs. 50 million for unlicensed virtual asset activity .

Test 3 — If you launched after March 5, 2026, you are a new entrant. No cutoff applies to you, and you may submit Sandbox or NOC applications as and when you meet the requirements . That freedom is narrower than it sounds: the absence of a deadline is not permission to operate. Launching into the Pakistani market without a sandbox admission, an NOC under Section 19, or a full licence puts you in the same unlicensed-activity bracket as a Transitional Person who missed the filing window.

• Serving Pakistani users on or before March 5, 2026 → Transitional Person. File the NOC application by September 5, 2026.
• Overseas entity, Pakistani customers, no local incorporation → Still a Transitional Person. Same date, same consequence.
• Started serving Pakistan after March 5, 2026 → New entrant. No deadline, but no legal launch without a Sandbox admission, NOC, or licence.
• Filed on time → Continue operating under transitional supervision during review.
• Did not file → From September 6, 2026, an enforcement target rather than a pending applicant.

The asymmetry is worth naming plainly. Filing costs documentation effort and disclosure; not filing converts a compliance question into a criminal one overnight. Binance and HTX, which secured preliminary approvals in December 2025, still could not begin operations at that stage — a reminder that even favourable early positioning does not substitute for a completed application file .

Sandbox vs. NOC vs. Full VASP Licence: Which Track Fits You?

PVARA's licensing portal opens three distinct application routes — the Regulatory Sandbox, No Objection Certificates, and full VASP Licences — and only one of them satisfies the September 5, 2026 obligation for firms already serving Pakistani users . Licensing itself is structured as a two-stage process: an applicant intending to incorporate in Pakistan either enters the sandbox to test a product, or first obtains a No Objection Certificate under Section 19 of the Virtual Assets Act, 2026, and then applies for a full licence once incorporation is complete . Picking the wrong door does not pause the clock.

The most consequential misreading available right now is treating the sandbox as a deadline escape hatch. It is not. The sandbox exists for controlled testing of products that have not launched, whereas a Transitional Person — a firm providing virtual asset services on or before the Act's March 5, 2026 commencement date — needs an NOC application on file by September 5 to keep operating lawfully . New entrants who never served Pakistani users before that date sit in a different position entirely: they face no equivalent cutoff and may file for the sandbox or an NOC whenever they meet the requirements .

Precedent already shows how the stages separate in practice. Binance and HTX received preliminary approvals in December 2025 and can now proceed toward full licences, but neither was permitted to begin operations at that stage . An NOC is a clearance to progress and, for Transitional Persons, a shield that keeps the lights on during review — it is not a trading authorisation. Firms that read it as one risk building a Pakistani user base on a permission they do not yet hold.

The practical decision rule is narrow. If you served Pakistani users before March 5, 2026, the NOC route is not a preference — it is the only route that addresses your deadline, and the sandbox will not stand in for it . If you did not, sequence matters more than speed: choose the sandbox when the product needs supervised validation, or go straight to a Section 19 NOC when the model is established and incorporation is the near-term step.

The 10 PVARA Licence Categories — Which One Matches Your Business?

The PVARA Regulations establish 10 licence categories, each attached to a specific virtual asset activity and each carrying its own conduct, prudential, technology and AML/CFT requirements . Category selection is not administrative housekeeping: a custody licence and a token-issuance licence are not interchangeable filings, and the obligations attached to each differ in substance. Firms filing before the September 5, 2026 cutoff need to map their live activities to categories before they open the application, because the requirements they will be assessed against follow from that mapping .

Two practical points follow from the structure. First, minimum paid-up capital is tied to the licence category, but the specific figures per category were not disclosed in the reporting reviewed . That is an open gap, not a reason to delay a filing — the deadline is a filing deadline, and firms can flag capital-threshold uncertainty in their submission rather than wait for numbers that may only surface during PVARA's review. Note that PVARA's own licensing pages were not retrievable during this research, so category-level capital tables may exist on the portal without having been picked up in press coverage.

Second, multi-category operators will likely need more than one application. An exchange that also holds client assets touches at least categories 1 and 2; a derivatives venue that self-custodies touches 6 and 2; a token issuer that also runs settlement rails touches 9 and 8. Broader obligations spanning consumer protection, governance, market integrity, cybersecurity, operational resilience, AML/CFT controls and segregated client assets apply across the framework, but the activity-specific layer stacks per category . Firms should scope every revenue line against the list above before filing — an under-scoped application is a slower path to a licence than an accurate one.

Banking Access Just Unlocked — Does It Change Your Filing Math?

Yes — banking access is now the strongest financial argument for filing before September 5. State Bank of Pakistan Circular No. 10 of 2026, issued on April 14, 2026, permits regulated financial institutions to open accounts for PVARA-licensed virtual asset service providers, including segregated Client Money Accounts . That ends an eight-year restriction dating to the 2018 State Bank directive that barred financial institutions from dealing in cryptocurrency . Licensing is now the only remaining gate between a virtual asset business and normal rupee rails.

The mechanics matter as much as the permission. Banks must maintain separate, non-remunerative rupee client accounts, so customer funds cannot sit inside a provider's operating balance . Licensed providers must also keep customer holdings separate from their own assets and cannot lend or pledge them without written consent . For firms that have historically run a single pooled treasury, this is an architectural change to reconcile before a bank onboards them — commingling is a substantive compliance failure under the segregated-client-asset obligations that run through the framework , not a bookkeeping preference.

Read the circular narrowly, though. What opened is banking for VASPs, not bank exposure to virtual assets. Commercial banks remain prohibited from trading, investing in, or holding virtual assets using their own capital or customer deposits . Any business model that assumed a bank counterparty would warehouse tokens, provide crypto-denominated credit, or take balance-sheet positions alongside a licensed provider should be re-scoped now, because no licence category supplies that permission.

The filing math follows directly. Before April, an unlicensed operator and a would-be licensee faced the same banking wall, which made the compliance spend look optional. That symmetry is gone. A licensed firm can hold segregated rupee client accounts, settle with local counterparties, and prove custody arrangements to auditors and partners; an unlicensed one relies on informal rails while carrying exposure to penalties of up to five years' imprisonment or a fine of Rs. 50 million for unlicensed virtual asset activity . Against an estimated 40 million Pakistani virtual asset users , losing rupee on-ramp access is a market-share decision, not just a legal one.

Practical read: if your treasury and custody design cannot yet support non-remunerative segregated client accounts, treat that as a build task to start immediately rather than a reason to delay the NOC application. Filing preserves the transitional supervisory window while PVARA reviews documentation ; missing September 5 removes both the banking path and the right to operate at all.

The Shariah Question: The Risk That Could Outlast the Deadline

The Shariah review is the one variable that a timely NOC filing cannot neutralize. On June 10, 2026, a fatwa targeted the use of digital assets to purchase goods and services, naming stablecoins such as USDT as failing a foundational test of Islamic jurisprudence . Because the Virtual Assets Act, 2026 itself mandates a Shariah Advisory Committee, that religious-law finding is not external commentary — it feeds directly into the body that will help define what PVARA-licensed firms may actually offer (source: The Block, 2026-08).

PVARA has engaged the issue directly rather than deferring it. Chairman Bilal bin Saqib, who also serves as Minister of State for Digital Assets, met scholar Mufti Muhammad Taqi Usmani around July 11, 2026 to explore a Shariah-compliant path for the framework . Reporting indicates PVARA is working to protect asset-backed tokens from falling under a broader prohibition — a signal that the likely outcome is a narrowing of permissible activity rather than a wholesale reversal, though nothing in the published record confirms where that line will be drawn.

For a filing decision, the exposure is uneven across licence categories. The June 10 fatwa focused on payments use — digital assets exchanged for goods and services — not on custody, trading infrastructure, or validation. That distribution matters when you assess your own risk:

• Highest exposure: token issuance involving fiat-referenced tokens, and any payment-adjacent transfer and settlement product, since these sit closest to the fatwa's stated concern .
• Moderate exposure: lending and borrowing, and derivatives — categories where interest-bearing and speculative structures invite separate jurisprudential scrutiny.
• Lower exposure: custody, exchange, broker-dealer, advisory, virtual asset management, and mining and validation infrastructure, which are closer to service provision than to the contested monetary function.

The decision implication is narrow and worth stating plainly: filing by September 5, 2026 secures transitional status and the right to keep operating under supervision while PVARA reviews documentation , but it does not lock in the scope of what you filed for. The Shariah Advisory Committee could narrow permissible token types or activity after applications are already in. The practical response is to file for the categories your business needs, document a fallback product configuration that survives a payments-focused restriction, and avoid committing capital to a single fiat-referenced token line until the Committee's position is published.

How to File: The Practical Steps Before September 5

Filing before the September 5, 2026 cutoff is a four-step sequence: confirm Transitional Person status, assemble the compliance documentation set, submit through PVARA's licensing portal, and then operate under transitional supervision while the authority reviews the file. The portal opened in the week ending August 24, 2026 and handles all three application routes — Regulatory Sandbox, No Objection Certificate, and full VASP Licence . Firms serving Pakistani users from overseas are covered by the same timetable as domestic ones .

Step 1 — Fix your status and your category. Only firms already providing virtual asset services on or before March 5, 2026, the Act's commencement date, are Transitional Persons bound by the deadline; new entrants may apply whenever they meet the requirements . Map your live activity onto the 10 licence categories before drafting anything, because paid-up capital minimums are tied to the category you select .

Step 2 — Assemble the documentation. PVARA's regulations attach activity-specific conduct, prudential, technology and AML/CFT requirements to every category, alongside consumer protection standards, governance structures, market integrity controls, cybersecurity and operational resilience, and segregated client assets . Custody arrangements deserve particular attention: licensed providers must keep customer holdings separate from their own balance sheet and cannot lend or pledge them without written client consent .

Step 3 — Submit, and submit on time. The filing itself is the compliance act. PVARA has stated plainly that "operating without submitting an application after that date is an offense" , with unlicensed activity exposed to up to five years' imprisonment or a fine of Rs. 50 million . Applicants intending to incorporate locally either enter the sandbox for product testing or obtain a Section 19 NOC first, then apply for the full licence after incorporation .

Step 4 — Treat filing as the start of supervision, not the end of it. Firms that file on time may continue operating under a transitional supervisory process while PVARA reviews their documentation . Preliminary approval is not authorisation to trade: Binance and HTX received NOCs in December 2025 and still were not permitted to begin operations at that stage . Budget for follow-up queries, remediation of gaps, and a period of operating under conditions rather than a clean licence.

The compression of the timetable is deliberate. "In under six months, Pakistan has moved from primary legislation to notified regulations and an open licensing process," PVARA said in its launch statement, distributed via the Associated Press of Pakistan (source: Dawn, 2026-08). A regulator moving at that speed is unlikely to extend a date it built the entire transitional regime around.

What Happens After September 5? Signals to Watch

After September 5, 2026, the question shifts from "who filed?" to "what does PVARA do with the filings?" — and four observable signals will answer it. Transitional Persons who submitted a No Objection Certificate application by the cutoff continue operating under a transitional supervisory process while their documentation is reviewed . Those who did not are, by PVARA's own wording, committing an offense, exposed to penalties of up to five years' imprisonment or a fine of Rs. 50 million . Everything after that is enforcement, and enforcement is where frameworks either acquire credibility or lose it.

The four signals worth tracking:

• A published register of applicants. PVARA has not committed to disclosing who filed. If it does, that list becomes the cleanest available proxy for compliance depth in a market the regulator itself sizes at roughly 40 million virtual asset users . Silence would be its own signal — regulators that intend to enforce usually name the compliant first.
• Binance and HTX converting preliminary approvals. Both received preliminary approvals in December 2025 without permission to begin operations . Their progression to full VASP licences is the first end-to-end test of the two-stage pipeline. If the two most-watched applicants stall, smaller firms should budget for longer review windows.
• Minimum paid-up capital figures per licence category. The Regulations tie capital thresholds to each of the ten licence categories, but per-category figures were not disclosed in the reporting available at launch . Until they publish, no applicant can finalize a funding plan — this is the single most consequential unpublished number in the regime.
• Whether the Shariah Advisory Committee narrows scope. The June 10, 2026 fatwa on payment use of digital assets remains unresolved . A restrictive committee position could shrink permissible activity inside categories that are already licensed.

The wider stake is comparative. Pakistan ranked third globally in the 2025 Chainalysis Global Crypto Adoption Index , which means other emerging-market regulators will read the post-deadline outcome as a template — or a caution. A framework that moved from primary legislation in March 2026 to an open portal by August has demonstrated speed; it has not yet demonstrated follow-through.

The concrete takeaway: if you served Pakistani users on or before March 5, 2026, file the NOC application before September 5 even if your documentation is incomplete — filing preserves your right to operate during review, while missing the date converts a paperwork problem into a criminal one. If you are a new entrant, there is no cutoff pressing on you: build to the ten-category requirements, wait for the capital figures to publish, and enter through the sandbox or Section 19 NOC route when your compliance stack is genuinely ready.

Last updated: 2026-08-25. Reviewed against PVARA's launch statement as reported by Dawn, The Express Tribune and Cointelegraph; PVARA's own portal pages were not directly retrievable at the time of writing.

Frequently asked questions

What happens if I miss the September 5, 2026 PVARA deadline?

If you were operating virtual asset services in Pakistan on or before March 5, 2026 and you do not submit a No Objection Certificate application by September 5, 2026 , continuing to operate becomes a criminal matter rather than a compliance lapse. PVARA has stated plainly that "operating without submitting an application after that date is an offense" . Unlicensed virtual asset activity carries penalties of up to five years' imprisonment or a fine of Rs. 50 million under the Virtual Assets Act, 2026 . Filing on time has the opposite effect: applicants may keep operating under a transitional supervisory process while PVARA reviews their documentation, so the application itself — not the licence — is what preserves legal standing on September 6 .

Does the deadline apply to foreign exchanges with Pakistani users, or only Pakistan-based firms?

It applies evenly to both. PVARA's framing of "Transitional Persons" covers any entity that was providing virtual asset services on or before March 5, 2026 — the commencement date of the Virtual Assets Act, 2026 — including overseas firms serving Pakistani users, not only companies incorporated or physically present in Pakistan . That extraterritorial reach is deliberate: PVARA has cited an estimated 40 million Pakistani virtual asset users and Pakistan's third-place ranking in the 2025 Chainalysis Global Crypto Adoption Index when inviting regulated international firms to apply . Offshore operators serving Pakistani retail flow should assume the September 5 cutoff applies to them, and that geo-restricting Pakistani users is the alternative to filing.

I launched my crypto business after March 5, 2026 — do I still need to file by September 5?

No. If you began providing virtual asset services after March 5, 2026, you are not a Transitional Person, and no equivalent cutoff applies to you. New entrants may submit Regulatory Sandbox or NOC applications as and when they meet the regulatory requirements . That is a timing concession, not a permission to operate unsupervised: the licensing requirement itself still binds, so serving Pakistani users without an application in the system carries the same exposure to the Act's penalty provisions. The practical read for a post-March-2026 startup is to use the extra runway to build the compliance stack — governance, AML/CFT controls, cybersecurity, segregated client assets — and enter through the sandbox or Section 19 route when documentation is genuinely ready .

What's the difference between an NOC and a full VASP Licence?

An NOC is the preliminary clearance; the full VASP Licence is the operating authorisation. Licensing runs as a two-stage process: an applicant intending to incorporate in Pakistan either enters the Regulatory Sandbox for product testing, or first obtains a No Objection Certificate under Section 19 of the Virtual Assets Act, 2026, and then applies for a full licence after incorporation . The distinction is not academic. Binance and HTX received preliminary approvals in December 2025 and can now proceed toward full licences, but neither was permitted to begin operations at that stage . Holding an NOC means you have cleared a gate and may proceed; it does not mean you may serve customers. The full licence is where the ten activity-specific categories, minimum paid-up capital and ongoing conduct obligations attach.

Can Pakistani banks now hold crypto or work with VASPs?

Banks can service licensed VASPs, but they cannot hold virtual assets themselves. State Bank of Pakistan Circular No. 10 of 2026, issued April 14, 2026, permits regulated financial institutions to open accounts for PVARA-licensed VASPs, including segregated Client Money Accounts, ending an eight-year restriction dating to the 2018 SBP directive that barred financial institutions from dealing in cryptocurrency . Those client accounts must be separate, non-remunerative rupee accounts so customer funds are not commingled, and licensed providers must keep customer holdings apart from their own assets, with no lending or pledging without written consent . Commercial banks remain prohibited from trading, investing in, or holding virtual assets with their own capital or customer deposits . The banking channel opens for licensed intermediaries only — which is another reason the September 5 filing matters operationally, not just legally.

Enjoyed this article? Subscribe to get new stories by email whenever they're published.

Subscribe