Cryptocurrency: An Interview with Shahid Jamal Tubrazy

Pakistan’s cryptocurrency and virtual asset market is entering a new regulatory era under the Virtual Assets Act, 2026, and the Pakistan Virtual Assets Regulatory Authority (PVARA). For international cryptocurrency exchanges, fintech companies, blockchain businesses, and virtual asset service providers, the central legal question is no longer simply whether Pakistan represents a promising market.

Instead, the more important question is:

How can a foreign cryptocurrency exchange legally establish and operate a regulated business in Pakistan?

To explore this question, a representative of a foreign cryptocurrency company interviewed Shahid Jamal Tubrazy, Cryptocurrency & Fintech Lawyer, about company incorporation, PVARA licensing, AML/CFT compliance, banking arrangements, technology requirements, and the broader regulatory strategy for entering Pakistan.

---

Cryptocurrency Regulation in Pakistan: Where Should a Foreign Exchange Start?

Foreign Company Representative:

Our company operates an international cryptocurrency exchange and is considering entering Pakistan. What should be our first legal step?

Shahid Jamal Tubrazy:

The first step should be a complete regulatory assessment of the proposed Pakistan business model.

I would not recommend immediately incorporating a company or submitting a PVARA application before identifying every service the exchange intends to offer to Pakistani users.

For example, we would first need to determine whether the company intends to provide:

• Spot cryptocurrency trading
• Fiat-to-crypto exchange
• Crypto-to-crypto exchange
• Custody services
• Wallet services
• Brokerage
• Virtual asset transfers
• OTC trading
• Lending
• Staking
• Derivatives
• Token issuance
• Investment or portfolio management

Each activity can create different legal and regulatory considerations. Therefore, the company should map its products and services before selecting a licensing route.

The appropriate strategy is:

Business Model → Regulatory Classification → Licence Category → Corporate Structure → Compliance Framework → PVARA Application

This approach can help prevent a foreign company from establishing the wrong corporate structure or applying for an inappropriate authorization.

For international businesses, this initial regulatory mapping is particularly important because an existing cryptocurrency licence in another country does not automatically mean that the same business model can operate in Pakistan.

---

Cryptocurrency Market Entry Through PVARA

Foreign Company Representative:

What regulatory pathway would you recommend for a foreign cryptocurrency exchange entering Pakistan?

Shahid Jamal Tubrazy:

For an established foreign cryptocurrency exchange seeking to create a regulated Pakistani operation, my preliminary approach would generally be to examine the NOC-to-Licence pathway.

PVARA currently provides different regulatory pathways, including:

1. Regulatory Sandbox
2. No Objection Certificate (NOC)
3. Full VASP Licence

The appropriate route depends on the company’s business model, proposed products, level of innovation, and regulatory requirements.

For a conventional international cryptocurrency exchange, the NOC-to-Licence route may be particularly relevant where the objective is to establish a licensed Pakistani entity.

Generally, the regulatory project can involve:

• Initial regulatory assessment
• Submission of the appropriate application
• Preliminary regulatory approval
• AML/CFT registration and compliance
• Establishment of the Pakistani company
• Preparation of corporate and governance documentation
• Application for the relevant VASP licence
• Completion of applicable regulatory requirements

However, companies should not assume that every foreign cryptocurrency business will follow exactly the same route.

Instead, the regulatory pathway should be determined after examining the actual products and services.

---

Does a PVARA NOC Authorize Cryptocurrency Exchange Operations?

Foreign Company Representative:

Does obtaining a PVARA NOC allow us to immediately operate a cryptocurrency exchange?

Shahid Jamal Tubrazy:

No. This distinction is extremely important.

A PVARA NOC should not automatically be presented as equivalent to a full VASP operating licence.

An NOC can represent an important stage in the regulatory process. However, the company’s permitted activities ultimately depend upon the applicable legal framework, regulatory conditions, and the authorization actually granted.

Therefore, my advice to a foreign cryptocurrency company would be:

Do not launch Pakistan-facing regulated services merely because an NOC has been obtained unless the specific activity is clearly authorized under the applicable regulatory framework.

In other words, the NOC should be treated as an important regulatory milestone rather than the end of the licensing process.

This distinction can be particularly important for international exchanges because marketing, onboarding customers, custody, trading, transfers, and other services may have separate regulatory implications.

---

Cryptocurrency Companies and Pakistani Corporate Incorporation

Foreign Company Representative:

Do we need to establish a Pakistani subsidiary?

Shahid Jamal Tubrazy:

For a foreign cryptocurrency exchange seeking a full regulated operation in Pakistan, establishing an appropriate Pakistani corporate entity is a central part of the regulatory strategy.

The local company should not be treated as merely a paper entity.

Instead, it should have an appropriate:

• Corporate structure
• Board and management arrangements
• Governance framework
• Compliance function
• Risk management system
• Technology arrangements
• Operational controls
• Regulatory reporting capability

The incorporation process should also be coordinated with applicable requirements of the Securities and Exchange Commission of Pakistan (SECP).

Furthermore, the PVARA regulatory analysis should be completed before the final corporate structure is selected.

This is important because the company’s ownership, management, activities, capital structure, and governance arrangements can all become relevant during regulatory due diligence.

---

Foreign Ownership of a Pakistani Cryptocurrency Business

Foreign Company Representative:

Can our foreign parent company own the Pakistani subsidiary?

Shahid Jamal Tubrazy:

Foreign ownership should be examined in the context of the applicable Pakistani corporate, investment, tax, foreign exchange, and regulatory requirements.

The key issue for PVARA will not simply be the nationality of the parent company.

Instead, regulators may require detailed information concerning:

• Shareholders
• Ultimate Beneficial Owners
• Controllers
• Directors
• Senior management
• Source of funds
• Source of wealth
• Corporate structure
• Regulatory history
• Existing licences

Therefore, the foreign parent company and its key controllers should be prepared for detailed regulatory due diligence.

I would recommend conducting a pre-application review of the entire corporate group before submitting the application.

This can identify potential regulatory issues before they become obstacles during the licensing process.

---

Can a Foreign Cryptocurrency Licence Be Used in Pakistan?

Foreign Company Representative:

Will our existing foreign cryptocurrency licence be recognized in Pakistan?

Shahid Jamal Tubrazy:

An existing foreign cryptocurrency licence can be valuable evidence of regulatory experience. However, it should not automatically be treated as a substitute for PVARA authorization.

For example, an exchange holding a licence in another jurisdiction may demonstrate:

• Existing regulatory experience
• Established AML/CFT controls
• Corporate governance
• Operational history
• Financial capability
• Regulatory supervision

Nevertheless, Pakistan’s own regulatory requirements must still be independently satisfied.

Therefore, I would include the foreign company’s existing licences and regulatory history as part of the application package while also conducting a complete Pakistan regulatory gap analysis.

There should be no assumption that a foreign VASP licence automatically provides passporting rights into Pakistan.

---

Cryptocurrency Exchange Licence Categories Under PVARA

Foreign Company Representative:

If we operate a global cryptocurrency exchange, will one PVARA licence cover all of our services?

Shahid Jamal Tubrazy:

Not necessarily.

A cryptocurrency exchange can provide multiple services, and each service may require separate regulatory analysis.

The PVARA framework identifies several categories of virtual asset services, including:

• Advisory Services
• Broker-Dealer Services
• Custody Services
• Exchange Services
• Lending and Borrowing Services
• Virtual Asset Derivatives Services
• Virtual Asset Management and Investment Services
• Virtual Asset Transfer and Settlement Services
• Asset-Referenced Token Issuance Services
• Fiat-Referenced Token Issuance Services
• Mining Related Virtual Asset Services

Consequently, a typical cryptocurrency exchange should conduct product-by-product regulatory mapping.

For example, Exchange Services may be relevant to the trading platform.

Custody Services may become relevant where the company controls customer assets or private keys.

Broker-Dealer Services may need consideration depending upon the company’s execution and dealing model.

Similarly, Transfer and Settlement Services may need to be assessed depending upon how customer assets move through the platform.

Additional products such as derivatives, lending, investment management, or token issuance should be reviewed separately.

Ultimately, the correct approach is:

Product → Activity → Regulatory Classification → Applicable Licence

---

AML/CFT Compliance for Cryptocurrency Businesses

Foreign Company Representative:

What AML and KYC requirements should we expect?

Shahid Jamal Tubrazy:

AML/CFT compliance will be one of the most important components of a cryptocurrency business operating in Pakistan.

A foreign cryptocurrency exchange should expect to establish systems addressing:

• Customer identification
• Customer due diligence
• Enhanced due diligence
• Beneficial ownership verification
• KYC
• KYB
• Transaction monitoring
• Suspicious transaction reporting
• Sanctions screening
• Politically Exposed Person screening
• Record keeping
• Customer risk assessment
• Blockchain transaction monitoring
• Travel Rule compliance where applicable

Furthermore, the company’s compliance framework should be appropriate for the risks associated with virtual assets.

A global AML programme can provide a useful starting point. However, I would not recommend simply copying a foreign compliance manual and submitting it unchanged.

Instead, the company should conduct a Pakistan-specific compliance gap analysis.

This analysis should identify differences between the company’s existing global framework and the requirements applicable to its proposed Pakistani operation.

---

Cryptocurrency Exchanges, FMU and goAML Requirements

Foreign Company Representative:

Do we need to register with the Financial Monitoring Unit and goAML?

Shahid Jamal Tubrazy:

AML registration and compliance are important components of the PVARA regulatory pathway.

The NOC process can involve regulatory steps relating to AML registration and the goAML system.

However, registration alone is not sufficient.

The compliance programme should be operational rather than simply a document prepared for licensing purposes.

Therefore, a cryptocurrency exchange should have:

• Written AML/CFT policies
• Customer-risk procedures
• Trained compliance personnel
• Transaction monitoring
• Escalation procedures
• Suspicious transaction reporting processes
• Record-retention systems
• Sanctions controls

In addition, the company should regularly test and update these systems as its cryptocurrency products and customer base develop.

---

Banking for Cryptocurrency Businesses in Pakistan

Foreign Company Representative:

Can we open a Pakistani bank account after obtaining an NOC?

Shahid Jamal Tubrazy:

Banking arrangements require careful analysis because an NOC holder and a fully licensed VASP are not necessarily in the same regulatory position.

The State Bank of Pakistan has issued guidance concerning banking arrangements for PVARA NOC holders and licensed VASPs.

Therefore, a foreign cryptocurrency company should not assume that obtaining an NOC provides unrestricted access to every type of banking or financial service.

Instead, the company should separately analyse:

• Corporate banking
• Customer funds
• PKR settlement
• Virtual asset transactions
• Foreign exchange
• Cross-border remittances
• Parent-company funding
• Treasury arrangements
• Customer payment flows

Importantly, banking and funds-flow planning should be carried out alongside the PVARA licensing strategy.

A technically compliant cryptocurrency exchange can still face operational difficulties if its banking and settlement structure has not been planned properly.

---

Technology and Cybersecurity for Cryptocurrency Exchanges

Foreign Company Representative:

Can we simply use our existing global technology platform in Pakistan?

Shahid Jamal Tubrazy:

Possibly, but the platform should be subject to a Pakistan-specific regulatory and operational review.

A foreign cryptocurrency exchange should be prepared to demonstrate appropriate controls relating to:

• Wallet architecture
• Private-key management
• Hot and cold wallet arrangements
• Access controls
• Cybersecurity
• Incident response
• Penetration testing
• Disaster recovery
• Business continuity
• Customer asset segregation
• Outsourcing arrangements
• Technology risk management

Furthermore, cryptocurrency businesses should pay particular attention to customer asset protection and cybersecurity because a security incident can create both financial and regulatory consequences.

Therefore, technology should not be treated as a separate technical issue.

It should form part of the overall licensing and compliance project.

---

Capital Requirements for Cryptocurrency Businesses

Foreign Company Representative:

How important is the minimum paid-up capital requirement?

Shahid Jamal Tubrazy:

Capital is an important part of the licensing process, but it should not be viewed in isolation.

The applicable capital requirement can depend upon the relevant licence category and regulatory requirements.

Consequently, a cryptocurrency company should conduct capital planning alongside:

• Regulatory classification
• Corporate structuring
• Financial projections
• Operational expenses
• Compliance costs
• Cybersecurity investment
• Technology infrastructure
• Customer protection arrangements

Furthermore, companies should verify the latest legally effective capital requirements before making investment decisions.

Regulatory requirements can evolve as the virtual asset framework develops. Therefore, relying on outdated information can create unnecessary compliance risks.

---

Should a Cryptocurrency Exchange Use the PVARA Regulatory Sandbox?

Foreign Company Representative:

Would you recommend the Regulatory Sandbox for an established international exchange?

Shahid Jamal Tubrazy:

It depends on the product.

The Regulatory Sandbox can be useful where a company is proposing a genuinely innovative virtual asset product that requires controlled testing under regulatory supervision.

For a conventional international cryptocurrency exchange entering Pakistan with an established business model, the NOC-to-Licence pathway may be more directly relevant.

However, where the foreign company proposes:

• A new tokenization model
• A novel stablecoin structure
• Blockchain-based settlement
• Innovative DeFi products
• New Web3 infrastructure
• Experimental financial technology

the Regulatory Sandbox may deserve serious consideration.

Therefore, the company should not select the Sandbox simply because it appears easier or faster.

Instead, it should determine whether its proposed cryptocurrency product genuinely fits the purpose of regulatory experimentation.

---

The Most Important Legal Advice for Foreign Cryptocurrency Companies

Foreign Company Representative:

What is your overall legal strategy for bringing our cryptocurrency exchange into Pakistan?

Shahid Jamal Tubrazy:

I would not approach PVARA merely as an application-form exercise.

Instead, I would treat the project as a complete regulatory market-entry programme.

My recommended strategy would involve the following steps.

Step 1: Cryptocurrency Regulatory Perimeter Analysis

Identify every cryptocurrency and virtual asset activity the company intends to provide in Pakistan.

This should include the exchange, custody, transfers, brokerage, lending, derivatives, token issuance, investment services, and any other proposed products.

Step 2: Product-by-Product Licence Mapping

Determine which PVARA licence categories may apply to each service.

This prevents the company from assuming that a single authorization automatically covers every product.

Step 3: Corporate Structuring

Establish the appropriate Pakistani legal entity and governance structure.

The corporate structure should be designed with PVARA, SECP, tax, investment, and operational requirements in mind.

Step 4: Foreign Parent Due Diligence

Review:

• Corporate ownership
• Ultimate beneficial owners
• Directors
• Senior management
• Regulatory history
• Existing cryptocurrency licences
• Source of funds
• Source of wealth
• Financial capability

Step 5: Compliance Gap Analysis

Compare the foreign company’s existing compliance framework against Pakistani requirements.

This is particularly important for an international cryptocurrency company that already operates under regulatory frameworks in other jurisdictions.

Step 6: AML/CFT Framework

Localize the company’s:

• AML policy
• KYC procedures
• KYB procedures
• Transaction monitoring
• Sanctions controls
• Suspicious transaction reporting
• Risk assessment

Step 7: Technology and Custody Review

Analyse:

• Cybersecurity
• Wallet architecture
• Private-key management
• Customer asset protection
• Access controls
• Incident response
• Business continuity

Step 8: PVARA Application Strategy

Prepare the appropriate NOC, Sandbox, or VASP licensing application based upon the actual cryptocurrency business model.

Step 9: SECP Incorporation

Coordinate the establishment of the Pakistani company with applicable SECP requirements.

The corporate entity should be established as part of the broader regulatory strategy rather than as an isolated incorporation exercise.

Step 10: Banking and Funds-Flow Analysis

Ensure that banking, PKR settlement, foreign exchange, cross-border funding, and customer funds arrangements are compatible with the regulatory structure.

Ultimately, the objective should not simply be:

“How do we obtain a PVARA NOC?”

The correct question should be:

“How do we establish a fully compliant and sustainable regulated cryptocurrency business in Pakistan?”

---

Cryptocurrency Regulation: Final Thoughts from Shahid Jamal Tubrazy

Foreign Company Representative:

What final advice would you give to an international cryptocurrency company considering Pakistan?

Shahid Jamal Tubrazy:

Pakistan represents a potentially significant market for international cryptocurrency exchanges, fintech companies, blockchain businesses, and other virtual asset service providers.

However, foreign companies should avoid treating market entry as a simple company-incorporation exercise.

Instead, a successful cryptocurrency market-entry strategy should integrate:

• PVARA licensing
• Corporate incorporation
• AML/CFT compliance
• FMU requirements
• Banking
• Cybersecurity
• Customer asset protection
• Corporate governance
• Technology compliance
• Risk management
• Ongoing regulatory reporting

PVARA’s regulatory framework establishes a formal authorization process for virtual asset businesses operating within Pakistan.

Therefore, international cryptocurrency companies should conduct regulatory classification before launching services, establishing a local company, or marketing regulated virtual asset products to Pakistani users.

Early legal planning can reduce the risk of unnecessary restructuring, compliance delays, licensing problems, and operational obstacles later in the process.

The cryptocurrency industry is developing rapidly, and Pakistan’s regulatory environment is evolving alongside it. Consequently, businesses should monitor new legislation, regulations, regulatory guidance, licensing requirements, and banking developments continuously.

For international exchanges and fintech companies, the most effective approach is therefore to combine cryptocurrency regulatory analysis, corporate structuring, AML/CFT compliance, PVARA licensing, and operational planning from the beginning.

For cryptocurrency and fintech legal consultancy relating to PVARA licensing and virtual asset regulation, readers may also visit Crypto Law Consult.