SBP legalises virtual assets under new law

KARACHI: The State Bank of Pakistan (SBP) on Tuesday announced that virtual assets have been legalised in the country through the enforcement of the Virtual Assets Act 2026, introducing a formal regulatory framework for the sector.

In a circular, the central bank said, “The act has been enacted, pursuant to which the Pakistan Virtual Asset Regulatory Authority (PVARA) has been established as the statutory authority responsible for the licensing, regulation, supervision and oversight of virtual asset activities in Pakistan,” adding that the instructions were effective immediately.

The SBP said its regulated entities would be allowed to open bank accounts for businesses licensed by PVARA as Virtual Asset Service Providers (VASPs), provided they fully comply with the conditions laid down by the central bank. According to the circular, “Subject to strict compliance with the conditions outlined herein, SBP Regulated Entities (REs) may open bank accounts of entities duly licensed by PVARA as Virtual Asset Service Providers (VASPs).”

Before taking on a VASP as a client or starting any activity with it, banks and other regulated entities must obtain and keep a copy of the provider’s valid PVARA licence and separately confirm its authenticity with the regulator.

The circular said regulated entities would open separate transactional accounts, described as client money accounts (CMAs), where applicable, to settle authorised transactions of licensed VASPs in line with their business models and the services they are permitted to offer. These accounts must remain strictly separate from other accounts maintained by VASPs, and mixing the firms’ own funds with client funds would not be allowed.

Under the new framework, CMAs will be rupee-denominated and non-remunerative, and will only be used for carrying out authorised transactions of licensed VASPs. The SBP also barred cash deposits and cash withdrawals in these accounts. Money held in CMAs cannot be pledged as collateral or used as security for any financing or credit facility extended to VASPs.

AML and compliance requirements

The central bank said regulated entities would be required to carry out customer due diligence not only under Regulation-2 of the Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing (AML/CFT/CPF) Regulations, but also specifically in relation to VASPs.

This includes collecting enough information to understand the nature and scale of a VASP’s business, the activities it undertakes, how it onboards customers, the type of customer base it serves, and the geographic markets in which it operates.

The SBP directed regulated entities to revise their customer risk profiling models to reflect the risks associated with VASPs. Using the updated models, they will be required to assign appropriate risk ratings and ensure that risk-based controls and monitoring systems are effectively applied.

The circular also said banks and other regulated entities must continuously monitor their relationships with VASPs and report suspicious transactions to the Financial Monitoring Unit (FMU) in line with the Anti-Money Laundering Act 2010. They must comply with all relevant laws and regulations, including the Anti-Money Laundering Act, 2010, and the SBP’s AML/CFT/CPF Regulations.

Limited-purpose accounts and restrictions

The SBP said banks may also open limited-purpose accounts for entities that hold no-objection certificates issued by PVARA so they can complete the formal requirements needed to secure a licence. However, the circular made clear that only after a licence is granted by PVARA may a bank provide additional services, including transactional activity related to virtual assets, and even then only under the conditions set by the central bank.

The central bank also placed restrictions on regulated entities themselves, stating that they will not be allowed to invest in, trade, or hold virtual assets using either their own funds or customer deposits. “The act has been enacted, pursuant to which the Pakistan Virtual Asset Regulatory Authority (PVARA) has been established as the statutory authority responsible for the licensing, regulation, supervision and oversight of virtual asset activities in Pakistan.”

The SBP further said regulated entities would remain responsible for complying with all applicable central bank rules, including foreign exchange regulations, and that entering into arrangements with a VASP would not remove that responsibility.