Pakistan

Licensing, Authorisation & Market Access

State Bank of Pakistan's licensing pipeline for Electronic Money Institutions and Payment System Operators processed multiple new entrants this cycle. SBP granted in-principle approval to Toko Lab Pvt Ltd as an Electronic Money Institution and to Accept Technologies, trading as PayMob, as a Payment System Operator and Payment Service Provider, while granting pilot-operations approval to HubPay Pvt Ltd as an Electronic Money Institution. This High-confidence, T1-sourced finding, drawn directly from an SBP press release, evidences three distinct stages within a single licensing sequence, in-principle approval, pilot operations, and eventual full commercial launch, and confirms that the non-bank side of Pakistan's payments market-access regime is actively processing applicants.

Alongside market entry sits a specific prudential safeguard governing how non-bank licensees may hold customer funds: Electronic Money Institutions are required to hold a segregated Trust Account with a licensed bank for all customer e-money float, kept distinct from the EMI's own operating funds, a direct requirement of SBP's EMI Regulations. This safeguarding structure is the mechanism that allows SBP to extend licensed status to non-bank entities without exposing customer float to the EMI's own commercial risk, and it sits at the centre of the bank-versus-non-bank distinction that runs through Pakistan's payments licensing architecture: EMIs and PSOs are licensed and supervised as a category distinct from banks, yet are required to park customer funds within the banking system itself.

A further, Assessed-confidence, dated data point illustrates how this licence-class distinction plays out commercially: industry reporting indicates that JazzCash and Easypaisa operate under the Payment System Operator category while NayaPay operates under the Electronic Money Institution category, meaning the two licence classes remain functionally distinct market segments even though both fall within SBP's non-bank payment-institution supervisory umbrella. This is a short dated dashboard-tier observation rather than a standalone finding, sourced from an industry blog rather than a primary SBP statement.

Outlook

The near-term marker to watch is whether Toko Lab, PayMob, and HubPay progress beyond their current approval stages toward full commercial launch, which would confirm that this cycle's approvals reflect a functioning licensing pipeline rather than an isolated batch. A further marker is whether additional EMI or PSO approvals follow in subsequent cycles, which would indicate whether SBP's non-bank market-access regime is expanding at a sustained pace.

Licensing, Authorisation & Market Access

Pakistan's legal and regulatory perimeter for virtual-asset activity was reset this cycle by the enactment of the Virtual Assets Act 2026, which converts the Pakistan Virtual Assets Regulatory Authority (PVARA) from a temporary presidential-ordinance body into a permanent statutory regulator. PVARA now holds licensing, suspension, and revocation power over virtual asset service providers, and the Act establishes criminal penalties for unlicensed operation. This finding is rated Assessed confidence: it is corroborated across multiple crypto trade-press outlets, but no primary legislative gazette text was retrieved this cycle, so the statutory detail rests on secondary reporting rather than direct primary-source verification.

A specific market-access consequence of the Act is the Section 70 transitional provision: virtual asset service providers already active in Pakistan before the Act's commencement have a six-month grace period to obtain a PVARA licence or must cease operations. This creates a defined compliance deadline where none previously existed, converting Pakistan's prior unregulated space into one with a formal cutoff for licensing. This grace-period finding is itself rated Assessed, sourced from legal commentary rather than independently corroborated primary legislative text, and is a distinct market-access fact from the Act's headline enactment.

PVARA has moved to operationalise the licensing perimeter it has just been granted: a draft Pakistan Virtual Asset Services Regulations 2026, together with ten activity-specific handbooks covering distinct licence categories, is out for public consultation, with comments closing 2 July 2026 at 4:00 PM Pakistan Standard Time. This is a direct, high-confidence, primary-source finding drawn from PVARA's own consultation notice, and it is the clearest indicator that the licensing regime remains at an interim stage, operators currently hold, at most, a no-objection certificate rather than a full licence, and the activity-specific detail that would define full licensing has not yet been finalised.

A further legal-perimeter consequence of the Act is that virtual asset service providers are now deemed financial institutions under the AML Act 2010, which brings with it inherited obligations including the Travel Rule and proof-of-reserves requirements once PVARA's supervisory framework is operational. This is recorded here as a legal-perimeter fact establishing scope, rather than as an assessment of enforcement in practice. For firms assessing market entry, the practical sequencing is now clearer than at any point since the 2018-era restrictions: the licensing perimeter is fixed in statute, the transitional deadline is fixed by section, and the only open variable is the substantive content of the activity-specific handbooks, which will determine the compliance burden attached to each licence category once finalised.

Outlook

The determinative near-term marker is the 2 July 2026 close of PVARA's consultation on the draft Regulations and handbooks; finalisation would convert the current interim no-objection-certificate regime into a full licensing architecture with activity-specific conditions. A second marker is the practical effect of the Section 70 grace period as its expiry approaches: whether PVARA enforces the cessation requirement against operators that have not obtained a licence, or extends the transitional window, will materially shape the market-access picture for both incumbent and prospective virtual-asset firms in Pakistan.

Operational Resilience & Critical Infrastructure

State Bank of Pakistan issued a Technology Risk Management Framework for Payment Institutions in October 2025, requiring cyber-risk controls, technology governance, business continuity planning, and incident-reporting readiness, with institutions expected to demonstrate readiness by 31 March 2026. This is a Probable-confidence finding, sourced from secondary reporting rather than the primary SBP text, and it applies across both bank and non-bank payment institutions alike, treating operational-resilience obligations as a function of payment-system participation rather than of institutional charter type.

The framework's timing is notable set against this cycle's licensing activity: several non-bank entrants, including Toko Lab, PayMob, and HubPay, received in-principle or pilot-operations approval this cycle, meaning the resilience framework's 31 March 2026 deadline arrives while these newly approved institutions are still working through their own licensing sequence. The deadline therefore functions as a compliance cliff that applies uniformly across the payments sector regardless of how recently an institution obtained its licence.

Outlook

The principal marker to watch is whether payment institutions, and particularly newly licensed non-bank entrants, demonstrate compliance with the framework's cyber-risk, governance, business-continuity, and incident-reporting requirements by the 31 March 2026 deadline. Confirmation of the primary SBP text for this framework, beyond the secondary reporting available this cycle, would also materially strengthen confidence in the finding's precise scope.

Product Innovation & Market Development

The State Bank of Pakistan lifted its seven-year prohibition on bank-crypto dealings this cycle, issuing BPRD Circular Letter No. 10 of 2026 on 14 April 2026. The circular permits licensed banks to open and maintain accounts for virtual asset service providers holding a PVARA no-objection certificate or full licence, replacing the April 2018 directive that had barred such relationships outright. The permitted accounts are structurally narrow rather than a general opening: they must be segregated and PKR-only, and banks themselves remain barred from proprietary crypto trading or holding. This is rated High confidence, corroborated by multiple independent secondary outlets converging on the same circular number and date, though no primary State Bank circular text was retrieved verbatim this cycle.

This is the first formal bank-to-VASP funding bridge Pakistan has had since the 2018 ban, and it is a product-innovation development in the sense that it creates, for the first time, a defined and licit path for fiat funds to move between the banking system and virtual-asset service providers operating under a PVARA licence or no-objection certificate. The bank-side and VASP-side halves of this bridge are both now defined: banks may hold segregated PKR accounts for licensed or NOC-holding VASPs, and VASPs inherit AML Act 2010 financial-institution status once PVARA's supervisory apparatus is operational.

The bridge's terms leave open questions that this cycle's evidence does not resolve: how banks will conduct day-to-day due diligence on the VASPs they are now permitted to bank, whether the PKR-only and segregation requirements will be interpreted narrowly or broadly in practice, and how the arrangement interacts with the draft Pakistan Virtual Asset Services Regulations 2026 once finalised. These are the practical variables that will determine whether the bridge functions as a meaningful new product-development channel or as a narrow, lightly used exception.

Outlook

Watch for any supplementary SBP guidance clarifying account-administration practice under the new circular, and for whether the finalised Regulations, consultation closing 2 July 2026, impose additional bank-facing conditions on the VASP accounts the circular has newly permitted. The interaction between the banking-sector circular and the VASP-licensing statute is the single variable most likely to determine how much real product innovation this bridge enables versus how narrowly it remains confined to a small set of NOC-holding VASPs.