Pareesa Afreen 
Dec 03, 2025
Pakistan has rolled out its most far-reaching regulatory framework yet for the country’s digital asset sector on Tuesday with the introduction of the Virtual Asset Service Provider (VASP) Governance and Operations Regulations 2025.
The draft aims to align Pakistan with global Anti-Money Laundering (AML) / Countering the Financing of Terrorism (CFT) standards, including full compliance with the Financial Action Task Force (FATF) Travel Rule.
Pakistan's new rules for crypto industry
The new rules would require all licensed VASPs to collect, verify, and maintain identifying information of both the sender and recipient for any digital asset transfer exceeding Rs 1 million.
The regulators will have on-demand access to this information, which will expand the scope of transaction traceability and oversight across Pakistan's crypto market.
The framework puts almost all crypto-related services under regulatory oversight, ranging from exchange to brokerage, custody, token issuance, derivatives trading, lending, asset management, to settlement services.
The licensed firms should therefore have blockchain analytics tools, real-time monitoring, and internal controls that would detect any coordinated attacks or system abuse to prevent manipulation and financial crime.
Moreover, VASPs must disclose ownership structures, beneficial controllers, and board-level qualifications to ensure accountability for operational integrity.
The reforms have financial and cybersecurity safeguards as a central pillar. A firm is required to maintain minimum paid-up capital for each category of service and deposit 30% of that amount as security with the State Bank of Pakistan.
Cross-border outsourcing will be allowed only if regulators retain full supervisory access.
The cybersecurity standards are some of the strictest proposed in the region, where VASPs would have to implement an authority-approved security framework covering access controls, smart contract audits, monitoring systems, incident response, and continuous testing for vulnerabilities.
