Cryptoverse Legal

Call Directions Website

Cryptoverse Legal A Crypto and Blockchain law firm advising tech start-ups on DAOs, DeFi, FinTech, Web 3.0, Metaverse.

PVARA Regulation 90 requires notification without delay where a matter materially affects—or is reasonably likely to aff...
13/10/2026

PVARA Regulation 90 requires notification without delay where a matter materially affects—or is reasonably likely to affect:

▪ Regulatory compliance;
▪ Financial soundness;
▪ Operational resilience;
▪ Client-asset safety; or
▪ Fitness, propriety or governance.

Notifiable matters can include material cyber incidents, legal breaches, insolvency events, significant proceedings, unresolved client-asset discrepancies and major control failures.

The initial notification does not need every forensic detail. It should provide the information reasonably available, explain the known impact and containment measures and identify what remains under investigation.

Supplemental updates should follow as the facts develop.

Waiting for a final root-cause report can turn a well-managed incident into a late-reporting breach.

Create a regulatory-notification matrix before an incident occurs—and test it through simulations.

PVARA Regulation 112 requires a VASP holding or controlling client virtual assets to demonstrate that its liabilities to...
10/10/2026

PVARA Regulation 112 requires a VASP holding or controlling client virtual assets to demonstrate that its liabilities to clients are fully matched by reserve assets or equivalent safeguarding arrangements.

Independent validation is required every six months unless PVARA requires an earlier review. The validation report must be submitted within 30 days after the six-month period.

But a wallet snapshot does not answer every question.

A reliable assurance process should establish:
▪ Whether the assets exist;
▪ Whether the VASP controls them;
▪ Whether all client liabilities were included;
▪ Whether assets are encumbered;
▪ Whether customer and company assets are segregated; and
▪ Whether reconciliation records are complete.

Cryptographic verification can support assurance, but it does not replace legal ownership analysis, reconciliation or insolvency protection.

Build proof of reserves into the custody-control framework—not as a last-minute public-relations exercise.

A PVARA licensee holding or controlling client assets must keep them identifiable, segregated and protected.Client money...
08/10/2026

A PVARA licensee holding or controlling client assets must keep them identifiable, segregated and protected.

Client money should be held in designated accounts with a bank licensed by the State Bank of Pakistan. It cannot be used to pay the VASP’s expenses or another client’s obligations.

Client virtual assets must be separated from the VASP’s proprietary holdings through appropriate legal, wallet and ledger arrangements.

The VASP must not use, pledge, lend, stake, encumber or rehypothecate client assets unless expressly permitted and supported by the customer’s prior explicit, informed consent.

Where client-money or virtual-asset movements occur daily, reconciliation must occur at least daily.

Material unresolved discrepancies must be reported to PVARA without delay, supported by root-cause analysis and remediation.

Review the entire safeguarding chain—from customer contract and bank account to ledger, wallet and private key.

PVARA requires licensed VASPs to maintain technology governance and cybersecurity controls proportionate to their risk.T...
06/10/2026

PVARA requires licensed VASPs to maintain technology governance and cybersecurity controls proportionate to their risk.

The framework should cover:

▪ Board and senior-management oversight;
▪ Information-security responsibility;
▪ Authentication and privileged access;
▪ Secure development and change management;
▪ Logging, monitoring and threat detection;
▪ Patching and vulnerability management;
▪ Backups, recovery and business continuity;
▪ Third-party technology risk; and
▪ Incident response and remediation.

Where the VASP controls customer wallets, additional measures apply to key generation, storage, signing, backup, recovery and access revocation.

Material smart contracts require independent security review before deployment or significant upgrades and periodically thereafter.

A policy is not enough. PVARA may request testing results, findings and evidence that weaknesses were remediated.

Test whether your cybersecurity documentation matches the live wallet and technology architecture.

Under PVARA Regulation 100, virtual asset transfers meeting or exceeding the PKR equivalent of USD 1,000 trigger Travel ...
05/10/2026

Under PVARA Regulation 100, virtual asset transfers meeting or exceeding the PKR equivalent of USD 1,000 trigger Travel Rule requirements.

The VASP must obtain and transmit or make available prescribed information, including:

▪ Originator’s full name;
▪ Originator account number, wallet address or unique identifier;
▪ Additional identification information required by law;
▪ Beneficiary’s name; and
▪ Beneficiary account number, wallet address or unique identifier.

Ordering VASPs must hold the required information before initiating the transfer.

Beneficiary VASPs must obtain it before making received assets available.
Transfers involving unhosted wallets are not automatically prohibited, but they require risk-based controls.

Travel Rule software alone is insufficient. The procedure must address missing, conflicting, late or unreliable data.

Map the Travel Rule data flow before selecting a technology provider.

PVARA-licensed VASPs must maintain an operating AML/CFT/CPF framework—not merely collect identity documents.The framewor...
02/10/2026

PVARA-licensed VASPs must maintain an operating AML/CFT/CPF framework—not merely collect identity documents.

The framework should include:

▪ Customer and beneficial-owner identification;
▪ Purpose and intended nature of the relationship;
▪ Source-of-funds information;
▪ Risk classification;
▪ Enhanced due diligence for higher-risk cases;
▪ Ongoing sanctions and transaction monitoring;
▪ Suspicious activity escalation; and
▪ Recordkeeping and periodic review.

The enterprise-wide AML risk assessment must be reviewed at least annually and promptly after material changes to products, customers, geographies or threats.

Where required due diligence cannot be completed, the VASP generally should not establish or continue the relationship or execute the transaction.

Third-party KYC providers may support compliance, but responsibility remains with the licensed VASP.

Can your VASP demonstrate how its AML risk assessment changes real customer controls? Request an AML framework review.

PVARA requires marketing and promotional communications to be accurate, clear, current and not misleading.The rule appli...
30/09/2026

PVARA requires marketing and promotional communications to be accurate, clear, current and not misleading.

The rule applies across:

▪ Websites and mobile apps;
▪ Social media and livestreams;
▪ Paid advertisements;
▪ Influencers and affiliates;
▪ Referral campaigns;
▪ Token promotions; and
▪ Foreign campaigns targeting Pakistan.

A disclaimer hidden below the fold will not necessarily correct a misleading headline.

Claims such as “guaranteed returns,” “risk-free,” “fully insured,” “PVARA approved” or “zero fees” require careful legal and factual substantiation.

A VASP also remains responsible where content is commissioned, approved, facilitated or distributed on its behalf by a creator, group company or marketing agency.

Before publishing a Pakistan crypto campaign, put every claim, risk warning and influencer script through compliance approval.

PVARA’s fit-and-proper assessment reaches the individuals and entities capable of influencing the VASP.A Controller gene...
28/09/2026

PVARA’s fit-and-proper assessment reaches the individuals and entities capable of influencing the VASP.

A Controller generally includes a person holding or controlling at least 20% of voting power, ownership or share capital. Significant influence may also create control below that threshold.

PVARA considers matters such as:

▪ Integrity and regulatory history;
▪ Professional competence and experience;
▪ Financial soundness;
▪ Criminal, civil and disciplinary matters;
▪ Insolvency, defaults and tax history;
▪ Conflicts of interest; and
▪ Source of wealth and source of funds.

Disclosures must be complete and consistent across application forms, affidavits, group records and public registers.

Fit and proper is a continuing requirement. New investigations, financial difficulties or conflicts may require escalation after licensing.

Identify every Controller and disclosure issue before PVARA finds it during due diligence.

PVARA expects a licensed VASP to operate as a coherent, accountable institution.The governance framework should demonstr...
25/09/2026

PVARA expects a licensed VASP to operate as a coherent, accountable institution.

The governance framework should demonstrate:

▪ At least three directors;
▪ Appropriate independent oversight;
▪ Relevant virtual asset, technology, risk and compliance experience;
▪ Clear Board and committee responsibilities;
▪ Pakistan-based management and escalation capacity;
▪ A resident Compliance Officer with sufficient authority; and
▪ Effective challenge of revenue-generating functions.

Local directors should understand the business and make meaningful decisions—not simply approve instructions received from an overseas parent.

Board minutes, delegated authorities, employment arrangements and system access should confirm that the organisational chart reflects reality.

A famous foreign parent cannot substitute for accountable governance inside the Pakistan licensee.

Does your proposed Pakistan VASP demonstrate genuine local decision-making? Contact CRYPTOVERSE Legal for a governance and substance review.

A realistic PVARA budget separates several financial obligations.Paid-up capital: PKR 15 million to PKR 500 million depe...
24/09/2026

A realistic PVARA budget separates several financial obligations.

Paid-up capital: PKR 15 million to PKR 500 million depending on the licence category, subject to possible risk-based additions.

Net liquid assets: At least 1.2 times adjusted monthly operating expenses.
Client assets: Segregated customer property that cannot fund the VASP’s operations.

Token reserves: For FRT and ART issuers, assets equal to 100% of outstanding redemption liabilities.

Insurance: Risk-based professional indemnity, commercial crime, cyber and other appropriate coverage.

Regulatory fees: Processing, licensing, supervision and renewal charges—separate from capital.

A company may satisfy its capital floor but fail the liquidity test after spending cash on systems, salaries or other illiquid assets.

Before applying, build a category-specific financial-resources model with a realistic regulatory buffer.

Address

Hamad Ben Mohammed Street
Fujairah

Opening Hours

Monday 09:00 - 18:00
Tuesday 09:00 - 18:00
Wednesday 09:00 - 18:00
Thursday 09:00 - 18:00
Friday 09:00 - 18:00

Telephone

+971522352234

Website

Alerts

Be the first to know and let us send you an email when Cryptoverse Legal posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category