PVARA Regulations 2026: Custody and Key Management Rules
Quick answer. Custodians must use MPC, multisig or equivalent distributed control where appropriate, so no single actor moves assets; keep most assets offline where appropriate; reconcile at least daily; prove reserves; and use SOC 2 Type II or equivalent wallet vendors. Exchanges disclose per-asset audit status.
Video transcript
Pakistan's crypto custody rules are now in force. PVARA's 2026 regulations set how custodians and exchanges must control keys, wallets and client assets.
PVARA notified two regulations on August 21, 2026, effective on gazette notification. The Activity Specific Regulations hold most custody controls.
Where the custody model's scale and risk call for it, key management needs MPC, multisig or equivalent distributed control, so no single person or system moves client assets alone. Key components are separated and independently tested.
The majority of client assets sit offline, where appropriate, under a board-approved allocation framework. Backups stay apart from primary keys.
Reconcile at least daily. A material discrepancy not fixed within 24 hours goes to PVARA without delay, and shortfalls are made good at once.
Proof of reserves needs independent validation every six months, or sooner if PVARA asks.
Wallet vendors play only a limited support role. Custodians pick them on institutional capability and experience, acceptable oversight, SOC two Type Two or equivalent, segregation and resilience, and reconciliation and audit support.
Exchanges must disclose, per asset, whether it had an independent smart contract audit and when. That is disclosure, not an audit mandate. Recheck dates after any token upgrade.
Read the full article for the applicant evidence checklist, or talk to Guardian about custody reviews, smart contract audits and your PVARA evidence pack.
The Two Regulations and Scope
Pakistan's custody rules are now in force, not in draft. PVARA notified two regulations on August 21, 2026, and both took effect on gazette notification. Pakistan Virtual Asset Regulatory Authority
This explainer covers PVARA's custody and exchange security controls and the evidence behind each. It is not legal advice.
The Pakistan Virtual Asset Services Regulations, 2026 (SRO 1419(I)/2026) apply to anyone carrying on virtual asset services in or from Pakistan. Each activity needs a valid licence for its category.
The Activity Specific Regulations (SRO 1420(I)/2026) add rules for each category, with Custody Services regulations 5 to 16 holding most controls below. Exchange Services regulation 6 sets the asset disclosures.
Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.
Key Management: No Single Actor
A custodian must keep effective control over private keys, seed phrases, signing devices and credentials. That means segregated duties, secure generation and storage, and auditable approvals. Pakistan Virtual Asset Regulatory Authority
Access needs multi-factor, multi-approval or multisignature controls as appropriate. Access nobody needs must be revoked promptly.
Services regulation 61 binds any licensee that holds keys or can approve transactions over customer assets, exchanges included. It requires minimizing single points of failure, segregated signing duties, auditable key-access records and, under 61(3), regular testing.
Where appropriate to the custody model's scale and risk, key management must meet four tests. First, it uses multi-party computation (MPC), multisignature or equivalent distributed control.
Second, no single individual or system can move client assets alone, so check policy engines and admin consoles too. Third, key components are separated geographically, organizationally and logically.
Fourth, key management undergoes periodic independent testing and validation. Custody regulation 4(6) adds independent assurance over safeguarding, reconciliation and key management, with reports available to PVARA half-yearly.
The whole provision is risk-based, so record why your design fits your scale. Our multisig vs MPC comparison covers how each design enforces a quorum.
Offline Allocation and Backups
Custodians need a risk-based wallet-allocation framework. It must limit hot or online holdings to levels that match operational needs and risk appetite. Pakistan Virtual Asset Regulatory Authority
The majority of client assets must sit in secure offline or equivalent environments, where appropriate. The board approves the framework and reviews it periodically.
Majority is the only threshold the text sets. Our hot, warm and cold wallets guide covers how to tier storage.
Key and seed backups must be stored separately from primary keys, under controls at least equivalent to those on the primary keys.
Custodians also need procedures for lost, stolen, corrupted or compromised credentials. They cover asset protection, communications, cooperation with authorities and, where relevant, emergency migration.
Reconciliation and Reserves
Custody regulation 9 requires client-asset reconciliation at least daily, as does Services regulation 111 where movements are processed daily. Higher volumes, asset values or risk call for more frequent runs. Pakistan Virtual Asset Regulatory Authority
Each run compares client ledgers with onchain wallet balances or equivalent evidence. It accounts for pending and unconfirmed transactions, and flags unexplained breaks or shortfalls.
A material discrepancy not fixed within 24 hours must be reported to PVARA without delay, with its known cause, impact and remediation. Updates follow as facts develop.
A shortfall must be made good at once from the custodian's own resources or other arrangements. Losses cannot be allocated to clients unless the Act, the regulations and the client agreement expressly permit it.
Custodians must keep proof-of-reserves or equivalent procedures. They must show, on an ongoing basis, that client-asset liabilities are fully matched by safeguarded holdings or equivalent arrangements.
Services regulation 112(3) requires independent validation of that showing every six months, or sooner if PVARA asks. The report is due within 30 days after each period.
Neither text prescribes one proof design. Our guide on how to verify proof of reserves explains what a Merkle proof covers and misses.
Breaks can start in contract code. In Guardian's RAAC Core Contracts review, finding L-08 (Low, resolved) showed ERC20 liquidations emitting zero collateral in the LiquidationFinalized event, although the collateral had moved. Guardian
No direct fund loss was shown, but an indexer or reconciliation job reading that event would misstate collateral. Reconcile against balances, not events alone.
Our Asia-Pacific reconciliation comparison sets Pakistan's daily clock beside Korea, Hong Kong and Australia.
Incidents and Reporting Clocks
Custody regulation 16(4) requires an incident log that records near misses as well as actual losses. Pakistan Virtual Asset Regulatory Authority
| Trigger | Rule | Notice to PVARA |
|---|---|---|
| Material discrepancy unfixed after 24 hours | Custody regulation 9 | Without delay; final report generally within 30 days |
| Client-asset shortfall | Custody regulation 9(6) | Immediate make-good; notify PVARA and affected clients without delay |
| Key loss, cyber breach, misallocation or significant return delay | Custody regulation 16(3) | As soon as practicable, within any timeframe PVARA sets |
| Material cyber or continuity event | Services regulation 67 | Within 24 hours of detection; interim in 5 working days; final in 30 calendar days |
Wallet Infrastructure Providers
A custodian may use a wallet infrastructure provider only in a limited support capacity. Ultimate responsibility and effective control of client assets stay with the custodian. Pakistan Virtual Asset Regulatory Authority
Outsourcing agreements must set responsibilities, segregation standards, reporting duties and audit rights. PVARA must get audit, inspection, access and information rights, and client assets must stay inside the approved custody framework.
Vendors take on these duties by contract, so confirm yours accepts PVARA's access rights before filing.
The regulations set no SOC 2 scope, though PVARA may add evidential requirements for wallet providers by instrument (regulation 15(9)).
Check that the report covers the wallet service you use, and pair it with an independent review of the signing stack.
Our third-party wallet provider comparison sets these duties beside Hong Kong, Japan and Australia.
The custodian's selection criteria must include, at a minimum:
- Institutional-scale operational capability, and custody or wallet infrastructure experience.
- Regulatory oversight in a jurisdiction PVARA accepts.
- SOC 2 Type II, or an equivalent certification PVARA accepts.
- Segregation, resilience, business continuity and, where applicable, insurance arrangements.
- Support for reconciliation, audit and supervisory reporting.
Exchange Smart Contract Audit Disclosure
Exchange Services regulation 6(1)(h)(v) requires a public disclosure for each virtual asset an exchange offers. It states whether the asset has had an independent smart contract audit, and the date of the latest one. Pakistan Virtual Asset Regulatory Authority
This is a disclosure duty. It does not itself require every listed asset to be audited.
Services regulation 62(3) separately covers smart contracts or other programmable protocols a licensee uses that are material to its services, or to safeguarding, transfer, settlement or issuance.
They need independent security review and testing before deployment or material upgrade, then periodically by risk.
Exchange Services regulation 6(3) requires disclosures to stay current after a material change.
An exchange's admission standards must address, where relevant, the technology and security risks of each asset's underlying protocol (Exchange Services regulation 9(2)(b)), and audit status must read as neutral fact, not endorsement (regulation 6(2)).
An audit date says little if the code changed afterwards. Treat a token upgrade as a material change, and recheck the audit against the deployed bytecode.
Our CEX listing security review guide lists the checks to run on a token's audit evidence, from commit match to fix review.
Evidence Checklist for Applicants
Each row pairs a PVARA control with a dated artifact and a warning sign.
| Control | Evidence to prepare | Red flag |
|---|---|---|
| Licence file | Key and Wallet Management Policy, Cybersecurity Policy, client-asset segregation mechanism | Policies with no test or run records |
| Distributed key control | Risk analysis for MPC, multisig or equivalent; quorum map | One admin can change signing policy alone |
| Key separation | Map of key components by site, team and system | All key shares in one cloud account |
| Independent key testing | Dated test report and retest; independent assurance report, half-yearly (Custody reg 4(6)) | Only an internal sign-off |
| Wallet allocation | Board-approved framework, minutes and review dates | Hot balances with no written justification |
| Backups and compromise | Backup locations, migration runbook and drill record | Backups stored beside primary keys |
| Reconciliation | Daily run logs, break records and 24-hour escalation trail | A job that can stop silently |
| Proof of reserves | Six-monthly independent validation report | Liabilities not matched asset by asset |
| Wallet provider | SOC 2 Type II report and contract with PVARA rights | Vendor holds effective control of keys |
| Incidents | Incident log with near misses; 24-hour notice runbook | Log records losses only |
| Exchange disclosure | Per-asset audit status, date, update process; listing policy with protocol security assessment | Audit dates unchanged after token upgrades |
Frequently Asked Questions
How long does PVARA take to decide an NOC or licence application?
PVARA must decide a complete NOC application within 60 days and a complete licence application within 90 days. The licence period may be extended by up to 60 days, for reasons recorded in writing, where an application is complex, involves novel risks or needs consultation with other authorities. Pakistan Virtual Asset Regulatory Authority
Is a PVARA NOC the same as a licence?
No. PVARA says an NOC is not a licence; it is preliminary approval to incorporate and file a licence application. It is valid for three months, extendable once by up to three. Firms operating before March 5, 2026 had to apply by September 5, 2026, or cease operations. Pakistan Virtual Asset Regulatory Authority, Associated Press of Pakistan
Which activities does PVARA license?
Eleven categories: custody, exchange, broker-dealer, advisory, lending and borrowing, derivatives, asset management and investment, transfer and settlement, mining-related services, and asset-referenced and fiat-referenced token issuance. This article covers custody and exchange. Pakistan Virtual Asset Regulatory Authority
Related reading
- private key management digital assets
- crypto incident reporting requirements
- best mpc wallet providers
- kenya vasp regulations 2026 cybersecurity
- crypto regulatory compliance
Sources
- Pakistan Virtual Asset Regulatory Authority: Pakistan Virtual Asset Services Regulations, 2026, S.R.O. 1419(I)/2026
- Pakistan Virtual Asset Regulatory Authority: Pakistan Virtual Asset Services Activity Specific Regulations, 2026, S.R.O. 1420(I)/2026
- Pakistan Virtual Asset Regulatory Authority: PVARA Regulatory Framework
- Pakistan Virtual Asset Regulatory Authority: PVARA VASP Licensing and FAQ
- Associated Press of Pakistan: PVARA launches virtual asset licensing regime
- Guardian: LiquidationFinalized reports zero collateral for ERC20 liquidations
- Guardian: Compliance audits for digital asset businesses
Preparing a PVARA licence or NOC application?
Guardian's compliance assessments review custody and key management, test the systems behind client assets, audit smart contracts, and organize the evidence pack for your application.