Virtual Assets Act, 2026

I AS PASSED BY THE NATIONAL ASSEMBLY ] BiII to establish a regulatory Authority for the licensing, regulation and supervision ofVirtual Assets and Virtuol Asset Service Providers WHEREAS, it is expedient to establish a dedicated Virtual Assets Regulatory Authority to license, regulate and supervise Virtual Assets and Virtual Asset Service Providers, in order to ensure investor protection, transparency and market integrity in Pakistan; AND WHEREAS, it is necessary to provide a comprehensive legal framework to empower the Authority to combat money laundering, terrorist financing, proliferation financing and other illicit activities involving Virtual Assets, in accordance with international standards, and to provide for matters connected therewith or ancillary thereto; lt is hereby enacted as follows: - Chapter I PRELIMINARY

1. Short title, extent, commencement.

(1J This Act Shall be called the Virtual Assets Act, 2026. (2) Itextends to the whole ofPakisran. (3) It shall come into force ar once. 2. Scope of application.- (1J This Act shall apply to- [a] any Virtual Asset Service Provider that carries on, or holds itselfout as carrying on, a Virtual Asset Service in or from Pakistan; and (bl any Issuer that offers, originates or distributes, on its own behalf, a Virtual Asset in or from Pakistan. (2) For the avoidance of doubt, this Act shall not apply to the following digital representations ofvalue or righs, insofar as they meet the conditions stated below- [a) closed-ecosystem or closed-loop digital tokens, including any digital representation ofvalue or rights that, by design, technical architecture, A

(bl (.J (dl IeJ t0 or enforceable conditions￾system controls, satisfies all of the following til is usable or redeemable solely within a restricted digital platform, ecosystem, application, or network administered by the issuer or operator; (ii] is not transferable outside such platform, ecosystem, application, or network, whether directly or indirectly; (iiiJ is not exchangeable for fiat currency or legal tender outside such ecosystem; (ivJ is not redeemable for real-world goods or services outside such ecosystem; (v) is not convertible into, exchangeable for, or interoperable with any other Virtual Asset; [vi) is not saleable, tradable, or transferable on any external market, exchange, or secondary trading venue; or (viiJ is not designed, marketed, or used for payment, investment or value-transfer purposes beyond such ecosystem. securities, derivatives, collecJive investment schemes, depositary receipts, or other traditional financial instruments that fall within the regulatory iurisdiction of the State Bank of pakistan or the Securities and Exchange Commission of pakistan; digital representations of fiat currency issued by the State Bank of Pakistan or any central bank or monetary authority of another sovereign jurisdiction; a non-fungible token that is not u_sed for payment or investment and does not represent, reference, or derive value from any security, commodity, financial asse! or other regulated instrument; any non-fungible token or digital collectible that does not constitute a Virtual Asset, having regard to its substance, function, or economic effect; o r any other digital representation of value or rights expressly excluded by the Authority. 3. or context: Definitions.- [1] In this Act, unless there is anything repugnant in the sublect 7

til (iil (iiD IivJ [u) [viJ (viil "Asset-Referenced Token" means a Virtual Asset that represents, directly or indirectly, ownership rights, claims, or economic interests, including entitlements to receive or share income, returns, or other economic benefits, in respect of one or more underlying assets, or is designed to maintain a stable value by reference to such underlying assets. "Authority" or "PVARA" means the Pakistan Virtual Asset Regulatory Authority established under this Act; "Blockchain" or "Distributed Ledger Technology" or "DLT" means a technology that enables a distributed ledger, an information repository that records transactions or data across multiple nodes in a synchronized manner using cryptography to ensure integrity, tamper-resistance, immutability, and consensus among participants, as may be further defined by Regulations; "Chairperson" means the Chairperson of the Authority appointed under this Act; "Controller" means a Person who, aione or together with associates, holds or is entitled to exercise twenty percent (20 %) or more of the voting power, ownership interest, or share capital of a Licensee, or otherwise exercises significant influence or control over its management or policies, whether directly or indirectly; "Customer" means any natural or legal person who obtains or uses a Virtual Asset Service from a Licensee, or who enters into a business or contractual relationship with a Licensee for the provision ofsuch service, whether on a one-off or ongoing basis; "Customer Assets" means Virtual Assets and fiat currency belonging to a customer that a Virtual Asset Service Provider holds, safeguards, or otherwise has custody or control over on that customer's behalf, and excludes assets owned by the Virtual Asset Service Provider; "Division concerned" means the Cabinet Division as defined in the Rules of Business, 1973; "Fiat-Referenced Token" means a Virtual Asset that purports to maintain a stable value relative to a single Official Currency ofany country and is redeemable at par value by its Issuer; (viiil (ixl J

(xl (xD (riD [xiii] (xivl (xrJ "High-Quality Liquid Assets" or "HQLA" means such high-quality liquid assets as may be prescribed by Regulations; "lnside information" means non-public information likely to affect virtual asset prices if disclosed, including client orders, trading intentions, or decisions related to issuance or facilitation, as may be further defined by regulations; "lnsiders" include Controller, officers, directors, employees, or affiliates of issuers or Virtual Asset Service Providers with access to inside information; family members; or other persons obtaining such information unlawfully or through employment, and as may be further prescribed by Regulations. "lssuer" means the legal Person that originates or creates a Virtual Asset and retains primary control over its initial supply, reserve assets (if any] or on-chain governance, and may distribute such Virtual Asset as part of its initial offering, and that bears the ongoing obligations as prescribed by the Authority. Explanation: A Person is not an Issuer solely because it markets, advertises, promotes, faciiitates secondary-Market trading (including third-party brokerage, distribution or exchangeJ, or provides technical developmenj or maintenance services without control over issuance, supply ol- reserve assets. "lnitial Virtual Asset Offering" means a method of raising funds by an Issuer through the public offering of Virtual Assets in exchange for funds or other Virtual Assets or anything of commercial value, subiect to the limitations and disclosure requirements prescribed under this Act; "Key Individual" means any natural Person who occupies or performs - whether on a full-time, part-time, acting or outsourced basis - one or more of the positions listed below in relation to a Licensee: (a) director (executive or non-executiveJ registered under the Companies Act, 2017 (XlX of 2077) (bl Managing Director; (.) chief financial officer; (dl chief operating officer; [eJ head of internal audit; 4

(xvi) (xviiJ (xix) (0 head of compliance; tg) money-laundering reporting officer [MLR0) or equivalent AML, CFT or CPF compliance officer designed under the AML, CFT and CPF Regulations issued pursuant to the Anti-Money Laundering Act 2010 (WI of2010J; th) head of risk management; (il head of information-security and ryber-security; or 0) any other position that the Authority, by written notice to the Licensee, declares to be a Key Individual. "Licensee" means a person who holds a license under this Act; Market Manipulation or Market Abuse means any act, practice or course of conduct that: [aJ gives false or misleading signals as to the supply, demand or price of one or more Virtual Assets; (bl secures the price ofVirtual Assets at an abnormal or artificial level; or (cJ employs any device, deception or artificial means to interfere with the normal operation of supply and demand in Virtual Asset maikets, as may be further defined by Regulations- "Managing Director" means the Managing Director of the Authority, appointed under this Act; "Virtual Asset Mining" means the process of validating or verifying transactions and recording them on a distributed ledger or blockchain network, using computational or other consensus mechanisms, and, in return, earning virtual assets, transaction fees, or other rewards. "Non-Fungible Token" ol- "NFT" means a unique, non￾interchangeable digital representation of value or rights recorded on a distributed ledgei or similar technology, where each token is distinguishable from every other token; "Official or Fiat Currency" means a currency issued by the central bank or monetary authority of a country that is recognized as legal tender under the laws of that country; "Person" means a natural or legal Person; Ivx] [xxiJ ) [xviiiJ (xxiiJ

(xxiii) "Prescribed" means prescribed by Rules or Regulations made under this Act; (xxivJ "Regulations" means Regulations made under this Act; (xxv) "Rules" means Rules made under this Act; (xxvi) "Segregated Reserve" means a pool of reserve assets that is kept separate from the lssuer's own assets, held in the name of the Issuer, or in a trust or special vehicle for the benefit of token holders, and under custody, with independent custodian or regulated financial institution, approved by the authority, so that the Issuer or its creditors cannot claim the assets. The Authority may, by Regulations, prescribe additional requirements regarding the types of assets, custody arrangements, audits, attestations, disclosures, and other safeguards; fxxvii) "Shariah Advisory Committee" means the committee constituted by the Authority for advice on Shariah matters; [xxviii) "Special Court" means a court notifled by the Federal Government to take cognizance ofoffence as mentioned under this Act; (xxixJ "Sponsor" means a person orgroup ofpersons who has contributed inirial capital to estabiish the company or hold a controlling shareholding therein, whether directly or indirectly; (xxx] "Tribunal" means a Tribunal constituted under this AcU fxxxi] "Virtual Asset" means a digital representation ofvalue that can be digitatly traded or transferred and used for payment or investment purposes, but does not include digital representations of fiat currency, securities or other financial assets regulated under any other law except where represented, issued, or transferred using distributed ledger technology. For the avoidance of doubt, Virtual Assets are not legal tender; [xxxiiJ "Virtual Asset Services,,means the categories ofservices set out in section 18 of this Act; and (xxxiii] "Virtual Asset Service provider,' means any person who, as a business, provides one or more Virtual Asset Services to third parties on a professional basis. (2) All other words and expressions not defined in this Act but defined in the State Bank of Pakistan Act, 1956 (XXxill of 19561, rhe securities Act, 2015, (Iil of 2015) rhe Anti-Money Laundering Act, 2010 pll of 20101, or the compani es Act, 2017 (xlx of 2017) 6

shall, unless the context otherwise requires, have the meanings assigned to them in those Acts 4. Extraterritorial application.- (1J For the purposes of investigation and enforcement under this Act, the Authority may exercise its powers extraterritorially to the fullest extent permitted by law. (2) In order to facilitate enforcement under this section and the effective regulation of Virtual Asset Services with cross-border implications, the Authority may enter into agreements or arrangements with regulatory authorities and law enforcement agencies in other jurisdictions for mutual assistance, information sharing, and the recognition and enforcement of regulatory decisions, and shall, by Regulations, prescribe the conditions under which a Virtual Asset Service conducted outside Pakistan shall or shall not be deemed to be offered or marketed to Persons in Pakistan. (3) The Authority shall, where applicable, align iti extraterrito riaI enforcement practices with mutual legal assistance treaties and international cooperation frameworks, including those of the Financial Action Task Force and International Organization of Securities Commissions fl OSCO). 5. Relationship with other laws.- [1J The provisions of this Act are in addition to, and not in derogation of, any other law for the time being enforce. [n the event of any inconsistency with any other law, other than the Foreign Exchange Regulation Act't947 Nll of 1947), this Act shall prevail except as provided i+sr*b-seetien{2} below. t2) Where any law prescribes measures relating to data protection, data governance, or cybersecurity, financial secrecy or cross-border transfer of personal data, such provisions shall prevail and be complied with by the Authority and Licensees. (31 The regulation and supervision of Virtual Assets, Virtual Asset Service Providers, tokenization of real-world assets, and blockchain technology shall vest primarily in the Authority under this Act, in coordination with other relevant regulators where applicable. ChaPter 2 PAKISTAN VIRTUAL ASSETS REGULATORY AUTHORITY 6. Establishment of the Authority.

(1) After the commencement of this Act, an authority shall be established to be known as the Pakistan Virtual Assets Regulatory Authority, which shall carry out the purposes of this Act. (?) The Authority shall be a body corporate with perpetual succession and a common seal and may sue and be sued in its name. 7

namely:- Composition of Authority.

• [1) The Authority shall consist of the following, (a) Chairperson - to be appointed by the Federal Government (b) the Secretary, Ministry ofFinance; (") the Secretary, Ministry of Lawand Justice; (d) the Governor, State Bank of pakistary (e) the Chairperson, Securities and Exchange Commission of pakistan; (0 rhe Chairman, Nationat AML-CFT Authoriry; (g) the Chairperson, pakistan Digital Authority; and (h) rwo independent directors with proven expertise and a strong track record possessing expertise relevant to virlual Asset markets, digital technology, digital finance, appointed by the Federal Government in rhe manner prescribed. (2) The members of the Authority, other than ex-officio members, s'hall hold office for a term ofthree years and shall be eligible for one further term ofthree years. (31 rhe Authority sharr determine its own policy and straregic direction and approve its budget and Regulations. B. Procedures of the Authority.

(1J The Authority may meet any time on requisition of the chairperson or at requisition of at least fifty percent of the members. Provided however, the Authority shall meet at least twice a year. (2) The quorum of the Authority,s meeting shall be at fifty percent of the total membership with the mandatory presence of the (a) (b] and (dJ as mentioned in section 7. (3) A meeting of the Authority shafl be presided over by the chairperson. [n the absence ofthe chairperson, a member nominated by the chairperson shall preside over the meeting. (4J Alt decisions in the meeting shall be made with majority of the present members. 9' objectives, functions and powers of the Authority.

• t1) The Authority shall: - 8 (31 The Authority shall be autonomous in the performance of its functions and exercise of its powers, subiect to this Act. (4) The headquarters ofthe Authoriry shall be at Islamabad, and it may set up as many offices across Pakistan as required.

(a) Iicense, regulate and supervise Virtual Asset Service Providers and issuers in accordance with the provisions ofthis Act and any Rules or Regulations made thereunder; (b) protect customers and investors and the integrity of Pakistan's Virtual Asset markets by establishing and enforcing appropriate safeguards and conduct of business requirements, prudentia[, operational-resilience, risk-management standards, and measures to prevent money laundering terrorist financing and other illicit use ofVirtual Assets; (c) attract investment and encourage companies operating in the fields of ' Virtual Assets to base their business in Pakistat; (d) promote responsible innovation, digital financidl inclusion and the development of compliant Virtual Asset markets within a framework that manages risks and supports financial stability and market integrity; (e) promote, develop, govern, and regulate the adoption, deployment, and scalable use of blockchain technology and distributed ledger technology across Pakistan; (f) assess, determine, and classi$r any Virtual Asset, service, activity, offerin& lssuer, or service provider based on its substantive features, underlying function, method of use, or economic effect, irrespective of the nomenclature, structure, or designation as:igned to it- Such classification may include, but is not limited to the determination of whether an asset is a Virtual Asset, whether a Person qualifies as a Virtual Asset Service Provider, or whether an offering constitutes a financial activity within the sco pe of this Act subiect to consultation with the State Bank ofPakistan or the Securities and Exchange Commission of Pikistan where the asset exhibits characteristics falling wiihin their respeative mandates; (g) coordinate with the Financial Monitoring Unit, National AML and CFT Authority, other relevant authorities and law enforcement agencies to combat money laundering, terrorist financing, and other illicit activities associated with Virtual Assets, in accordance with the Anti-Money Laundering Act, 201.0 pll of 2010J, other applicable laws, and intemational standards; (h) advise the Federal Government, on its own nrotion or upon request, on regulatory, supervisory, technical or emerging.risk matters relating to Virtual Assets, digital-asset markets, tol(enisation, stablecoin structures, blockchain, DLT, cyber-risks or any matter connected with its mandate under this Act; and 9

(i) do all such acts as may be necessary or incidental to the discharge of its funcrions and to achieve its obiectives under this Act and other applicable laws. (2) For the purposes ofsub-section [1J, and without prejudice to the generality of the foregoing, the Authority may- (a) make Regulations, standards, directives, guidelines, handbooks and circulars, or any other instrument, consistent with the obiectives of this Act and other applicable laws; (b) set prudential, conduct operational resilience, risk-managemeng cybersecurity, data protection & technical standards; (c) issue, vary, suspend or revoke licenses, approvals or directives under this Act and prescribe conditions for such actions; (d) prescribe licensing conditions, eligibility criteria, renewal requirements and any additional obligations for Licensees; (e) conduct on-site inspections and off-site monitoring of Licensees and other entities to ensure compliance with this Act and relevant Rules and Regulations; (0 require Licensees to furnish information, documents and data in the manner and timeframe reasonably prescribed by Regulations; (g) ensure compliance of data-protection, data-governance and cyber security obligations by Virtual Asset Service providers subject to supervisory follow-up; (h) impose administrative sanctions in accordance with the provisions of this Act and any Rules or Regulations made thereunder; (i) apply to court for civil or criminal remedies as provided under any applicable law; O levy such fees, charges and penalties as may be prescribed by Rutes; (k) operate regulatory sandboxes in a transparent and accountable manner; (D enter into cooperation or mutual assistance arrangements with domestic and foreign regulators and law enforcement agencies to facilitate information sharing and coordinated action, including mutual recognition of Regulations and Iicenses; (m) conduct public education and awareness initiatives to promote informed participation in the Virtual Asset ecosystem; and l0

(n) constitute as many committees as deemed necessary to conduct its functions under this Act. 10. Delegation of powers.

The Authoriry may delegate any of is powers and functions to the Managing Director, subiect to such terms, conditions, and limitations as it may deem appropriate. 11. Appointment and Functions of Chairperson. - (1) The Chairperson of the Authoriry shall be appointed by the Federal Government on such terms and conditions as it may deem fil The Chairperson shall have demonstrable expertise in digital finance or technology and a minimum of three years' relevant professional expgrience, and shal be eligible for re-appointment for maximum two terms on such term or terms as the Federal Government may determine. {2) The Chairperson shall provide overall guidance, direction, and oversight ofthe Authority. (3 j The Chairperson shall only be removed prior to th e expiry of the term for gross misconduct or incapacity following a show cause notice and opportuniry to be heard. (4) The Chairperson may resign by writing to the prime Minister. 72. Appointmentand Functions of Managing Director.- (11 The Authority shatl appoint a Managing Director for a term ofthree years, extendable for a further maximum of two term of three years only. (2) The Managing Director shall be a person ofproven integriiy and competence, and shall meet such qualifications, criteria, and requirements as may be prescribed by Regulations. (31 The Managing Director shall act as Secretary of the Authority for its proceedings but shall not have voting rights unless specifically authorized. 13. Appointment of Officers, Staff, Consultants, Advisors and other personnel. - [1) The Autllority may, from rime to time, create and sanction such posts, prescribe required qualifications and experience, and deternrine ierrns of service through Regulations as required. (2) The Authority may, through a transparentand competitive process prescribed by Regulations, appoint such employees, officers, consultants, and technical or professional advisers as are necessary for the performance of its functions and the exercise of its powers under this AcL (31 The Authority may, as prescribed by Regulations, request any Ministry, Division, public authority, public entity or autononrous or regulatory body to assign an official with requisite expertise to the Authorit), for such period as may be mutually agreed.

I 14. Pakistan Virtual Asset Regulatory Autrhority Fund. -(1) There shall be established a lapsable fund, vested in and adrninistered and controlled by the Authority, to be known as the Pakistan Virtual Asset Regulatory Authority Frrnd, for meeting expenditures in connection with the perlbrmance of the functions and operations of the Authority under this Act. (2) Subiect to the provisions of the Public Finance Management Act, 2019 (V of 2019), the Fund shall consist of- (a) funds provided by the Federal Government for salaries, infrastructure, administrative, operational, and other expenses, including the day-to￾day functioning of the Authority; (bJ loans or funds obtained from the Federal Government, any provincial Government, a local authority or any other entity with the approval of the Authority; (cJ grants made by the Federal Government; (d) aids, grants, donations, or loans raised or obtained by the Authority from domestic and international agencies, in consultation with the Division to which the business of finance stands allocated and other relevant Divisions; (eJ contribr.rtions from multiiateral orpJanisations, international agencies, and philanthropic organisations for purposes consistent with the objectives of the Authority, to be managed in accordance with regulations ensuring transparency and good governance; (0 all sums or property which may in any manner become payable to or vested in the Authority in connection with the exercise of its powers or performance of its functior.rs; (gl income from investments and assets ofthe Authority; (hl NOC, Iicensing, supervision, rener,r,al or other fees received by the Aul"hority; (il penalties, fines, settlements, and other recoveries imposed or realized under this Act or any Rules or Regulations made thereunder; (,1 charges for services rendered by the Authority, including sandbox participation and other prescribed services; and (kl any other source as may be prescribed. t3) The Fund shall be managed and operated in such manner as may be prescribed by Regulations. 12

t4l The Fund shall be maintained in such manner and with such institutions as the Authority may determine, subiect to any requirements prescribed by Regulations. (51 The Pakistan Virtual Asset Regulatory Authority Fund may be expended for- (a) paying any expenditure lawfully incurred by the Authority; tb) payment of salaries and other remunerations payable to the chairperson, Managing Director, Offi cers, employees, consultants, and advisers of the AuthoritY; [c) paying any other expenses, costs or expenditures properly incurred or approved by the Authority in the performance of its functions or the exercise of its powers under this Act; td) purchasing or hiring equipment, machinery and other materials, acquiring land and constructing buildings, and carrying out any other work or undertakings in connection witlr the performance of its functions or the exercise ofits powers uucler this Act; [.) repayment of any Ioans or advances obtained under this Act, together with any associated interest, charges or fees; (fl meeting any financial bbligations or liabilities that arising out of the performance ofthe functions ol the Authority under this Act; tg] funding strategic and enabling proiects or initiatives neczssary to support the obiective of this Act or to cnhance the operational capabilities of the Autho rity a n d its stal<eh o lri ers; (h) meeting expenses relating to investigations, inspections, enforcement actions, legal proceedings, arbitration, mediation, and dispute resolution, including court fees, expert fees, and legal costs; and t0 capacity-buitding, research, training, certilica[ion, and international cooperation activities, incltrclirrg participation in regional or international regulatory firrun.rs￾15. Budget, Finance and Audit.

• [1) The Atrthority shall, in respect of each financial year, prepare and approve its budget in accordance urith the procedure prescribed through Rules. [2) The budget statement shall specifically state thc estimated receipts and expenditure and the sums which are to be required from tlre Fecleral Government during the next financial year. (3) The Authority shall maintain complete and accuratc books of accounts of its receipts of funds and expenditure. J

(4J At the end ofeach financiar year, the accounls ofthe Authority sha be audited by the Auditor General of Pakistan and by a firnr of chartered Accountants nominated by the Auditor General of Pakista n. (5J The Authority shall ploduce sucir accounts, books and documents and furnish such explanations and information as the auditors may require for the purpose ofaudit. (6) copies of the auditor's report on the accounts shall be provided to the Authority. (71 The Authority shall submit an annual report ofthe fund under this section to the Prime Minister through the corcerned Division within ninety days of the crose of each financial year, including audited financiar statements and performance against approved oblectives, and such other matters as the Aurhority may consider necessary for transparency and accountability. 16' code ofconduct.- (1) The Chairperson, Members ofthe Authority incruding ex-officio Members, Managing Director, office's and employees ofthe Authority, sha , in the performance of their functions, acr with inregrity, impartiarity, confidentiality and in good faith, and shall avoid any conflict of interes[, whether direct or indirect. [2) The Authority sharr prescribe, by Regulations, a code ofconduct appricable to the chairperson, Members of tl.re Authority, Managing Director, officers and emproyees of the Authority, including provisions rerating to. discrosure of interests, conflict management, restrictions on personal trading in virtual Assets, conddentiality, and post-tenure obligations. (3) Any violation of the provisions of this section or the Code of Conduct prescribed thereunder shall constitute misconduct and sharr resurt in removar from office or service, as the case maybe, and the initiarion ofdisciplinary proceedings. 17 ' Inter-agency cooperation and information-sharing.- (1) For the effective regulation and supervision of virtual Assets and virtuar Asset service providers, and to prevent their misuse, the Authority shall cooperate and share supervisory and enforcement information, in a timely and secure manner, with the State Bank of pakistan, the securities and Exchange commission of pakistan, the Financial Monitoring unit, the Federal Investigation Agency, the Federar Board of Revenue, and any other competent reguratory or law-enforcement agencies or bodies. [2J The Authority may, with the prio r approval of the Federal Government, enter into cooperation arrangements or information-s haring arrangements wirh foreign regulatory or supervisory authorities for cross-border supervision, enforcement and mutual assistance relating to VirtuaI Assets and Virtual Assets Service prorriders. [3) The Authority may establish one or more inter-agency coordination mechanisms, including a regulatory coordination committee, comprising representatives of rerevant t4

public authorities, to facilitate policy coordination, info rmation-sharing, supervision, enforcemen! and risk mitigation in relation to Virtual Assets and Virtual Asset Service Providers. Chapter 3 LICENSING OF VIRTUAL ASSET SERVICE PROVIDERS AND ISSUANCE OF VIRTUAL ASSETS 18. Categories ofvirtual assetservices.- The following constitute Virtual Asset Services and shall be subject to licensing and regulation under this Act: (a) all services as specified in Schedule I; and (bJ any other service as may be notified by the Federal Government and subsequently included in Schedule I of this Act. 19. Application for License.

(1J Any Person intending to incorporate a company, under the Companies Act,2017 (XlX of Z0l7) or any other law for the time being in force, with the primary objective ofengaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation. (2J An application for a No-Objection Certificate under sub-section (1J shall be made in such form and manner, accompanied by such information and fee as may be prescribed . by the Authority. (3) Upon review of an application for No-Objection Certificate, the Authority may, having regard to the obiects of this Act and the need to ensure the integrity of the Virtual Asset market, grant the approval or certificate, subiect to any conditions, or refuse the application, providing written reasons for refusal. (4) An application for a license, following incorporation ofthe company, shall be made to the Authority in such form and manner as may be prescribed. It shall be accompanied by- [a) the prescribed fee, which shall be non-refundable unless otherwise determined by the Authority; and [bJ such information and documents as may be prescribed or required by the Authority. 20. Fit-and-proper criteria.- (1) The Authority shall determine whether a Controller, Sponsor, Chief Executive Officer and Director is fit and proper in accordance with criteria prescribed by Regulations. (21 The fit-and-proper criteria shall apply to all Key Individuals. It shall be the responsibility ofthe applicant for a license or the licensee to assess and maintain the fitness 15

and propriety of other key individuals not mentioned in sub-section [1), and to submit a written undertaking to the Authority confirming compliance and ongoing maintenance thcrco f. (3] The Authority may refuse, suspend or revoke a ricense where any controler, Sponsor or Key lndividual fails to meet the prescribed fit-and-proper criteria. (4J Fit-and-proper criteria shall be continuing in nature, and any person subject to such criteria shall notify the Authority of any matter that may affect their fitness and propriety. (5J The Authority shall prescribe additional requirements for corporate controllers, including assessment of the corporate behaviour, integrity and track record of controller and ultimate beneficial owners. (6) Every Licensee shall maintain a registered office in Pakistan and ensure that at least one Key Individual ordinarily resident in pakistan is vested with operational and decision-making authority subject to conditions prescribed. 2l- Grant, refusal and terms oflicense.

• [1J Sublect to this Act and any Rures or Regulations made thereunder, the Authority may _ (a) grant a license, subiect to such terms and conditions as it may deem appropriate; or (b) refuse the application, providing the applicant with written reasons for such refusal- [2] The Authority may, on a case-by-case basis, grant a provisional or a rimited-scope licence to an applicant, subiect to such terms and conditions as may be prescribed. (3) A license granted to a Virtual Asset Service providers shall speciflz the Virtual Asset Services that is permitted to undertake and shall remain in force unless suspended or revoked. (4J The Authority shall maintain and publish an up-to-date register of Licensees on its official website. The register shall include, at a minimum, the name, license number, permitted services and current regulatory status of each Licensee.

22. Ongoing obligations of licensees.

A Licensee sha[, at all times_ [a] maintain the prescribed minimum paid-up capitar and financial resources; (b) comply with this Act and all Rules, Regulations, directives and guidelines issued by the Authority; (cJ submit such periodic returns, reports and audited financiar statements as may be prescribed; I6

(d) obtain the prior approval of the Authority for any material change in control or business, in the manner prescribed; (e) maintain risk-management, compliance and cybersecurity systems in accordance with applicable legal and regulatory requirements including adherence to data privacy standards; and (f pay such supervision, renewal or other fees as may be prescribed. 23. Variation, suspension and revocation oflicense.

(1) The Authority may, by way of written notice and after providing an opportunity ofbeing heard, vary, suspend or revoke a license if it is found that- (a) the Licensee has contravened any provisions of this Act or any other applicable laws, or any terms or condition of its license; (b) the Licensee is insolvent or no longer satisfies the fit-and-proper criteria; (c) the Licensee has ceased to carry on the Virtual Asset Service for which it is licensed; or (d) such action is necessary or expedient in the public interesg including for the protection of consumers, the integrity of the marke! or financial stabiliry; or (e) the license was obtained by fraud, misrepresentation, or concealment of material facts. [2) Where a license is revoked, the Licensee shall immediately cease the provision of Virtual Asset Services, and the Authority may notiS/ the Securities and Exchange Commission of Pakistan to initiate winding-up or dissolution proceedings in accordance with the Companies Act" 2017 (XlX of 2077) and any Regulations that may be prescribed under this Act. (3) The Authority may, by Regulations prescribe further procedures, timelines, and safeguards for variation, suspension, or revocation under this section. Chapter 4 PRUDENTIAL REQUIREMENTS, SAFEGUARDING AND CUSTODY 24. Segregation of customer assets.

(1) A Licensee shall, at all times, hold Customer Assets in segregated accounts separate from its own assets, in the manner prescribed by Regulations. t7

(2) Notwithstanding anything to the contrary contained in any other law for the rime being in force, customerAssets held by a Licensee shall not form part ofthe Licensee's estate in the event of its insolvency or liquidation. (3) Licensee owes a fiduciary duty to its customers and shall at all times act honestly, fairly, and in the best interests of its customers when dealing with customer fusets. (4J A Licensee shall not rehypothecate, lend, pledge, or otherwise encumber customer Assets, whether virtual Assets or fiat balances, without the customer's explicit, informed, and revocable written consenL 25. Minimum financial resource requirements.

• [1) A Licensee shall, at all times, maintain such minimum paid-up capital, liquid assets and financial resources not less than such amounts as may be prescribed. (2J The Authority may, having regard to the category, size, complexi!2, or risk profile of a Licensee, prescribe higher financial-resource requirements. [3) The Authority may, by Regulations, prescribe additional liquidity, margin, risk￾based capital or reserve requirements having regard to the risks posed by the Licensee's activities. (4) The Authority may, in the manner prescribed by Regulations, granr conditional or risk-based exemptions from requirements under this section for limited-scope or low-risk Licensees.

26. Custody standards and key-management controls.

• t1) A Licensee providing custody services for Virtual Assets shall: (aJ ensure the secure custody and protection of Virtual Assets against unauthorized access, loss, or misuse; and (b) maintain operational resilience, including robust disaster-recovery and business-continuity arrangements. (2) The Authority shall prescribe detailed technical standards, operational requirements, and audit procedures to ensure that Licensees meet the obligations under this clause, including but not limited to, standards for key management, custody mechanisms, and verification or assurance processes.

27. Proof-of-reserves and audit obligations.

(1J A Licensee shall furnish to the Authority, at such intervals as may be prescribed by Regulations, cryptographic proof￾of-reserves reconciled against its liabilities to customers. (2J A Licensee shall cause its operations to be auclited annually by a firm of chartered Accountants approved by the Division concerned. Such audit shall include a verification of the segregation ofCustomer Assets as required under section 24. I8

2A. Reserve custodians.

A cuslodian of reserve assets shall comply with such requirements, oversight and inspection standards as may be prescribed by Regulations. 29. Customer safeguard or compensation mechanism.

The Authority may, establish a customer-compensation or safeguard mechanism for Iosses arising from custodiaI failure, in such manner as may be prescribed by Regulations. ChaPter 5 FIAT-REFERENCED AND ASSET.REFERENCED TOKENS 30. Initial virtual Asset offerings.- (1) Only legal entities, as registered in Pakistan and meeting the eligibility criteria prescribed by Regulations shall be permifted to conduct an Initial Virtual Asset Offering. (2J The Authority may prescribe, by Regulations, the conditions, disclosure requirements' approval processes and ongoing obligations applicabte to Initial virtual Asset offerings. 31. Issuance Requirements for Fiat-Referenced Tokens'

(1] Any Issuer intending to issue a Fiat-Referenced Token in Pakistan shall comply with following requirements: [a] Hundred percent reserve backing, with High-Quality Liquid Assets (HQLAJorotherassetsasprescribedforfiatreferencedtoken'heldasa segregated reserve; [bJ mechanisms for redemption at par value without undue delay; [c) audited reserve disclosures as prescribed by the Authority; (d) robust AML, CFT, CPF and sanctions compliance programs; (eJ prioritized holder protections in insolvency; and (fJ any other requirement prescribed by the Authority' (2) The Authority may prescribe differentiated requirements based on the size, scope, complexity, or risk profile of the Issuer, including but not limited to, expedited approval, stress testing, ongoing supervision, and consultation with the state Bank of Pakistan on reserve arrangements. 32. Issuance Requirements for Asset-Referenced Tokens'- [1) Any Issuer intending to issue Asset-Referenced Token in Pakistan shall comply with following requirements: (a) a reserve ofthe underlying assets, as prescribed, for Assets-referenced token held in custody in accordance with Regulations; ib] audited reserve disclosures as prescribed by the Authority; l9

(.J td) (ul [3J The Authority may issue guidance, communications in accordance with Regulations. robust AML, CFT, CPF and sanctions compliance programs; prioritized holder protections in insolvency; and any other requirement prescribed by the Authority. tz) An Asset-Referenced roken shal at a times be fu[y backed by the underlying assets and may reference tangible or intangible assets, incruding but not limited to commodities, real estate, rea[-world assets, securities, financiar assets, or a combination of official currencies, but sha[ not be backed or derive its value from other virtuar Assets. (3) The Authoriry mayprescribe differentiated requirements based on the size, scope, complexity, or risk profire of the Issuer, including, but not rimited to, expedited approval, stress testing, ongoing supervision, and consurtation with the state Bank of pakisian on reserve arrangements. The Authority may prescribe eligible categories of underlying assets and may restrict or prohibit types ofassets for the issuance of Asset-Referenced roken. 33' Significant issuers.

(1J An Issuer shall be deemed a Significant [ssuer if it meets the threshords and criteria prescribed by Regulations, having regard to size, scare, systemic importance, market impact, number of holders, and cross-border activity. {2) Significant Issuers shall be registered with rhe Authority and shall comply with enhanced requirements, including reporting, disclosure, governance, and risk management, as prescribed in Regulations_ Chapter 6 CYBERSECURITY, SANDBOX AND INNOVATION 34. Cybersecurity and operational resilience._ Licensees shall comply with cybersecurity and operationa[-resilience requirements prescribed by the Authorigz or under any other applicable laws, incruding, but not limited to, technical standards, security controls, and reporting mechanisms. 35. Regulatory sandbox.- (1) The Authority may establish a regulatory sandbox to facilitate controlled testing ofinnovative virtual Asset products or services, in the manner prescribed by Regulations. (2J Eligibility, application procedures, supe^,isory arrangements, risk limits, duration and exit requirements shall be prescribed by Regulations. 20 no-objection statements or no-action

36. Oversight of blockchain technology adoption.

(1) The Authority shall issue Regulations, standards, directives, and guidelines on the adoption, deployment, and use of blockchain or distributed-ledger technology. (2) The Authority shall consult with relevant regulators and ministries to ensure harmonization of blockchain adoption across Pakistan. 37. Regulation of Virtual Asset Mining Activities.

• [1J The Authoriry may, in consultation with relevant government entities, issue Regulations, standards, and guidelines for mining activities. [2) Pure mining, by itself, does not constitute a Virtual Asset Service requiring license under section 1.8 and schedute I. Mining operations involving customer assets or funds, however, shall be treated as Virtual Asset Services and require [icensing, (3J The Authority may establish a registration or declaration framework for mining operators exceeding thresholds ofscale, energy use, or hash rate, as set by Regulations.

38. Establishment of Strategic Digital Wallet Company.- (1J The Federal Government may establish or designate, under the Companies Act,201,7 (XlX of 201,7), a wholly owned company to be known as the Strategic Digital Wallet Company (SDWCJ to perform custody and administration services, and to design, develop, operate and secure wallet infrastructure that enables the Government of Pakistan or other designated public bodies or institutions to manage, transfer and record Virtual Assets in furtherance of the Company's strategic reserve objectives. (2J The Company shall operate exclusively on behalf of the Government of Pakistan and designated public bodies and shall not provide services to the private persons.
39. Data localization framework.- (1) A Licensee may store or process data outside Pakistan, subject to compliance with applicable laws relating to data protection, cybersecurity, and cross-border data transfers, and subiect to such safeguards as shall be prescribed by Regulations. [2J Nothing ln this section shall prevent the Authority from requiring immediate localization or restricted cross-border transfer of specific datasets where necessary in the interest of national security, financial stability, consumer protection, or enforcement effectiveness.
40. Data segregation and protection of sensitive information.- (1) Every Licensee shall implement appropriate technical, organisational, and governance measures to ensure the segregation of sensitive information from other operational data, in such manner as may be prescribed by Regulations. (2J For the purposes ofthis section, "sensitive information" shall include, but not be limited to￾ZI

(a) customer identification :rnd due-diligence records; tb) transaction-level data capable of ideritifuing a customer; (cJ private keys, crJ&tographic crcdcntials, or wallet authcntication data; (d) proprietary trading data and risk-management systems; and (e) any other category of information designated as sensitive by the Authority. (31 A Licensee shall ensure that- (a] sensitive information is logicalty and technically segregated from non￾sensitive data; [b) access to sensitive information is strictly controlled on a need-to-know basis; (c) encryption, tokenization, and secure key-management protocols are implemented in accordance with internationally recognised standards; and (d) appropriate audit trails and monitoring mechanisms are maintained. (4J The Authority may prescribe, by Regulations, minimum technical standards, rybersecurity controls, storage architectures, encryption requirements, and data￾governance frameworks to give efFect to this section. Chapter 7 MARKET CONDUCT, CONSUMER PROTECTION 47. Duty of integrity and fair dealing. -- [i) A Licensee shall conduct its business honestly, fairly and professionally and in accordance with the best interests of its customers and in a manner that upholds the integrity ol the market. (2) The Authority may prescribe, by Regulations, detailed requirements relating to market conducq including standards of fair dealing, professional behaviour, and customer treatment. 42. Obligations of issuers of Virtual Assels.

(1) An Issuer offering a Virtual Asset to the public shall publish a whitepaper in such form and manner as may be prescribed by Regulations. [2) Issuers shall make ongoing disclosures of ma.terial information including reserve attestations in the manner and frequency prescribed by Regulations. [3) The Authority may exempt categories of Issuers or offerings from requirements under this section, subject to appropriate safeguards. [ ] The Authority shall prescribe, by Regulations, mandatory risk disclosures, periodic reporting requirements and disclosure ternplates applicable to Issuers and Licensees. 22

43. Marketing and conduct restrictions.

[1] No person shall advertise or market a Virtual Asset unless the Issuer holds a valid license or registration under this Act. (2) All marketing materials shall contain risk disclosures and shall comply with such conditions, standards and limitations, in such form and manner, as may be prescribed bythe Authorily. 44. Conflict-of-interest management.

A Licensee shall identify, manage, and disclose conflicts of interest and shall not place its own interests above those of its customers, in accordance with detaited requirements on policies, disclosure, and management as may be prescribed by the Authority by Regulations. 45. Complaint-handling and dispute resolution.

(1) Licensees shall establish and maintain internal complaint-handling procedures in accordance with the requirements prescribed by Regulations. (2) Notwithstanding anything contained in any other law for the time being in force, the Authority may establish or recognize an independent dispute-resolution scheme for claims below a prescribed monetary threshold. Chapter B ANTI.MONEY LAUNDERING, COUNTERING OF TERRORISM FINANCING AND COUNTERING OF PROLIFERATION FINANCING 46. Application of Anti-Money Laundering Act, 2010.

[1J For the purposes of rhe Anti-Money Laundering Act, 2070 (VII of 20101, Virtual Asset Service Providers licensed under this Actshall be deemed to be financial institutions, and shall comply with all obligations thereunder. (2) Without preiudice to sub-section [1J, every Virtual Asset Service Provider and Issuer shall- (a) report suspicious transactions to the Financial Monitoring Unit IFMUJ in accordance withAnti-Money Laundering Act, 2010 (VII of 20101 and any rules, regulations or guidelines issued thereunder; (bJ maintain records of customer due diligence, transactions and other relevant information for the period prescribed under Anti-Money Laundering Act, 2010 (VII of 2010); and [c] establish and maintain internal controls and compliance programmes to prevent money laundering and terrorist financing, including the appointment of an AML, CFT or CPF compliance officer. 23

(3J The Authoriry sha , through AML, cFT or cpF Regulations, align its supervisory framework with the standards of the Financial Action Task Force IFATF] and may issue additional guidance, consistent wth FMl_t,s mandate, to adclress risks specific to Virtual Assets. 47 ' Travel rule and record-keeping obrigations.

• [1J A Licensee shall obtain, hold and transmit originator and beneficiary information in any transfer of virtual Assets meeting or exceeding the threshold prescribed by the Authority, in a manner consistent with Recommendations of Financial Action Task Force, as updated from time to time. (2J Such obligations shal be impremented in compliance with applicable data protection, data governance, and cybersecurity raws, ensuring the confidentiality, integrity, and security of the informatir-rn. (3J The Authority may prescribe detailed procedures, standards, and formats for record-keeping, reporting, and transmission of information through Regulations. [4] A Licensee sharl maintain records of transactions, customer due-dirigence data and risk assessments for a period prescribed by Regurations, which sha[ not be ress than the period required under the Anri-Money LaunderinC Act, 20 L0 (VII of 2010). 48' Real-time data access and reporting.

(1) Licensees shall establish secure reporting channels, and where required secure automated interfaces, enabling the Authority and such other agencies as notified to access prescribed data for supervisory and enforcemen? purposes. (2) The Authority shall prescribe, by Regurations, the technicar standards, security requirements and data specifications for the reporting and interfaces referred to in sub￾section (1J. 49. implement strict Iimits on the co[ection, use, and sharing of customer data, requiring explici! informed, and revocable consent for any non-essentiar data processing. Chapter-9 Prohibitions 50' Prohibition ofunricensed Virtuar Asset services.

(1) No person sha[, by way ofbusiness, engage in, or represent themselves as engaging in, anyvirtuar Asset Services in or from Pakistan, unless that person:_ (a) is a company incorporated under the Companies Acr,2Oi_7 or any other law for the time being in force in pakir;tan governing the incorporation of companies; and Data Privacy obligations for Licensed entities.- Each licensee shall 24

(b) holds a valid license granted by the Authority under this Act. 51. Prohibition on Initial Virtual Asset Offerings.

No Person shall conduct or purport to conduct an Initial Virtual Asset Offering, in or from Pakistan, except in accordance with this Act and the Rules or Regulations made thereunder. 52. Prohibition ofmarket manipulation and insider trading. - [1J No person shall engage in market manipulation or Market abuse in relation to virtual assets. (2) No person shall: (a) use inside information to trade virtual assets for themselves or others; (b) recommend or induce trading based on inside information; or (c) unlawfully disclose inside information. (3J The Authority shall issue guidelines and regulations specifying the type of manipulative behaviour. 53. Prohibition on Algorithmic tokens.

No Person shall issue, offer, or market a Virtual Asset whose primary mechanism for maintaining value is algorithmic and not fully or adequately collateralized, unless specifically permitted by Regulations and subject to the salegua rds prescribed th erein. Chapter-10 ENFORCEMENT, OFFENCES AND PENALTIES 54. Criminal offences.- [1J Whoever, willfully, provides an unlicensed Virtual Asset Service shall be punishable with imprisonment for a term up to five years, or with fine up to fifty million Rupees, or with both. (2) Whoever conducts an Initial Virtual Asset Offering in contravention ofthis Act, Rules and Regulations shall be punishable with imprisonment for a term up to three years, or with fine up to twenty-five million Rupees or with both. (31 Whoever, wilfully, conuavenes section 52 shall be punishable: (aJ in the case of natural person, with imprisonment for a term up to three years or with fine up to twenty-five million Rupees or with both. (bJ in the case of a legal person, with fine or three times the amount of any profit gained or loss avoided as a result ofthe contravention, Ifthe amount ofprofit gained or loss avoided cannot be determined, a fine not exceeding 15% of the total annual turnover of the body corporate in the preceding financial year. 25

(4) Whoever, knowingly, makes any false or misleading statement in any application, return or document submitted to the Authority shali be punishable with imprisonment for a term up to three years, or with fine up to twenty million pakistani Rupees, or with both. (5) Whoever, obstructs an officer ofthe Authority in the exercise ofpowers under this Act shall be punishable with imprisonment for a term up to two years, or with fine up to ten million Pakistani Rupees, or with both. (6J Whoever, witlfutly, fails to comply with any order or decision of the Authority shall be punishable with imprisonment up to one year, or with fine up to twenty-five million Pakistani Rupees and the Authority may also impose administrative penalties prescribed in this Act. [7] All offences punishable under this Act shall be investigated, tried, and punished in accordance with the provisions ofthe code of Criminal procedure, lggg (Act V of IBgBJ and the Qanun-e-Shahadat order, 1984 (order X of 1984), unless otherwise provided in this Act. (81 The Federal Government may, by notification in the Official Gazette, designate one or more Special courts to exercise jurisdiction over offences committed under this AcL 55. Liability of officers ofbodies corporate.- Where an offence under this Act is commilted by a body corporate with the consent, connivance or neglect of any director, manager, secretary or similar officer, such Person shall be deemed to have committed the offence. 56. Power t-o Investigate.

Only an authorized officer of the Authority shall have the power to investigate offences under this Act. 57. Powers of Authorized Officer.- (1) For the purpose of investigation of offences under this Act, an authorised officer shall obtain a warrant for search and seizure of evidence of an offence from a court o f competent jurisdiction. (2) The powers specified in sub-section (1.J, the authorized officer shall, for the purposes of investigation, inquiry, search, seizure, arrest, attachment, confiscation, and other criminal proceedings under this Act, exercise all powers conferred upon an officer incharge ofa police station or an investigating officer under the Code of Criminal Procedure, 1898 [Act V of 1898], subject to the provisions of this Act. (3) Any person who, wilfully, refuses to provide information required by the Authorized officer under sub-section (1) shatl be punishable with imprisonmenr for a term up to one year or with fine up to one million rupees or with both. (41 No Court shall take cognizance ofany offence under this Act except on a report in writing submitted by an authorized officer of the Authority. 58. Prosecution of offences.

(1J An prosecutions under this Act shall be conducted by a special public prosecutor appointed by the Federal Government. The special 26

public prosecutor, or advocates appointed by the Division concerned, may institute or defend cases, appeals, petitions, applications, and all other matters before any court, including the High Court and Supreme Courq arising from proceedings under this Act. (2) The personal attendance of any officer authorized by the Authority to file a complaint shall not be required during trial in the presence ofthe special public prosecutor referred to in sub-section (1J. (3J The court shall, in a manner not inconsistent with this Act, follow the procedure provided under Chapter XXII-A of the Code of Criminal Procedure, 1898 [Act V of 1898), and all prosecutions shall be disposed ofand judgments pronounced as expeditiously as possible. (4) Hearings shall not be adjourned except for sufficient cause to be recorded, and for no more than fourteen days at a time. The court may impose such costs as it deems fit. 59. Administrative sanctions.- (1) Where the Authority is satisfied that a Person has contravened any provision of this Act, or any Rules, Regulations, directions, circulars, or other regulatory requirements made thereunder, it may, impose one or more of the following sanctions- [a] issue a written reprimand or public censure; [b) issue a directive requiring the Person to cease or remedy the contravention; (cJ impose a financial penalty up to the maximum amount prescribed by the . Rules; (d) suspend or revoke any license issued under this Act or (eJ disqualify any Person from holding any office or position of responsibility in a Licensee. (2) Where the Authority is satisfied that an Issuer has contravened this Act or any Regulations made thereunder, it may impose sanctions under sub-section [1), with such modifications as are appropriate, upon Issuers. (3) Without prejudice to sub-sections (1J and [2), where a Virtual Asset Service Provider or lssuer contravenes any other law applicable in Pakistan, the Authority may, in accordance with Regulations, impose administrative sanctions as it deems appropriate. [4) The Authority may impose a fine up to twenty-five million rupees for any contravention ofthe provisions of this Act. (5) The court may order restitution, disgorgement of profits or such other reliefas it deems appropriate. 21

60. Emergency intervention powers.

[n the event of a systemic threat, market manipulation, fraud, or cybersecurit5r breach, or other serious risk to customers or market integrity, the Authority may issue an order temporarilv srrspending specified Virtrral Asset Services or freezing related assets for a period not exceeding thirty days. 6L. Power to prevent access to unlicensed virtual asset services. _ [1) The Authority may remove, block, or direct the removar or brocking of any online material (e.g., websites, apps, ads, payment links) if, on reasonable grounds, it promotes, operates, or relates to an unlicensed virEual Asset service or contravenes this Act, its Rules, or Regulations. [2J Such directions may be issued to telecommunication authorities, Virtual Asset service Providers, intermediaries, hosting providers, app stores, search engines, advertising networks, registrars, payment providers, or any person facilitating such material. [3] AII orders or directions shall be in writing stating reasons and statutory basis, and communicated to the affected person. [4) The Authority may require preservation of copies, rogs, or transactionar data for evidentiary purposes. [5J A person aggrieved by an order may submit a representation within ten days; the Authority shall respond in writing within fifteen days. Chapter- 11 APPEALS 62. Establishment ofthe virtual assets appellate tribunal. - (1) A virtual Assets Appellate Tribunal shall be established and no court shirll take cognizance ofa legal dispute under this Act or the Rules or Regulations made thereunder to which the jurisdiction ofthe Virtual Assets Appellate Tribunal extends. (2] The virtual Assets Appellate Tribunal sha consist of a presiding officer, who shall be a person who is a retired Judge of a High cour! or an advocate having not less than ten years' practice and experience in the relevant field, and two members, one being a technical expert and the other being a financial expert, who shall be persons of abitity, integrity, and have special knowledge and professional experience of not less than ten years in the fields of law, technology, finance, or economics. [3) The presiding officer and members ofthe Virtual Assets Appellate Tribunal shall be appointed by the Federal Government, in the manner prescribed, and hord office for a period ofthree years and shall be eligible for re-appointment for a similar term or terms and shall cease to hold office on attaining the age of sixty years or the expiry of the term, whichever is earlier. 28

[4J The terms, conditions, and appointment ofthe Virtual Assets Appellate Tribunal presiding officer and other members shall be in the manner Prescribed by the Federal Government. 63. furisdiction.- Any Virtual Asset Service Provider, Licensee, or any other Person aggrieved by an order ofthe Authority may prefer an appeal before the Virtual Assets Appellate Tribunal within thirty days of the date on which the order was communicated, in accordance with the Prescribed Rules. 64. Appeal.- (1J An appeal to the Virtual Assets Appellate Tribunal shall be filed within thirfy days from the date ofsuch order in such form, contain such particulars, and be accompanied by such documents and fees as may be prescribed under this Act (2) The Virtual Assets Appellate Tribunal sha[[ decide an appeal expeditiously but not later than three months of its presentation to the Tribunal. (3) The Virtual Assets Appellate Tribunal shall, for the purpose ofdeciding an appeal, be deemed to be a civil court and shall have the same powers as are vested in such court under the Code of Civil Procedure, 1908 (Act V of 1908J, including the powers of

[a) enforcing the attendance ofany Person and examining him on oath; (bJ compelling the production of documents; and [cJ issuing commissions for the examination of witnesses and documents. (4) It shall -be sufficient for the Virtual Assets Appellate Tribunal to establish, or to be satisfied as to any matter on the standard of proof applicable to civil proceedings in a summary manner in a court of law. [5J The Virtual Assets Appellate Tribunal's determinations or decisions underthis Act shall be deemed to be the decrees of a civil court under the Code of Civil Procedure, 1908 [Act V of 1908). 65. Appeal to Supreme Court.

Any Person aggrieved byan orderofthe Virtual Assets Appellate Tribunal may file an appeal to the Supreme Court of Pakistan within thirty days from the date ofsuch order and in such manner as may be prescribed. Chapter-12 MISCELLANEOUS 66. Tax Compliance.

Every Virtual Asset Service Provider licensed under this Act shall comply with the obligations imposed under the Income Tax Ac! 2001and any Rules or Regulations issued by the Federal Board of Revenue. 29

67. Power to make Rules.

The Federal Government may by notification in the official Gazette, make Rules, as deemed necessary for th€r implementation ofand to carry our the purposes of this Act. 68. Powers to make regurations.

The Authorify may make Regurations in the consultation with Division concerned as deemed necessary for the implementation of and for carrying out the purposes ofthis Act. 69. officers to be public Servants.

The chairperson, Managing Director, members, staff, experts; consultants, advisers, other officers and employees ofthe Authority shall be deemed to be public servants within the meaning of section 21 ofthe pakistan penal Code; 1860 (XLV of 1860). 70- Transitional provisions.- (1) Any person providing virtual Asset Services immediately before the commencement of this Act shall, within six months of such commencement, apply to the Authority for a license under this Act or shall cease to provide such services. (2J After the commencement of this Act, within six months, a person who has submitted a complete application as per sub-section [1J may continue to provide existing Virtual Asset Services: Provided that such Person fully complies with any interim directives issued by the Authority and continues to adhere to the core obligations of this Act, particularly regarding customer asset protection under AML, CFT atd CpF. 71, Power of the Federal Government to issue policy directives._ The Federal Government may, by notification in the official (;azette, give poricy directives to the Authoriry to align its actions with national policies, priorities and interests consistent with the objectives and framework established under this Act. Such policy directives shall not impede the Authority's operational autonomy. 72. Annual and speciar reports of the Authority.- (1J The Authority sha[ prepare an annual report at the end ofthe financial year and may at any time prepare special reports on any matter which in its opinion is ofparticular urgency or importance. (2) The Division concerned shall cause the annual report and the special reports to be laid before the Majlis-e-Shoora (parliament) within ninety days. (3J The report shall be placed on the website of rhe Authority immediately after its lying before the Majlis-e-shoora (parriament) for information of generar pubric. 73' Removal of difficulties.- If a procedural or operational difficutty arises in giving effect to any of the provisions of this Act, the Federal Government may, within six months of the commencement of this Act, make such order not inconsistent with the 30

provisions of this Act, as may appear to it to be necessary or expedient for removing such difficulty. 74. Savings.- Notwithstanding the lapse of the Virtual Assets ordinance,2025 (VlI of 2025), anything done, action taken, appointment made, notification or order issued, or righg privilege, obligation or liability accrued under the said 0rdinance shall be deemed to have been validly done, taken, made, issued or accrued under the corresponding provisions of this AcL 3l

SCHEDULE I (See secion 1Bl CATEGORIES OF VIRTUAL ASSET SERVICES The list below shall constitute the Sr. No (1) Advisory Services types ofVirtual Asset Services and their description. Service Category Description (2) (3) means the provision of personalised recommendations, l on professional basis, to a customer, either upon request or at the initiative of Virtual Asset Service Providers, relating to one or more actions or transactions involving VirtuaI Assets. The term "personalised" refers to recommendations that are addressed to a specific customer and take into account (or are presented as taking into account] that customer's individual circumstances, obiectives, risk profile or financial situation. General market information, research reports or non￾individualised suggesrions do not constitute recommendations. personalised 32 1. ! l :

2 , Broker-Dealer Services Custody and Administration Services means any of the following: (a) arranging or facilitating orders for the purchase and sale of Virtual Assets between two parties; (b) soliciting or accepting orders and receiving consideration in fiat currency or virtual Assets; (c) trading Virtual Assets on the Virtual Asset Service Provider's own account; Exemption: A Person that deals solely on its own account, does not execute orders on behalf of customers, and does not hold or control Customer Assets is not regarded as carrying on 'broker￾dealer services'for the purposes of this Act id.1 market-making using Customer Assets; or (e) providing placement or distribution services for lssuers acting as intermediaries. means the safekeeping or administration, on behalf of customers and pursuant to their instructions, of: [aJ Virtual Assets; or (bJ private cryptographic keys or other means of access that allow the customer to transfer or dispose of Virtual Assets independently, J.

4 Exchange Services but excludes the mere provision of software, hardware or infrastrrrchrre that enables a customer to retain exclusive control over their own private keys. means any of the following: (a) exchanging Virtual Assets for fiat currency; (b) exchanging one or more types of Virtual Assets; (cJ matching orders between buyers and sellers and executing conversions as described in [a) and (b); or [d] maintaining an order book for the above purposes. Lending and Borrowing Services :means the facilitatio n, arrangement, intermediation or directprovision (as principalJ of lending or borrowing arrangements involving virtual Assets, where one or more lenders transfer, lend or make available Virtual Assets (or rights theretoJ to one or more borrowers, subject to a contractual obligation for the borrower to return equivalent Virtual Assets (together with any agreed interest, fees or rewardsJ at a specified time or upon demand. Virtual Asset Derivatives Services means the offering, facilitation, execution, clearing, trading or ' arranging of transactions in i derivatives (including futures, 'options, swaps, contracts for :difference or other similar 6 J4 ,E

Virtual Asset Ma[agement and Invesrment : Services instruments) that have a Virtual Asset (or a basket or index of Virtual Assetsl as their . underlying reference asset means acting in a fiduciary or agency capacity for the purpose :of managing or administering another Person's Virtual Assets, including: , [aJ portfolio or discretionary investment management involving Virtual Assets; and {b) responsibility for staking on behalf of customers to earn validator or network rewards, provided that such staking is performed on a discretionary basis or forms part of a broader investment management mandate. o Virtual Asset Transfer and Settlement Services Virtual Assets Issuance Services Mining-related Virtual Asset Services includes transfer, transmission, or settlement of Virtual Assets between parties, or from one wallet, address, or location to another, on behalf of customers excluding exchang9 execution Creation, issuance, initial offering, administration, and ongoing management of Virtual Assets, including supply control, reserve management fif anyJ, redemption, governance, and requireddisclosures.

9 10. lncludes activities where mining operations provide services to third parties involving customer virtual assets or funds- Pure mining for own account is excluded. Licensing and regulatory obligations apply 9lly 35 7.

STATEMENT OF OBJECTS AND REASONS Virtual Assets being an evolving component of the modern financial ecosystem, necessitate a dedicated regulatory authority for licensing and supervision of virtual asset service providers, with the aim to ensure investor protection, transparency and market integrity. The Authority will ensure investor protection, foster innovation, and promote transparency in the Virtual Asset Market. This authority will create an enabling environment for safe trading, prevent illegal activities like money laundering and fraud, and enhance global competitiveness. 2. Therefore, a corresponding legal framework, empowering the Authority, is also required to combat money laundering, terrorist financing, and other illicit activities while promoting innovation, financial inclusion, economic grolvth and development of Shariah complaint virtual asset services aligned with international standards. 3. The Mrtual Assets Ordinance, 2025 is designed to achieve the aforementioned purposes. Senator I/inister for Finance and Revenue Muhammad Aurangzeb