Self-custodial wallet / non-custodial software in Pakistan
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Pakistan without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No statutory AML obligations attach directly to a non-custodial software publisher since it is not a VASP under current Pakistani law — the publisher never holds, controls, or has access to user funds.
- The SBP CDD/KYC Regulations 2022 (BPRD Circular No. 04 of 2022) define VASPs consistently with FATF and mandate CDD/KYC obligations, but these apply to financial institutions and regulated VASPs, not to software publishers without custody.
- FATF Recommendation 15 (VASP regulation for AML/CFT) influences Pakistan's policy direction, and any future regulatory framework is expected to cover VASPs — but pure non-custodial software likely falls outside the VASP definition.
- If the publisher transitions to a custodial model or offers ancillary financial services, it would be treated as a VASP and become subject to full AML obligations: CDD/KYC, beneficial ownership identification, PEP screening, sanctions screening, transaction monitoring, STR filing to the FMU, and record-keeping under the AMLA 2010.
Key Restrictions
- SBP BPRD Circular No. 03 of 2018 prohibits banks, MFBs, and PSOs/PSPs from dealing in, facilitating, or maintaining accounts related to virtual currencies — this means non-custodial wallet software cannot integrate with the formal banking system for fiat on/off ramps.
- No specific regulatory framework exists for non-custodial software or wallet publishers; the legal environment is ambiguous with no explicit prohibition on publishing the software itself.
- The Pakistan Virtual Assets Act, 2026 reportedly requires licensing of VASPs (including custodians) by PVARA, but a non-custodial software publisher does not meet the VASP definition under FATF standards.
Key Risks
- De facto banking ban: Users cannot easily convert crypto to PKR through regulated financial channels, creating practical friction and potential informal market reliance.
- Enforcement precedent: The FIA has targeted Binance Pakistan for alleged money laundering and illegal financial transactions, indicating a risk that authorities may take an expansive view of what constitutes a crypto-related violation.
- Regulatory ambiguity: The shift from a de facto ban (SBP 2018 circular) to proposed regulation (Virtual Assets Act, 2026 / PVARA) creates uncertain transition risk — the current status is neither fully banned nor legally recognized.
- Political/PR risk: Negative official statements and media coverage (e.g., Dawn reporting on proposed bans) create reputational exposure for entities operating in the space.
- Extraterritorial risk: As a foreign software publisher, local enforcement action (e.g., blocking the website/app store listing) is possible despite no custody relationship.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SBP BPRD Circular No. 03 of 2018: Issued on April 06, 2018, this circular explicitly prohibits all banks, Microfinance Banks (MFBs), and Payment System Operators (PSOs)/Payment Service Providers (PSPs) from:
Dealing in Virtual Currencies/Coins/Tokens (VCs/VCOs/VCTs).
Facilitating any transaction involving VCs/VCOs/VCTs.
Maintaining accounts of individuals/entities involved in VCs/VCOs/VCTs.
Cryptocurrency exchanges, custody providers, and payment processors cannot legally operate with bank accounts in Pakistan or integrate with the traditional financial system.
Anti-Money Laundering Act, 2010 (AMLA 2010): This is the overarching legislation that criminalizes money laundering and provides the legal basis for AML/CFT measures in Pakistan. It mandates reporting obligations for financial institutions and designated non-financial businesses and professions (DNFBPs).
SBP CDD / KYC Regulations, 2022 (BPRD Circular No. 04 of 2022): This is a critical development. The State Bank of Pakistan, through its Banking Policy & Regulations Department (BPRD), issued comprehensive Customer Due Diligence (CDD) / Know Your Customer (KYC) Regulations, 2022. These regulations explicitly define and include "Virtual Asset Service Providers" (VASPs) as a type of entity that must comply with AML/CFT requirements, effectively bringing them under the regulatory ambit.
Key Aspect: These regulations define a VASP, consistent with FATF definitions, and mandate that they adhere to all the CDD/KYC obligations applicable to other financial institutions.
SBP Circular (January 2018): The State Bank of Pakistan issued Circular No. 03 of 2018, titled "Prohibition of Dealing in Virtual Currencies/Tokens (VCs/ICTs)." This circular explicitly stated that VCs/ICTs are not legal tender in Pakistan and prohibited all banks, financial institutions, and payment system providers from dealing in, processing, or facilitating transactions involving VCs/ICTs.
Pakistan has enacted the Virtual Assets Act, 2026, which requires all Virtual Asset Service Providers, including cryptocurrency custodians, to obtain a license from the Pakistan Virtual Assets Regulatory Authority (PVARA).
Entity Targeted: Binance Pakistan (and implicitly, individuals running scam schemes facilitated through Binance). Violation Type: Alleged involvement in multi-million dollar cryptocurrency scam, money laundering, illegal financial transactions, non-compliance with local regulations. The FIA issued a formal notice to Binance's Global Head of Growth for its alleged role in facilitating fraudulent transactions that led to significant financial losses for Pakistani citizens. Penalty Amount: No direct fine was publicly levied against Binance by Pakistani authorities. The "penalty" was primarily investigative pressure, a formal inquiry, and a demand for cooperation, which could have led to further action or reputational damage. The FIA initiated criminal proceedings against individuals involved in the scam. Outcome: The FIA launched an inquiry and issued a formal notice to Binance, demanding details and cooperation. Binance subsequently stated its commitment to cooperate with the FIA and local authorities. The FIA also identified and initiated action against 11 individuals alleged to be masterminds of a multi-million dollar fraud scheme involving Binance. The action highlighted the government's serious concerns about unregulated crypto activities. While Binance itself wasn't fined, the action put significant pressure on the exchange and warned the public.
FATF Recommendation 15: Which requires countries to regulate and supervise Virtual Asset Service Providers (VASPs) for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) purposes. Pakistan's compliance with FATF recommendations is critical for its international financial standing.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Non-custodial wallet software publishing does not currently trigger VASP classification or AML obligations in Pakistan since the publisher never holds user funds, but the SBP's 2018 banking prohibition blocks fiat integration, and the emerging Virtual Assets Act 2026/PVARA framework creates transition risks; the model is legally ambiguous but practically operable as pure software without financial services.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?