How a Licensed Crypto Exchange Must Hold Your Money and Coins in Pakistan Under PVARA Rules
PVARA 2026 rules make licensed crypto exchanges keep your rupees in a client bank account and your coins apart, with no staking without your written consent.
Short answer: A PVARA-licensed crypto exchange must keep your rupees in a separate client account at an SBP-licensed bank and your coins in labelled wallets of their own. It may not lend, stake or pledge your coins without your written consent. Retail customers must get a statement at least every month.
Most crypto losses in Pakistan do not come from price falls. They come from a platform that mixed customer funds with its own, used them, and then froze withdrawals. Pakistan's new virtual asset regulations speak to exactly this. They tell licensed firms how to hold your money and your coins, and they tell you what to ask for.
We read the Pakistan Virtual Asset Services Regulations, 2026, notified on 21 August 2026, on the PVARA website on 13 October 2026, including regulations 103 to 112 on client money and client assets. These rules bind licensed firms only. We could not test any firm's custody, and we found no firm that has published a proof of reserves yet.
Your rupees go into a separate client account at a licensed bank
The regulations define client money as money a licensed firm receives or holds for you in connection with a virtual asset service. The firm must keep it separate from its own money, identifiable at all times and never used to meet its own debts or those of another client.
It must hold client money in a segregated account marked for clients, with a bank licensed by the State Bank of Pakistan. The regulations say the money is not the firm's property and is not part of its estate if the firm becomes insolvent, subject to insolvency law and court directions.
The firm must pay your money into that account at once, and in any case by the end of the next business day. It may not put its own money in, except a small amount the bank needs to open the account or a short top-up to cover a shortfall.
Your coins must sit in wallets that are labelled and kept apart
For coins, the regulations use the term client virtual assets. The firm does not own them. It must keep them identifiable, protected and apart from its own assets, and record which wallets or accounts hold them, with clear labels.
The firm must be set up so that your coins can be found and returned if it fails, again subject to insolvency law and court orders. It may not take ownership of your coins through the client agreement, except where the regulations expressly allow it.
It cannot lend, stake or pledge your coins without written consent
The regulations bar a firm from using, pledging, lending, staking or re-lending your coins, except to carry out your instruction or with your prior explicit written consent. That consent must come with a clear description of the activity, the risks, any withdrawal restrictions and how rewards and losses are shared.
Rewards such as staking income, airdrops and fork benefits belong to you, unless you agreed otherwise in advance in the client agreement and the term was disclosed in a fair and clear way. So a "yield" product you never signed up for is a red flag.
| Your asset | What the firm must do | What it must not do |
|---|---|---|
| Rupees | Keep them in a client account at an SBP-licensed bank | Use them for its own debts or another client |
| Coins | Hold them in labelled wallets, apart from its own | Lend, stake or pledge without written consent |
| Rewards | Pass airdrops and staking income to you | Keep them unless you agreed in advance |
| Records | Reconcile daily where there is daily activity | Leave shortfalls unexplained |
Statements, reconciliations and proof of reserves
A licensed firm must give retail clients a statement of client money balances and movements at least monthly. It must reconcile client money and client coins, at least daily where it handles daily movements, and must tell PVARA about material gaps it does not fix in time.
For coins, the firm must also keep procedures to show that what it owes clients is fully matched by reserves. This is called proof of reserves. It must be validated independently every six months, with the report sent to PVARA within 30 days of the period end.
- Ask the firm for its licence number and match it with PVARA's list.
- Ask in which bank the client account is held.
- Read the client agreement for any clause on lending, staking or "earn".
- Check that you receive a monthly statement.
- Ask for the latest proof of reserves report, or when it will be published.
The licence check itself is in how to check a crypto exchange is PVARA licensed before you deposit. The bank side of the rule is in SBP lets banks open accounts only for PVARA-licensed crypto firms, and the licence conditions are in the crypto exchange licence guide.
What these rules do not do
The rules do not insure your money. A licensed firm must keep insurance, but regulation 36 says it must not present insurance as a guarantee that customers will recover their losses. A platform without a licence owes you none of these duties, and our guide to the Virtual Assets Act penalties explains that dealing with one can carry legal risk. If funds are lost to fraud, report it as in how to complain to PVARA about a crypto scam.
Common questions
Can a crypto exchange use my coins to earn yield?
Only with your prior explicit written consent, with the risks and withdrawal limits explained. Without it, the regulations bar lending, staking and pledging.
Where is my rupee balance held?
In a segregated client account at a bank licensed by SBP. Ask the firm which bank it uses.
Do I get a statement from the exchange?
For retail clients, at least monthly. It must show client money balances and movements.
What is proof of reserves?
It is evidence that the firm holds enough assets to match what it owes clients in coins. The regulations require independent validation every six months.
Are my coins safe if the exchange fails?
The rules are written so your coins are segregated and can be identified and returned, subject to insolvency law and court directions. They are not a guarantee.
How we verified this
What we checked, where we read it, and what we could not confirm.
Last checked on 13 October 2026, Pakistan time. We read PVARA's legal framework page and the notified Pakistan Virtual Asset Services Regulations, 2026, regulations 103 to 112. We did not test any firm and we could not confirm that any licensed firm has yet published proof of reserves.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
