Virtual assets law: a faulty approach

Business Recorder

4 days ago

The emergence of Pakistan's regulatory framework for crypto assets unfolds not through a linear evolution but as a series of abrupt pivots, uncertain mandates, and fragmented institutional posturing. Initial state responses oscillated between prohibition and passive ambiguity, particularly crystallized through the State Bank of Pakistan's 2018 circular barring financial institutions from engaging with crypto-related activity. However, a noteworthy departure has occurred with the promulgation of the Virtual Assets Ordinance, 2025 ('the Ordinance') on July 8, 2025.
This Presidential Ordinance, issued under Article 89 of the Constitution becoming effective immediately, defies parliamentary process and oversight as no emergency existed for not presenting it as a Bill before the Parliament. It reveals an institutional attempt to assert authority over a previously unregulated domain. Yet rather than embodying a product of rigorous legislative deliberation, the Ordinance resembles an amalgam of foreign statutes hastily adapted to domestic soil, lacking coherence and structural fidelity to Pakistan's socio-legal ecosystem.
The Ordinance introduces a licensing and regulatory regime under which Virtual Asset Service Providers (VASPs) are to operate drawing clear inspiration from frameworks such as the European Union's Markets in Crypto Assets (MiCA) Regulation, the United Arab Emirates' VARA rulebook, and Singapore's Payment Services Act. For instance, the classification of VASP categories, as outlined in Schedule 1, closely mirrors MiCA's broad taxonomy of crypto-asset services.
Inclusion of custody, exchange, and token issuance services under one regulatory umbrella reflects a consolidation seen in Singapore's Monetary Authority guidelines. Furthermore, capital requirements imposed under Schedule 2 strongly resemble United Arab Emirates' licensing prerequisites. Despite these parallels, the Ordinance suffers from superficial mimicry rather than thoughtful transposition.
The Ordinance appears to have been drafted in undue haste, attempting to regulate a highly volatile and technically nuanced sector without erecting a solid and reliable institutional or legal foundation. References made to other existing Pakistani laws within the Ordinance, such as Anti-Money Laundering Act, 2010, Securities Act, 2015, and Companies Act, 2017, are broadly worded failing to adequately address issues specific to virtual currencies.
These laws, originally fashioned for traditional financial instruments and corporate structures, lack definitional clarity and enforcement mechanisms appropriate for digital assets. Moreover, to date, no substantive amendments have been made to these foundational statutes to incorporate the realities and peculiarities of blockchain-based assets. Mere invocation of these statutes in the Ordinance does not bridge this gap.
The use of generic cross-references to legacy financial legislation creates interpretive ambiguity, risking inconsistent application and regulatory arbitrage. The resulting legal uncertainty may inhibit development of a stable and predictable crypto-asset ecosystem. Ordinance's overreliance on non-specific statutory references undermines its credibility as a standalone regulatory framework exposing it to challenge both from a constitutional and administrative perspective.
Inclusion of Schedule 1 in the Ordinance categorizing 'Virtual Asset Services' deserves scrutiny. The definitions employed, such as 'broker-dealer services' and 'exchange services', are broadly phrased and lack operational precision. For example, classification of 'broker-dealer services' in clause (c) as including trading on one's own account may inadvertently encompass individuals or businesses engaged in proprietary trading for treasury management purposes, creating overregulation and deterring legitimate activity.
The exemption carved out for sole-account dealers is not sufficiently delineated and could be manipulated to escape oversight. Such drafting anomalies reflect a limited understanding of digital asset market dynamics.
The category of 'custody services', defined as safekeeping or controlling virtual assets or means of access on behalf of customers, lacks an articulation of technical standards for security, segregation of assets, and recovery protocols in the event of platform insolvency or cyber compromise.
In jurisdictions such as Switzerland and Germany, regulations include specific custody protocols and operational audits, with agencies like BaFin requiring compliance with these standards. Absence of these benchmarks in the Ordinance reveals a superficial regulatory posture.
The 'exchange services' classification aggregates fiat-to-crypto and crypto-to-crypto conversions, as well as matching orders and maintaining order books. However, it provides no indication of technical, operational, or liquidity benchmarks for functioning as an exchange.
No clear definition and requirements are laid down regarding prevention of wash trading or liquidity mirroring. The oversight of algorithmic trading and market manipulation risks, well-acknowledged internationally, is glaringly missing. The lack of granularity in these definitions may lead to both overreach and under-enforcement.
Inclusion of lending and borrowing services appears forward-thinking, yet the clause fails to distinguish between collateralized, over-collateralized, and algorithmic lending models. Given the global controversies surrounding platforms like Celsius and Terra-Luna, the omission of risk buffers and liquidity thresholds in such definitions may lead to replication of failures within Pakistan's regulatory purview.
The provision on derivatives services also lacks clarity on permissible underlying assets, leverage caps, margining, and clearing obligations.
The Schedule's provision on fiat-referenced token issuance services, analogous to stablecoin issuance, requires a more robust framework. The Ordinance mandates establishment and administration of reserve assets but fails to define the nature, composition, and auditability of such reserves. This is in stark contrast to frameworks like MiCA, which require regular attestation of reserves, segregation of backing assets, and mandatory redemption rights. Without such safeguards, Pakistani consumers and investors remain exposed to systemic vulnerabilities.
The capital requirements prescribed in Schedule 2 amplify the Ordinance's exclusionary tendencies. Imposing a minimum paid-up capital of Rs.one billion on exchanges and token issuers effectively prohibits startups, SMEs, and even well-established fintechs from entering the market. This figure, though inspired by UAE and EU standards, disregards the local financial and technological environment.
The Rs 100 million requirements for broker-dealer services and Rs 200 million for custody services are similarly prohibitive, especially when coupled with compliance, infrastructure, and legal costs. The Ordinance appears designed for incumbents and well-capitalized foreign players, erecting entry barriers that stifle domestic innovation.
The economic impact of these high thresholds is likely to be severe. Startups and small and medium enterprises (SMEs) constitute the bulk of Pakistan's fintech and blockchain innovation ecosystem. By mandating paid-up capital far exceeding industry norms within Pakistan's own regulatory infrastructure (e.g., NBFCs, mutual funds), the Ordinance reflects a protectionist rather than enabling character. It renders Pakistan's virtual asset environment an exclusive domain for the privileged, in direct contradiction to the digital financial inclusion objectives articulated in the National Financial Inclusion Strategy (NFIS).
The designation of 'Significant Issuers' under sections 26-27 [Schedule-3] and related threshold market capitalization exceeding Rs 5 billion or five million domestic users introduces further complications. Though the intention to impose enhanced governance on systemic actors is commendable, the provision is poorly calibrated.
The mandatory requirement for significant issuers to maintain 3% of reserve assets as own funds, capped at Rs. 2 billion, does not consider market volatility or token model diversity. In the absence of clear stress testing frameworks or audit requirements, such thresholds may inadvertently penalize token issuers experiencing organic growth rather than managing genuine systemic risks.
The Ordinance's regulatory philosophy appears inherently conservative, prioritizing compliance and capital buffers over innovation, inclusion, and agility. The pace of technological evolution in the blockchain domain renders such rigid structures counterproductive.
The sandbox rules sections, 42-44, lack clear eligibility criteria, transparent evaluation metrics, and defined procedures for transitioning successful innovations to full licensing, creating uncertainty for innovators. The no-action relief mechanism offers limited legal certainty, as relief letters can be withdrawn arbitrarily without safeguards, potentially deterring participation.
Enforcement powers granted to the Authority are broad but lack procedural oversight, risking overreach. Penalties, including fines up to Rs 100 million or 5% of turnover, may disproportionately burden firms. The Authority should clarify sandbox participation and exit criteria, strengthen legal certainty around no-action relief, introduce independent oversight of investigatory powers, scale penalties appropriately, define emergency intervention protocols, ensure tribunal independence, and provide detailed transitional guidelines.
Additionally, the Ordinance does not distinguish between low-risk innovation (such as community tokens) and high-risk instruments (such as leveraged derivatives), thereby imposing a one-size-fits-all model that is bound to fail.
The overarching legal inconsistencies further delegitimize the Ordinance. Although the document cites Prevention of Electronic Crimes Act 2016,Anti-Money Laundering Act 2010, and other laws, they do not specifically address blockchain traceability, private key security, or decentralized finance activities.
Similarly, Income Tax Ordinance 2001 is silent on the classification of gains from crypto trading, whether they constitute business income, capital gains, or speculative gains, resulting in tax ambiguities that may lead to litigation and non-compliance.
The lack of legislative amendments to the underlying laws renders the Ordinance an isolated and unsupported enactment. This legal vacuum prevents consistent enforcement and frustrates expectations of VASPs seeking certainty. The result is an underdeveloped ecosystem governed by disconnected laws. Provisions related to 'closed ecosystems' or 'closed-loop systems', and critical analysis of definitions e.g., consumer protection, AML-CFT framework, and taxation-related provisions will be analyzed in our coming articles.
Failure to integrate the Ordinance with a broader digital economy vision dilutes its impact. The uncoordinated insertion of regulatory obligations, unsupported by infrastructure, legal amendments, or tax clarity, will most likely hinder rather than harness the potential of crypto technologies.
Implementation of the Ordinance, in its current form, could entrench systemic challenges, deter foreign direct investment, and exclude domestic talent from participating in the digital asset revolution. The absence of consultative processes and empirical market assessments reveals a policy framework reactive to compliance optics rather than developmental objectives.
The government must reconsider its approach by (i) introducing a risk-based, tiered licensing regime; (ii) aligning existing laws through amendments specific to virtual assets; and (iii) developing consultative mechanisms with industry stakeholders and technical experts to ensure adaptive regulation in this dynamic field.
Copyright Business Recorder, 2025