Pakistan has drafted new regulations that will require full identity verification for crypto transfers above Rs. 1 million.
Under the Virtual Asset Service Provider Regulations 2025, all Virtual Asset Service Providers (VASPs) must collect, verify, and store detailed information about both the sender (originator) and receiver (beneficiary) of large digital asset transfers. The data must be provided to authorities whenever requested.
The move aims to bring Pakistan in line with global anti–money laundering (AML) and counter–terror financing (CTF) standards, including the FATF Travel Rule.
The draft rules cover almost every major crypto activity in Pakistan, including trading, custody, lending, derivatives, token issuance, and settlement services. Companies operating in this sector will be required to use blockchain monitoring tools to detect suspicious transactions and prevent market manipulation.
VASPs must also meet strict corporate governance standards, disclose ownership details, maintain conflict-of-interest registers, and keep paid-up capital for their licensed activities. In some cases, 30% of capital will be held as security with the State Bank of Pakistan.
The regulations also include strong cybersecurity requirements. Each VASP must maintain an approved cybersecurity policy covering system monitoring, smart contract audits, employee vetting, incident response, and vendor risk checks.
Authorities say the new framework will increase transparency in Pakistan’s crypto space and improve financial monitoring of digital asset transfers.
