Pakistan's Virtual Asset Regulatory Authority (PVARA) published the Pakistan Virtual Asset Services Regulations, 2026 on August 21, 2026. They set licensing and conduct rules for virtual asset service providers (VASPs), including Travel Rule requirements in line with FATF standards.
Here’s What VASPs Need to Know:
- Travel Rule data is required on transfers of USD 1,000 or more (paid in PKR equivalent).
- Required data includes names and account or wallet IDs for both the sender and the recipient, plus any extra identifiers the law requires.
- The data must be in hand before you send a transfer, or before you release funds you receive.
- You need risk controls for unhosted wallets and missing data, and yearly due diligence on foreign counterparty VASPs.
- You must show the regulator, on an ongoing basis, that your controls work.
Why This Matters to Your Team:
- It affects your license: You must show the regulator working Travel Rule controls when you apply for a license and on an ongoing basis.
- Funds can’t move without the data: A transfer can’t be sent, and received funds can’t be released, until the required sender and recipient data is in hand.
- Counterparty risk is your problem: You’re responsible for vetting foreign VASPs every year and for handling unhosted wallets and missing data.
- Breaches carry penalties: The regulator can impose administrative penalties, or suspend or revoke your license.
- Pakistan is now in line with global rules: The requirements follow FATF Recommendation 16, so one approach can cover your transfers to other countries too.
When Do VASPs Need to Comply?
- New VASPs: Immediately. The regulations took effect on August 21, 2026. Any VASP licensed from then on must meet the Travel Rule requirements from day one.
- Existing VASPs: Apply within 6 months. Providers that were operating when the Virtual Assets Act, 2026 took effect have six months from that date to apply for a license. If they don’t apply, they must stop operating.
- Until the license decision: Core rules still apply. A provider that applies on time can keep operating while it waits. During that time it must still follow the core AML/CFT and customer-protection rules, which include the Travel Rule. It also needs PVARA’s approval before doing any marketing.
How TRISA Envoy Helps
TRISA Envoy is an open-source Travel Rule solution that sends compliance data directly between VASPs (peer-to-peer). Customer data is never passed through or stored by a central hub and remains under full control of your organization. The IVMS101 data for each transfer is sealed with envelope encryption, which encrypts the message itself, and sent over mutually authenticated TLS (mTLS) connections, where both sides prove their identity. Counterparties are verified through certificates issued by the TRISA Global Directory, so only the intended recipient can read the data. Envoy supports both the TRISA and TRP protocols, with a secure email fallback, so you can reach out-of-network counterparties. It is free to host yourself, which keeps customer data entirely on your own infrastructure, or you can use the managed service for $375 a month, which can be set up for your security requirements. Envoy is open, interoperable, adaptable, and affordable for VASPs of any size.