Pakistan has drafted comprehensive anti–money laundering (AML) and counter-terror financing (CTF) regulations for virtual asset service providers (VASPs) as part of a new FATF-aligned framework.

The rules are designed to monitor large crypto transactions, curb illicit financial flows, and strengthen oversight of the digital asset ecosystem.

The draft framework aims to prevent money laundering, terror financing, and suspicious activity in crypto transfers. It proposes mandatory submission of a complete database for all crypto transactions exceeding Rs1 million.

Officials say the framework is expected to take effect later this year, with Pakistan declaring full implementation of the FATF Travel Rule mandatory for virtual asset activity.

Mandatory reporting, data submission

According to the document, VASPs will be required to maintain and provide detailed records of both senders and recipients of funds. The government has decided to adopt global guidelines to tighten AML controls in the virtual asset space.

Under the proposed system, crypto transfer data must be shared immediately upon request by designated government agencies.

The regulations cover all major crypto-related activities, including brokerage, custody, exchange, and token issuance. Blockchain tracking tools will also be made compulsory to identify suspicious crypto movements.

Authorities will conduct strict scrutiny of unidentified and high-risk transactions to curb illegal financial activity.

Cybersecurity declared high-priority area

Cybersecurity has been designated the most strictly regulated domain under the new framework. Every virtual asset company will be required to implement an annual cybersecurity policy approved by the relevant authority.

To enhance investor protection, the rules also mandate capital requirements, security deposits, and financial stability measures. The security deposit will only be refunded after complete clearance when a business shuts down.

The framework proposes making the fit-and-proper criteria compulsory for board members of VASPs. Any change in ownership or control will require prior approval from the Virtual Asset Authority.

Continuous system testing and auditing will also be mandatory to ensure the integrity of crypto service operations.

The draft notes that dedicated laws are being prepared for fintech and digital enterprises. The framework includes a risk-based approach and technology-driven supervision to detect illicit practices more efficiently.

A new data-sharing mechanism is being considered to support action against financial criminals across digital ecosystems.

Authorities are also weighing the creation of a special unit to monitor blockchain transactions, enhancing surveillance across Pakistan’s emerging virtual asset landscape.