Pakistan: technology regulation at a glance

Framework: Virtual Assets Act 2026 (enacted March 2026, in force upon Gazette publication); Pakistan Virtual Assets Regulatory Authority (PVARA), established July 8 2025 under Virtual Assets Ordinance 2025; SBP BPRD Circular Letter No. 10 of 2026

Pakistan enacted the Virtual Assets Act 2026, establishing PVARA as an autonomous federal regulator with full licensing and enforcement authority over virtual asset service providers and token issuers. A long-standing SBP banking prohibition on crypto (in place since 2018) was formally reversed via BPRD Circular No. 10 in April 2026, permitting banks to open segregated rupee accounts for PVARA-licensed VASPs. Crypto is legal to hold and trade but is explicitly not legal tender, and all service providers must be licensed by PVARA.

Framework: National Artificial Intelligence Policy 2025 (Ministry of IT & Telecom, approved by Federal Cabinet July 2025); Regulation of Artificial Intelligence Act 2024 (Senate bill, pending)

Pakistan's Federal Cabinet approved its first National AI Policy on 30 July 2025, establishing a six-pillar strategic framework covering innovation, human capital, secure ecosystems, sectoral transformation, infrastructure, and international partnerships. The policy is a non-binding strategic document, not statute; no comprehensive AI law is yet in force. A proposed 'Regulation of Artificial Intelligence Act 2024' introduced in the Senate remains under parliamentary review as of mid-2026.

Framework: No comprehensive data protection law in force; Personal Data Protection Bill (2023 draft, revised 2025) pending parliamentary enactment; interim sectoral coverage via Prevention of Electronic Crimes Act 2016 (as amended 2025), State Bank of Pakistan (SBP) frameworks, and Pakistan Telecommunication Authority (PTA) regulations

Pakistan currently lacks an enacted, comprehensive personal data protection statute. The Personal Data Protection Bill, originally drafted in 2023 and revised in 2025, received Federal Cabinet approval but has not been passed by Parliament, leaving personal data governed by a patchwork of sectoral rules under the SBP, PTA, and the Prevention of Electronic Crimes Act. A proposed National Commission for Personal Data Protection would serve as the dedicated supervisory authority only upon the Bill's enactment.

Framework: Payment Systems and Electronic Fund Transfers Act 2007 (PS&EFT Act); administered by the State Bank of Pakistan (SBP) via PSO/PSP Rules 2014, EMI Regulations 2023, and Digital Bank Licensing Framework 2022

Pakistan operates a well-established, multi-tier digital payments licensing regime administered entirely by the State Bank of Pakistan (SBP) under the PS&EFT Act. Distinct license categories exist for Payment System Operators/Payment Service Providers (PSOs/PSPs), Electronic Money Institutions (EMIs), and Digital Banks, with the national instant payment rail Raast underpinning interoperability. Open banking APIs are available to licensed EMIs under the 2023 revised regulations, though no standalone Open Banking Act exists; BNPL remains unregulated as a discrete product category.

Framework: Foreigners Act 1946, administered through the Directorate General of Immigration & Passports (DGIP) and the Pakistan Online Visa System (NADRA); work permits governed by the Board of Investment under the Investment Policy framework

Pakistan has no dedicated digital-nomad or remote-work visa as of May 2026. Foreign remote workers may enter on tourist visas (extendable to six months) or business visas issued via the e-Business Invitation Letter System, but no explicit legal category for location-independent remote work exists. The legal framework governing remote work arrangements in Pakistan is described by the International Bar Association as 'fragmented, incomplete or entirely absent.'

Framework: Prevention of Electronic Crimes Act 2016 (PECA) as amended by the Prevention of Electronic Crimes (Amendment) Act 2025; Pakistan Telecommunication Authority (PTA); Social Media Protection and Regulatory Authority (SMPRA, est. 2026)

Pakistan regulates online content primarily through PECA 2016 and its sweeping 2025 amendments, which criminalise cybercrime, 'fake or false information', and unlawful online content, while creating new enforcement bodies including the SMPRA, Social Media Complaint Council, Social Media Protection Tribunals, and the National Cyber Crime Investigation Agency. The framework imposes mandatory platform registration, content-removal obligations, and PTA-administered site and VPN blocking, but lacks the user-welfare, algorithmic-transparency, and risk-assessment architecture of comprehensive laws such as the EU DSA or UK Online Safety Act. A proposed Senate bill to restrict under-16s from social media was introduced and subsequently withdrawn in 2025, with a revised version expected.

Framework: Patchwork: Prevention of Electronic Crimes Act (PECA) 2016 (as amended 2025) for cybercrime; National Cyber Security Policy 2021 (non-binding) and CERT Rules 2023 administered by the Ministry of IT & Telecommunication (MoITT); plus sector-specific rules (e.g. State Bank of Pakistan ETGRM Framework for financial institutions). No single comprehensive cybersecurity-obligations law; the Personal Data Protection Bill remains a draft.

Pakistan regulates cybersecurity through a patchwork rather than a single comprehensive (NIS2-style) statute. PECA 2016 (amended January 2025) is a criminal cybercrime law and established the National Cyber Crime Investigation Agency; the National Cyber Security Policy 2021 sets aspirational goals but is not binding legislation, while binding security and incident-reporting duties exist mainly sectorally (notably the State Bank of Pakistan's framework for banks). A general personal-data-breach notification regime is still only proposed under the draft Personal Data Protection Bill.

Framework: Companies Act 2017 (administered by SECP); Foreign Private Investment (Promotion & Protection) Act 1976; Board of Investment (BOI) Ordinance 2001

Pakistan permits up to 100% foreign ownership in most sectors, with company registration handled digitally through SECP's eServices portal and typically completable within one week. However, foreign investors must navigate multiple post-incorporation registrations across several agencies (FBR, EOBI, Provincial Labour/Tax departments), and certain sectors, including banking, media, agriculture, and defence-related industries, carry specific ownership caps or restrictions.