Pakistan has the users, the regulator, and the political will. FATF’s March 2026 report tells it exactly where the gaps are. The question is whether the State Bank of Pakistan (SBP) and Pakistan Virtual Assets Regulatory Authority (PVARA) will move fast enough to fill them.
Pakistan has a regulator now. A year ago, 40 million crypto users operated in a grey area with no licensing body, no formal oversight, and no legal status for Virtual Asset Service Providers (VASPs). People traded billions in stablecoins through Telegram groups and Over the Counter (OTC) desks in Dubai, and the government looked the other way. That changed when the Virtual Assets Ordinance 2025 established PVARA, and by March 2026 Parliament had turned it into permanent law. The Virtual Assets Act 2026 gives PVARA full authority to license exchanges, ban market manipulation, and jail unlicensed operators. Binance and HTX have No Objection Certificates. A regulatory sandbox for stablecoins and remittances launched in February. Pakistan is, on paper, serious about digital finance.
Then FATF published its March 2026 targeted report on stablecoins and unhosted wallets. The gap between having a regulator and having a regulated stablecoin ecosystem became very visible, very fast.
What FATF Actually Said in March 2026
The Financial Action Task Force (FATF) released a forty two page report on March 3, 2026, drawing on more than fifty submissions from across its Global Network. The headline finding: stablecoins now account for 84% of illicit Virtual Asset (VA) transaction volume globally. TRM Labs data puts illicit stablecoin receipts at $141 billion in 2025, the highest in five years, across a market of over 250 coins with a combined cap exceeding $300 billion.
The real finding, though, is structural. When a stablecoin moves Peer to Peer (P2P) through an unhosted wallet between two individuals with no licensed VASP in the middle, no Anti-Money Laundering/Countering the Financing of Terrorism/Counter Proliferation Financing (AML/CFT/CPF) check is triggered, no Know Your Customer (KYC) obligation applies, and no Suspicious Activity Report (SAR/STR) is filed. FATF identified four misuse categories driving this: P2P transfers bypassing compliance infrastructure entirely; cross chain movements outside issuer controls; complex Money Laundering/Terrorist Financing/Proliferation Financing (ML/TF/PF) layering chains; and state linked actors including Democratic People’s Republic of Korea (DPRK) cybercriminals and Iranian networks financing prohibited procurement through stablecoin corridors.
FATF’s ask is concrete: require freeze, burn, and deny list capabilities in the secondary market; mandate Customer Due Diligence (CDD) at redemption; enforce the Travel Rule across Travel Rule-covered Wallets (TRWs); apply Enhanced Due Diligence (EDD) to high risk P2P activity; and fully implement Recommendation 15 to bring stablecoin issuers and intermediary VASPs under clear obligations.
Why This Report Lands Differently in Pakistan
Pakistan is the world’s third largest crypto market by retail activity, with an estimated 40 million users and over $25 billion in annual crypto transactions, most of it flowing through informal P2P channels. Chainalysis has documented for years that Pakistan’s crypto activity is dominated by P2P exchanges, typical of markets with capital controls and limited formal financial access. Since stablecoin purchases happen through these channels, almost none of it reaches the Financial Monitoring Unit (FMU).
The former Chairman of the Federal Board of Revenue said it plainly: stablecoin remittance flows through Pakistan are definitely happening, a digital evolution of the hawala/hundi system. A Pakistani exporter waiting days for a bank transfer while navigating FBR audits will choose a USDT P2P desk that settles in minutes. A freelancer required to submit contracts and foreign client details before receiving payment will prefer an offshore wallet. This is rational behaviour, not malice, and it means billions in flows remain invisible to Pakistani institutions.
Two specific risks follow. First, grey list re-entry. Pakistan exited the FATF grey list in October 2022. When the next mutual evaluation arrives, Recommendation 15 compliance around stablecoins will be assessed. A jurisdiction processing $25 billion in annual crypto volume with no stablecoin specific reporting and no blockchain analytics at the FMU will not score well. Second, transit jurisdiction risk. FATF explicitly flags stablecoins as the instrument of choice for DPRK cybercriminals and Iranian procurement networks. Pakistan does not need to be a knowing participant to become a routing jurisdiction.
We have over 100 million unbanked citizens, people who have no saving tools, no investment tools, no way to break out of their economic class. Hence why crypto and blockchain are not a luxury for Pakistan. It is a ladder for the masses. — Bilal Bin Saqib, Chairman PVARA, Consensus Hong Kong 2026
The Gap Between Having a Regulator and Having Oversight
PVARA exists. The Act gives it real statutory authority. The sandbox is running. All of this is genuine progress. But VASP licensing alone cannot close the gap FATF is describing. PVARA’s mandate covers licensed VASPs. FATF’s concern is with what flows outside those channels: Decentralised Finance (DeFi) protocols, unhosted wallets, Decentralised Exchange (DEX) activity, the informal USDT desks on Telegram. These flows are by definition outside any VASP licensing framework. France, Canada, India, and Singapore are cited in the FATF report as case studies precisely because even mature regulators are struggling with this. But those countries have one thing Pakistan lacks: on chain visibility. Pakistan’s FMU cannot yet see what is happening in the stablecoin ecosystem. You cannot supervise what you cannot see.
What SBP and PVARA Must Actually Do
The FMU needs blockchain analytics in 90 days
SBP should execute an agreement with a blockchain analytics provider, Chainalysis and TRM Labs both operate in this region, giving the FMU visibility into Pakistan linked wallet clusters, P2P flows, and Gulf corridor Distributed Ledger Technology (DLT) based USDT movements. Without this, every other supervisory action is enforcement theatre.
PVARA must impose stablecoin reporting on NOC holders now
Binance and HTX are already registering with the FMU. PVARA should require both to file monthly stablecoin transaction reports covering volume by corridor, wallet type, and average transaction size. Both exchanges need PVARA’s approval to advance toward full licensing. Pakistan has the leverage. It should use it.
SBP must design a stablecoin remittance corridor connected to PRISM+
A material share of Pakistan’s $30 to $35 billion in annual remittances flows informally through USDT. SBP should designate a licensed stablecoin remittance pathway through PVARA licensed VASPs that feeds into the PRISM+ real time settlement system. Senders remit in stablecoins; the VASP converts at receipt; SBP sees the foreign exchange flow; the FMU gets the transaction data. No legal tender status required, no monetary policy authority surrendered.
PVARA’s sandbox must run a freeze and burn pilot before June 2026
PVARA should require at least one sandbox participant to implement FATF’s technical controls on a live stablecoin instrument before the end of Q2: freeze capability, deny listing, CDD at redemption. The pilot shows whether these controls work in Pakistan’s actual infrastructure before they are mandated sector wide.
SBP, PVARA, and FMU must run a joint task force that meets monthly
The Virtual Assets Act 2026 mandates coordination between SBP, PVARA, SECP, and FMU. That coordination needs to be operational and documented, not a clause in legislation. A monthly working group on stablecoin flow mapping produces the inter agency evidence FATF’s mutual evaluation will look for.
The Case for Pakistan to Build Its Own Stablecoin Infrastructure
Pakistan should not be trying to regulate its way around stablecoins. It should be building its own. A rupee backed stablecoin designed with FATF’s required technical controls embedded from inception would give Pakistan’s 40 million users a domestically governed, Shariah compliant, Central Bank Digital Currency (CBDC) adjacent instrument that keeps economic activity visible to Pakistani institutions rather than routing it through Tether’s infrastructure or through DeFi protocols no regulator can monitor.
PVARA Chairman Bilal Bin Saqib has already confirmed Pakistan will launch a sovereign stablecoin, and the SBP’s CBDC pilot with Soramitsu, backed by World Bank and IMF involvement, is underway. The instinct is right. What the FATF report adds is urgency: every month those instruments are not in place, the informal P2P economy grows larger and harder to pull back into visibility. If Pakistan does not build this infrastructure, the OTC desks in Dubai will keep handling Pakistani flows, Anonymity Enhanced Cryptocurrencies (AECs) and mixing services will absorb the volume that wants to avoid scrutiny, and Pakistan will enter its next FATF evaluation having presided over one of the world’s largest informal crypto markets while producing almost no supervisory data about it.
The Moment Is Now
Pakistan has a regulator, a law, a sandbox, and two major exchanges in its licensing pipeline. The Virtual Assets Act 2026 was signed the same week FATF’s stablecoin report made headlines. That creates a specific window to move from having built the institutional architecture to actually using it. Get FMU analytics in 90 days. Impose reporting on licensed platforms immediately. Design a remittance corridor. Run a technical pilot. Coordinate monthly. None of this requires abandoning IMF commitments or treating stablecoins as legal tender. It requires deciding that regulatory visibility is better than regulatory invisibility, and that building Pakistan’s own stablecoin infrastructure is the only way to permanently shift $25 billion in informal VA activity from invisible to bounded. Pakistan has the users, the regulator, and the political will. What it needs now is the specificity to turn all of that into infrastructure 100 million Pakistanis can actually trust.
Key Numbers
84% of global illicit Virtual Asset transaction volume involves stablecoins — Chainalysis / FATF, March 2026
$300B+ stablecoin market cap, 250+ coins in circulation — FATF Targeted Report, March 2026
$141B illicit stablecoin receipts in 2025, highest in five years — TRM Labs
40M+ Pakistani crypto users — Pakistan Crypto Council, 2026
$25B+ Pakistan’s estimated annual P2P crypto volume, mostly informal
About Author:
Tehreem Kashif, a BS Financial Technologies student at FAST and the General Secretary of the NUCES FinTech Society. She also work with the MENA Fintech Association as a Member Success Coordinator, supporting initiatives that engage and grow the fintech community.”
For contact: https://www.linkedin.com/in/tehreem-kashif-719913346/
