PVARA notified the full framework on 21 August. Regula’s catalogue reads it →
RegulaComply
Early access
All 11 modules live · 38 obligations · 6 instruments

The compliance operating system for Pakistan’s virtual asset economy.

Onboard and screen customers, monitor transactions, run the Travel Rule, file with the FMU and close licence gaps, all on one rule catalogue. Every decision traces to the rule in force that day.

Join early accessSee the coverage proof

In the catalogue today

VA Act 2026 s.47(1)NOC Reg. 12FATF Recommendation 16NOC Reg. 11
Operations/Alerts
API connected

Alerts

Alert queue over HIGH and CRITICAL risk scores, with a real Form A7 Internal SAR draft: transaction facts, the rule that fired, and a narrative, generated on demand. Exports as a goAML STR-F filing, validated against the FMU's 5.0.2 schema before release.

TransactionRiskStatus
Today3 alerts
0x7a3f0c19e4b2d8a6f15c3e7b90d4a2c8e6f1b3d5a7c9e2f4b6d8a0c2e4f6c41dHighFiled

Form A7 Internal SAR · NOC Regulations 2025 Form A7

Export draft

Transaction 0x7a3f0c19e4b2d8a6f15c3e7b90d4a2c8e6f1b3d5a7c9e2f4b6d8a0c2e4f6c41d on ETHEREUM moved 1500.00 USD-equivalent of USDT from 0x9b21f6d04a77c3e8b5f2a19d6c4e7b0f3a8d5c2e to 0x4e8c2a71d9b5f306e1c7a2d8f4b9e5c3a6d0b7f2, recorded at 2026-09-17T09:31:00+00:00. The transaction was classified HIGH under NOC Reg. 11 (indirect_illicit_exposure_2hop 0.62 >= 0.5).

Why it fired · NOC Reg. 11

  • indirect_illicit_exposure_2hop 0.62 >= 0.5

goAML export

Validated against the FMU's goAML schema 5.0.2 before release. Upload it to the goAML portal under your own reporting-entity registration.

Download goAML XML

Triage

Filed by s.malik@vasp.example · 2-hop exposure confirmed · 12 Oct 2026, 14:36

0x2c8be1a4f7d09635c2e8b4a1f6d3c7e9b0a5d2f8c4e1b7a3d9f6c2e8b5a0d4f1HighDismissed
0xe19d4b7a2c6f8053a7d1e4b9c2f6a8d3e0b5c7f1a4d8e2b6c9f3a5d7e1b4c8f0CriticalDismissed
An illustrative walk through the RegulaComply console on a demonstration tenant. An officer opens the obligation catalogue of 38 provisions and selects VA Act 2026 s.47(1), whose condition reads a transfer's value and type. A transfer is scored HIGH by the heuristic classifier, which raises an alert. A Travel Rule assessment of the same transfer applies the threshold, builds an IVMS101 package, resolves the counterparty and finds the rule in force, then holds for review because no message channel exists yet. The alert's Form A7 draft is opened, its goAML XML downloaded, a filing proposed and approved by a second officer. The readiness report's Form A6 pre-fill counts the filed report and an assessment is recorded. The audit trail's signed checkpoint is proposed and approved, sealing the chain.

38

Obligations in force

6

Months to build it

3,115

Automated backend tests

3rd

Pakistan's crypto-adoption rank (Chainalysis 2025)

In motion

A rulebook can’t run itself.Watch what does.

A short film that plays on a loop, muted until you turn the sound on with the speaker button. It opens on the rules PVARA notified in August 2026, then shows the rule catalogue, customer screening, risk scoring, the Travel Rule, an alert that becomes a filing two people approve, licence readiness and the audit trail, and closes on the three questions a regulator asks.

The problem

A licensing race with no compliance tooling built for it.

The Virtual Assets Act 2026 opened the market. Its first entrants are racing to a licence with no compliance stack built for Pakistan.

The 2026 Regulations arrived complete and in force: thresholds, IVMS101, screening, recordkeeping. Reading 178 pages is easy. Proving which version you met, on a given date, is the part no tool on the market does.

  1. 2018

    Pakistan placed on the FATF grey list

  2. 2022

    Exits the grey list after 34 action items

  3. 2025DEC

    First NOCs reported issued: Binance, HTX

  4. 2026MAR

    Virtual Assets Act opens the licensed market

  5. 2026AUG

    Full framework notified: S.R.O. 1419 and 1420

Getting this right isn’t a checkbox; it’s a condition of staying off the grey list again.

How it works

11 modules. One catalogue underneath.

All 11 modules read one versioned catalogue of 38 obligations: change a rule once and it lands everywhere, live today. The only gap is PVARA’s, which has yet to publish a sanctions list.

01 · Foundation

38 provisions live

16 of 38 obligations carry a machine-evaluable condition. The rest are proven by filed evidence, because no ledger can prove who your MLRO is.

  • From the VA Act 2026 to FATF Recommendation 16
  • Versioned: superseded, never overwritten
  • One tested engine evaluates every condition
  • Each rule names the evidence it needs
In the catalogue todayVA Act 2026 s.47(1)NOC Reg. 12

02 · Screening & scoring

Screening + scoring live

Scores wallets and transactions against 1,700+ sanctioned addresses and names the exact signals that fired. Never a bare number.

  • One sanctions hit overrides everything to CRITICAL
  • Sees tainted funds up to two hops away
  • Nine warning signs per transfer, each explained
Reads from the catalogueNOC Reg. 12NOC Reg. 11

03 · Licensing

Gap analysis live

Know exactly where you stand on all 38 obligations: each marked satisfied, partial or missing, with the evidence still needed.

  • Gaps ranked by severity, worst first
  • Every upload tracked against its requirement
  • Form A6 pre-filled from observed data; unknowns say so
Reads from the catalogueVA Act 2026 s.46; NOC Regulations 2025 Part 4NOC Regulations 2025 Form A6

04 · Transfers

Assessments live

Every transfer from USD 1,000 up runs five stages: threshold check, IVMS101 package, counterparty resolution, sunrise check and a stored verdict.

  • Threshold read live from s.47(1)
  • IVMS101 payloads hashed and stored as evidence
  • Sunrise gaps recorded; unresolved VASPs held for review
  • Advisory by design: your officer decides
Reads from the catalogueVA Act 2026 s.47(1)FATF Recommendation 16 (rev. June 2025)

05 · Reporting

Alert queue + Form A7 draft live

The moment a transaction scores HIGH or CRITICAL, an alert opens. One click drafts its Form A7 internal SAR from stored facts. Nothing invented.

  • Form A7 draft from the alert and the rule that fired
  • Review queue for borderline cases, cleared or escalated by a person
  • goAML XML validated against the FMU's 5.0.2 schema
Reads from the catalogueNOC Regulations 2025 Form A7NOC Reg. 11

06 · Customer due diligence

Customer records + screening live

Every customer is a record, not an address string. Screened on arrival and again after every list change, against 75,000+ sanctioned names and 29,800+ public officials.

  • Added by hand or resolved from a Travel Rule transfer
  • Re-screened on demand, with every screen kept
  • Beneficial owners recorded per entity
  • Unrated shows as unrated, never as low risk
Reads from the catalogueS.R.O. 1419(I)/2026 Reg. 98VA Act 2026 s.47(1)

01 · The problem

The rules are written. That is the problem.

Two instruments. 178 pages. In force the day they were notified. Chapter VIII alone, regulations 80 to 102, runs from the MLRO to the Travel Rule, and none of it is a draft you can wait out.

02 · The approach

Regulation as data, not as code.

Each obligation is a versioned entry: its provision, its evidence and, where the duty is observable, a condition checked against your data. PVARA moves a threshold; the catalogue changes. Your code doesn’t.

03 · The posture

Regula recommends. Your compliance officer decides.

Regula evaluates, flags and builds the evidence. Block, hold or release stays your officer’s call, which keeps Regula clear of “critical outsourcing”.

04 · The progress

Built in 6 months.

All 11 modules are live, backed by 3,115 automated tests. The one open gap is stated, not hidden: PVARA has yet to publish a sanctions feed.

3rdworldwide · Chainalysis’s 2025 Global Crypto Adoption Index

The difference

One parameter changes. Everything downstream follows.

Hard-coded compliance

  1. 1A threshold changes
  2. 2Find every hard-coded check across the codebase
  3. 3Update each one, hope none were missed
  4. 4Redeploy, and hope nothing else broke

Compliance-as-code

  1. 1A threshold changes
  2. 2Update one catalogue entry
  3. 3Every module reads the new version automatically
  4. 4No code change, no redeploy

The approach

Regulation as data, not as code.

All 38 obligations live in the RegulaCatalogue as versioned rule objects, not logic buried in a handler. Each keeps its full history, so an auditor sees exactly which rule applied on any day.

Reading the response

  • conditionJSONLogic, evaluated at runtime. Never hand-coded.
  • version · superseded_atAmendments supersede the old entry. Nothing is ever deleted.
  • evidence_requiredThe exact fields an auditor will ask for, spelled out per rule.
GET /api/v1/catalogue/rules/{id}
200 OK
{
  "rule_id": "6f3b2c1a-8e4d-4a2b-9c7e-1f5a3d8b0e42",
  "provision_ref": "VA Act 2026 s.47(1)",
  "obligation_type": "THRESHOLD",
  "service_scope": ["EXCHANGE", "BROKER_DEALER", "CUSTODY"],
  "condition": {
    "and": [
      { ">=": [{ "var": "transfer_value_usd" }, 1000] },
      { "in": [{ "var": "transfer_type" }, ["withdrawal", "external_transfer"]] }
    ]
  },
  "evidence_required": ["ivms101_payload_hash", "counterparty_resolution_record"],
  "severity": "CRITICAL",
  "version": 1,
  "effective_date": "2026-07-01",
  "source_instrument": "VA Act 2026",
  "superseded_at": null
}

The exact shape of a real catalogue rule, not illustrative UI

The full picture

One engine. Every compliance workflow.

Rules, risk, licence readiness, the Travel Rule and alerting all read one versioned catalogue. Revise an obligation and everything downstream moves with it. No release.

The foundation

RegulaCatalogue

38 obligations as versioned rules every module reads: 16 checked against your data, the rest by filed evidence.

Screening & scoring

Risk Intelligence

Wallet and transaction scoring against 1,700+ sanctioned addresses, with exposure traced two hops deep.

Licensing

Readiness

A live gap analysis on all 38 obligations, worst first, with Form A6 pre-filled from your data.

Transfers

Travel Rule

IVMS101 packaging, counterparty resolution and the sunrise check on every transfer from USD 1,000 up.

Reporting

Alerts

Raised the instant a transaction scores HIGH or CRITICAL, with a real Form A7 draft on demand.

Sanctions

Screening

75,000+ names across 5 sanctions sources, each match checked against the listed date of birth and ID.

Roles & approvals

Governance

Roles from auditor to admin. Filing a report or sealing the audit chain takes two people, even for an admin.

Trust & assurance

RegulaProof

An exhaustive proof of what Regula can and cannot alert on, with every AI-drafted fix checked against it.

Why now

The market is large, and largely unaddressed.

Pakistan ranks 3rd in the world for crypto adoption (Chainalysis), with an estimated 30–40 million users and over USD 300 billion traded a year.

The licensing portal opened on 21 August 2026, the day the framework took effect. VASPs are building compliance from zero, against rules already in force.

3rd

Pakistan’s rank on Chainalysis’s 2025 Global Crypto Adoption Index

30–40M

estimated users

$300B+

estimated annual volume

Regulator estimates, not independently audited.

The road ahead

REGULA [ROADMAP]2026

One catalogue, 11 modules.

Built in 6 months: every planned module live, a hash-chained audit trail and two-person approval on filings. One gap stays open, and it is PVARA’s: no sanctions feed yet.

See how it works →

One workspace

The catalogue, the gaps, the queue, and the receipt.

Four of the 11 modules, in the order an officer meets them: what the law requires, where you stand, what needs work today, and the tamper-evident record of every answer.

The console

Every obligation in force, evaluated against your own data, and a record of every answer.

Regula

Catalogue

Every obligation in force, versioned and cited, with your position on each. Evaluated automatically where the duty shows up in your data, evidence-gated where it does not.

In force today
38Versioned rule objects across 6 instruments
Reg. 100(2)Critical

Originator and beneficiary information on qualifying Travel Rule transfers.

Questions

Answered directly, not dodged.

All 11 modules are live, built in 6 months on the real backend, with 3,115 automated tests, a hash-chained audit trail and two-person approval on filings.

PVARA notified the Virtual Asset Services Regulations (S.R.O. 1419(I)/2026) and the Activity Specific Regulations (S.R.O. 1420(I)/2026), in force at once, and opened the licensing portal. Reg. 100(2) set the Travel Rule threshold at the PKR equivalent of USD 1,000, the placeholder already in our catalogue: an edit, not a redeploy.

No. Each match carries the list’s own date of birth and ID number, checked against your customer record: a second fact closes it, a conflict rules it out, and a gap is never guessed. Sources: OFAC’s SDN list, the UN Security Council Consolidated List, the EU consolidated list, the UK OFSI list and OpenSanctions.

No. Regula is an independent Final Year Project built on PVARA’s public framework, not commissioned, endorsed or reviewed by the regulator.

Acting on transactions could make Regula an AML-critical outsourced function under NOC Regulation 14. Advisory keeps your officer in charge, and Regula out of the transaction path.

They already have. One thing waits on an outside party: PVARA publishes no sanctions list. The goAML export validates every report against the FMU’s own 5.0.2 schema; a live filing awaits a licensed entity’s FMU registration.

Yes. The console is live, linked throughout this page and running on the real backend.

Be ready when the regulator asks.

We’re onboarding a handful of design partners: VASPs, compliance teams and RegTech practitioners. Every module is live, so you test the console on your own customers, not a roadmap.

Founding VASPs start with 60 days at no cost. See the terms