Built in the open: all nine months shipped, sanctions name screening now live →
Regula
Join early access
Month 9 of 9 · multi-source sanctions screening live

Compliance-as-code for Pakistan’s Virtual Asset Service Providers.

PVARA is licensing VASPs under a framework that is still being finalized. Regula stores every obligation as a versioned, machine-evaluable rule: Travel Rule thresholds, sanctions screening, recordkeeping. When the regulation changes, your compliance stack changes with it, instead of months later in a redeploy.

Join early accessSee how it works →

In the catalogue today

VA Act 2026 s.47(1)NOC Reg. 12FATF Recommendation 16NOC Reg. 11

16

Provisions seeded in the catalogue

9 / 9

Month of the build, honestly

351

Automated tests passing

3rd

Pakistan's global crypto-adoption rank (Chainalysis 2025)

The problem

A licensing race with no compliance tooling built for it.

The Virtual Assets Act 2026 opened Pakistan’s VASP market. Its first entrants are already racing toward licensure — under a regime with no locally-calibrated compliance infrastructure.

Thresholds, IVMS101, screening standards — still moving as PVARA finalizes the 2026 Regulations. Anything hard-coded against today’s drafts is obsolete by the time it ships.

  1. 2018

    Pakistan placed on the FATF grey list

  2. 2022

    Exits the grey list after 34 action items

  3. 2025DEC

    First NOCs reported issued: Binance, HTX

  4. 2026

    Virtual Assets Act opens the licensed market

Getting this right isn’t a checkbox; it’s a condition of staying off the grey list again.

How it works

Five modules. One catalogue underneath.

Each module reads its rules from the same versioned catalogue: a revised threshold ships once and lands everywhere. All five run against the real backend today; the one honest gap is the goAML export, waiting on the FMU’s schema.

01 · Foundation

16 provisions live

Every obligation in force, stored as a machine-evaluable rule object: a provision reference, a JSONLogic condition, a severity, evidence requirements, and a version history. When PVARA revises a rule, the catalogue versions it, and every module below follows without a redeploy.

16 provisions seeded, from the VA Act 2026 to FATF Recommendation 16

  • Immutable versions: superseded, never overwritten
  • JSONLogic conditions, evaluated by one tested engine
  • Evidence requirements declared per rule, not per app

In the catalogue today

VA Act 2026 s.47(1)NOC Reg. 12VA Act 2026 Schedule I

02 · Screening & scoring

Screening + scoring live

Wallet and transaction scoring with live sanctions screening against two independent sources (OFAC's published addresses and the UN Consolidated List's named entities), feature extraction from observed Ethereum and TRON history, and a rule-based classifier that shows its reasons. A sanctions match forces CRITICAL, and where no model backs a number, the score is an honest null, not a guess.

Live sanctions screening: a hit overrides everything to CRITICAL

  • Two-hop indirect exposure computed from observed history
  • Every verdict ships with risk_class_reasons, never a bare number

Reads from the catalogue

NOC Reg. 12NOC Reg. 11FATF March 2026 Report (multiple-hops)

03 · Licensing

Gap analysis live

Rule-by-rule gap analysis against PVARA's licensing checklist: every obligation marked satisfied, partial, or missing, with the evidence that proves it tracked per rule. Form A6's annual-return metrics pre-fill from observed compliance data, not self-assertion.

Satisfied / partial / missing per provision, prioritised by severity

  • Evidence uploads tracked against each obligation's requirements
  • Form A6 pre-filled from observed data; unknowns say so

Reads from the catalogue

VA Act 2026 s.46; NOC Regulations 2025 Part 4NOC Regulations 2025 Form A6

04 · Transfers

Assessments live

A five-stage assessment for every in-scope transfer: threshold routing from the catalogue's s.47(1) rule, IVMS101.2023 package construction, counterparty resolution, the sunrise check, and information exchange. When a counterparty jurisdiction isn't Travel-Rule-ready, the package is recorded as evidence: a documented exception, never a silent drop.

Threshold routing reads s.47(1) straight from the catalogue

  • IVMS101 payloads hashed and stored as evidence
  • Sunrise gaps recorded; unresolved VASPs held for review
  • Advisory recommendations: your officer keeps the decision

Reads from the catalogue

VA Act 2026 s.47(1)FATF Recommendation 16 (rev. June 2025)VARA Rulebook III.G.8

05 · Reporting

Alert queue + Form A7 draft live

Alerts raise automatically the moment a scored transaction's risk crosses HIGH or CRITICAL, with a real Form A7 Internal SAR draft (transaction facts, the rule that fired, and a narrative) generated on demand. The goAML export stays explicitly gated: the FMU's schema hasn't been obtained, so that one field says so, honestly, rather than faking it.

Alert queue over HIGH and CRITICAL scores, raised automatically

  • Form A7 draft from the alert and the rule that fired
  • goAML export marked unavailable, pending the FMU schema

Reads from the catalogue

NOC Regulations 2025 Form A7NOC Reg. 11

01 · The problem

The rules are still being written.

Pakistan’s VASP market opened under the Virtual Assets Act 2026, and the regulations governing it are still in public consultation. Any compliance system hard-coded against today’s draft is obsolete by the time it ships.

02 · The approach

Regulation as data, not as code.

Every obligation is a versioned catalogue entry with a provision reference, a JSONLogic condition, and an evidence contract. When PVARA changes a threshold, the catalogue changes. No code change. No redeploy.

03 · The posture

Regula recommends. Your compliance officer decides.

Advisory, not enforcing: Regula evaluates, flags, and evidences, but the block, hold, or release decision stays inside your systems and under your compliance officer’s authority. That keeps your team in control of every AML-critical decision, and keeps Regula out of the “critical outsourcing” classification.

04 · The progress

Month 9 of 9.

Every planned module is live: the catalogue, risk intelligence, the readiness dashboard, the Travel Rule engine, alert automation and sanctions screening. Two gaps stay open and stated rather than quietly filled: the goAML export waits on the FMU’s schema, and PVARA publishes no sanctions feed to screen against.

3rdworldwide · Chainalysis’s 2025 Global Crypto Adoption Index

The difference

One parameter changes. Everything downstream follows.

Hard-coded compliance

  1. 1A threshold changes
  2. 2Find every hard-coded check across the codebase
  3. 3Update each one, hope none were missed
  4. 4Redeploy, and hope nothing else broke

Compliance-as-code

  1. 1A threshold changes
  2. 2Update one catalogue entry
  3. 3Every module reads the new version automatically
  4. 4No code change, no redeploy

The approach

Regulation as data, not as code.

Every obligation lives in the RegulaCatalogue as a structured, versioned rule object, evaluated with JSONLogic, not buried three layers deep in a transaction handler. A Travel Rule threshold is a catalogue entry: a provision reference, a condition, a severity, a version history. That history lets an auditor reconstruct exactly which rule applied, on any date, with no change log or Slack thread to consult.

Reading the response

  • conditionEvery condition is JSONLogic, evaluated at runtime, not hand-coded in a handler.
  • version · superseded_atEvery rule is versioned: amendments supersede the old entry; nothing is deleted.
  • evidence_requiredEvery rule carries its own evidence contract: the fields an audit needs, spelled out.
GET /api/v1/catalogue/rules/{id}
200 OK
{
  "rule_id": "6f3b2c1a-8e4d-4a2b-9c7e-1f5a3d8b0e42",
  "provision_ref": "VA Act 2026 s.47(1)",
  "obligation_type": "THRESHOLD",
  "service_scope": ["EXCHANGE", "BROKER_DEALER", "CUSTODY"],
  "condition": {
    "and": [
      { ">=": [{ "var": "transfer_value_usd" }, 1000] },
      { "in": [{ "var": "transfer_type" }, ["withdrawal", "external_transfer"]] }
    ]
  },
  "evidence_required": ["ivms101_payload_hash", "counterparty_resolution_record"],
  "severity": "CRITICAL",
  "version": 1,
  "effective_date": "2026-07-01",
  "source_instrument": "VA Act 2026",
  "superseded_at": null
}

The exact shape of a real catalogue rule, not illustrative UI

The full picture

One engine. Every compliance workflow.

Regula connects regulatory rules, risk intelligence, license readiness, Travel Rule operations, and alerting through a single compliance-as-code foundation.

The foundation

RegulaCatalogue

Every regulatory obligation stored as a versioned, machine-evaluable rule object that every other module reads from.

Screening & scoring

Risk Intelligence

Wallet and transaction risk scoring with live sanctions screening against OFAC and the UN Consolidated List, plus on-chain exposure analysis.

Licensing

Readiness

Rule-by-rule gap analysis against PVARA's licensing checklist, with Form A6 pre-filled from observed data.

Transfers

Travel Rule

Threshold routing, IVMS101 packaging, counterparty resolution, and the sunrise protocol for every in-scope transfer.

Reporting

Alerts

Raised automatically the moment a scored transaction crosses HIGH or CRITICAL, with a real Form A7 draft generated on demand.

Trust & assurance

RegulaProof

An exhaustive proof of what this system can and cannot raise an alert on, with AI-drafted fixes checked against that same proof before they ship.

Why now

The market is large, and largely unaddressed.

Chainalysis’s 2025 Global Crypto Adoption Index ranks Pakistan 3rd worldwide. Pakistani regulators have estimated 30–40 million users and over USD 300 billion in annual trading activity. Figures cited as regulatory estimates, not independently audited totals, but directionally consistent with Pakistan’s adoption ranking.

That scale, combined with a licensing regime that’s only months old, means the VASPs operating here today are building compliance capability from a standing start, at the same time the rules they’re building against are still being written.

3rd

Pakistan’s rank on Chainalysis’s 2025 Global Crypto Adoption Index

30–40M

estimated users

$300B+

estimated annual volume

Regulator estimates, not independently audited.

The road ahead

REGULA [ROADMAP]2026

One catalogue, six modules.

Month 9 of 9: the catalogue, risk intelligence, the readiness dashboard, the Travel Rule engine, alert automation and sanctions screening are all live. Two gaps stay open and stated: the goAML export waits on the FMU’s schema, and PVARA publishes no sanctions feed to screen against.

See how it works →

Questions

Answered directly, not dodged.

All nine months of the planned build have shipped. The RegulaCatalogue (the rule schema, versioning, and JSONLogic evaluation engine) is real, tested, and seeded with 16 provisions. On-chain risk intelligence is live: Ethereum and TRON ingestion, real sanctions screening, and a scoring endpoint that's honest about what it doesn't know yet. The license-readiness dashboard is live: rule-by-rule gap analysis with evidence tracking and a Form A6 pre-fill. The Travel Rule engine is live: threshold routing, IVMS101 packages, counterparty resolution, and the sunrise protocol. Alert automation is live: a queue over HIGH and CRITICAL scores with a real Form A7 Internal SAR draft. Rules can be drafted from plain English behind a gate that refuses to guess. And screening now runs against two independent sanctions sources: OFAC's published wallet addresses and the UN Security Council Consolidated List's 1,011 named individuals and entities. Two gaps stay honestly open: the goAML export, blocked on Pakistan's FMU publishing its schema, and PVARA, which publishes no sanctions feed to screen against at all.

No. Regula is an independent Final Year Project built against PVARA's public regulatory framework, not commissioned, endorsed, or reviewed by the regulator.

Executing compliance actions directly risks classifying Regula as an AML-critical outsourced function under NOC Regulation 14. Staying advisory keeps the compliance officer's decision and responsibility where they belong, and keeps Regula out of the transaction path where latency and availability would become safety issues.

Per the build's own roadmap: risk intelligence in months 2–4, the readiness dashboard in month 5, the Travel Rule engine in month 6, alert automation in month 7, natural-language rule authoring in month 8, and multi-source sanctions screening in month 9. All shipped. Two things stay honestly gated, both because of external prerequisites rather than engineering scope: the goAML export on the Form A7 draft, blocked on Pakistan's FMU publishing its schema, and PVARA screening, blocked on PVARA publishing a sanctions list at all. The catalogue itself is what makes each module additive rather than a rebuild.

Yes. The console is live and linked throughout this page. The catalogue, risk intelligence, readiness, Travel Rule and alerts pages all run against the real backend; the one remaining gap (the goAML export) says so as a field on a real response, not a mockup standing in for it.

Building in the open. Early access starts before the build finishes.

We’re onboarding a small number of design partners (VASPs, compliance teams, and RegTech practitioners) ahead of the full module build-out. Join the list to get early access as each module ships, starting with the catalogue itself.