AHMAD BILAL
← AHMAD BILAL / WRITING AI & RESEARCH
DESIGNGOVTRUST

Designing a regulator people can trust

What trust means for a regulator's digital front door, and the design decisions behind the PVARA web experience work.

Ahmad BilalAug 2026~7 minAI & Research
FIG. 01 · VERIFY One line forking into consumer and VASP paths that rejoin at a stamped verify mark.
Two audiences, one point of verification.

Pakistan busted a $60 million crypto scam this year. The people running it showed victims fabricated proof of profits on a phone screen, then asked for one more transfer before the payout. That's the audience half of a website like pvara.gov.pk actually serves: people who already got burned, or are one convincing screenshot away from it. The other half is a licensed exchange trying to figure out whether it's worth entering a new market. A federal regulator's website has to hold both of those readers at once. In late 2025, before the Pakistan Virtual Assets Regulatory Authority website existed in any public form, I did the foundation research and design for it.

PVARA didn't exist a year ago in any form a citizen could point to. It was signed into law as an emergency ordinance in July 2025, then formalized by parliament as the Virtual Assets Act in 2026. Somewhere in that gap, someone has to design the thing people actually meet: the page a worried parent lands on after a nephew tells them Bitcoin is finally legal here. I took that problem on. Not as the client, and not as the shipped final product. As the person who did the benchmark, the structure, and the first design answer.

01What does a new regulator's website actually need to do?

Most institutional sites get to lean on a reputation that already exists. A regulator launching from zero doesn't have that. Nobody knows PVARA exists yet, half the people who find it are scared of the thing it regulates, and the other half want a license yesterday. That's not a branding problem you solve with a nicer logo. It's a structural one: the site has to earn belief from two audiences with almost nothing in common, on the first visit, with no prior relationship to draw on.

So I started with the two mature regulators that had already solved a version of this: VARA in Dubai and ADGM in Abu Dhabi. I read their rulebooks, mapped their public-facing flows, and watched what happens when a citizen or a business actually tries to use them.

VARA's answer is a public register: type in a company name and it tells you, plainly, whether that entity holds a valid in-principle approval or a full VASP licence. Everything else on the site (the modular rulebooks for exchanges, custody, lending, issuance) exists to support that one lookup. ADGM's FSRA takes a narrower, more technical route. It was the first regulator globally to treat virtual-asset trading platforms as Multilateral Trading Facilities, so its site speaks mostly to institutions who already know what an MTF is. Neither one is built primarily to explain itself. Both are built to let you check something.

That's the finding that shaped the design: a regulator doesn't earn trust by telling you it's trustworthy. It earns it by giving you a way to verify a specific claim in under a minute.

FIG. 02 · ASSERT VS VERIFY A dense dithered slab with a seal beside a single provider-name field resolving to a stamped yes/no block over a sixty-tick scale.
A wall of asserted text with a seal, against one input, one answer, and a clock.

02The decisions that actually carry the weight

Verifiability set the structure, but a regulator also has to be readable by someone who has never opened a rulebook, so the second material I benchmarked was language itself: rulebook prose versus FAQ prose, and how much distance sits between them on VARA's and ADGM's sites. The design decisions I made for the Pakistan Virtual Assets Regulatory Authority website followed from that, and I can defend each one:

- A dual-audience fork, right at the top. One path for people checking whether a platform is safe to use, one for businesses applying for a license, both landing on the same register as the shared trust anchor. Consumers and VASPs don't read the same page well, so I didn't ask them to. - A public register framed as "verify a provider," not "our licensees." The verb matters more than the noun. "Verify" tells a scared user what to do with the page. A list just tells them what exists. - The Shariah-compliance framework as a first-class service, not a disclaimer. An independent advisory committee reviewing licensed services isn't decoration for a Pakistani regulator; it's a credibility requirement a lot of the population will check before they check anything else. I designed it as its own pillar, with its own explanation, instead of a line item under compliance. - A remittance-savings calculator as the deepest piece of citizen-facing work. Virtual-asset policy is abstract until it touches a family sending money home. I specified the calculator end to end: real corridor cost data, the comparison logic, the interface for someone to see what a regulated channel saves them against an informal one. That's where "safe" stops being a slogan and becomes a number a person can check against their own remittance. - Plain-language FAQs split by who's asking, not one shared page trying to serve a worried consumer and a compliance officer at the same reading level.

Every one of those is a claim about design intent I made during the foundation work, and I stand behind all of them as decisions I reasoned through against a real benchmark. None of them is a claim that the current pvara.gov.pk implements them exactly as I drew them.

FIG. 03 · WHAT THE FEES TAKE Two parallel rails from sender to home, the upper stacked with hatched fee blocks, the lower thin, a delta bar between them.
Two rails home: the informal channel thickened by fee blocks, the regulated one clean, the difference kept.

03Where the live site stands now

pvara.gov.pk is live, and it has grown well past the foundation work I did. There's a licensing portal now, and a public consultation process that ran through the summer of 2026 on the draft Virtual Asset Services Regulations. There's a complaints channel built with the national cybercrime investigation agency. No-objection certificates have already gone out to exchanges the size of Binance and HTX.

Three specific claims about what carried over are still open, and I'm flagging them rather than guessing:

A word on scope, because an essay about verifiable institutions should hold itself to the same bar. I was part of the original conception: the foundation research and design in late 2025, the benchmarks, two working prototypes, the information architecture and positioning. The live service has grown well past that starting point under PVARA's own team. Some of what the foundation argued for is still ahead of the live site; some was iterated away as the service found its shape. Both are normal fates for groundwork, and I make no line-by-line claims either way. What the foundation argued for is the point of this essay; the record is the contribution.

I wasn't the client here and I'm not claiming PVARA endorses this account of the work. I did research and design for the authority during its foundation period; what shipped and what PVARA's own team built independently after are two different questions, and I'd rather flag the gap than paper over it.

04Why I keep taking government work

This isn't the first time I've designed for an institution that has to earn belief instead of buying it. I did the same kind of work on GovX, a government experience platform built with EY for Saudi Arabia's Vision 2030, serving 20,000 attendees from more than 40 countries who needed the system to be legible fast, not eventually. A regulator and a national summit platform don't look alike, but they fail the same way: the moment a citizen can't tell what's real, the whole thing stops working, no matter how good the policy underneath it is.

What would you want to see on a regulator's website before you trusted it with a scam report, or a license application? That's the question I designed against here, and it's the one I'd ask again on the next one.

05References

06Further study

Branching by what you are actually trying to do next.

If you are designing a public register or a verify-this-provider flow

If you are writing the words a scared citizen reads first

If you want the evidence that design moves institutional trust