Changing Control After Registration: What PVARA Must Approve First

Buying into a licensed Virtual Asset Service Provider in Pakistan is not a transaction you can complete quietly and disclose afterwards. Once an entity is registered with PVARA, any move to acquire or increase control over it has to clear the regulator’s desk first, not after the fact.

This piece works through the prior-approval requirement in Regulation 7.3 of the PVARA No Objection Certificate Regulations 2025 and Section 22(d) of the Virtual Assets Act 2026, and sets out what is settled in the source documents and what is still left to PVARA to define.

What does “prior approval” for a change of control actually require?

It requires written approval from PVARA before the change takes effect, not a notification after the deal closes. Regulation 7.3 of the NOC Regulations states:

“7.3 The Authority must approve each Controller before AML registration may be granted. Once registered, no Controller may acquire or increase control above thresholds to be determined by PVARA without written approval from the Authority.”

The first sentence covers the entry point: no Controller is admitted to the ownership structure of an Applicant without PVARA’s approval at the AML-registration stage. The second sentence is the ongoing rule this article is about — once the entity is registered, any Controller looking to increase its stake above a threshold PVARA sets needs the same approval, applied for and granted, before the increase happens.

Who counts as a “Controller” for this purpose?

Regulation 7.1 of the NOC Regulations sets the threshold at 20%:

“7.1 Any person holding, directly or indirectly, 20% or more of voting power or share capital of the Applicant is deemed a ‘Controller’.”

Section 3(1)(v) of the Act defines Controller in materially the same terms, adding that the definition also captures a person who “otherwise exercises significant influence or control over its management or policies, whether directly or indirectly” — so the 20% shareholding test is not the only route into Controller status. A person holding less than 20% of shares but sitting in a position of de facto management control could still meet the definition, which means the prior-approval requirement in Regulation 7.3 can apply to arrangements that do not look, on paper, like a straightforward equity increase.

What does the Act itself say about changes in control?

Section 22 of the Act sets out the ongoing obligations every Licensee carries “at all times,” and paragraph (d) covers control changes directly:

“22. Ongoing obligations of licensees.— A Licensee shall, at all times— … (d) obtain the prior approval of the Authority for any material change in control or business, in the manner prescribed.”

This provision is broader than Regulation 7.3 in one respect and narrower in another. It is broader because it covers “any material change in control or business” — not only a Controller increasing an existing stake, but potentially a change in the identity of who controls the business, or a material change to the business itself. It is narrower because it is qualified by “material,” a threshold the Act does not itself define here, leaving PVARA’s Regulations to fix the meaning of “material” in this context.

What are the thresholds, and has PVARA published them yet?

The source documents do not fix a specific numerical threshold for Regulation 7.3’s ongoing control-increase rule. The text states control increases are barred “above thresholds to be determined by PVARA” — leaving the number itself for PVARA to set through its regulation-making power under Section 68 of the Act. In practice, this means an existing Controller planning to increase its holding cannot rely on the 20% figure in Regulation 7.1 as the ongoing ceiling; that figure marks the point at which Controller status begins, not the point at which a further increase requires fresh approval. Where guidance on the specific increase thresholds has not yet been issued, an entity considering a control change should treat any material increase as requiring PVARA’s prior written approval and confirm the applicable threshold with the Authority directly, rather than assuming a de minimis increase is exempt.

What has to be disclosed about an incoming or increasing Controller?

Regulation 7.2 of the NOC Regulations requires the Applicant to “disclose all Controllers including Beneficial Owners (as defined in the AMLA 2010) and submit Form A2” — the Controller and Beneficial Owner Disclosure Form. Form A2 requires, among other things, full personal identification details, the nature and mechanism of control exercised, the percentage of ownership and voting power, a beneficial ownership declaration, professional background, regulatory and criminal history, financial soundness, and a full narrative on source of funds and source of wealth for the specific investment. Where the change is a corporate entity acquiring or increasing control rather than a natural person, Form A1’s Section 4 also requires a complete ownership and control structure chart showing every intermediate layer down to the ultimate natural persons involved.

What happens if a control change goes ahead without approval?

The source documents do not set out a bespoke penalty specific to an unapproved change of control. Instead, the general consequences that apply to any breach of the Act or Regulations apply here. Section 23(1)(a) of the Act lists contravention of “any provisions of this Act or any other applicable laws, or any terms or condition of its license” as grounds for the Authority to vary, suspend or revoke a licence, following written notice and an opportunity to be heard. Separately, Section 59 gives the Authority power to impose administrative sanctions — including a written reprimand, a directive to cease or remedy the contravention, a financial penalty, or licence suspension or revocation — for a contravention of “any provision of this Act, or any Rules, Regulations, directions, circulars, or other regulatory requirements.” An unapproved acquisition of control would fall within both provisions as a breach of Regulation 7.3 and Section 22(d).

How does this connect to the wider fit-and-proper regime?

A change of control is not just a paperwork exercise — the incoming or expanding Controller has to independently satisfy PVARA’s fit and proper standard. Section 20(1) of the Act gives PVARA direct authority to determine whether a Controller is fit and proper, and Section 20(5) requires PVARA to prescribe additional requirements for corporate Controllers specifically, including assessment of “the corporate behaviour, integrity and track record of Controller and ultimate beneficial owners.” A control-change approval under Regulation 7.3, in other words, is not a separate, lighter process from the fit and proper assessment applied to Controllers generally — it triggers the same scrutiny a new Controller would face at NOC stage.

What should an entity do before agreeing to a control change?

Three practical points follow from the text. First, treat the 20% figure in Regulation 7.1 as the floor for Controller status, not the ceiling for further increases — confirm the applicable increase threshold with PVARA directly, since the Regulations leave the exact figure to be determined. Second, prepare the Form A2 disclosure package — including source of funds and source of wealth documentation — before the transaction is agreed, not after, since PVARA’s approval is a precondition to the increase taking effect rather than a formality that follows it. Third, treat “material change… in business” under Section 22(d) as a separate trigger from a control change in ownership — a business model pivot for an already-licensed VASP may need the same prior approval even where the ownership structure does not move at all.

About this analysis

This analysis was prepared by the CoinConnect research desk from Sections 3(1)(v), 20(1), 20(5), 22(d), 23(1)(a), 59 and 68 of the Virtual Assets Act 2026, and Regulations 7.1 through 7.3 of the PVARA No Objection Certificate Regulations 2025, together with Forms A1 and A2 in Annex A, as published. Where a specific numerical threshold or procedure has not yet been published, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.