Corporate Controllers and the UBOs Behind Them Under PVARA

A holding company can be a Controller. A trust can be a Controller. A fund can be a Controller. But under Pakistan’s virtual asset framework, none of them are the end of the disclosure chain — PVARA’s requirements are built to look through the corporate wrapper to the natural persons standing behind it.

This piece sets out what Section 20(5) of the Virtual Assets Act 2026 and Regulations 7.1 and 7.2 of the PVARA No Objection Certificate Regulations 2025 require when the Controller of a Virtual Asset Service Provider is itself a corporate entity, not an individual.

Who is a “Controller” when the shareholder is a company, not a person?

The definition does not change depending on who or what holds the stake. Regulation 7.1 of the NOC Regulations sets the threshold:

“7.1 Any person holding, directly or indirectly, 20% or more of voting power or share capital of the Applicant is deemed a ‘Controller’.”

Section 3(1)(xxii) of the Act defines “Person” to mean “a natural or legal Person” — so a company, a trust, a fund or any other legal entity holding 20% or more of an Applicant’s voting power or share capital is a Controller in exactly the same sense as an individual holding that stake directly. What changes is not whether the entity is a Controller, but what has to be disclosed about it.

What does the Act require specifically for corporate Controllers?

Section 20(5) of the Act creates a distinct obligation for corporate ownership structures:

“20.(5) The Authority shall prescribe additional requirements for corporate Controllers, including assessment of the corporate behaviour, integrity and track record of Controller and ultimate beneficial owners.”

Two things are notable here. First, the provision names “ultimate beneficial owners” (“UBOs”) directly, alongside the corporate Controller itself — the assessment is not satisfied by looking at the immediate corporate shareholder in isolation. Second, the assessment criteria go beyond financial soundness to “corporate behaviour, integrity and track record,” a standard the Act leaves for PVARA’s Regulations to detail further. Where those specific additional Regulations for corporate Controllers have not yet been published in the source documents reviewed here, this analysis describes the general disclosure obligations that currently apply through the NOC Regulations rather than a bespoke corporate-Controller regulation that does not yet exist in the material we hold.

What must be disclosed about the corporate Controller and its UBOs?

Regulation 7.2 of the NOC Regulations sets the baseline disclosure duty:

“7.2 Applicants must disclose all Controllers including Beneficial Owners (as defined in the AMLA 2010) and submit Form A2.”

Form A2, the Controller and Beneficial Owner Disclosure Form, has to be completed for “every Controller (holding 20% or more direct or indirect control) and every Beneficial Owner of the Applicant and the proposed local entity” — meaning a separate Form A2 is required for the corporate Controller’s own particulars where relevant, and a separate Form A2 again for each natural person identified as a Beneficial Owner standing behind it.

What does the ownership chain actually have to show?

Form A1’s Section 4.3 requires the Applicant to attach “a complete Ownership and Control Structure Chart,” which must show:

• all shareholding layers;
• all intermediate entities and jurisdictions; and
• the ultimate natural person(s) who own or control the Applicant.

Where indirect ownership exists through a corporate Controller, Form A2’s Section 2.2 repeats the same requirement at the individual disclosure level: any indirect ownership must be supported by an ownership and control chart “showing each intermediary entity, ownership percentage at each layer, and jurisdiction.” In practice, this means a multi-layer corporate structure — a holding company owned by a fund, owned in turn by a family office — cannot stop at the first corporate layer in its PVARA filing. Every layer has to be mapped down to the individual human beings who ultimately own or control the chain.

How does PVARA define a “Beneficial Owner” for this purpose?

Regulation 7.2 anchors the definition to the Anti-Money Laundering Act 2010: Controllers must be disclosed “including Beneficial Owners (as defined in the AMLA 2010).” The NOC Regulations do not restate the AMLA 2010 definition in full within the text reviewed here, so an Applicant working through a corporate Controller’s beneficial ownership disclosure should apply the AMLA 2010 definition directly rather than relying on a paraphrase. Form A2’s own Section 2.3 gives a working description consistent with that anchor, asking whether the individual is “a Beneficial Owner under AMLA 2010 and PVARA definitions” and, if so, whether the ownership arises from equity interest, rights to profits or dividends, ultimate control, decision-making influence, or “economic or voting rights beyond nominal shareholding” — language that reaches control exercised through mechanisms other than a direct shareholding.

What background information has to be disclosed about a UBO personally?

Form A2 goes well beyond identity verification. Section 3 requires professional background covering the last ten years, including any regulated entities the individual has owned, controlled or served as a director or officer of. Section 3.2 requires disclosure of any prior regulatory investigation, enforcement action, refused licence application, removal from a position of responsibility, or adverse media relating to financial misconduct. Section 3.3 requires disclosure of any criminal conviction, pending charge, or investigation for fraud, corruption, money laundering or terrorist financing. Section 4 requires a full narrative on source of wealth — how the individual’s overall wealth was accumulated — and a separate, more specific narrative on source of funds for the particular investment in the Applicant, supported by documentary evidence such as bank statements, dividend records, tax filings or asset disposal documents.

How is this different from the ordinary fit-and-proper check on Key Individuals?

The fit and proper standard applied to Key Individuals under Form A3 and the disclosure regime applied to Controllers and UBOs under Form A2 overlap in substance — both examine integrity, regulatory history and financial soundness — but they are not the same process. Section 20(1) of the Act gives PVARA direct authority to assess whether a Controller is fit and proper, the same direct-assessment tier that applies to the CEO and Directors, rather than the applicant self-assessment route that applies to most other Key Individual roles under Section 20(2). For a corporate Controller, this direct PVARA assessment under Section 20(5) extends specifically to “corporate behaviour, integrity and track record” — criteria aimed at the entity’s own conduct as a corporate actor, not only the individuals who own it.

What should an entity with a layered ownership structure prepare for?

Three practical implications follow from reading Sections 20(5) and Regulation 7.1–7.2 together. First, a corporate ownership chain adds disclosure volume, not a shortcut — every intermediate entity and every UBO at the end of the chain needs its own Form A2 and supporting documentation, regardless of how many layers separate them from the Applicant. Second, the source-of-funds and source-of-wealth narrative required at Form A2 Section 4 has to trace back to the natural person, even where the immediate investing entity is a fund or holding company with its own independent balance sheet. Third, because Section 20(5) ties the corporate Controller’s own conduct — not just its owners’ — into the fit-and-proper assessment, an Applicant should expect PVARA’s scrutiny of a corporate Controller’s regulatory and litigation history to sit alongside, not instead of, the personal disclosures made by the UBOs behind it.

About this analysis

This analysis was prepared by the CoinConnect research desk from Sections 3(1)(xxii) and 20(1), (5) of the Virtual Assets Act 2026, and Regulations 7.1 and 7.2 of the PVARA No Objection Certificate Regulations 2025, together with Forms A1 and A2 in Annex A, as published. Where PVARA’s additional Regulations for corporate Controllers referenced in Section 20(5) have not yet appeared in the source documents reviewed, that gap is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.