Crypto Company Pakistan: Why NOC Comes Before SECP

Most founders arrive with the company already registered. They have a Private Limited entity, a memorandum of association naming crypto exchange services as the principal line of business, and an expectation that licensing is the next step. Under the Virtual Assets Act, 2026, that order is wrong.

The Act inverts the sequence that applies to almost every other business in Pakistan. Regulatory clearance comes first. Incorporation comes second. A licence application comes third. Getting this wrong is not fatal, but it costs weeks and it starts your relationship with the regulator on the wrong footing.

This piece sets out what the statute actually requires, in what order, and where the Securities and Exchange Commission of Pakistan (SECP) fits in.

Do I incorporate my crypto company before applying to PVARA?

No. Under section 19(1) of the Virtual Assets Act, 2026, any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services must first apply to the Pakistan Virtual Asset Regulatory Authority (PVARA) for a No-Objection Certificate, before commencing the incorporation process.

The operative words are unambiguous:

“Any Person intending to incorporate a company, under the Companies Act, 2017 (XIX of 2017) or any other law for the time being in force, with the primary objective of engaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.”

Two elements of that sentence carry the weight. The first is “intending to incorporate” — the duty bites before the company exists, at the point of intention. The second is “primary objective”. The trigger is the purpose of the company, not the presence of a licence application.

In practice, this means the sequence is: apply to PVARA, obtain the No-Objection Certificate (NOC), then go to SECP for incorporation, then apply for the licence. If you have already incorporated, you have not committed an offence under the Act as drafted — but you have skipped a gate the Authority expects to have controlled, and you will be explaining that in your application.

What is the correct sequence for setting up a crypto company in Pakistan?

The correct sequence has four stages: NOC application to PVARA, incorporation of a local company at SECP, goAML registration with the Financial Monitoring Unit, and a full licence application under section 17 of the Ordinance framework as operationalised by the PVARA No Objection Certificate Regulations 2025. Each stage unlocks the next.

Stage	What happens	Source
1	Apply to PVARA for a No-Objection Certificate using Form A1	Act s.19(1)–(2); NOC Regs reg 15.1
2	PVARA assesses and issues or refuses the NOC	NOC Regs reg 17.1
3	Register the foreign entity already providing AML-Registered Services in Pakistan on the goAML portal	NOC Regs reg 15.3(a)
4	Incorporate a local company in Pakistan	NOC Regs reg 15.3(b)
5	Submit the licensing application within three months of issuance of the VASP licensing regulations	NOC Regs reg 15.3(c)

Regulation 15.3 of the NOC Regulations sets out stages three to five as obligations that crystallise upon issuance of the NOC:

“Upon issuance of the NOC, the successful Applicant shall: (a) Register the foreign entity already providing AML Registered Services in Pakistan on the goAML portal; (b) Incorporate a local company as required under Section 15(1) of the Ordinance; and (c) Submit the licensing application, in the form prescribed by the Authority, within three months of the issuance of the VASP licensing regulations.”

Note the drafting quirk. The NOC Regulations were written against the Virtual Assets Ordinance, 2025 and refer to “Section 15(1) of the Ordinance”. The Act that has now passed the National Assembly places the equivalent pre-incorporation clearance duty at section 19(1). Section 74 of the Act saves everything done under the Ordinance, so the Regulations continue to operate — but the cross-references will not line up with the Act until the Authority reissues them. We flag this because founders reading both documents side by side will notice the mismatch.

Why does PVARA insist on clearance before incorporation?

Because the NOC is a gatekeeping decision about people and structure, not about paperwork. Regulation 16.1 of the NOC Regulations makes the assessment cover fitness and propriety of Key Individuals and Controllers, adequacy of the AML/CFT framework, governance, financial soundness, technology architecture, and the applicant’s inherent and residual money laundering and terrorist financing risk profile.

If PVARA reviewed that only after a company had been registered, the regulator would be assessing a fait accompli. Shareholdings would be issued, directors appointed, capital subscribed. Reversing an unsuitable ownership structure after incorporation is far harder than declining to clear it before.

Regulation 15.4 states the point directly: the grant of the NOC “shall satisfy the pre-incorporation regulatory clearance required under Section 15 of the Act and shall permit the Applicant to provide AML-Registered Services in accordance with these Regulations.”

Our reading is that this is deliberately designed so that the identity of the ultimate beneficial owners is settled before an SECP file number exists. That is why the Controller and Beneficial Owner Disclosure Form (Form A2) must be completed for every Controller and every Beneficial Owner of both the global entity and the proposed local entity — a company that has not yet been formed.

What must the incorporated company look like?

Section 50(1) of the Act sets two conditions that must both be satisfied before any person may carry on Virtual Asset Services by way of business in or from Pakistan.

“No Person shall, by way of business, engage in, or represent themselves as engaging in, any Virtual Asset Services in or from Pakistan, unless that Person:- (a) is a company incorporated under the Companies Act, 2017 or any other law for the time being in force in Pakistan governing the incorporation of companies; and (b) holds a valid license granted by the Authority under this Act.”

The consequences of ignoring this are set out in section 54(1) of the Act: wilfully providing an unlicensed Virtual Asset Service is punishable with imprisonment up to five years, or a fine up to fifty million rupees, or both.

Beyond incorporation itself, the Act imposes structural requirements on the resulting entity. Section 20(6) requires every Licensee to maintain a registered office in Pakistan and to ensure that at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority, subject to prescribed conditions.

The NOC Regulations, at regulation 5.1, list the Key Individuals an Applicant must maintain:

• Chief Executive Officer
• Director (executive or non-executive)
• Chief Financial Officer
• Compliance Officer
• Money Laundering Reporting Officer (MLRO)
• Head of Internal Audit
• Head of Risk Management
• Head of Information Security

Regulation 5.2 permits the Compliance Officer and MLRO functions to be combined where justified by the size and complexity of the applicant. It does not extend that concession to the other roles. Each of these individuals must submit a Fit and Proper Questionnaire (Form A3) under regulation 6.4.

What if my company is already incorporated overseas?

The NOC Regulations contemplate exactly this. The pathway assumes a foreign group with an existing entity that may already be serving Pakistani users. Under regulation 17.1(a), the NOC authorises the applicant to register the foreign chapter already providing AML-Registered Services in Pakistan on the goAML portal, and separately to incorporate a local entity for the purpose of applying for a full licence.

The interim reporting position matters. Regulation 11.4 provides that following issuance of the NOC, the foreign applicant registers on the Financial Monitoring Unit’s goAML platform as the reporting entity, unless otherwise directed by the FMU or the Federal Government. Regulation 11.5 then shifts that role: once the local entity is incorporated and after being granted the licence, the local entity assumes the reporting entity role.

There is a period, therefore, in which the foreign entity carries the reporting obligation and the Pakistani company exists but is not yet the reporting entity. Plan your compliance staffing around that overlap.

Form A1 also reflects the dual-entity reality. Section 3.2 requires Key Individual details “for both the global entity being registered on the goAML portal and the proposed local entity in Pakistan”. Section 4.2 requires beneficial ownership disclosure for both. A foreign exchange entering Pakistan is effectively disclosing two governance structures at once.

Can I trade while the licence application is pending?

Partially, and only for four service categories. Regulation 2.3 of the NOC Regulations designates Broker-Dealer Services, Custody Services, Exchange Services and Virtual Asset Derivative Services as “AML Registered Services”. An applicant granted AML Registration may provide those services before obtaining a full licence, subject to conditions imposed by the Authority and until the licence application is finally determined.

The Regulations are equally clear about what this does not cover:

“For the avoidance of doubt, all other Virtual Asset Services defined under the Ordinance not otherwise constituted as an AML Registered Service may only be provided following the grant of a full license under Section 17, unless otherwise agreed with PVARA.”

So advisory services, lending and borrowing, management and investment services, transfer and settlement, and issuance services sit outside the interim permission. If your business model depends on one of those licence categories, the NOC does not let you launch it early.

Section 70 of the Act provides a separate transitional route: a person providing Virtual Asset Services immediately before commencement must, within six months, apply for a licence or cease providing them. Those who file a complete application within that window may continue existing services, provided they comply with interim directives and core obligations, particularly on customer asset protection and AML, CFT and CPF.

Where does SECP actually come in?

SECP performs the incorporation itself, under the Companies Act, 2017 — but only after PVARA has cleared the way. Its role is mechanical rather than evaluative on the virtual asset question; the substantive suitability assessment sits with PVARA.

Two further points connect the two regulators. Section 23(2) of the Act provides that where a licence is revoked, the Licensee must immediately cease providing Virtual Asset Services, and the Authority may notify SECP to initiate winding-up or dissolution proceedings under the Companies Act, 2017. Section 17(1) obliges PVARA to cooperate and share supervisory and enforcement information with SECP, the State Bank of Pakistan, the FMU, the Federal Investigation Agency and the Federal Board of Revenue.

Form A1 section 9.1 asks directly whether the applicant or any group entity holds a licence from the SBP, SECP or any other Pakistani authority. Disclose it. The regulators talk to each other by statute.

Practical steps we would sequence alongside the NOC application:

1. Settle the ownership chart to ultimate natural persons before filing — Form A1 section 4.3 requires all shareholding layers, intermediate entities and jurisdictions.
2. Identify and secure the eight Key Individual roles, including the Pakistan-resident decision-maker.
3. Build the AML/CFT framework documents to the standard in regulation 8.2 — a Board-approved policy, documented CDD and EDD procedures, sanctions screening, transaction monitoring, STR/CTR escalation, an enterprise-wide risk assessment, recordkeeping to seven years, training and outsourcing management.
4. Begin banking conversations early. Form A1 section 2.5 asks for fiat on-ramp and off-ramp arrangements.
5. Prepare for tax registration — section 66 of the Act requires compliance with the Income Tax Act, 2001 and FBR rules.

Founders who want the shorter answer on what the whole PVARA licensing route involves, or who are weighing the sandbox against the NOC, should read those separately. This piece deals only with sequence.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, and the PVARA No Objection Certificate Regulations 2025 (document code PVARA/REG/AML-REG/2025-1, version 1.0, effective 2 December 2025), read as published. Where practice is not yet settled or guidance has not been issued, that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.