Fit and Proper Is a Continuing Duty Under the Virtual Assets Act

A Controller, Sponsor, Director or Key Individual does not pass a fit and proper check once and move on. Section 20(4) of Pakistan’s Virtual Assets Act 2026 makes the standard continuing, and attaches a positive duty to tell the regulator when something changes.

This piece sets out what “continuing” means in practice, who has to notify PVARA and about what, and what the regulator can do — to an individual and to the licence itself — when a person stops meeting the standard.

What does it mean for fit and proper to be a “continuing” obligation?

It means the assessment made at NOC or licensing stage is not the end of the process. Section 20(4) of the Virtual Assets Act 2026 states the rule directly:

“20.(4) Fit-and-proper criteria shall be continuing in nature, and any person subject to such criteria shall notify the Authority of any matter that may affect their fitness and propriety.”

Two things follow. First, the standard itself — integrity, competence, financial soundness, experience, as set by Regulation 6.1 of the PVARA No Objection Certificate Regulations 2025 — has to be maintained for as long as the person holds the role, not just satisfied at the point of appointment. Second, the duty to disclose a problem sits with the individual, not only with the Virtual Asset Service Provider that employs them.

Who has to notify PVARA, and about what?

The text of Section 20(4) is broad: “any person subject to such criteria.” That covers every role named in Section 20 — Controller, Sponsor, Chief Executive Officer and Director, who PVARA assesses directly under Section 20(1), and every other Key Individual, whose fitness and propriety the applicant or Licensee itself assesses and undertakes to maintain under Section 20(2).

The Act does not define “any matter that may affect their fitness and propriety” with a closed list. Our reading is that the natural reference point is Regulation 6.3 of the NOC Regulations, which sets the three grounds that disqualify a person from serving as a Key Individual outright:

• conviction of an offence under the Anti-Money Laundering Act 2010, the Virtual Assets Act, or any law involving dishonesty, fraud or financial misconduct;
• being sanctioned by any regulatory body in Pakistan or abroad; and
• being subject to bankruptcy or insolvency proceedings, except where duly discharged.

Beyond these three, the standard in Regulation 6.1 — integrity, competence, financial soundness, experience — is broader than the disqualifying grounds, so a matter could affect fitness and propriety without triggering an automatic bar. In practice, this leaves individuals and their employers to exercise judgement about what is disclosable, guided by the disqualifying grounds as the clearest indicators and by the Applicant’s own governance obligations under Regulation 4.2 of the NOC Regulations, which requires the governing body to oversee AML/CFT compliance generally.

What is the entity’s own notification duty, separate from the individual’s?

Regulation 18.1(b) of the NOC Regulations runs alongside Section 20(4) and applies to the registered Applicant itself, not just the individual. It requires the Applicant to:

“notify the Authority of any material changes affecting AML compliance, governance, ownership or technology.”

This is wider than a fitness-and-propriety notification — it covers governance and ownership changes generally — but a Key Individual ceasing to meet the standard falls squarely within it. Where a change involves the appointment, replacement or removal of a Key Individual, Form A8 — the Key Individual Appointment/Change Form — is the document the PVARA No Objection Certificate Regulations provide for formalising it, together with a fresh Form A3 Fit and Proper Questionnaire for any new appointee.

What can PVARA do once someone stops meeting the standard?

At the licensing stage, Section 20(3) of the Act gives PVARA a direct power:

“20.(3) The Authority may refuse, suspend or revoke a license where any Controller, Sponsor or Key Individual fails to meet the prescribed fit-and-proper criteria.”

This sits alongside the general licence-variation power in Section 23(1)(b) of the Act, under which the Licensee “is insolvent or no longer satisfies the fit-and-proper criteria” is a listed ground for the Authority to vary, suspend or revoke a licence — by written notice, and after giving the Licensee an opportunity to be heard.

At the earlier NOC stage, Regulation 19.1(c) of the NOC Regulations gives PVARA the equivalent power over the No Objection Certificate itself:

“19.1 The Authority may revoke an Applicant’s NOC, including AML Registration status, where: … (c) any Key Individual ceases to satisfy Fit and Proper requirements.”

Read together, a fit-and-proper lapse is a live risk at every stage of the VASP licence lifecycle — before incorporation, during the NOC’s AML-registered phase, and after a full licence is granted.

Does one person’s lapse automatically take down the whole entity?

Not necessarily, though the Act does not spell out a proportionality test for licence variation, suspension or revocation under Section 23. Regulation 19.2 of the NOC Regulations does state one explicitly, at the NOC stage:

“19.2 Revocation shall be applied proportionately, taking into account the severity and impact of the breach.”

Our reading is that this gives PVARA room to act against the individual first — for example by requiring removal and replacement via Form A8 — rather than moving straight to revocation of the entity’s NOC or licence, where the breach is confined to one Key Individual and does not implicate the Controller tier or the entity’s own conduct. Where the Act itself is silent on proportionality at the full-licence stage, this is an inference from the pattern in Regulation 19.2 rather than a stated rule — the Act simply lists “no longer satisfies the fit-and-proper criteria” as one ground among several in Section 23(1), all subject to the same written-notice-and-hearing procedure.

Is the continuing duty the same for an NOC holder as for a full licensee?

The underlying standard is meant to be the same throughout — Regulation 6.1 of the NOC Regulations ties it to “section 16” of the Act as the source criteria, while our reading of the Act text places the fit-and-proper provisions at Section 20. This kind of section-number mismatch between the NOC Regulations and the Act text most likely reflects the Regulations having been drafted against the Virtual Assets Ordinance 2025 that preceded the Act, whose section numbering differed from the Act as finally passed. We describe the substance of the obligation here rather than relying on either document’s cross-reference number, and readers should verify the current section numbering with PVARA directly before citing it in a filing.

What is consistent across both instruments is the direction of travel: fitness and propriety is assessed once at entry, then re-tested continuously through self-notification, PVARA’s interview and inspection powers under Regulation 16 of the NOC Regulations, and — for a registered Applicant — the annual return obligations under Regulation 18. A Key Individual or Controller who assumes the check ends once the NOC or licence is granted is working from an outdated picture of the framework.

What should a VASP actually do to meet this duty in practice?

Three things follow directly from the text. First, build an internal trigger list based on Regulation 6.3’s disqualifying grounds — conviction, sanction, bankruptcy — so individuals know precisely what must be reported and when. Second, treat any material governance, ownership or Key Individual change as reportable under Regulation 18.1(b), using Form A8 where a role is affected, rather than waiting for PVARA to ask. Third, keep the underlying Form A3 declarations current rather than treating them as a one-off application document — since the undertaking behind them, under Section 20(2) of the Act, is expressly one of “ongoing maintenance.”

About this analysis

This analysis was prepared by the CoinConnect research desk from Sections 20(3), 20(4) and 23(1)(b) of the Virtual Assets Act 2026, and Regulations 4.2, 6.1, 6.3, 16, 18.1(b), 19.1(c) and 19.2 of the PVARA No Objection Certificate Regulations 2025, together with Form A8 in Annex A, as published.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.