Fit and Proper Under PVARA: Who Assesses Whom?

“Fit and proper” sounds like a single standard applied uniformly by the regulator to everyone in a senior role. Under Pakistan’s virtual asset framework, it is not applied by a single assessor at all — the Act splits the job in two, and who does the assessing depends on which role a person holds.

This piece works through Section 20 of the Virtual Assets Act 2026, sets out exactly which roles PVARA assesses directly and which the applicant must assess itself, and explains the written undertaking that closes the gap between the two.

Who actually assesses fitness and propriety under the Virtual Assets Act 2026?

Section 20 of the Act splits the assessment between two parties. PVARA itself directly determines whether a Controller, Sponsor, Chief Executive Officer and Director is fit and proper. For every other Key Individual, it is the applicant’s own responsibility to assess and maintain that person’s fitness and propriety, and to submit a written undertaking confirming it has done so.

“20.(1) The Authority shall determine whether a Controller, Sponsor, Chief Executive Officer and Director is fit and proper in accordance with criteria prescribed by Regulations. (2) The fit-and-proper criteria shall apply to all Key Individuals. It shall be the responsibility of the applicant for a license or the Licensee to assess and maintain the fitness and propriety of other key individuals not mentioned in sub-section (1), and to submit a written undertaking to the Authority confirming compliance and ongoing maintenance thereof.”

Who assesses	Roles covered	Basis
PVARA directly	Controller, Sponsor, Chief Executive Officer, Director	Section 20(1)
The applicant itself, via written undertaking	All other Key Individuals — CFO, Compliance Officer, MLRO, Head of Internal Audit, Head of Risk Management, Head of Information Security	Section 20(2)

Why does PVARA assess some roles directly but not others?

The Act does not state its reasoning explicitly, but the pattern in Section 20(1) is consistent: the four roles PVARA assesses directly — Controller, Sponsor, CEO and Director — are the roles that carry ultimate ownership or control, or sit at the top of executive and board accountability. A Controller is defined elsewhere in the Act as anyone holding 20% or more of voting power, ownership interest or share capital, or otherwise exercising significant influence over management; a Sponsor is defined as a person who contributed initial capital to establish the company or holds a controlling shareholding. Those are the positions from which the whole operation is ultimately directed.

In practice, this concentration of direct PVARA scrutiny on ownership and top executive leadership, combined with applicant self-assessment for the more operational Key Individual roles, mirrors the proportionality principle that runs through the wider licensing regime — the highest-stakes roles get the highest-intensity regulatory scrutiny, while functional compliance and risk roles are assessed by the applicant itself, subject to PVARA’s oversight and audit powers rather than a first-instance PVARA review of every appointment.

What exactly does the applicant have to do for the roles it assesses itself?

Section 20(2) requires the applicant to do two things: actually assess the person’s fitness and propriety, and submit a written undertaking to PVARA confirming compliance and ongoing maintenance of that standard. This is not a lighter-touch or informal process just because PVARA is not conducting the primary assessment.

Regulation 6.1 of the NOC Regulations applies the same substantive standard — “integrity, competence, financial soundness and experience” — to every Key Individual, regardless of who is doing the assessing. Regulation 6.4 requires each Key Individual to submit a signed Fit and Proper Declaration using Form A3, and Form A4, Section 5, requires the CEO and MLRO to jointly declare that “all information contained in this Statement and all accompanying documents is true, complete and accurate” and that no material information relevant to AML/CFT compliance has been omitted. In practice, the applicant’s self-assessment obligation under Section 20(2) is discharged through this documented pipeline of forms, declarations and board-level sign-off — not through an informal internal check that stops at the compliance department.

Does PVARA retain any oversight over the roles the applicant assesses itself?

Yes. Section 20(2)’s self-assessment responsibility does not remove PVARA’s supervisory powers over those roles — it shifts who performs the first-instance assessment, not who has final authority. Regulation 16.1 of the NOC Regulations makes clear that fitness and propriety documentation for all Key Individuals and Controllers is assessed, and may be re-evaluated, as part of the NOC process and again at the subsequent licensing stage. Regulation 16.2 gives PVARA the power to interview any Key Individual to verify competence and suitability, and Regulation 16.3 allows PVARA to conduct inspections or request additional information.

Section 20(3) of the Act gives PVARA the power to “refuse, suspend or revoke a license where any Controller, Sponsor or Key Individual fails to meet the prescribed fit-and-proper criteria” — a power that applies across all Key Individual roles, not only the four PVARA assesses directly under Section 20(1). Our reading is that the written undertaking required under Section 20(2) functions as a compliance representation the applicant makes to PVARA, which PVARA can then test, audit or override through its interview and inspection powers — it is not a substitute for PVARA’s authority over these individuals, only a delegation of the first assessment step.

What are the automatic disqualifiers that apply regardless of who assesses the individual?

Regulation 6.3 of the NOC Regulations sets three grounds that bar a person from serving as a Key Individual outright, whether PVARA or the applicant is doing the primary assessment: conviction of an offence under the Anti-Money Laundering Act 2010, the Virtual Assets Act, or any law involving dishonesty, fraud or financial misconduct; being sanctioned by any regulatory body in Pakistan or abroad; or being subject to bankruptcy or insolvency proceedings, except where duly discharged. These three grounds are absolute — they apply uniformly across the Section 20(1)/20(2) split, since Regulation 6.3 does not distinguish between the two tiers of Key Individual.

Is fitness and propriety a one-time check, or does it continue after the NOC is granted?

It is continuing. Section 20(4) states that “fit-and-proper criteria shall be continuing in nature, and any person subject to such criteria shall notify the Authority of any matter that may affect their fitness and propriety.” This applies equally to the four roles PVARA assesses directly and to the roles the applicant assesses itself under its written undertaking.

For the applicant-assessed roles, this means the written undertaking under Section 20(2) is not a document filed once at application stage and forgotten — “confirming compliance and ongoing maintenance thereof” is written directly into the statutory text. Regulation 18.1(b) of the NOC Regulations requires a registered applicant to “notify the Authority of any material changes affecting AML compliance, governance, ownership or technology,” and Form A8 — the Key Individual Appointment/Change Form — exists specifically to formalise a change to any of these roles once it occurs.

What happens if the applicant’s own assessment turns out to be wrong?

Section 20(3) gives PVARA the power to refuse, suspend or revoke a licence where any Key Individual fails to meet the fit and proper standard — regardless of whether the applicant’s own earlier self-assessment concluded the person was fit and proper. Regulation 19.1(a) of the NOC Regulations separately lists “the Applicant has provided false, misleading or incomplete information” as a ground for revocation of the NOC itself.

In practice, an applicant that submits a written undertaking under Section 20(2) without having genuinely conducted the assessment — or having conducted it carelessly — carries real regulatory risk if PVARA later determines through interview, inspection or a subsequent event that the individual did not in fact meet the standard. The self-assessment responsibility under Section 20(2) shifts who does the initial work; it does not shift accountability for getting it right.

Related reading

• PVARA Exchange License: Capital, Rules & Obligations 2026
• PVARA Transfer & Settlement License: Crypto Payments 2026

About this analysis

This analysis was prepared by the CoinConnect research desk from Section 20(1) through (4) of the Virtual Assets Act 2026, read alongside Regulations 6.1 through 6.4, 16.1 through 16.3, 18.1(b) and 19.1(a) of the PVARA No Objection Certificate Regulations 2025, and Forms A3, A4 and A8 in Annex A, as published.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.