NOC as Dual Approval: goAML Registration Plus Incorporation

A No Objection Certificate (“NOC”) sounds like a single, narrow clearance. Under the PVARA No Objection Certificate Regulations 2025 it is not. Regulation 2.2 defines an NOC as granting two separate permissions at once, and treating them as one undifferentiated approval is a common source of confusion for an Applicant planning its Pakistan entry sequence.

This article isolates each permission, explains how they interact, and sets out what an Applicant is expected to do with each one once the NOC is issued.

What two things does a PVARA NOC approve at the same time?

Regulation 2.2 states that PVARA’s issuance of an NOC “required under Section 15 of the Ordinance shall constitute (i) approval for the Applicant’s AML Registration on the goAML portal; and (ii) permission for the Applicant to proceed with incorporation of its local entity in Pakistan.” One decision, two distinct and independently actionable outcomes.

• AML Registration approval — clearance to register on the Financial Monitoring Unit’s goAML reporting platform as a designated non-financial business.
• Incorporation permission — the regulatory clearance needed to proceed with setting up a local Pakistani entity.

Neither is conditional on completing the other first, but they feed into different next steps, which is why Regulation 15.3 lists them as separate actions for a successful Applicant to take after the NOC issues.

Why is AML Registration on goAML the first permission, not a full licence?

Because the Regulations deliberately separate AML compliance from full licensing as two different regulatory gates. Regulation 2.3 explains why: four categories of virtual asset service — broker-dealer, custody, exchange and derivatives services — are “designated non-financial businesses and professions in accordance with Section 38(1) of the Ordinance” once an Applicant holds AML Registration. That designation is what lets an Applicant provide those four services, under conditions PVARA sets, before a full licence under Section 17 has been granted at all.

Once AML Registration is approved, Regulation 11.4 requires the foreign Applicant — where its foreign chapter is already providing VASP services in Pakistan — to register on the goAML platform as the reporting entity for those AML-Registered Services, unless FMU or the federal government directs otherwise. Regulation 11.5 then hands that reporting-entity role to the local entity once it is incorporated and licensed, and Regulation 11.6 requires the Applicant to demonstrate technical readiness to file suspicious transaction reports and currency transaction reports “immediately upon goAML registration” — not at some later point once systems happen to be ready.

Why does the NOC also grant permission to incorporate?

Because Section 15(1) of the Ordinance requires regulatory clearance before a VASP applicant can incorporate its Pakistani entity, and the NOC is that clearance. Regulation 15.4 confirms this directly: “The Authority’s grant of the NOC shall satisfy the pre-incorporation regulatory clearance required under Section 15 of the Act and shall permit the Applicant to provide AML-Registered Services in accordance with these Regulations.”

In practice, this is what separates PVARA’s regime from a conventional SECP company registration, where incorporation ordinarily comes first and sector approval follows. Here, a VASP applicant cannot lawfully incorporate its local entity for this purpose ahead of the NOC — the NOC is the gate that opens the door to incorporation, not a step that gets layered on top of an entity that already exists.

What must the Applicant actually do once the NOC issues?

Regulation 15.3 sets out three concrete follow-on actions, and the first two map directly onto the dual approval in Regulation 2.2:

1. Register the foreign entity already providing AML-Registered Services in Pakistan on the goAML portal.
2. Incorporate a local company, as required under Section 15(1) of the Ordinance.
3. Submit the licensing application, in the form PVARA prescribes, within three months of the issuance of the VASP licensing regulations.

The third action is not part of the dual approval in Regulation 2.2 itself, but it is the deadline that anchors the entire phased pathway — the licensing routes available under the NOC are time-limited, not indefinite. Regulation 17.1(a)(iv) repeats the same three-month clock as part of PVARA’s decision letter itself, and Regulation 19.1(e) makes “failure to apply for or progress toward obtaining a full VASP License within the prescribed period” a ground for revoking the NOC entirely.

Does the dual approval apply differently to a foreign group versus a Pakistan-only start-up?

Regulation 2.2 itself does not distinguish between them — its wording applies to any Applicant. Where the practical sequencing differs is in Regulation 11.4, which is written specifically around “the foreign Applicant (the applicants whose foreign chapter is already providing VASP services in Pakistan).” A foreign group in that position registers its existing foreign entity on goAML first, and only later transfers the reporting-entity role to the newly incorporated local company once that entity holds a licence, per Regulation 11.5.

A Pakistan-only start-up with no pre-existing foreign chapter does not have an “already providing” entity to register in the interim — the Regulations do not spell out a separate goAML sequence for that case. Where the text is silent on that point, that gap is stated here rather than filled with an assumption.

Which of PVARA’s own decision-letter conditions map back to Regulation 2.2?

Regulation 17.1(a) shows how PVARA itself frames the dual approval when it actually grants an NOC. The decision letter, following assessment within a period not exceeding 60 calendar days, issues the NOC on four conditions: registering the foreign chapter on goAML, incorporating a local entity for the purpose of applying for a full licence, providing AML-Registered Services once goAML registration completes, and submitting the licensing application within three months of the licensing regulations being promulgated. Regulation 17.3 confirms that these are read together as “the conditions referenced here,” which include goAML registration, incorporation, and the commitment to apply for a full licence.

Reading Regulation 17.1(a) against Regulation 2.2 shows that PVARA’s decision letter does not add a third permission on top of the two set out in Regulation 2.2 — it operationalises the same two permissions into a dated, conditional grant. The AML Registration permission becomes the goAML-registration-and-services condition; the incorporation permission becomes the incorporation condition; and the three-month licensing deadline sits alongside both as the mechanism that keeps the NOC from becoming a permanent substitute for full licensing.

What does the Applicant need to have ready before the AML Registration permission is useful?

An internal reporting workflow that can actually operate once goAML access is granted, not just the registration itself. Section 7.1 of Form A1 asks the Applicant to describe how internal suspicious activity will be escalated and submitted as suspicious transaction reports and currency transaction reports through goAML once registration completes, or to cross-reference the equivalent section of the attached STR/CTR procedures. Form A7, the Internal Suspicious Activity Report, sets out the minimum fields such a workflow should capture — reporter details, customer details, transaction details, a narrative of the suspicion, and an MLRO determination on whether to file a report — regardless of whether the Applicant chooses to use PVARA’s template or an equivalent internal form.

An Applicant that treats Regulation 2.2’s AML Registration permission as satisfied by the act of registering on the goAML portal, without this internal escalation chain already built and tested, has completed the administrative half of the permission without the operational half Regulation 11.6 separately requires — demonstrated technical readiness to file “immediately upon goAML registration.”

What happens if an Applicant treats the NOC as covering only incorporation?

It exposes the Applicant to the exact enforcement risk Regulation 19 describes. An Applicant that incorporates its local entity but never completes AML Registration, or that registers on goAML but never files suspicious activity reports through it, has only executed half of what Regulation 2.2 actually authorised. Regulation 19.1(b) allows PVARA to revoke the NOC — including AML Registration status — for a breach of AML/CFT obligations, and the ongoing obligations in Regulation 18.1 require maintaining “active FMU goAML registration” at all times, not merely obtaining it once and setting it aside.

Our reading is that the safest operating assumption for an Applicant is to treat the two permissions in Regulation 2.2 as two parallel workstreams from day one — one owned by whoever is standing up the AML/CFT framework and goAML connectivity, the other owned by whoever is running the corporate-setup track — rather than as a single project with one finish line.

About this analysis

This analysis was prepared by the CoinConnect research desk from the PVARA No Objection Certificate Regulations 2025, principally Regulations 2.2, 2.3, 11.4, 11.5, 11.6, 15.3, 15.4, 17.1 and 19.1, read as published. Where the Regulations do not describe a sequence for an Applicant without a pre-existing foreign chapter, that gap is stated in the text above rather than assumed.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.