PVARA Fit and Proper Standard: The Four Limbs Explained

Most applications for a virtual asset licence in Pakistan will not fail on capital or technology. They will fail on people. The fit and proper standard is the one requirement that attaches to individuals rather than to the company, and it is the one requirement that cannot be fixed by rewriting a policy document.

The standard sits in two places. Section 20 of the Virtual Assets Act, 2026 creates it and sets out who it binds. Regulation 6 of the PVARA No Objection Certificate Regulations 2025 gives it four limbs, adds three automatic disqualifiers, and prescribes the declaration form that every senior person must sign.

This article reads both provisions as published and explains what they require. If you are preparing an application, the same people caught by this test are the people whose CVs, police clearances and disclosures form the bulk of your regulatory and licensing submission.

What is PVARA’s fit and proper standard?

PVARA’s fit and proper standard is a suitability test applied to the individuals who own, control or run a virtual asset business. Under Regulation 6.1 of the No Objection Certificate Regulations 2025, all Key Individuals must satisfy standards of integrity, competence, financial soundness and experience. Those are the four limbs. Section 20 of the Virtual Assets Act, 2026 gives the Authority the power to refuse, suspend or revoke a licence where they are not met.

The regulation states it directly:

All Key Individuals must satisfy Fit and Proper standards of integrity, competence, financial soundness and experience, as prescribed by section 16 of the Act.

Two points on that sentence. First, the four limbs are cumulative — a person must satisfy all of them, not merely most of them. Second, the cross-reference to “section 16 of the Act” does not align with the numbering of the Virtual Assets Act, 2026 as passed, where fit-and-proper criteria appear at section 20 and section 16 deals with the code of conduct. The NOC Regulations were issued in 2025 under the Ordinance. Read the substance, not the citation, and verify the current cross-reference with PVARA before relying on it in correspondence.

Who does the test apply to?

Section 20 of the Act splits the population into two tiers. Sub-section (1) requires the Authority itself to determine whether a Controller, Sponsor, Chief Executive Officer and Director is fit and proper. Sub-section (2) then extends the criteria to all Key Individuals, but shifts the burden:

The fit-and-proper criteria shall apply to all Key Individuals. It shall be the responsibility of the applicant for a license or the Licensee to assess and maintain the fitness and propriety of other key individuals not mentioned in sub-section (1), and to submit a written undertaking to the Authority confirming compliance and ongoing maintenance thereof.

In practice this creates a two-speed process. For your Controllers, Sponsors, CEO and directors, PVARA assesses. For everyone else in the Key Individual population, you assess and you sign an undertaking saying you have done so — which means the liability for a bad appointment sits with the company.

Section 3(1)(xv) of the Act defines “Key Individual” as any natural person who occupies or performs a listed position, whether on a full-time, part-time, acting or outsourced basis. The outsourced limb matters. A fractional compliance officer engaged through a service provider is still a Key Individual.

Role	Source of the requirement	Who assesses
Controller (20% or more)	Act s.20(1); NOC Reg 7	PVARA
Sponsor	Act s.20(1)	PVARA
Chief Executive Officer	Act s.20(1); NOC Reg 5.1(a)	PVARA
Director (executive or non-executive)	Act s.20(1); NOC Reg 5.1(b)	PVARA
Chief Financial Officer	NOC Reg 5.1(c)	Applicant, per s.20(2)
Compliance Officer	NOC Reg 5.1(d)	Applicant, per s.20(2)
Money Laundering Reporting Officer	NOC Reg 5.1(e)	Applicant, per s.20(2)
Head of Internal Audit	NOC Reg 5.1(f)	Applicant, per s.20(2)
Head of Risk Management	NOC Reg 5.1(g)	Applicant, per s.20(2)
Head of Information Security	NOC Reg 5.1(h)	Applicant, per s.20(2)

Regulation 5.2 permits the Compliance Officer and MLRO functions to be combined “where justified by the size and complexity of the applicant”. No other combination is expressly permitted. Section 3(1)(xv)(j) also lets the Authority declare any other position a Key Individual by written notice — so the list is a floor, not a ceiling. Our detailed walkthrough of the declaration itself sits in the piece on the fit and proper test and Form A3.

What are the automatic disqualifiers?

Regulation 6.3 of the NOC Regulations lists three circumstances in which no individual may serve as a Key Individual. These are not weighed in the balance. They are bars.

No individual may serve as a Key Individual if he or she: (a) has been convicted of an offence under the Anti-Money Laundering Act, 2010 (“AMLA 2010”), the Act, or any law involving dishonesty, fraud or financial misconduct; (b) has been sanctioned by any regulatory body in Pakistan or abroad; and / or (c) is subject to bankruptcy or insolvency proceedings, except where duly discharged.

Three observations on the drafting.

• Limb (a) is not jurisdictionally limited. It says “any law involving dishonesty, fraud or financial misconduct”. A conviction in a third country for a dishonesty offence engages it.
• Limb (b) has no materiality qualifier as drafted. “Sanctioned by any regulatory body” is broad. Whether PVARA reads it to capture a minor historic administrative penalty, or only meaningful enforcement, is not stated in the Regulations. Guidance has not been issued. Disclose and explain rather than omit.
• Limb (c) carries an express carve-out — “except where duly discharged”. Discharged bankruptcy is not an automatic bar, but you must evidence the discharge.

The Sandbox Guidelines 2026 apply a parallel eligibility screen. An applicant must be a fit and proper person with no directors, sponsor shareholders, controllers or key management found liable for fraud, financial crime or misconduct; prior regulatory or licensing breaches “including proscribed and designated persons”; or bankruptcy or insolvency proceedings unless adequately resolved. The reference to proscribed and designated persons is a sanctions-list screen in substance. If you are weighing the sandbox against the NOC route, note that neither route offers a softer people test.

How does PVARA actually test it?

Through documents, interviews and its own checks. Regulation 6.4 requires each Key Individual to submit a Fit and Proper Declaration in the form prescribed at Annex A — Form A3, the Fit & Proper Questionnaire. Regulation 6.2 gives the Authority a discretionary interview power:

The Authority may conduct interviews with Key Individuals to satisfy itself of their competence, independence, knowledge and suitability for the role.

Note the four things the interview tests: competence, independence, knowledge and suitability. Independence is not one of the four limbs in Regulation 6.1, but it is in the interview power. Read together with Form A3 Section 7 on conflicts of interest, our reading is that PVARA is testing whether a compliance or audit appointee can actually say no to the CEO who hired them.

Form A3 must be completed by every Key Individual of both the applicant and the proposed local entity. It requires, among other things:

• Ten years of employment history, with the reason for leaving each position and an explanation for any gap of three months or more
• Academic qualifications, professional certifications and AML/CFT training completed in the last three years
• Yes/no answers on regulatory record, criminal record, financial soundness, conflicts of interest and professional conduct
• Certified police clearance certificates from all jurisdictions of residency in the past 10 years
• Two independent professional references, which “must not be from relatives, subordinates or individuals with conflicts of interest”
• Declarations on medical and mental fitness, other directorships and time commitment

Controllers and Beneficial Owners complete a separate instrument, Form A2, which additionally demands a full source-of-wealth and source-of-funds narrative with documentary evidence. Regulation 7.1 deems any person holding directly or indirectly 20% or more of voting power or share capital to be a Controller, and Regulation 7.3 requires the Authority to approve each Controller before AML registration is granted. The Act’s own definition at section 3(1)(v) is wider — it also catches a person who “otherwise exercises significant influence or control over its management or policies”. We have unpacked that gap in our note on the Controller definition under the Act.

Is fit and proper a one-off test or continuing?

Continuing. Section 20(4) of the Act is explicit:

Fit-and-proper criteria shall be continuing in nature, and any person subject to such criteria shall notify the Authority of any matter that may affect their fitness and propriety.

The notification duty sits on the individual, not only on the company. Layered on top are four company-level obligations:

1. Ongoing notification. Regulation 18.1(b) requires a registered applicant to notify the Authority of any material changes affecting AML compliance, governance, ownership or technology.
2. Appointment and change filings. Form A8 must be submitted whenever a Key Individual is appointed, replaced, has their role modified, or resigns or is removed — a separate form for each individual, with Form A3, an updated CV, identity documents, a board approval resolution and, for new appointments, a police clearance certificate.
3. Controller creep. Regulation 7.3 provides that once registered, no Controller may acquire or increase control above thresholds to be determined by PVARA without written approval. Section 22(d) of the Act requires prior approval for any material change in control or business.
4. Annual reporting. Form A6, the Annual AML/CFT Return, requires disclosure of Key Individuals in post during the reporting period and a summary of changes in governance, board composition and reporting lines.

The consequences of failing the standard mid-life are severe. Section 20(3) of the Act allows the Authority to refuse, suspend or revoke a licence where any Controller, Sponsor or Key Individual fails to meet the criteria. Regulation 19.1(c) makes it a ground for revoking the NOC where “any Key Individual ceases to satisfy Fit and Proper requirements”, though Regulation 19.2 requires revocation to be applied proportionately, taking into account the severity and impact of the breach. Section 59(1)(e) of the Act separately empowers PVARA to disqualify a person from holding any office or position of responsibility in a Licensee.

There is also a criminal exposure. Section 54(4) of the Act provides that whoever knowingly makes a false or misleading statement in any application, return or document submitted to the Authority is punishable with imprisonment up to three years, a fine up to twenty million rupees, or both. Form A3 is a document submitted to the Authority. An undisclosed regulatory sanction is not a paperwork problem.

What should applicants do before they file?

Run the test on yourselves first, and do it before you commit to a board. Four practical steps.

• Map the population. Build the full Key Individual list from Regulation 5.1, then add anyone performing those functions on a part-time, acting or outsourced basis, per section 3(1)(xv). Only then check for the Regulation 5.2 combination of Compliance Officer and MLRO.
• Screen against Regulation 6.3 early. Adverse media, sanctions lists and regulatory registers in every jurisdiction where a candidate has held office. A bar found in diligence is a resourcing question; a bar found by PVARA is a refusal.
• Order police clearances immediately. Certificates from every jurisdiction of residency in the past decade are the single slowest item in the pack, and they gate the whole filing. This is the same sequencing trap that drives most timeline overruns.
• Satisfy the residency requirement. Section 20(6) requires every Licensee to maintain a registered office in Pakistan and ensure at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority, subject to prescribed conditions. That is a real hiring decision, not a nominee arrangement — see our note on the resident director requirement.

Two things the documents do not settle. There is no published lookback period for spent convictions or historic sanctions, and there is no materiality threshold in Regulation 6.3(b). Both are matters for PVARA’s discretion until guidance issues. Where a candidate has a disclosable history, our reading is that a full narrative with supporting documents and a clear account of remediation gives the Authority something to assess. Silence gives it a reason to refuse, and section 54(4) makes silence expensive.

For applicants sequencing this alongside company incorporation, banking arrangements and the broader licensing pathway, the people work should start first. Everything else can be drafted in parallel. A person cannot be manufactured to order.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 as passed by the National Assembly, the PVARA No Objection Certificate Regulations 2025 (including Forms A2, A3, A6 and A8 at Annex A), and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.