PVARA Licensing Process: NOC to Full Licence, Step by Step

Most people asking about the PVARA licensing process assume it is one application. It is not. It is a sequence, and the sequence matters more than any single document in it, because each stage locks in facts the next stage is assessed against.

The route runs: No Objection Certificate application, then a decision by the Authority within a fixed window, then goAML registration and incorporation of a Pakistani company, then — within a further fixed period — the full licence application under the Virtual Assets Act, 2026.

This article sets out each step, who it applies to, what the source documents actually say about timing, and where the drafting leaves genuine gaps.

What is the PVARA licensing process from start to finish?

The PVARA licensing process has four stages: apply for a No Objection Certificate using Form A1; receive the Authority’s decision within 60 calendar days; on issuance of the NOC, register the foreign entity on goAML and incorporate a local Pakistani company; then submit the full licensing application within three months of the VASP licensing regulations being promulgated.

The legal spine sits in two places. Section 19 of the Virtual Assets Act, 2026 creates the NOC-first requirement. The PVARA No Objection Certificate Regulations 2025 then build out the mechanics — the forms, the assessment criteria, the decision window and the post-NOC conditions.

Stage	Instrument	Timing stated in the documents
1. NOC application	Form A1, reg 15.1	No stated deadline; applicant-driven
2. Authority decision	Reg 17.1	Not exceeding 60 calendar days
3. goAML registration + incorporation	Reg 15.3(a), (b)	No stated deadline
4. Licensing application	Reg 15.3(c), reg 17.1(a)(iv)	Within three months of issuance of the VASP licensing regulations

Why must you apply for an NOC before incorporating a company?

Because section 19(1) of the Act reverses the ordinary sequence. You cannot incorporate first and regularise later. The Authority’s clearance is a pre-condition to starting the incorporation process at all, and the NOC is what satisfies that pre-incorporation clearance.

Section 19(1) of the Virtual Assets Act, 2026 provides:

Any Person intending to incorporate a company, under the Companies Act, 2017 (XIX of 2017) or any other law for the time being in force, with the primary objective of engaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.

Regulation 15.4 of the NOC Regulations confirms the effect from the other direction:

The Authority’s grant of the NOC shall satisfy the pre-incorporation regulatory clearance required under Section 15 of the Act and shall permit the Applicant to provide AML-Registered Services in accordance with these Regulations.

Note the cross-reference problem: the NOC Regulations refer throughout to “Section 15 of the Ordinance” and “Section 15 of the Act”, while the pre-incorporation clearance in the Act as passed sits at section 19. The Regulations were drafted against the Virtual Assets Ordinance, 2025. Section 74 of the Act preserves anything done under the Ordinance, so the Regulations continue to operate — but the section numbering in the two documents does not line up. Read the substance, not the number. We cover the practical consequences of this in our work on SECP registration for crypto companies.

Under section 19(2), the NOC application must be made “in such form and manner, accompanied by such information and fee as may be prescribed by the Authority” — which is Form A1.

What does the NOC actually permit you to do?

An NOC does three things at once. It approves your AML Registration on the goAML portal, it permits incorporation of a local Pakistani entity, and — critically — it lets you provide four specified virtual asset services before you hold a full licence.

Regulation 2.2 states that issuance of the NOC “shall constitute (i) approval for the Applicant’s AML Registration on the goAML portal; and (ii) permission for the Applicant to proceed with incorporation of its local entity in Pakistan.”

The four services are set out in regulation 2.3, and are designated non-financial businesses and professions for goAML purposes:

• Broker-Dealer Services
• Custody Services
• Exchange Services
• Virtual Asset Derivative Services

Together these are the “AML Registered Services”. Regulation 2.3 then says:

Where an Applicant is granted AML Registration, the Applicant may provide AML-Registered Services prior to obtaining a license under Section 17 of the Ordinance, subject to the conditions imposed by the Authority and until such time as the application for obtaining such license is finally determined.

That is the commercial heart of the NOC route. Everything else — advisory, lending and borrowing, management and investment, transfer and settlement, issuance and mining-related services — may only be provided after a full licence, “unless otherwise agreed with PVARA”.

How long does PVARA have to decide on an NOC application?

Sixty calendar days. Regulation 17.1 requires the Authority, following assessment, to either issue the NOC or refuse it “within a period not exceeding 60 calendar days”. Where refused, regulation 17.2 requires the Authority to provide written reasons for its decision.

Two things to hold in mind about that window.

First, it is calendar days, not working days. The contrast with the sandbox route is instructive: the PVARA Sandbox Guidelines 2026 give the Authority sixty working days for comprehensive evaluation, running from the conclusion of initial screening, and expressly allow extension where the Authority determines there is reasonable cause. The NOC Regulations contain no equivalent express extension clause.

Second — and this is our reading, not something the documents state — the sixty days is expressed as a period for the decision “following assessment”. Regulations 16.2 and 16.3 permit the Authority to conduct interviews with Key Individuals, carry out inspections, and request additional information. The documents do not say whether time spent awaiting a response to such a request stops the clock. Treat sixty days as the Authority’s target for a clean file, not as a guaranteed outer limit on a file that generates queries. Our view on realistic PVARA timelines sets out why the paperwork clock and the practical clock diverge.

What must you do once the NOC is issued?

Three obligations attach immediately under regulation 15.3, and they map onto the four limbs of the NOC itself in regulation 17.1(a).

1. Register the foreign entity on goAML. Regulation 15.3(a) requires registration of “the foreign entity already providing AML Registered Services in Pakistan” on the goAML portal. Regulation 11.4 confirms the foreign applicant registers as the reporting entity, “unless otherwise directed by FMU or the Federal Government”.
2. Incorporate a local company. Regulation 15.3(b), giving effect to the pre-incorporation clearance. Regulation 11.5 then provides that once the local entity is incorporated and licensed, it assumes the reporting entity role on goAML.
3. Submit the licensing application. Regulation 15.3(c) requires submission “in the form prescribed by the Authority, within three months of the issuance of the VASP licensing regulations.”

That third deadline is worth reading twice. The three months runs from promulgation of the VASP licensing regulations — not from the date of your NOC. At the time of writing those regulations have not been published, which means the clock has not started for anyone holding an NOC. It also means every NOC holder will face the same deadline simultaneously. That is a queue, and being at the front of it is worth planning for. This is the point at which corporate setup work done early pays back.

Regulation 17.3 confirms the conditional character of the whole arrangement: “The conditions referenced here include goAML registration, incorporation and the commitment to apply for a full license under the Ordinance.”

What does PVARA assess at the NOC stage?

Six matters, listed at regulation 16.1. What makes the provision unusual is that it expressly contemplates re-assessment of the same material at the licensing stage.

The documentation submitted by the Applicant to the Authority on the fitness and propriety shall be assessed as part of the NOC process and the same along with the below mentioned matters may be evaluated/re-evaluated during the subsequent licensing application stage.

The six matters are:

• fitness and propriety of Key Individuals and Controllers
• adequacy and operational readiness of the AML/CFT Framework for AML-Registered Services
• governance and internal control arrangements
• financial soundness of the Applicant
• adequacy of technology architecture and monitoring systems
• the Applicant’s inherent and residual ML/TF risk profile

In practice, this means nothing you file at NOC stage is spent. The Form A3 Fit and Proper Questionnaire you submit for a CEO in month one will be read again against whatever has happened to that individual by the time the licence is assessed. Regulation 20(4) of the Act reinforces the point: fit-and-proper criteria “shall be continuing in nature, and any person subject to such criteria shall notify the Authority of any matter that may affect their fitness and propriety.”

Note also the dual-entity requirement running through the forms. Form A1 section 3.2 requires Key Individual details “for both the global entity being registered on the goAML portal and the proposed local entity in Pakistan.” Form A2 section 4.2 says the same for beneficial owners. You are effectively documenting two entities from the outset, one of which does not yet exist.

How does the licensing stage differ from the NOC stage?

The licensing stage is governed by the Act rather than the NOC Regulations, and it carries ongoing obligations the NOC does not. Section 19(4) of the Act requires the licence application to be made “following incorporation of the company”, accompanied by the prescribed fee — which “shall be non-refundable unless otherwise determined by the Authority” — and such information and documents as may be prescribed.

Under section 21(1), the Authority may grant a licence “subject to such terms and conditions as it may deem appropriate”, or refuse with written reasons. Section 21(2) permits a provisional or limited-scope licence on a case-by-case basis. Section 21(3) provides that a licence “shall specify the Virtual Asset Services that it is permitted to undertake and shall remain in force unless suspended or revoked” — there is no fixed expiry in the Act itself.

Section 21(4) requires the Authority to maintain and publish a register of licensees on its official website, including name, licence number, permitted services and current regulatory status.

Once licensed, section 22 imposes continuing obligations: minimum paid-up capital and financial resources, compliance with all rules and directives, periodic returns and audited financial statements, prior approval for material changes in control or business, risk-management and cybersecurity systems, and payment of supervision and renewal fees. Section 20(6) additionally requires every licensee to maintain a registered office in Pakistan and ensure at least one Key Individual ordinarily resident in Pakistan holds operational and decision-making authority.

What happens if you miss the licensing deadline?

Your NOC can be revoked. Regulation 19.1(e) lists “failure to apply for or progress toward obtaining a full VASP License within the prescribed period” as a ground for revocation of the NOC, including AML Registration status.

The full revocation grounds under regulation 19.1 are:

• false, misleading or incomplete information
• breach of AML/CFT obligations
• any Key Individual ceasing to satisfy Fit and Proper requirements
• systemic or material AML/CFT failures
• failure to apply for or progress toward a full licence in time

Regulation 19.2 tempers this: “Revocation shall be applied proportionately, taking into account the severity and impact of the breach.” But proportionality is cold comfort if the underlying failure is simply not filing. Regulation 18.1(f) puts the obligation positively — a registered applicant must “apply for and progress diligently toward a full VASP License within the time period required by the Authority.”

Separately, section 70 of the Act contains a transitional provision for persons already providing virtual asset services at commencement: apply within six months or cease. Section 70(2) allows continued provision of existing services by a person who has submitted a complete application, provided they comply with interim directives and core obligations, particularly on customer asset protection and AML, CFT and CPF. How section 70 interacts with the NOC route for a foreign incumbent is not spelled out in either document, and we would not assume the two timelines are the same.

Is there an alternative to the NOC route?

Yes — the regulatory sandbox, though it answers a different question. Section 35 of the Act empowers the Authority to establish a sandbox for controlled testing of innovative products or services, with eligibility, procedures, risk limits, duration and exit requirements prescribed by regulations.

The Sandbox Guidelines operate on an agile basis, accepting applications across the year, and successful applicants receive a Letter of Approval rather than an NOC. The exit stage under the Guidelines determines whether a participant transitions to full licensing, discontinues, or takes other directed steps. Section 35(3) also permits the Authority to issue no-action communications; the Guidelines are explicit that a no-action letter “shall not constitute a legal immunity”.

The sandbox suits a genuinely novel proposition that needs regulatory flexibility to test. The NOC route suits an established operator with existing Pakistani users who needs continuity of service. We compare the four PVARA routes in detail elsewhere, and set out the sandbox and reduced-capital considerations for firms testing before committing.

Whichever route you take, the banking question runs in parallel and does not resolve itself. Our tax and banking analysis and our note on banking-first sequencing explain why. If you want the licensing sequence mapped against your own structure, our regulatory and licensing practice does exactly that.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 (as passed by the National Assembly), the PVARA No Objection Certificate Regulations 2025 (Document Code PVARA/REG/AML-REG/2025-1, version 1.0, effective 2 December 2025) and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.