Sandbox Eligibility: The Fit and Proper Gate

Before PVARA looks at a sandbox applicant’s technology, its testing plan or its exit strategy, it looks at the people behind it. The Sandbox Guidelines 2026 open the Eligibility Criteria section with a single requirement that every other requirement sits on top of: the applicant must be “a fit and proper person.”

This is not a soft threshold. Unlike the readiness and risk-assessment limbs that follow it, the fit and proper limb is written as a set of hard disqualifications rather than a scale of adequacy. Fail it, and the rest of the application does not matter.

This article sets out exactly what the fit and proper limb requires, who it applies to, and the three categories of past conduct that disqualify a person from being part of a sandbox applicant.

What does “fit and proper” require in the Sandbox Guidelines?

The Guidelines require the applicant to “be a fit and proper person, with no directors, sponsor shareholders, controllers or key management found liable for” three named categories of conduct. The requirement is stated as an absence, not a presence — the applicant passes by having no disqualifying history among the named group of people, not by demonstrating a positive quality.

The named group covers four roles: directors, sponsor shareholders, controllers, and key management. This is broader than the applicant’s board alone. A sponsor shareholder or a controller who has never sat on the board, and a member of key management who has no formal directorship, are all captured by the same test.

What are the three disqualifying categories?

The Guidelines list exactly three categories of liability that disqualify a person from being part of a fit and proper sandbox applicant:

1. Fraud, financial crime, or misconduct. This is the broadest of the three categories and is not further defined within the Sandbox Guidelines themselves.
2. Prior regulatory or licensing breaches including proscribed and designated persons. This category folds together two distinct things — a past finding of a regulatory or licensing breach, and separately, appearing on a proscribed or designated persons list, which in Pakistan’s broader legal context relates to sanctions and counter-terrorism financing designations.
3. Bankruptcy or insolvency proceedings (unless adequately resolved). Unlike the first two categories, this one carries an explicit qualifier — bankruptcy or insolvency does not disqualify a person if it has been “adequately resolved.” The Guidelines do not define what counts as adequate resolution, leaving that to PVARA’s assessment of each case.

In practice, our reading is that categories one and two are treated as closer to absolute bars, while category three is the one area where a person with a resolved financial history in their past can still qualify, provided the resolution is documented and can withstand scrutiny.

Who exactly is covered — directors, sponsors, controllers, key management?

The Guidelines name four categories of person without separately defining any of them within the Sandbox document itself. Read alongside the Virtual Assets Act, 2026, a controller is a person who, alone or with associates, holds or is entitled to exercise twenty percent or more of the voting power, ownership interest, or share capital of a licensee, or who otherwise exercises significant influence over its management or policies. A sponsor is a person or group who has contributed initial capital to establish the company or who holds a controlling shareholding in it, whether directly or indirectly.

Key management is not separately defined in the Sandbox Guidelines, but the Act’s related concept of a Key Individual — used in the PVARA No Objection Certificate Regulations for the parallel AML registration process — lists the chief executive officer, chief financial officer, compliance officer, money laundering reporting officer, head of internal audit, head of risk management and head of information security, among other senior roles. Applicants should expect PVARA to look at an equivalent list of senior functions when assessing the sandbox’s “key management” wording, even though the Sandbox Guidelines do not spell out the list themselves.

How is fit and proper assessed for a sandbox applicant, in practice?

The Sandbox Guidelines do not prescribe a separate fit and proper assessment procedure of their own — no equivalent to the detailed Form A3 fit and proper questionnaire used in the No Objection Certificate Regulations. What the Guidelines do require is that the applicant’s overall submission, assessed during the evaluation phase, demonstrate compliance with this criterion as part of Key Evaluation Criteria under the heading “Risk Management and Compliance,” which includes review of systemic, operational and ML/TF/PF risks.

In our reading, the absence of a dedicated sandbox fit and proper form does not mean the standard is lighter than the one applied to a full licence application. It means the sandbox applicant should expect to substantiate the same categories of disclosure — regulatory history, criminal or fraud findings, insolvency history — through its own submission and supporting documents, in whatever form PVARA requests them for during assessment, including through interviews or additional information requests the Guidelines expressly permit.

What happens if a disqualifying finding exists but is disputed or old?

The Guidelines do not set a limitation period for any of the three disqualifying categories, and do not distinguish between a recent finding and one from many years ago. Nor do they set out an appeal or waiver mechanism specific to the sandbox eligibility criteria. Where a person believes a past finding should not be treated as disqualifying — for example, because it was later overturned, or because a related insolvency has since been discharged — our reading is that the burden sits with the applicant to make that case to PVARA as part of the application and self-assessment submission, since the Guidelines give PVARA broad discretion to request “any other information sought subsequently” during assessment.

This is an area where the Guidelines are genuinely silent on process, and applicants with a mixed history in this area should treat early, proactive disclosure as the safer course rather than waiting for PVARA to raise it.

How does this fit and proper limb compare with the full licensing standard?

The Virtual Assets Act, 2026 sets its own fit and proper standard at section 20, applicable to a controller, sponsor, chief executive officer and director of a full licensee, and extends the same standard to all Key Individuals. The Act’s standard is a continuing obligation — anyone subject to it must notify PVARA of any matter affecting their fitness at any time, not only when first assessed.

The sandbox’s fit and proper limb reads as a narrower, application-stage version of the same underlying policy: keep people found liable for fraud, financial crime, regulatory breaches, sanctions designation, or unresolved insolvency out of positions of control over a PVARA-supervised entity, whether that entity is a full licensee or a sandbox participant. A firm that has already gathered the disclosures needed for a full licence application, or for the parallel No Objection Certificate process, will already hold most of what a sandbox application needs on this point.

Related reading

• PVARA Exchange License: Capital, Rules & Obligations 2026
• PVARA Transfer & Settlement License: Crypto Payments 2026

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026, the PVARA No Objection Certificate Regulations and the PVARA Sandbox Guidelines 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.