Most company formation in Pakistan runs a simple order: register with the Securities and Exchange Commission of Pakistan (SECP), then seek whatever sector licence the business needs. A crypto company intending to provide virtual asset services cannot follow that order. Section 19(1) of the Virtual Assets Act 2026 inserts a regulator ahead of the company registrar, not after it.
This piece sets out the sequence the Act actually requires — No-Objection Certificate (“NOC”), then SECP incorporation, then licence application — and the specific steps that fall inside each stage.
What is the correct sequence for setting up a virtual asset company in Pakistan?
The Act creates three stages, in a fixed order, not two. Section 19(1) requires anyone intending to incorporate a company “with the primary objective of engaging in Virtual Asset Services” to first apply to the Pakistan Virtual Assets Regulatory Authority (“PVARA” or “the Authority”) for a No-Objection Certificate, before starting incorporation. Section 19(4) then describes the licence application as following incorporation of the company. Read together, the three stages are: NOC application and grant, then incorporation, then licence application.
| Stage | Governed by | What happens |
|---|---|---|
| 1. NOC application | Act s.19(1)–(3) | Founder applies to PVARA before touching SECP |
| 2. Incorporation | Companies Act 2017, via SECP | Company is formed only after the NOC is granted |
| 3. Licence application | Act s.19(4) | Filed after incorporation, with prescribed fee and documents |
Why can’t a founder incorporate with SECP first and apply for the NOC afterwards?
Because section 19(1) makes the NOC a precondition for starting the incorporation process, not an optional early step. The provision reads:
“Any Person intending to incorporate a company, under the Companies Act, 2017 (XIX of 2017) or any other law for the time being in force, with the primary objective of engaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.”
The trigger is intent to incorporate for a virtual asset business, not the incorporation itself. A founder who has decided to build a virtual asset service provider (“VASP”) is inside this rule before any SECP filing exists. That sequencing is explored in more depth in our related piece on the NOC-before-incorporation rule, including the section-numbering discrepancy between the Act and PVARA’s own Regulations.
What does PVARA’s NOC actually authorise once it’s granted?
Regulation 2.2 of PVARA’s No Objection Certificate Regulations 2025 states that the NOC “shall constitute (i) approval for the Applicant’s AML Registration on the goAML portal; and (ii) permission for the Applicant to proceed with incorporation of its local entity in Pakistan.” The NOC is therefore not a trading licence. It is regulatory clearance to move to the next stage — registering AML compliance and starting incorporation — not authorisation to provide virtual asset services commercially.
Regulation 15.4 puts it in similar terms: the grant of the NOC “shall satisfy the pre-incorporation regulatory clearance required under Section 15 of the Act.” Note that the Regulations refer to “Section 15,” a numbering carried over from the predecessor Virtual Assets Ordinance, while the Act itself places this requirement at section 19. The two documents should be read as related but not identically numbered.
What must happen in the three-stage window after NOC approval?
Regulation 15.3 sets out three specific obligations that fall on a successful applicant once the NOC issues:
- Register on goAML. The foreign entity already providing AML-Registered Services in Pakistan must register on the FMU goAML portal.
- Incorporate the local company. The applicant must incorporate a local company at SECP, satisfying the requirement referenced in Regulation 15.3(b).
- Submit the licensing application. This must be filed, in the form PVARA prescribes, within three months of the issuance of the VASP licensing regulations.
That third obligation is a moving deadline. It does not run from the date of the NOC itself, but from whenever PVARA separately issues its VASP licensing regulations — a document distinct from the NOC Regulations already in force. A founder should not assume the three-month clock starts on the day incorporation completes.
What are the ongoing corporate requirements once the company exists?
Two requirements from section 20(6) of the Act attach to the company from the point it is licensed, and are worth building into the incorporation itself rather than retrofitting later:
- A registered office in Pakistan, maintained at all times.
- At least one Key Individual ordinarily resident in Pakistan, vested with operational and decision-making authority, subject to conditions PVARA may prescribe.
Building these into the company’s founding documents — rather than treating them as post-licensing housekeeping — avoids a scramble to appoint a resident director or lease an office once PVARA is already reviewing the licence application. Founders planning market entry from outside Pakistan should treat the resident Key Individual requirement as a hiring decision that needs lead time, not a form field.
What happens to a company that provides virtual asset services without both incorporation and a licence?
Section 50(1) prohibits any person from engaging in virtual asset services in or from Pakistan unless that person is both:
“(a) a company incorporated under the Companies Act, 2017 or any other law for the time being in force in Pakistan governing the incorporation of companies; and (b) holds a valid license granted by the Authority under this Act.”
Incorporation alone does not satisfy section 50(1) — a company that exists but has not been licensed still falls outside the permitted structure. Section 54(1) separately makes wilfully providing an unlicensed virtual asset service a criminal offence, punishable with imprisonment for a term up to five years, a fine up to fifty million rupees, or both. The Act does not, in section 19 itself, state a specific consequence for a founder who incorporates before applying for or receiving the NOC — that scenario sits in a gap between sections 19 and 50, and a founder in that position should raise it directly with PVARA rather than assume the sequencing point is merely administrative.
How should a founder sequence the practical steps?
A founder building out a Pakistan entity should treat each of the three stages as gating the next, not as parallel workstreams:
- Prepare the NOC application — governance structure, Key Individuals, Controllers and the AML/CFT framework — before engaging SECP at all.
- Hold incorporation until the NOC is in hand, then move quickly, since Regulation 15.3’s three-month licensing clock starts running from a separate trigger the founder needs to track independently.
- Line up the resident Key Individual and registered office as part of incorporation planning, not as afterthoughts once section 20(6) becomes relevant.
- Treat the licensing application stage as materially separate from the NOC — different documents, different fee, different assessment — rather than a formality that follows automatically from having incorporated.
Founders comparing this route against PVARA’s regulatory sandbox as an alternative entry point should note that the sandbox does not remove the section 19 sequencing requirement for a company whose primary objective is virtual asset services — it is a different route into supervision, not an exemption from incorporation rules. For questions specific to a proposed structure, contact CoinConnect directly rather than relying on general guidance of this kind.
About this analysis
This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act 2026 as passed by the National Assembly — principally sections 19, 20 and 50 — and from PVARA’s No Objection Certificate Regulations 2025, principally Regulations 2.2, 15.3 and 15.4, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect