The 20% Controller Threshold for VASPs in Pakistan

Most founders building a virtual asset business in Pakistan assume the ownership question is arithmetic. Add up the share register, circle anyone above twenty per cent, file their paperwork. That reading is wrong, and it is the single most common cause of a shareholding structure that has to be unpicked halfway through an application.

The Virtual Assets Act, 2026 defines a Controller in two limbs. The first is numerical. The second is a catch-all for significant influence or control that has nothing to do with how many shares a person holds. A person who owns nothing at all can be a Controller.

This piece sets out both limbs, the separate definition of Sponsor, what the No Objection Certificate Regulations 2025 require by way of disclosure, and the practical structuring consequences for anyone preparing a PVARA licence application.

Who is a Controller of a VASP in Pakistan?

Under section 3(1)(v) of the Virtual Assets Act, 2026, a Controller is a person who — alone or with associates — holds or is entitled to exercise 20% or more of the voting power, ownership interest or share capital of a Licensee, or who otherwise exercises significant influence or control over its management or policies, whether directly or indirectly.

The definition in full:

“Controller” means a Person who, alone or together with associates, holds or is entitled to exercise twenty percent (20 %) or more of the voting power, ownership interest, or share capital of a Licensee, or otherwise exercises significant influence or control over its management or policies, whether directly or indirectly;

Four separate mechanics are packed into that sentence, and each of them widens the net:

• “alone or together with associates” — holdings are aggregated. Two family members at 12% each are, on a plain reading, a Controller pairing at 24%.
• “holds or is entitled to exercise” — an unexercised entitlement counts. A convertible instrument, an option, or a voting arrangement that has not yet been triggered can bring a person inside the definition before any share certificate is issued.
• “voting power, ownership interest, or share capital” — three alternative measures. Crossing any one of them is sufficient. A dual-class structure that keeps economic ownership at 10% but voting power at 30% produces a Controller.
• “whether directly or indirectly” — the test looks through intermediate entities to the person exercising influence at the end of the chain.

“Person”, under section 3(1)(xxii), means a natural or legal person. Controllers are therefore not only individuals. Corporate shareholders, holding companies and funds sit within the definition on identical terms.

What does the significant influence catch-all actually capture?

The second limb of section 3(1)(v) captures anyone exercising significant influence or control over the Licensee’s management or policies, regardless of shareholding. The Act does not define “significant influence”, and no PVARA guidance interpreting the phrase appears in the material published so far. That gap is the point worth understanding.

Because the term is undefined, the assessment is substantive rather than mechanical. Our reading is that the Authority will look at how decisions are actually made in the business, not at what the constitutional documents say. Section 9(1)(f) of the Act gives the Authority a general power to classify any person or arrangement “based on its substantive features, underlying function, method of use, or economic effect, irrespective of the nomenclature, structure, or designation assigned to it”. Applied to ownership, that power cuts against form.

Form A2 of the NOC Regulations gives the clearest available indication of what the Authority has in mind. Its Section 2.1 asks the discloser to indicate all applicable forms of control, listing:

• direct shareholding;
• indirect shareholding;
• voting rights;
• board control or influence;
• senior management influence;
• control via shareholders’ agreement;
• control via financing arrangements;
• control via trust or nominee structures; and
• other (to be explained).

Five of those nine categories have nothing to do with equity. “Control via financing arrangements” is worth pausing on: a lender with negative covenants over the business plan, or a convertible noteholder with veto rights, may be disclosable. So may a founder who has transferred shares but retained board appointment rights. Form A2 also requires “a detailed narrative explaining how control is exercised, including any agreements, arrangements or relationships relevant to influence or control”.

The practical test we apply when reviewing a corporate structure before incorporation is simple: if a person can stop the business from doing something it wants to do, or make it do something it does not want to do, that person is a candidate for disclosure whatever the share register says.

How does a Controller differ from a Sponsor or a Key Individual?

Three separate categories of person carry regulatory obligations under the Act, and they overlap without being interchangeable. A Controller is defined by ownership or influence. A Sponsor is defined by initial capital or controlling shareholding. A Key Individual is defined by the role occupied.

Section 3(1)(xxix) defines Sponsor:

“Sponsor” means a person or group of persons who has contributed initial capital to establish the company or hold a controlling shareholding therein, whether directly or indirectly;

Category	Source	Basis of capture	Threshold stated?
Controller	Act s.3(1)(v)	Voting power, ownership interest, share capital, or significant influence	Yes — 20%
Sponsor	Act s.3(1)(xxix)	Contribution of initial capital, or controlling shareholding	No numeric figure given
Key Individual	Act s.3(1)(xv)	Occupying one of the listed positions	Not applicable

The Sponsor definition has no percentage attached, which means a seed investor who put in founding capital and then diluted well below 20% may still be a Sponsor. In practice this matters because section 20(1) applies the fit-and-proper determination to “a Controller, Sponsor, Chief Executive Officer and Director” — the Authority makes that determination itself for those four categories, whereas section 20(2) places responsibility for assessing other Key Individuals on the applicant, together with a written undertaking confirming compliance and ongoing maintenance.

Section 20(3) then gives the enforcement teeth:

The Authority may refuse, suspend or revoke a license where any Controller, Sponsor or Key Individual fails to meet the prescribed fit-and-proper criteria.

Section 20(5) adds that the Authority shall prescribe additional requirements for corporate Controllers, including assessment of corporate behaviour, integrity and track record of the Controller and ultimate beneficial owners. Anyone mapping this against the Form A3 fit and proper questionnaire should note that A3 covers Key Individuals; Controllers and beneficial owners complete Form A2 instead.

What does the NOC stage require from Controllers?

Regulation 7 of the No Objection Certificate Regulations 2025 restates the 20% threshold, requires disclosure of all Controllers including Beneficial Owners, and makes Controller approval a precondition to registration. Regulation 7.3 is the provision that most affects deal timing.

The three limbs of regulation 7 read:

7.1 Any person holding, directly or indirectly, 20% or more of voting power or share capital of the Applicant is deemed a “Controller”.

7.2 Applicants must disclose all Controllers including Beneficial Owners (as defined in the AMLA 2010) and submit Form A2.

7.3 The Authority must approve each Controller before AML registration may be granted. Once registered, no Controller may acquire or increase control above thresholds to be determined by PVARA without written approval from the Authority.

Two observations. First, regulation 7.1 is worded slightly more narrowly than section 3(1)(v) — it refers to voting power or share capital and omits the significant influence limb. The Act governs where the two differ, and Form A2’s control checklist plainly contemplates non-equity influence, so we treat the statutory definition as the operative test.

Second, the post-registration thresholds referred to in regulation 7.3 are “to be determined by PVARA”. At the time of writing we have not seen those thresholds published. Until they are, any planned secondary sale, top-up round or internal reorganisation after registration should be raised with the Authority rather than assumed to be free.

Form A2 must be completed by every Controller and every Beneficial Owner, of both the global entity being registered on goAML and the proposed local Pakistani entity. It runs to six sections and requires certified identity documents, proof of residential address, tax residency documentation, a full ten-year professional history, regulatory and criminal record declarations, financial soundness declarations, and — the part that consistently takes longest — a documented source of wealth and source of funds narrative with supporting evidence. Where funds originate offshore, Form A2 requires full details of jurisdiction, bank and transfer pathway.

Section 4.3 of Form A1 requires an Ownership and Control Structure Chart showing all shareholding layers, all intermediate entities and jurisdictions, and the ultimate natural person or persons who own or control the applicant. A chart that stops at a holding company will be returned.

What should you do about your cap table before you apply?

Map influence before you map equity, and do it before incorporation rather than after. Under section 19(1) of the Act, any person intending to incorporate a company whose primary objective is Virtual Asset Services must first apply to the Authority for a No-Objection Certificate. The Controller position is fixed at that point, which makes pre-incorporation the cheapest moment to fix it.

A working sequence:

1. List every person and entity on the share register, with voting power, ownership interest and share capital shown separately. Test each of the three measures against 20% independently.
2. Aggregate associates. Family holdings, connected corporate vehicles and parties acting under an understanding should be totalled before you conclude anyone is below the line.
3. Add unexercised entitlements. Options, convertibles, warrants and drag or veto arrangements go into the calculation because the Act captures anyone “entitled to exercise” voting power.
4. Read the shareholders’ agreement and any loan documents against Form A2’s nine control categories. Reserved matters, board appointment rights and financing covenants are where undisclosed Controllers hide.
5. Identify Sponsors separately. Ask who funded incorporation, not who holds shares today.
6. Run a source-of-wealth readiness check on each identified Controller. If a Controller cannot document how their wealth was accumulated, that is a structuring problem, not a paperwork problem.
7. Decide on nominee arrangements now. Form A2 requires full details and supporting documents where a person acts through a nominee, trustee or intermediary. Nominee structures do not conceal a Controller; they add a disclosure obligation.

Structures with a genuinely dispersed cap table — no holder above 20% and no influence arrangements — do exist, and they simplify the NOC file considerably. But dispersal has to be real. A group of small holders bound by a voting agreement is, in substance, one Controller.

Two further points that catch foreign applicants. Section 20(6) requires every Licensee to maintain a registered office in Pakistan and to ensure at least one Key Individual ordinarily resident in Pakistan is vested with operational and decision-making authority, subject to prescribed conditions — a point we deal with at length in our note on resident director requirements. And section 22(d) obliges a Licensee at all times to obtain prior Authority approval for any material change in control or business, in the manner prescribed. Controller approval is therefore not a one-off gate at SECP registration; it is a continuing obligation, reinforced by section 20(4), which makes fit-and-proper criteria continuing in nature and requires any person subject to them to notify the Authority of anything affecting their fitness and propriety.

For applicants weighing whether to enter through the regulatory sandbox rather than straight to licensing, note that the Sandbox Guidelines 2026 require a complete governance structure with a clearly identifiable Ultimate Beneficial Owner as part of operational readiness. Ownership transparency is not deferred by choosing the sandbox route.

Where ownership sits offshore, the tax registration and banking workstream depends on the same source-of-funds evidence, so building the Controller file once and using it across all three workstreams saves considerable duplication. Founders comparing entry routes into the Pakistani market should treat Controller identification as gating work in every one of them, and those still deciding on licence scope may find our breakdown of the ten licence categories useful alongside the full PVARA guide.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act, 2026 (as passed by the National Assembly), the PVARA No Objection Certificate Regulations 2025 (Document Code PVARA/REG/AML-REG/2025-1, Version 1.0) including Forms A1, A2 and A3, and the PVARA Sandbox Guidelines 2026, each read as published. Where practice is not yet settled or guidance has not been issued — in particular the meaning of “significant influence” and the post-registration control thresholds referred to in regulation 7.3 — that is stated above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.