The Eight Statutory Forms in Annex A of the NOC Regulations

The PVARA No Objection Certificate Regulations 2025 do not leave the paperwork to guesswork. Annex A sets out eight standard forms, labelled Form A1 through Form A8, that a Virtual Asset Service Provider (“VASP”) applicant and, later, a registered applicant must use at defined points in the No Objection Certificate (“NOC”) process.

This article lists all eight forms, states what each is for, and names the regulation each is issued under where the Regulations state one.

What are the eight statutory forms in Annex A?

Annex A of the NOC Regulations lists them in this order: Form A1 (application for AML Registration), Form A2 (Controller and beneficial owner disclosure), Form A3 (Fit & Proper Questionnaire), Form A4 (AML/CFT Framework Submission Statement), Form A5 (outsourcing declaration and register), Form A6 (Annual AML/CFT Return), Form A7 (Internal Suspicious Activity Report), and Form A8 (Key Individual appointment or change form). The Regulations state that “all forms shall be read as forming part of these Regulations and must be used in the manner prescribed by the Authority.”

Form	Title	Who completes it
A1	Application for AML Registration	The Applicant (two authorised signatories)
A2	Controller & Beneficial Owner Disclosure Form	Every Controller and every Beneficial Owner
A3	Fit & Proper Questionnaire (Key Individuals)	Every Key Individual
A4	AML/CFT Framework Submission Statement	CEO and MLRO
A5	Outsourcing Declaration & Register	The Compliance Officer
A6	Annual AML/CFT Return	MLRO and CEO, once per calendar year
A7	Internal Suspicious Activity Report (ISAR)	Whoever identifies the suspicious activity
A8	Key Individual Appointment / Change Form	The Applicant, per individual appointed or changed

Form A1: Application for AML Registration

Form A1 is “issued under Regulation 15.1 of the No Objection Certificate Registration Regulations 2025.” Regulation 15.1 confirms this directly: “Applications for an NOC shall be submitted using Form A1, as prescribed in Annex A, together with all required documentation.” The form itself runs to ten sections covering applicant details, the licensing activity sought, governance and Key Individuals, Controllers and beneficial ownership, AML/CFT framework documentation, technology and systems, FMU compliance readiness, financial resources, other regulatory licences, and a declaration signed by two authorised signatories, typically the Chief Executive Officer and one other Key Individual.

Form A2: Controller & Beneficial Owner Disclosure Form

Form A2 is “issued under Regulation 7 of the No Objection Certificate Regulations 2025.” Regulation 7.2 confirms the link: “Applicants must disclose all Controllers including Beneficial Owners… and submit Form A2.” The Regulations define a Controller as any person holding, directly or indirectly, 20% or more of voting power or share capital of the Applicant. Form A2 must be completed by every Controller and every Beneficial Owner individually, and covers personal identification, the nature of control exercised, background and integrity, financial soundness, and source of funds and source of wealth.

Form A3: Fit & Proper Questionnaire

Form A3 is “issued under Regulation 6.4 of the No Objection Certificate Regulations 2025.” Regulation 6.4 states: “Each Key Individual shall submit a Fit and Proper Declaration in the form prescribed in Annex A (Form A3).” The Regulations name eight Key Individual roles at regulation 5.1 — Chief Executive Officer, Director, Chief Financial Officer, Compliance Officer, MLRO, Head of Internal Audit, Head of Risk Management, and Head of Information Security — and Form A3 covers twelve sections including employment history, qualifications, regulatory and criminal record, financial soundness, conflicts of interest, and two independent professional references.

Form A4: AML/CFT Framework Submission Statement

Form A4 is “issued under Regulation 8 of the No Objection Certificate Registration Regulations 2025.” Regulation 8 sets out what the AML/CFT framework itself must contain — a Board-approved policy, customer due diligence and enhanced due diligence procedures, targeted financial sanctions screening, transaction monitoring, suspicious and currency transaction report escalation, an enterprise-wide risk assessment, recordkeeping, training, and an outsourcing risk framework. Form A4 is the certification that this framework has actually been submitted, is complete, and is operational — signed jointly by the Chief Executive Officer and the MLRO, confirming Board approval and operational readiness of the underlying systems.

Form A5: Outsourcing Declaration & Register

Form A5 is “issued under Regulation 14 of the No Objection Certificate Regulations 2025.” Regulation 14.1 restricts outsourcing of AML-critical functions — those going to the core of the Applicant’s AML/CFT duties, such as customer due diligence, enhanced due diligence, sanctions screening, transaction monitoring, suspicious and currency transaction report filing, and MLRO responsibilities — unless the Applicant conducts due diligence on the provider, maintains oversight, retains audit rights, and ensures those rights are legally enforceable including in cross-border arrangements. Form A5 is completed by the Compliance Officer and requires a line-by-line register of every outsourced function relevant to AML/CFT, covering the provider, data shared, audit rights, and a risk rating for each.

Form A6: Annual AML/CFT Return

Form A6 is “issued under Regulation 18 of the No Objection Certificate Registration Regulations 2025.” Regulation 18.1(c) requires a registered applicant to “submit an Annual AML/CFT Return in the prescribed form (Form A6).” The Return must be completed once every calendar year and covers entity profile, governance changes, risk assessment updates, customer due diligence and transaction monitoring metrics, suspicious and currency transaction report figures, and independent audit findings, signed by both the MLRO and the CEO.

Form A7: Internal Suspicious Activity Report (ISAR)

Form A7 does not carry an “issued under Regulation X” citation in the Regulations as published — the text introducing it states only that “VASPs are welcome to use their own ISAR, but they should include the below information at a minimum.” It sits within the broader monitoring and escalation duties in regulation 11 of the Regulations, which require Applicants to maintain systems capable of detecting suspicious or unusual activity and to demonstrate technical readiness to file Suspicious Transaction Reports (“STRs”). Form A7 covers reporter details, customer details, transaction details, a suspicion narrative, and a determination by the MLRO on whether to file an external STR.

Form A8: Key Individual Appointment / Change Form

Form A8, like Form A7, does not carry a specific “issued under Regulation X” citation in the text as published. The form’s own introduction states only that it must be submitted “whenever an Applicant appoints a new Key Individual or makes a change affecting an existing Key Individual, in accordance with the No Objection Certificate Regulations.” A separate Form A8 is required for each individual appointed, replaced, modified in role, or resigning or removed, and requires Board approval documentation, a fit and proper questionnaire, and an acknowledgment signed by the Key Individual themselves.

Why does it matter which regulation a form sits under?

Because it tells an applicant when the form is triggered and what breach it connects to. A form tied to a specific regulation — like Form A6 under regulation 18.1(c) — has a stated ongoing obligation attached to it, and failing to submit it feeds directly into the revocation grounds set out elsewhere in the Regulations. Forms A7 and A8, which do not carry an explicit citation in the source text, still sit within the broader AML/CFT framework and Key Individual duties covered by other numbered regulations, even without a single stated cross-reference.

About this analysis

This analysis was prepared by the CoinConnect research desk from the PVARA No Objection Certificate Regulations 2025, Annex A and the preamble text of each of the eight forms, read alongside regulations 5.1, 6.3, 6.4, 7.2, 8, 11, 14.1, 15.1 and 18.1(c) for context, as published. Where a form’s preamble does not state a specific “issued under” regulation number — Forms A7 and A8 — that is stated in the text above rather than inferred.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.