Most licensing regimes require a full authorisation before a business can operate at all. Pakistan’s virtual asset framework builds in a narrower, earlier gate. Regulation 2.3 of the PVARA No Objection Certificate Regulations 2025 identifies four specific services an Applicant may provide once it holds AML Registration — ahead of the full VASP licence under Section 17 of the Virtual Assets Ordinance 2025.
This piece sets out what the four services are, the conditions attached to providing them, and where the boundary of that permission actually sits.
What are the four AML-Registered Services under PVARA’s NOC Regulations?
Regulation 2.3 designates four categories of virtual asset service as non-financial businesses and professions under Section 38(1) of the Ordinance, for the purposes of AML Registration on the goAML portal following receipt of an NOC:
“i. Broker-Dealer Services; ii. Custody Services; iii. Exchange Services; and iv. Virtual Asset Derivative Services. Together the ‘AML Registered Services’.”
| Service | Coverage |
|---|---|
| Broker-Dealer Services | Dealing in virtual assets on behalf of, or as principal against, customers |
| Custody Services | Holding or safeguarding customer assets on a customer’s behalf |
| Exchange Services | Facilitating the trading or conversion of virtual assets |
| Derivatives Services | Virtual asset derivative products |
These four, and only these four, carry the “AML Registered Services” label anywhere in the Regulations. No other service category defined under the Ordinance receives the same early-access treatment.
What conditions attach to providing an AML-Registered Service before full licensing?
Regulation 2.3 attaches two limits directly to the permission. First: “Where an Applicant is granted AML Registration, the Applicant may provide AML-Registered Services prior to obtaining a license under Section 17 of the Ordinance, subject to the conditions imposed by the Authority and until such time as the application for obtaining such license is finally determined.” Two conditions sit inside that single sentence.
- Conditions PVARA imposes. The Regulations do not enumerate a fixed list of these conditions in Regulation 2.3 itself — they are left to PVARA’s discretion at the point AML Registration is granted. Where the text does not specify what those conditions will be, that gap is stated here rather than guessed at.
- A time limit tied to the licence outcome. The permission runs “until such time as the application for obtaining such license is finally determined” — meaning it is not indefinite. It ends when PVARA reaches a final decision on the full Section 17 licence application, whether that decision is a grant or a refusal.
Regulation 9.3 adds a separate, service-level condition that applies before any individual customer relationship: customer due diligence “must be completed before the Applicant provides any AML Registered Service.” A general AML Registration at entity level does not substitute for fit and proper-standard customer checks at the transaction level.
What is the practical sequence for accessing the four AML-Registered Services?
Regulation 17.1(a) lays out PVARA’s decision letter structure, and item (iii) makes the sequence explicit: PVARA’s grant of an NOC authorises the Applicant “to provide ‘AML-Registered Services’ (limited to Exchange, Broker-Dealer, Custody and Derivative Services) upon completion of goAML registration, in advance of obtaining a full VASP Licence.” Completion of goAML registration is the trigger, not the NOC decision by itself.
- PVARA issues the NOC, which under Regulation 2.2 approves AML Registration and permits incorporation.
- The Applicant completes goAML registration as the reporting entity.
- Only once goAML registration is complete may the Applicant begin providing the four AML-Registered Services, subject to whatever conditions PVARA has imposed.
An Applicant that holds an NOC but has not yet completed step 2 is not yet authorised to provide any of the four services under this Regulation, regardless of how far its business build-out has otherwise progressed.
Why does Regulation 2.3 call this a “phased regulatory pathway”?
Because that is the language the Regulations themselves use to describe the objective this provision serves. Regulation 3.1(g) lists as one of the Regulations’ seven objectives: “to facilitate a phased regulatory pathway whereby AML-Registered Services may be provided once registration has been completed and the NOC has been issued, and prior to full licensing under the Ordinance.” Regulation 2.3’s four-service list is the operative mechanism that objective describes in the abstract.
In practice, this design lets PVARA extend limited, AML-supervised market access to an Applicant while the fuller assessment for a Section 17 licence — capital requirements, technology architecture, governance depth — is still under way, rather than requiring a business to sit idle in Pakistan for the full duration of that later process. Our reading is that this phased design is what makes the NOC route materially different from a straightforward licence application: it is a staged market-entry instrument, not merely a preliminary filing.
What must an Applicant document to be considered for the four AML-Registered Services?
Section 2.1 of Form A1 requires the Applicant to list, from a fixed menu of the four AML-Registered Services, which ones it is seeking AML Registration for — broker-dealer, custody, exchange or virtual asset derivatives services. Section 2.5 then requires a detailed narrative business model description covering the customer types the Applicant will serve, the products offered, whether the Applicant will operate a centralised exchange, brokerage, OTC desk or custodian, and its fiat on-ramp and off-ramp arrangements. That narrative is what PVARA uses to test whether the services actually requested match the services the Applicant’s real business model would provide.
An Applicant that requests AML Registration for exchange services alone, but whose Section 2.5 narrative describes an OTC desk offering staking or lending products as well, has already flagged a mismatch between what Regulation 2.3 permits and what the business intends to do — a mismatch PVARA’s assessment under Regulation 16.1 is designed to catch before an NOC is granted, not after.
What happens to the permission once the licensing decision is finally determined?
Regulation 2.3’s time limit — “until such time as the application for obtaining such license is finally determined” — resolves in one of two directions. Where the Section 17 licence is granted, the Applicant moves from providing AML-Registered Services under the NOC to providing them under a full licence, and Regulation 18.1(f) requires the Applicant to keep applying for and progressing diligently toward that licence throughout the interim period. Where the licence application is refused, Regulation 17.2 requires PVARA to give written reasons, and the permission to provide AML-Registered Services under Regulation 2.3 lapses with the refusal, since the condition that kept it alive — an undetermined licence application — no longer exists.
Regulation 19.1(e) reinforces this by making “failure to apply for or progress toward obtaining a full VASP License within the prescribed period” a distinct ground for revoking the NOC itself, separate from the licence outcome. An Applicant cannot treat the four AML-Registered Services as a standing business model in their own right — Regulation 2.3 frames them throughout as a bridge to full licensing, not an alternative to it.
Does AML Registration under Regulation 2.3 cover every virtual asset service?
No. Regulation 2.3 is explicit that it does not: “For the avoidance of doubt, all other Virtual Asset Services defined under the Ordinance not otherwise constituted as an AML Registered Service may only be provided following the grant of a full license under Section 17, unless otherwise agreed with PVARA.” Any Schedule I service category outside the four listed here — for example lending, transfer and settlement, or investment services — stays locked behind full licensing under this Regulation, with the narrow exception of “unless otherwise agreed with PVARA,” which the Regulations do not further define.
About this analysis
This analysis was prepared by the CoinConnect research desk from the PVARA No Objection Certificate Regulations 2025, principally Regulations 2.3, 3.1(g), 9.3 and 17.1(a), read as published. Where the Regulations leave the specific conditions PVARA may impose on AML-Registered Services undefined, or leave the “unless otherwise agreed” exception unexplained, those gaps are stated in the text above rather than filled in.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect