The NOC-Before-Incorporation Rule for Pakistani VASPs

Anyone planning a virtual asset business in Pakistan usually assumes the order runs incorporate, then license. Section 19 of the Virtual Assets Act 2026 reverses that order for a specific category of company. Where the primary objective of the business is to provide virtual asset services, incorporation is not step one. It cannot lawfully begin until the Pakistan Virtual Assets Regulatory Authority (PVARA) has issued a No-Objection Certificate.

Getting the sequence wrong is not a paperwork problem. It means incorporating a structure PVARA has never reviewed, and it puts a founder outside the process the Act actually describes.

Why must the NOC come before incorporation, not after?

Section 19(1) states the rule directly:

“Any Person intending to incorporate a company, under the Companies Act, 2017 (XIX of 2017) or any other law for the time being in force, with the primary objective of engaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.”

Two features of that wording matter. First, the trigger is intent, not the act of incorporation — a person who has decided to build a virtual asset service provider is already inside the rule before any document reaches the Securities and Exchange Commission of Pakistan (SECP). Second, the word “first” and the phrase “before commencing the process of such incorporation” rule out running incorporation and the NOC application in parallel. One must precede the other.

The logic is straightforward from a supervisory standpoint. Once a company exists, PVARA would be reviewing an entity that already has directors, shareholders and a share register filed with SECP. Reviewing the structure, ownership and purpose before the company is created gives PVARA the chance to object, or refuse outright, before anyone has spent money creating a company it does not want operating in Pakistan.

What has to accompany an NOC application?

Section 19(2) leaves the specifics to PVARA rather than fixing them in the Act itself: “An application for a No-Objection Certificate under sub-section (1) shall be made in such form and manner, accompanied by such information and fee as may be prescribed by the Authority.” The Act does not itself list the required documents or set a fee amount — both sit in PVARA’s own prescribed form.

A related instrument, PVARA’s No Objection Certificate Regulations 2025, gives a sense of what that form asks for in practice — though it should be read as illustrative rather than a direct gloss on section 19. The Regulations reference the predecessor Virtual Assets Ordinance’s section numbering, which does not necessarily map onto the Act’s own sections, so this analysis treats the two as related but separate documents rather than assuming identical cross-references. With that caveat, the Regulations describe an application that covers:

• Applicant identity, incorporation details and group structure
• The virtual asset services sought and a detailed business model narrative
• Directors and Key Individuals, each supported by a fit and proper questionnaire
• Controllers and beneficial owners, with ownership and control charts
• The applicant’s anti-money laundering and countering the financing of terrorism framework
• Technology architecture and the systems used for onboarding, screening and monitoring
• Financial statements and evidence of the source of the applicant’s capital
• Any other regulatory licences the applicant or its group already holds

Under those same Regulations, PVARA targets a decision within sixty calendar days of a complete submission. That timeline sits in the Regulations, not in section 19 of the Act, and should be verified against PVARA’s current published position rather than assumed to be a statutory deadline.

What can the Authority do with the application?

Section 19(3) sets the decision out plainly: “Upon review of an application for No-Objection Certificate, the Authority may, having regard to the objects of this Act and the need to ensure the integrity of the Virtual Asset market, grant the approval or certificate, subject to any conditions, or refuse the application, providing written reasons for refusal.”

Outcome	What follows
Grant, unconditional	Applicant may proceed to incorporation
Grant, with conditions	Incorporation may proceed, but the applicant must satisfy the stated conditions
Refusal	Written reasons are given; incorporation for the proposed virtual asset business cannot lawfully begin

The refusal ground is broad — “the objects of this Act and the need to ensure the integrity of the Virtual Asset market” — rather than a narrow, itemised test. In practice, our reading is that this gives PVARA considerable discretion at the earliest possible point, before a company’s ownership and governance are locked in on the SECP register. A founder who is refused at NOC stage has been refused before spending the time and cost of incorporation, which is a materially cheaper outcome than a refusal after the company already exists.

What happens if a company incorporates without waiting for the NOC?

The Act does not state, within section 19 itself, a specific penalty for incorporating a virtual-asset-services company before applying for or receiving a No-Objection Certificate. What the Act does establish elsewhere is that a company cannot lawfully carry on virtual asset services without both proper incorporation and a valid licence. Section 50 prohibits any person from engaging in virtual asset services in or from Pakistan unless they are a company incorporated under the Companies Act 2017 (or equivalent law) and hold a valid licence granted by PVARA. Section 54(1) separately makes wilfully providing an unlicensed virtual asset service a criminal offence, punishable with imprisonment up to five years, a fine up to fifty million rupees, or both.

Neither provision addresses the narrower scenario of a company that incorporates first and applies for the NOC afterwards — that gap is not filled anywhere in the source material reviewed for this analysis, and a founder in that position should raise it directly with PVARA or take professional advice rather than treat the sequencing as merely administrative. What is clear from the structure of section 19 is that the licence application under section 19(4) is described as coming “following incorporation of the company” — meaning the process the Act sets out runs NOC, then incorporation, then licence application, in that order, and a company that incorporates first is operating outside that structure.

How does the NOC fit into the wider licensing process?

The NOC is the first of at least two gates in Pakistan’s licensing framework: the pre-incorporation NOC under section 19(1) to (3), and the post-incorporation licence application under section 19(4). It is worth being precise about what the NOC is not. It is not itself a licence to provide virtual asset services, and the Act does not describe it as authorising any commercial activity. It clears the way to incorporate. The licence application that follows is the gate that authorises actual operation, and it carries its own documentation and fee rules, addressed separately.

Founders comparing licensing routes — a direct NOC and licence path, or testing a model through PVARA’s regulatory sandbox first — should treat the NOC stage as a decision about the corporate structure itself, not paperwork to clear quickly. Fit and proper assessment of directors and controllers begins here, before a single share has been issued, and the choice of Controllers, directors and initial Key Individuals should be settled, at least in outline, before an application is filed rather than finalised once the company is already on the SECP register.

For a foreign group planning market entry into Pakistan, this front-loading is the practical consequence of section 19: the corporate and governance decisions that would normally happen after incorporation have to happen first, in front of the virtual asset service provider’s future regulator, rather than after the company already exists.

About this analysis

This analysis was prepared by the CoinConnect research desk from the Virtual Assets Act 2026 as passed by the National Assembly — principally section 19, with cross-references to sections 50 and 54 — and from PVARA’s No Objection Certificate Regulations 2025, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.