The No Objection Certificate is the first gate in Pakistan’s virtual asset regime, and it is the one most often misunderstood. It is not a licence. It is not a letter of comfort. It is a statutory clearance that must be obtained before a company exists, and it carries conditions that bind the applicant from the day it is issued.
PVARA has published a dedicated instrument governing it: the PVARA No Objection Certificate Regulations 2025, document code PVARA/REG/AML-REG/2025-1, version 1.0 (Final), effective 2 December 2025, prepared by the Authority’s Licensing and Supervision Division.
This guide covers what the NOC is, what it permits, what an application must contain, how long a decision takes, and what happens after it is granted.
What is a PVARA No Objection Certificate?
A PVARA No Objection Certificate is a pre-incorporation regulatory clearance. Under regulation 2.2 of the PVARA No Objection Certificate Regulations 2025, its issuance constitutes both approval for the applicant’s AML Registration on the goAML portal and permission for the applicant to proceed with incorporation of its local entity in Pakistan.
PVARA is the Pakistan Virtual Assets Regulatory Authority. goAML is the reporting platform operated by Pakistan’s Financial Monitoring Unit (FMU), through which regulated entities file suspicious transaction reports and currency transaction reports.
The statutory basis sits in the Virtual Assets Act, 2026. Section 19(1) requires any person intending to incorporate a company with the primary objective of engaging in Virtual Asset Services to first apply to PVARA for a No-Objection Certificate, before commencing the process of such incorporation.
“Any Person intending to incorporate a company, under the Companies Act, 2017 (XIX of 2017) or any other law for the time being in force, with the primary objective of engaging in Virtual Asset Services shall first apply to the Authority for a No-Objection Certificate before commencing the process of such incorporation.”
— Virtual Assets Act, 2026, section 19(1)
Under section 19(3), PVARA may grant the certificate subject to conditions, or refuse the application with written reasons.
What does an NOC permit you to do?
Regulation 17.1 of the NOC Regulations sets out four things an NOC authorises: registering the foreign entity on goAML, incorporating a local Pakistani entity, providing four specified categories of service, and submitting a licensing application within three months of the VASP licensing regulations being issued.
The four permissions in full:
- Register the foreign chapter already providing AML-Registered Services in Pakistan on the goAML portal
- Incorporate a local entity in Pakistan for the purpose of applying for a full VASP licence
- Provide “AML-Registered Services” upon completion of goAML registration, in advance of obtaining a full VASP licence
- Submit a licensing application within three months of promulgation of the VASP licensing regulations
Regulation 2.3 defines AML-Registered Services as four of the Schedule I categories:
| AML-Registered Service | Available pre-licence |
|---|---|
| Broker-Dealer Services | Yes, per reg 2.3 |
| Custody Services | Yes, per reg 2.3 |
| Exchange Services | Yes, per reg 2.3 |
| Virtual Asset Derivatives Services | Yes, per reg 2.3 |
| All other Schedule I services | No — full licence required |
The final paragraph of regulation 2.3 is explicit on the second group: all other virtual asset services “may only be provided following the grant of a full license… unless otherwise agreed with PVARA.”
An important qualification. Regulation 2.3 permits AML-Registered Services to be provided before a licence is granted. Section 50(1) of the Virtual Assets Act, 2026 states that no person shall provide any virtual asset service unless incorporated in Pakistan and holding a valid licence, and section 54(1) makes wilful contravention punishable by up to five years’ imprisonment or a fine up to fifty million rupees. The documents do not explain how these sit together. Our reading is that this is a question every applicant should put to PVARA in writing and obtain a written answer on before relying on the pre-licence permission. We do not think it is safe to assume either instrument silently overrides the other.
What must an NOC application contain?
An application is made on Form A1, prescribed in Annex A to the NOC Regulations, under regulation 15.1. Form A1 runs to ten sections covering applicant details, services sought, governance, ownership, AML framework, technology, goAML workflow, financial resources, other licences, and a two-signatory declaration.
The application is document-heavy. The core attachments are:
- A group structure chart showing all entities and jurisdictions
- A board composition chart, plus a CV for each director
- Form A3 (Fit and Proper Questionnaire), an up-to-date CV and a passport copy for each Key Individual
- Form A2 (Controller and Beneficial Owner Disclosure) for every Controller and every Beneficial Owner
- A complete ownership and control structure chart showing all shareholding layers, intermediate entities, jurisdictions and the ultimate natural persons
- Fourteen AML/CFT documents, listed at Form A1 section 5, including a board-approved AML/CFT Policy, CDD and EDD procedures, a blockchain analytics methodology, an enterprise-wide ML/TF risk assessment, and a training programme
- Form A4 (AML/CFT Framework Submission Statement), signed by the CEO and the MLRO
- Form A5 (Outsourcing Declaration and Register), signed by the Compliance Officer
- Latest audited financial statements, or management accounts and pro forma financials if newly incorporated
- Evidence of paid-up capital and external auditor details
Under regulation 5.1, an applicant must maintain eight Key Individuals: Chief Executive Officer; Director (executive or non-executive); Chief Financial Officer; Compliance Officer; Money Laundering Reporting Officer; Head of Internal Audit; Head of Risk Management; and Head of Information Security. Regulation 5.2 permits the Compliance Officer and MLRO functions to be combined where justified by the size and complexity of the applicant.
Form A1 section 3.2 requires Key Individual details for both the global entity being registered on goAML and the proposed local entity in Pakistan. That is a dual-disclosure requirement, and it is easy to miss.
Regulation 8A sets documentation standards. Every submission must be in English or Urdu, carry version control, be paginated and indexed, be submitted in a searchable electronic format, and include written evidence of board approval where required.
How does PVARA assess an application?
Regulation 16.1 lists six assessment heads: fitness and propriety of Key Individuals and Controllers; adequacy and operational readiness of the AML/CFT framework; governance and internal control arrangements; financial soundness; adequacy of technology architecture and monitoring systems; and the applicant’s inherent and residual ML/TF risk profile.
Regulation 16.1 also states that these matters may be evaluated or re-evaluated at the subsequent licensing application stage. An NOC assessment is therefore not final clearance on any of these points.
Two further powers apply during assessment:
- Interviews. Regulations 6.2 and 16.2 both allow PVARA to interview Key Individuals to satisfy itself of their competence, independence, knowledge and suitability.
- Inspections and further information. Regulation 16.3 allows PVARA to conduct inspections or request additional information.
On fitness and propriety, regulation 6.3 sets three absolute bars. No individual may serve as a Key Individual if they have been convicted of an offence under the Anti-Money Laundering Act 2010, the Act, or any law involving dishonesty, fraud or financial misconduct; have been sanctioned by any regulatory body in Pakistan or abroad; or are subject to bankruptcy or insolvency proceedings, except where duly discharged.
How long does an NOC decision take?
Regulation 17.1 requires PVARA to issue or refuse the NOC within a period not exceeding sixty calendar days following assessment. Where an application is refused, regulation 17.2 requires PVARA to provide written reasons for its decision.
Note that the sixty days runs from assessment, not from submission. The Regulations do not fix a maximum time for the assessment phase itself to begin or conclude, and they do not state what happens if the sixty days expires without a decision. Both are gaps in the drafting.
The deadlines that appear in the NOC framework are:
| Deadline | Source | Runs from |
|---|---|---|
| 60 calendar days for the decision | Reg 17.1 | Following assessment |
| 3 months to file the licensing application | Reg 15.3(c), 17.1(iv) | Issuance of the VASP licensing regulations |
| Annual AML/CFT Return (Form A6) | Reg 18.1(c) | Once every calendar year, by PVARA’s deadline |
| 7 years minimum record retention | Reg 13.1 | Ongoing |
The three-month licensing deadline is worth reading precisely. It runs from the promulgation of the VASP licensing regulations, not from the date of the NOC. An applicant holding an NOC before those regulations are published is not yet on that clock.
What must you do after the NOC is granted?
Regulation 15.3 imposes three post-issuance steps: register the foreign entity already providing AML-Registered Services in Pakistan on the goAML portal; incorporate a local company; and submit the licensing application in the prescribed form within three months of the issuance of the VASP licensing regulations.
Regulation 11.5 then makes a structural point about who reports. Once the applicant incorporates its local entity, the local entity — after being granted the licence — assumes the role of reporting entity on goAML and must maintain active reporting credentials at all times. The reporting obligation migrates from the foreign chapter to the licensed local company.
Regulation 18.1 sets six ongoing obligations for a registered applicant:
- Comply with all AML/CFT obligations at all times
- Notify PVARA of any material changes affecting AML compliance, governance, ownership or technology
- Submit an Annual AML/CFT Return in the prescribed form (Form A6)
- Undergo independent AML audits when directed by PVARA
- Maintain active FMU goAML registration
- Apply for and progress diligently toward a full VASP licence within the time required
Regulation 7.3 adds a control condition: once registered, no Controller may acquire or increase control above thresholds to be determined by PVARA without written approval. A Controller is any person holding, directly or indirectly, 20% or more of voting power or share capital, under regulation 7.1.
When can an NOC be revoked?
Regulation 19.1 lists five grounds for revocation of an NOC, including AML Registration status: false, misleading or incomplete information; breach of AML/CFT obligations; a Key Individual ceasing to satisfy fit and proper requirements; systemic or material AML/CFT failures; and failure to apply for or progress toward a full VASP licence.
Regulation 19.2 requires revocation to be applied proportionately, taking into account the severity and impact of the breach.
The first and last grounds deserve particular attention. The first makes accuracy at application stage an ongoing exposure rather than a one-off filing risk — Form A1’s declaration requires two authorised signatories to confirm the information is true, complete and accurate, and to undertake to notify PVARA without undue delay of material changes. The last makes the NOC conditional on forward motion. An applicant that obtains an NOC and then stalls is in breach of regulation 18.1(f) and exposed under 19.1(e).
About this analysis
This analysis was prepared by the CoinConnect research desk from the PVARA No Objection Certificate Regulations 2025 (PVARA/REG/AML-REG/2025-1, version 1.0, effective 2 December 2025) including Annex A Forms A1 to A8, and from the Virtual Assets Act, 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.
Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.
Entering Pakistan's crypto market?
CoinConnect handles market entry, partnerships, PR and launch for exchanges and Web3 companies moving into Pakistan and South Asia.
Visit CoinConnect