The Six Ongoing Obligations After an NOC

Getting the No Objection Certificate is not the finish line. It is the point at which a Virtual Asset Service Provider’s compliance obligations actually start running, on the clock, in front of a regulator who now expects reports rather than promises.

Regulation 18 of the PVARA No Objection Certificate Regulations 2025 sets out exactly what a registered Applicant owes the Authority once the NOC is granted. This piece works through each of the six duties in Regulation 18.1, in the order the Regulations list them.

What ongoing obligations apply once an NOC is granted?

A registered Applicant carries six standing duties under Regulation 18.1: comply with AML/CFT obligations at all times, notify PVARA of material changes, file an Annual AML/CFT Return, undergo independent audits when directed, keep FMU goAML registration active, and progress toward a full licence. The Regulations state the list directly:

“18.1 A registered Applicant shall: (a) comply with all AML/CFT obligations at all times; (b) notify the Authority of any material changes affecting AML compliance, governance, ownership or technology; (c) submit an Annual AML/CFT Return in the prescribed form (Form A6); (d) undergo independent AML audits when directed by the Authority; (e) maintain active FMU goAML registration; and (f) apply for and progress diligently toward a full VASP License within the time period required by the Authority.”

Two things follow from the drafting. First, the Regulations call the entity a “registered Applicant” throughout this section — the No Objection Certificate does not convert a firm into a full Licensee; it converts it into an AML-registered Applicant with a defined path to licensing. Second, five of the six duties are open-ended — “at all times”, “when directed”, “maintain active” — while only one carries a fixed annual cycle.

What does “comply with AML/CFT obligations at all times” require in practice?

It means the AML/CFT framework built for the NOC application has to keep operating exactly as submitted, not just exist as a filed document. Part 4 of the NOC Regulations sets the substantive standard: a Board-approved AML/CFT policy, customer due diligence and enhanced due diligence procedures, targeted financial sanctions screening, transaction monitoring, suspicious and currency transaction report escalation, an enterprise-wide risk assessment, recordkeeping, training, and an outsourcing risk management framework.

Regulation 8A of the same Part sets documentation standards that carry into ongoing operation, not just the application: records must be in English or Urdu, version-controlled, paginated and indexed, and kept in searchable electronic format. In our reading, obligation (a) is best understood as a continuing certification that the whole apparatus assessed at NOC stage — customer due diligence, sanctions screening, monitoring — is still live and still working, not a separate standalone duty.

When must a registered Applicant notify PVARA of a material change?

Obligation (b) covers material changes “affecting AML compliance, governance, ownership or technology” — a broader trigger than a single event, and one the Regulations do not narrow with a closed list of examples. Reading it alongside the rest of Part 3 of the NOC Regulations, the categories that plainly fall inside it include:

• a change of Controller or an increase in an existing Controller’s stake above the threshold PVARA sets, which Regulation 7.3 separately requires written approval for before it happens;
• appointment, replacement or removal of a Key Individual, which Form A8 in Annex A exists specifically to formalise;
• a material change to the AML/CFT framework itself — a new transaction monitoring system, a new outsourced provider, a change in sanctions screening tooling; and
• any matter affecting a Key Individual’s fitness and propriety, which Section 20(4) of the Virtual Assets Act 2026 separately makes a continuing, self-reporting duty for the individual concerned.

Where a change is not obviously “material”, our reading is that the safer course is disclosure rather than silence — Regulation 19.1(a) makes providing “false, misleading or incomplete information” a ground for revoking the NOC outright, and an omission discovered later reads worse than a disclosure made in good faith.

What has to go into the Annual AML/CFT Return?

Form A6, issued under Regulation 18, is the fixed annual reporting instrument. It requires, at minimum, entity and Key Individual details for the reporting period; an MLRO statement summarising overall AML/CFT compliance for the year; disclosure of governance and outsourcing changes; an update to the enterprise-wide ML/TF risk assessment, including new risks identified and emerging typologies observed; customer due diligence metrics — total customers onboarded, customers classified high-risk, PEPs identified, customers refused or exited on AML/CFT grounds; transaction monitoring metrics, including alerts generated, escalated, closed and pending at year end; STR and CTR counts filed via goAML, with broad categories of suspicion reported; and a summary of independent audit findings together with the status of remediation. The Return must be signed by both the MLRO and the CEO.

When can PVARA order an independent AML audit?

Obligation (d) — “undergo independent AML audits when directed by the Authority” — gives PVARA discretion to order an audit at any point, separate from the annual return cycle. The Regulations do not fix a trigger or a frequency for this power; it sits with the Authority’s judgement. Form A6 itself asks the registered Applicant to report the “status of audit remediation” against four categories — fully implemented, partially implemented, in progress, or not yet started — which suggests PVARA expects any audit finding to be tracked through to closure rather than filed and forgotten.

What does maintaining “active FMU goAML registration” actually mean here?

This obligation ties back to who is registered on the Financial Monitoring Unit’s goAML platform as the reporting entity, and that identity changes as the Applicant moves through the framework. Regulation 11.4 requires a foreign Applicant already providing AML-Registered Services in Pakistan to register on goAML as the reporting entity following NOC issuance. Once the local entity is incorporated and granted a full licence, Regulation 11.5 shifts the reporting-entity role to that local entity, which “must maintain active reporting credentials at all times.” Regulation 11.6 adds a readiness standard behind the registration itself: the Applicant must be able to demonstrate technical capability to file STRs and CTRs immediately once goAML registration is granted — registration without a working filing pipeline behind it does not satisfy the obligation.

What does “progress diligently toward a full licence” require, and what is the deadline?

Obligation (f) is the clearest bridge between the NOC stage and full licensing, and the Regulations attach a concrete deadline to it elsewhere in the document. Regulation 15.3(c) requires the successful Applicant to “submit the licensing application, in the form prescribed by the Authority, within three months of the issuance of the VASP licensing regulations.” Regulation 17.1(a)(iv) repeats this as a condition attached to the NOC decision itself.

The word “diligently” in obligation (f) matters because it is not satisfied by the act of filing alone — it implies continued active progress after submission, not a single filing followed by inaction. This is the obligation most directly connected to the risk of losing the NOC: failure to apply for, or progress toward, a full licence “within the prescribed period” is itself listed as a ground for revocation under Regulation 19.1(e). We cover that revocation power and the four other grounds in a companion piece on when PVARA can revoke an NOC.

How does this differ from a full licensee’s ongoing obligations?

The six duties in Regulation 18.1 apply to an NOC holder that has not yet been granted a full VASP licence. Section 22 of the Virtual Assets Act sets a parallel, broader list of ongoing obligations that apply once a full licence is granted — minimum paid-up capital and financial resources, compliance with all Rules, Regulations, directives and guidelines, periodic returns and audited financial statements, prior approval for material changes in control or business, risk-management and cybersecurity systems, and supervision and renewal fees. The two lists overlap in substance — notification of material change and ongoing AML compliance run through both — but the Act’s list is the fuller, permanent standard a Licensee carries once it holds the licence itself, rather than the AML-registered permission to operate that sits ahead of it. A firm should not treat Regulation 18.1 compliance as the finished article; it is the floor the Act’s fuller obligations are built on top of once the full licence is granted.

About this analysis

This analysis was prepared by the CoinConnect research desk from Regulations 7.3, 8A, 11.4–11.6, 15.3(c), 17.1(a)(iv), 18.1 and 19.1(e) of the PVARA No Objection Certificate Regulations 2025, Form A6 in Annex A, and Sections 20(4) and 22 of the Virtual Assets Act 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.