When PVARA Can Revoke Your NOC

A No Objection Certificate is not a permanent status. It is a conditional permission, tied to continued compliance and continued progress toward a full licence, and PVARA can take it away.

Regulation 19 of the PVARA No Objection Certificate Regulations 2025 sets out exactly when that can happen and, separately, how the Authority is expected to weigh the decision once a ground is made out. This piece works through both parts.

What can cause PVARA to revoke an NOC?

Regulation 19.1 lists five grounds on which the Authority “may revoke an Applicant’s NOC, including AML Registration status”. The Regulations state them as follows:

“19.1 The Authority may revoke an Applicant’s NOC, including AML Registration status, where: (a) the Applicant has provided false, misleading or incomplete information; (b) the Applicant has breached AML/CFT obligations; (c) any Key Individual ceases to satisfy Fit and Proper requirements; (d) systemic or material AML/CFT failures occur; and/or (e) failure to apply for or progress toward obtaining a full VASP License within the prescribed period.”

Two drafting points shape how these five grounds should be read together. First, revocation reaches “AML Registration status” as well as the NOC itself — the two are treated as a single package, consistent with Regulation 2.2, which defines the NOC as satisfying both AML registration on the goAML portal and pre-incorporation clearance in one grant. Losing the NOC therefore also removes the permission to provide AML-Registered Services. Second, the connector before ground (e) is “and/or” rather than “or” — the Regulations treat the five grounds as independently sufficient, any one of which can support revocation on its own, rather than requiring the Authority to find a combination.

What does “false, misleading or incomplete information” cover?

Ground (a) reaches the application itself and everything submitted alongside it — Form A1 and its accompanying documentation, Form A2 Controller and beneficial owner disclosures, Form A3 fit-and-proper questionnaires, and Form A4’s AML/CFT framework submission statement. The Declaration section of Form A1 makes the consequence explicit at the point of signing: the Applicant confirms understanding that “providing false, misleading or incomplete information may result in refusal of AML Registration, revocation of any approval granted, and/or regulatory or legal action by PVARA, FMU or other competent authorities.”

The word “incomplete” is doing real work here — this ground does not require an active misstatement. Leaving out material information, even without an intent to deceive, falls within the same ground as a deliberate falsehood. Our reading is that this is why Regulation 18.1(b)’s ongoing notification duty — covered in our companion piece on ongoing obligations after an NOC — matters so much in practice: a gap that goes uncorrected can convert what started as an omission into a standing state of incompleteness.

What counts as a breach of AML/CFT obligations, and how is that different from a “systemic or material” failure?

Ground (b) and ground (d) sit close together but are not the same test. Ground (b) — “breached AML/CFT obligations” — is the general standard, covering any failure to meet the Part 4 AML/CFT framework requirements: customer due diligence, enhanced due diligence, targeted financial sanctions screening, transaction monitoring, STR and CTR filing, recordkeeping, and the outsourcing controls in Regulation 14. Ground (d) — “systemic or material AML/CFT failures” — reads as a narrower, more serious category within the same subject matter, distinguished by scale or significance rather than by the type of obligation breached.

The Regulations do not define where a breach under ground (b) becomes systemic or material under ground (d). In practice, this line is likely to be judged by the Authority against the risk-based standard set in Regulation 8.1, which requires the AML/CFT framework to be “proportionate to its business activities and operational complexity” — a failure that undermines that proportionate framework at a structural level looks closer to ground (d) than a single missed filing does. Where guidance on this distinction has not been published, that is a gap PVARA would need to fill through decisions rather than the text itself.

Does one Key Individual’s problem put the whole NOC at risk?

Ground (c) attaches revocation risk to an individual’s continuing fitness and propriety, not only to the entity’s own conduct. This connects directly to Section 20(4) of the Virtual Assets Act 2026, which makes fit-and-proper a continuing obligation and requires any person subject to the criteria to “notify the Authority of any matter that may affect their fitness and propriety.” Regulation 6.3 of the NOC Regulations sets the three grounds that disqualify a person from serving as a Key Individual outright: conviction of an offence involving dishonesty, fraud, financial misconduct, the AML Act 2010, or the Virtual Assets Act itself; being sanctioned by any regulator in Pakistan or abroad; or being subject to unresolved bankruptcy or insolvency proceedings.

Because ground (c) is framed at the level of the individual, our reading — reinforced by the proportionality principle discussed below — is that PVARA has room to address a single Key Individual’s disqualification through replacement, using Form A8, rather than moving straight to revoking the entire NOC, where the problem is confined to that individual and does not implicate the Controller tier or the entity’s own governance.

What is the proportionality principle, and what does it change?

Regulation 19.2 sits immediately after the five grounds and qualifies how the Authority must apply them:

“19.2 Revocation shall be applied proportionately, taking into account the severity and impact of the breach.”

This is a meaningful constraint on an otherwise broad power. It means establishing one of the five grounds under Regulation 19.1 is necessary but not automatically sufficient for revocation — the Authority is directed to weigh how serious the breach was and what effect it had before deciding that revocation, rather than a lesser response, is the right outcome. The Regulations do not spell out what those lesser responses are, but the broader framework points to obvious alternatives: a direction to remedy a specific failure, a requirement to replace a Key Individual, or a demand for additional information or independent audit under Regulation 18.1(d).

Does the Virtual Assets Act give PVARA the same power over a full licence?

Yes, in substance, though the drafting differs. Section 23(1) of the Act allows the Authority to “vary, suspend or revoke a license” on five grounds of its own: contravention of the Act, other laws or licence conditions; insolvency or no longer meeting fit-and-proper criteria; ceasing to carry on the licensed service; public interest, including consumer protection, market integrity or financial stability; and a licence obtained by fraud, misrepresentation or concealment of material facts. Unlike Regulation 19.2, Section 23 does not state an explicit proportionality test — though it does require the Authority to act “by way of written notice and after providing an opportunity of being heard” before varying, suspending or revoking, which builds procedural fairness into the decision even without a stated proportionality standard.

The two revocation regimes cover the same broad territory — false information, AML failure, fit-and-proper lapses, and a version of “no genuine progress” — but they attach to different instruments at different stages of the VASP licence lifecycle: the NOC and AML Registration under the NOC Regulations, and the full licence under the Act.

What happens to a firm once its NOC is revoked?

The NOC Regulations do not set out a specific wind-down procedure for a revoked NOC in the way Section 23(2) of the Act does for a revoked full licence — which requires the Licensee to “immediately cease the provision of Virtual Asset Services” and allows PVARA to notify the Securities and Exchange Commission of Pakistan to initiate winding-up. Because Regulation 2.2 treats NOC and AML Registration as a single package, revocation of the NOC removes the legal basis for providing any AML-Registered Service — broker-dealer, custody, exchange or derivatives services — even though the Regulations do not spell out the mechanics of ceasing operations in the same detail the Act provides for a full licence. Where that gap exists in the published text, a firm facing revocation should treat the practical consequence as the same as losing a full licence — an immediate stop to regulated activity — and confirm the precise procedural next steps directly with the Authority rather than assume silence in the Regulations means less exposure.

About this analysis

This analysis was prepared by the CoinConnect research desk from Regulations 2.2, 6.3, 8.1, 14, 18.1(d) and 19.1–19.2 of the PVARA No Objection Certificate Regulations 2025, Form A1’s declaration section, and Sections 20(4) and 23 of the Virtual Assets Act 2026, read as published. Where practice is not yet settled or guidance has not been issued, that is stated in the text above.

Regulatory positions change and specific requirements should be verified against the current position published by the relevant authority before you act on them. This is information and analysis, not legal advice, and it does not create an advisory relationship. Take professional advice on your own circumstances.