PVARA Licensing Requirements: Governance, Local Substance, Capital and Fit-and-Proper Standards

Last updated: 24 August 2026

A crypto company can have excellent technology, serious investors and a strong global brand—and still be unlicensable in Pakistan.

Why? Because under Pakistan’s crypto licensing framework, PVARA is not only asking whether the platform works. It is asking who is responsible when it does not.

Who can stop a suspicious withdrawal? Who challenges the chief executive? Who proves where the capital came from? Who answers PVARA during a cyber incident? Who protects customers when commercial targets conflict with compliance?

These questions sit at the heart of the PVARA licensing requirements. The Pakistan Virtual Assets Regulatory Authority expects every licensed Virtual Asset Service Provider (VASP) to be a properly governed, adequately funded and genuinely local operating institution—not a website attached to an empty Pakistan company.

This guide explains the four requirements that most directly determine whether a Pakistan crypto licence applicant is institutionally credible: governance, local substance, paid-up capital and fit-and-proper standards.

PVARA licence requirements

• Legal entity: Company incorporated in Pakistan
• Minimum board: Three directors
• Independent directors: Ordinarily at least one-third of the board
• Local presence: Registered office and at least one resident Key Individual with operational and decision-making authority
• Compliance Officer: Senior, adequately resourced, fit and proper, and resident in Pakistan
• Controller threshold: 20% or more, or significant influence or control
• Paid-up capital: PKR 15m to PKR 500m by category
• Liquidity: Net liquid assets of at least 1.2 times adjusted monthly operating expenses

PVARA licensing requirements at a glance

To obtain and maintain a VASP licence in Pakistan, an applicant must demonstrate that it:

• is incorporated in Pakistan under the Companies Act, 2017 or another applicable incorporation law;
• has transparent shareholders, ultimate beneficial owners and controllers;
• appoints a suitably composed and competent board;
• maintains meaningful management and decision-making capacity in Pakistan;
• establishes independent compliance, AML/CFT and risk functions;
• satisfies the applicable minimum paid-up capital requirement;
• maintains sufficient liquid financial resources;
• appoints fit-and-proper controllers, sponsors, directors and Key Individuals;
• segregates duties and manages conflicts of interest;
• controls outsourcing and group dependencies; and
• continues meeting these conditions after the licence is granted.

PVARA summarises its requirements on its official licensing page, while the detailed obligations appear in the Pakistan Virtual Asset Services Regulations, 2026.

The last point is crucial. These are not entry requirements discarded after approval. Capital, fitness and propriety, local presence, governance, insurance and systems must be maintained throughout the life of the licence.

Requirement 1: A transparent ownership and control structure

Before looking at the board, Pakistan crypto licence for foreign companies and PVARA will look through the company.

Regulation 18 requires a transparent ownership and control structure showing the complete chain of ownership, voting rights, ultimate beneficial owners, persons acting in concert and any other arrangements through which control is exercised.

Under section 3 of the Virtual Assets Act, 2026, a Controller is generally a person who, alone or with associates:

• holds or can exercise at least 20% of the voting power;
• owns at least 20% of the ownership interest or share capital; or
• otherwise exercises significant influence or control over management or policy.

The final limb matters. A person may be a Controller without appearing as a 20% shareholder. Veto rights, board-appointment rights, shareholder agreements, funding conditions, management contracts or informal influence can create control.

What PVARA expects to see

An applicant should be able to produce:

• a legal ownership chart and group structure chart;
• registers of shareholders and ultimate beneficial owners;
• constitutional documents and shareholder agreements;
• voting, reserved-matter and board-appointment rights;
• details of nominees, trusts, foundations or persons acting in concert;
• source-of-funds and source-of-wealth evidence;
• corporate records for body-corporate shareholders; and
• regulatory history across the wider group.

PVARA may assess the corporate behaviour of a body-corporate Controller and the integrity and track record of its ultimate beneficial owners. Placing a holding company between the VASP and a controversial owner does not remove the underlying assessment.

Changes of control require prior approval

Regulation 19 prohibits a change of control without PVARA’s prior approval. A fundraising round, restructuring, share transfer, conversion of an instrument or new veto right should therefore be analysed before it becomes legally effective.

The common mistake is to treat a change of control as ordinary company administration and notify the regulator afterwards. Under a regulated structure, the transaction timetable should contain a PVARA approval condition.

Requirement 2: Effective VASP governance

PVARA governance requirements begin with the board but extend through the entire control environment.

Minimum board composition

Regulation 20 requires at least three directors. Unless PVARA specifies otherwise based on the VASP’s nature, scale, complexity and risk profile, independent directors must comprise at least one-third of the board.

For a three-person board, that ordinarily means at least one independent director. Simply calling someone independent is not enough. The person must be free from relationships, interests and influences that could impair objective judgement.

PVARA can permit a lower proportion for a limited-scope licence or small board where equivalent independent challenge is achieved through acceptable alternatives, such as board committees or external advisers. Applicants should not assume that exception applies without regulatory acceptance.

Collective competence of the board

The board must collectively understand the VASP’s business and risks. Regulation 20(5) specifically refers to competence in:

• risk management;
• technology and cybersecurity;
• financial crime compliance; and
• the virtual asset services provided.

A board composed entirely of investors or commercial founders may therefore be insufficient, even if every member is individually successful. The skills matrix should show who provides regulatory, financial, technical, cyber, operational and customer-protection challenge.

The board remains ultimately responsible

Under regulation 21, the board has overall responsibility for governance, oversight and regulatory compliance. Its responsibilities include:

• internal controls and enterprise risk management;
• operational resilience and cybersecurity;
• AML/CFT/CPF and market-integrity controls;
• customer-asset safeguarding and segregation;
• oversight of outsourcing and service providers;
• recordkeeping and regulatory reporting; and
• remediation of material weaknesses.

The board may delegate work to a committee or Key Individual, but it cannot delegate ultimate accountability. “Our compliance vendor handles that” is not an adequate board answer.

Directors must receive induction and continuing training, and the VASP must periodically assess board and committee effectiveness under regulation 22.

Governance must exist below the board

A credible governance framework should contain:

• a documented organisational chart;
• clear reporting and escalation lines;
• board and committee terms of reference;
• a schedule of reserved matters;
• management responsibility statements;
• management and board information packs;
• risk appetite and risk registers;
• compliance and internal-control monitoring;
• conflicts and related-party registers;
• outsourcing oversight; and
• recorded decisions, challenges and remediation.

The aim is not to create committees for decoration. It is to make sure every important risk has an accountable owner and an effective route to the board.

Segregation of duties

Regulation 26 requires separation between revenue-generating functions and control functions such as compliance, risk and internal audit. Operational duties—including sales, dealing, accounting, settlement, reconciliation and custody—must also be separated sufficiently to reduce error, abuse and conflicts.

Smaller applicants may use compensating controls where full separation by personnel is impractical. Dual approvals, independent checks, enhanced supervision and more frequent reviews may help.

One individual should not be able to create a wallet address, approve a transfer and reconcile the same transaction without independent oversight.

Conflicts, personal dealing and related parties

PVARA expects written arrangements for identifying, preventing, managing and disclosing conflicts. Regulation 27 specifically contemplates conflicts arising from proprietary trading, remuneration, group structures, token listings, issuance and referrals.

The VASP must maintain a conflicts register. A director or Key Individual with a material interest must declare it, recuse themselves and avoid influencing the decision.

Personal virtual asset dealing by directors, Key Individuals and relevant employees must be controlled through measures such as pre-clearance, restricted lists, closed periods and monitoring.

Material related-party transactions must be on arm’s-length terms, approved by the board or an independent committee, recorded and reported to PVARA quarterly under regulation 30.

Requirement 3: Genuine local substance in Pakistan

The words “local substance” do not appear as a single checklist in the regulations, but the requirement emerges clearly from the legal-entity, local-presence, governance and staffing obligations. So the question arises, do you need a PVARA licence? 

Pakistan-incorporated company

The full licence applicant must be a company incorporated in Pakistan. A foreign parent’s overseas crypto licence does not authorise its Pakistan activities, and a branch name or representative office does not replace the licensed operating company required by the framework.

The Pakistan company should have constitutional objects, contracts, capital and operations consistent with its PVARA permissions.

Registered office and resident authority

Regulation 10(4) requires:

1. a registered office in Pakistan; and
2. at least one Key Individual resident in Pakistan who has operational and decision-making authority and is accountable to PVARA for regulatory compliance.

PVARA may require more resident officers based on the nature, scale, complexity and risk of the business.

This is more than an address-and-visa test. A resident executive who must seek overseas permission for every customer, compliance or incident decision may not demonstrate meaningful authority.

Resident Compliance Officer

Regulations 23 and 81 require an independent compliance function and a resident Compliance Officer who is:

• fit and proper;
• sufficiently senior;
• appropriately qualified and experienced;
• adequately resourced;
• able to access relevant information and personnel;
• independent from revenue generation; and
• able to report directly to the board or a responsible board committee.

The Compliance Officer should ordinarily be a full-time employee unless PVARA permits another arrangement based on the business’s nature, scale and complexity.

MLRO and other Key Individuals

The VASP must appoint an MLRO with adequate AML/CFT/CPF knowledge, seniority and authority. The MLRO requires direct board access and unfettered access to relevant records, systems and personnel.

Other functions—finance, risk, operations, custody, information security and internal audit—must be staffed according to the business model. Not every applicant needs a separate individual for every title, but combined roles must not create conflicts or undermine independence.

What local substance looks like in practice

PVARA may examine where the following activities actually occur:

• customer onboarding and approval;
• sanctions and transaction-monitoring escalation;
• suspicious-transaction reporting;
• wallet and key-management decisions;
• product and token-listing approval;
• complaint handling;
• cyber-incident response;
• regulatory reporting;
• finance, reconciliation and capital monitoring; and
• vendor and outsourcing oversight.

A global group can provide technology, custody tools, analytics or shared services, but the Pakistan licensee must retain control, information access and accountability.

Evidence of substance may include employment contracts, job descriptions, delegated-authority matrices, board minutes, office arrangements, local system access, incident playbooks, committee packs and examples of decisions taken in Pakistan.

Requirement 4: PVARA paid-up capital and liquidity

The minimum capital for a crypto licence in Pakistan depends on the licensed activity.

Capital is not a licence fee

Paid-up capital belongs to the licensed Pakistan company and must be maintained at all times under regulation 31. It is not paid to PVARA and should not be confused with processing, licensing, supervisory or renewal fees.

Our regulatory compliance advisory services state that the licence application requires evidence that capital has been injected and maintained in the applicant’s Pakistan bank account or through arrangements accepted by PVARA. The source and availability of the funds must be documented.

Borrowed, temporarily parked, circularly transferred or encumbered funds may fail to demonstrate genuine financial resources. The applicant should preserve bank statements, transfer evidence, funding resolutions, shareholder financial information and source-of-funds records.

Multiple licence categories

Holding several categories does not automatically require adding every capital figure together. Under regulation 32, the general prudential floor is the highest requirement applicable to the categories held unless another activity creates a separate and non-overlapping risk requiring an additional amount.

Regulation 31 also permits PVARA to impose a risk-based methodology or prudential add-ons for custody, operational, technology, market or cross-border risk.

Applicants should therefore avoid promising investors that the highest table amount will always be the final capital requirement.

Net liquid assets

Paid-up capital is only one layer of the prudential framework. Regulation 32 requires net liquid assets equal to at least 1.2 times adjusted monthly operating expenses.

Net liquid assets are eligible liquid assets minus current liabilities. Eligible assets must be readily convertible into cash within a short period without material discount and remain subject to PVARA limits, haircuts and concentration thresholds.

Qualifying paid-up capital held in eligible liquid assets may count towards the liquidity requirement. Capital locked into illiquid equipment, group receivables or speculative assets may not provide the same prudential value.

Capital is separate from customer assets and token reserves

Customer money and virtual assets are not regulatory capital. They must be segregated and safeguarded and cannot be used to fund the VASP’s obligations.

Likewise, issuers of Fiat-Referenced and Asset-Referenced Tokens must maintain reserve assets equal to 100% of outstanding redemption liabilities under regulation 34. Those reserves are separate from the issuer’s PKR 300 million paid-up capital requirement.

Insurance and ongoing monitoring

Regulation 36 requires insurance proportionate to the VASP’s activities and risks. PVARA may specify professional indemnity, commercial crime or fidelity, cyber-risk and other coverage, including limits and deductibles.

Insurance should ordinarily be obtained from an insurer authorised in Pakistan unless PVARA permits otherwise. Coverage changes, lapses, cancellations and non-renewals must be notified, and insurance must not be marketed as a guarantee that every customer loss will be repaid.

Licensees must monitor capital and liquidity continuously, disclose funding and liquidity sources to PVARA monthly, stress-test their position and notify PVARA without delay of an actual or anticipated breach. A remedial plan may also be required.

Requirement 5: PVARA fit-and-proper standards

Our corporate structuring services for crypto and Web3 businesses state that the PVARA fit-and-proper test asks whether the people controlling and managing the VASP can be trusted and are capable of performing their roles.

Schedule II applies to:

• individual or corporate Controllers;
• sponsors;
• directors;
• the Managing Director or CEO; and
• Key Individuals.

The assessment is proportionate to the role and business, but it focuses on four broad pillars.

Integrity and track record

PVARA considers criminal convictions, fraud, breach of trust, financial or business misconduct, money laundering, terrorist financing, market abuse, regulatory findings, ongoing investigations, director disqualification and involvement in businesses that failed through mismanagement or malpractice.

Applicants should disclose matters inside and outside Pakistan. PVARA can consider decisions of foreign regulators and the condition of other businesses with which the person is involved.

An investigation does not necessarily produce the same outcome as a conviction, but failing to disclose it can create a separate integrity concern.

Financial soundness

The assessment may consider tax status, loan defaults, overdue amounts in credit reports, write-offs, insolvency and bankruptcy. Controllers and major shareholders must have disclosed and verifiable financial resources.

This is not a wealth competition. PVARA is testing whether financial history creates concerns about reliability, pressure, improper funding or the ability to support the licensed business.

Professional competence and experience

Schedule II contains specific expectations:

• directors should generally have at least five years of senior management or business experience, although the condition does not apply to sponsor directors;
• directors should have knowledge or experience in relevant fields such as finance, banking, accounting, law or information technology;
• the Managing Director should have a relevant master’s degree or recognised professional qualification;
• the Managing Director should have senior financial or technology experience, including at least two years relating to blockchain, virtual assets or associated services;
• an Executive Director should have a relevant master’s degree or recognised professional qualification and at least one year of relevant virtual asset experience; and
• other Key Individuals should possess relevant qualifications and senior-level experience.

PVARA may interview the Managing Director where it is not satisfied that the documented criteria demonstrate suitability.

Conflicts of interest

Controllers, sponsors, directors, the Managing Director and Key Individuals must identify, manage and disclose conflicts and act in the interests of customers and the VASP.

Outside directorships, ownership in counterparties, token investments, group incentives, vendor relationships and personal trading can all be relevant. Disclosure is only the first step; the conflict may require recusal, independent approval, information barriers, restriction or divestment.

Who requires PVARA approval?

Controllers, sponsors, the Managing Director and directors must be fit and proper and approved by PVARA. Regulation 20(7) provides a 30-Business-Day decision period after receipt of a complete approval application, subject to specified outstanding information or external-regulator checks.

A proposed director or Managing Director should not assume office before approval.

Other Key Individuals do not generally require separate prior approval under Schedule II(4), but the VASP must assess and ensure their fitness and propriety at appointment and throughout their service. PVARA may request information and can take action where suitability is inadequate.

Fit-and-proper status is perpetual. A relevant person must report a change to the Company Secretary within three business days; the Company Secretary must report it to PVARA within seven business days of receipt.

If a person ceases to satisfy the criteria, the board must stop them performing the role, inform PVARA and begin replacement.

Evidence for the fit-and-proper assessment

A well-prepared evidence pack may include:

• identity, nationality and residential-address documents;
• detailed curriculum vitae and ten-year employment history;
• academic and professional qualifications;
• employment and regulatory references;
• police or criminal-record certificates where required;
• litigation, investigation and enforcement declarations;
• directorship and business-interest schedule;
• insolvency, bankruptcy and credit information;
• active-taxpayer and financial-soundness evidence;
• net-worth, source-of-wealth and source-of-funds documents;
• sanctions and designated-person screening;
• conflicts-of-interest declarations; and
• the prescribed affidavit under Annexure A.

Cross-check every document. Dates, job titles, ownership percentages and disclosures should be consistent across the CV, application form, affidavit, corporate records and public profiles.

How the four requirements work together

Governance, substance, capital and fitness are not separate boxes. They reinforce one another.

A company may meet the PKR 500 million Exchange Services capital floor but fail because its funding source is unclear. It may appoint three directors but fail because none can challenge technology or AML risks. It may hire a resident Compliance Officer but fail to give that person information or authority. It may have a famous foreign parent but fail to demonstrate that the Pakistan VASP makes meaningful decisions locally.

PVARA is ultimately looking for a coherent institution:

• transparent people own and control it;
• competent people direct and manage it;
• local people can make and escalate decisions;
• independent functions can challenge revenue teams;
• genuine capital absorbs business losses;
• liquid resources meet obligations under stress; and
• evidence proves the framework works in practice.

Common mistakes

1. Using nominee leadership. Resident personnel hold titles but lack authority.
2. Selecting directors for reputation alone. The board lacks the combined skills required by the business.
3. Treating independence as a label. Commercial, family or group relationships undermine objective challenge.
4. Injecting capital temporarily. Funds are withdrawn, encumbered or returned after being evidenced.
5. Confusing customer assets with company resources. Segregated customer property cannot finance the VASP.
6. Hiding historic issues. A late-discovered investigation or insolvency damages trust.
7. Outsourcing responsibility. Group entities and vendors operate critical functions without effective Pakistan oversight.
8. Ignoring post-licence changes. Ownership, roles, conflicts or financial resources change without approval or notification.

Final word

The strongest Pakistan VASP is not the company with the most impressive organisational chart. It is the company where the chart reflects reality.

Directors understand the risks. The Compliance Officer can challenge the business. Local management can act without waiting for another time zone. Capital is genuine and available. Owners are transparent. Difficult facts are disclosed. Decisions leave an evidence trail.

That is what PVARA’s governance, local substance, capital and fit-and-proper standards are designed to achieve: a virtual asset business that remains accountable when the market is volatile, a system fails or commercial pressure is at its highest. Speak with our Pakistan crypto licensing team and know more!

Legal disclaimer: This article provides general information as at 24 August 2026 and does not constitute legal, regulatory, tax, financial or investment advice. PVARA may issue further rules, directions, standards or interpretations, and the requirements applicable to a VASP depend on its activities, scale, ownership and risk profile. Applicants and licensees should obtain professional advice and confirm current requirements directly with PVARA and other relevant authorities.

FAQs