Huzaima Bukhari, Dr. Ikramul Haq & Abdul Rauf Shakoori
Introduction of the ‘No Objection Certificate Regulations 2025’ [“the Regulations] shows a significant step towards Pakistan’s broader policy ambition of placing virtual assets within a formal regulatory perimeter. Development of a dedicated path for Anti Money Laundering (AML) registration and the authorization of AML Registered Services, indicate that Pakistan now recognizes the size and strategic potential of its domestic crypto ecosystem, which has remained active despite regulatory uncertainty and the absence of a licensing structure.
The formalization of a structured no objection certificate regime lays the foundation for controlled innovation, market discipline and technology aligned commercial activity that could substantially enhance fiscal revenues, attract foreign investment and develop supervisory capacity in an industry that otherwise operates informally.
The regulatory direction is also aligned with Pakistan’s considerable potential as a technology and digitally enabled economy, where a large youth population, high levels of crypto adoption and rapid expansion of fintech participation create conditions for responsible virtual asset markets.
Although the domestic economy has consistently ranked among the world’s largest emerging crypto markets by user participation, this activity has not translated into formal revenue streams, tax collection or financial sector development because of the absence of legal clarity.
The newly issued Regulations now provide an opportunity for Pakistan to allow compliant operators to enter the market lawfully, support AML integration with the Financial Monitoring Unit (FMU), and create an evidence-based revenue architecture through licensing, reporting and supervision. The Government can therefore use the NOC framework as an early gatekeeping instrument, ensuring that only serious, financially capable and globally compliant firms participate in Pakistan’s virtual asset economy.
Issuance of Regulations by the Licensing and Supervision Division of Pakistan Virtual Asset Regulation Authority [PVARA] represents the first binding mechanism under the Virtual Assets Ordinance 2025 [VAO 2025] for permitting an applicant to register for AML purposes, incorporate locally and subsequently apply for a full Virtual Asset Service Provider (VASP) license.
The Regulations require every virtual asset service provider seeking an NOC to demonstrate fitness and propriety of controllers and key individuals, establishment of a complete Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework, capability to integrate with the goAML [United Nations Office of Drugs & Crime (NODC) Software Products] platform. It must also maintain governance and compliance structures proportionate to the nature and scale of operations.
The structure reflects a phased model that allows the provision of AML Registered Services only after registration and before full licensing under section 17 of the VAO 2025, thereby introducing a controlled onboarding model that resembles international practices in jurisdictions such as the UAE and Singapore.
The Regulations establish that broker dealer services, custody services, exchange services and virtual asset derivative services will be treated as non-financial businesses and professions for purposes of AML registration under section 38 of the VAO 2025. This treatment ensures that all core virtual asset activities that pose elevated money laundering or terrorist financing risks remain within the formal reporting perimeter from the initial stage of market entry.
The approach is consistent with the Financial Action Task Force (FATF) recommendations, which require licensing or registration of all VASPs subjecting them to effective systems for monitoring and compliance. The Pakistani framework therefore adopts the correct global baseline, although its practical impact will depend heavily on supervisory capacity, technology absorption and the consistent application of proportionate oversight.
The Regulations impose detailed governance obligations, requiring a full suite of key individuals including chief executive officer, chief financial officer, compliance officer, money laundering reporting officer (MLRO), head of internal audit, head of risk management and head of information security. These mandatory roles align with international regulatory practices in advanced jurisdictions including the Monetary Authority of Singapore, the Dubai Virtual Assets Regulatory Authority and the European Union’s Markets in Crypto Assets Regulation.
The Pakistani regime correctly incorporates integrity, competence, independence and financial soundness criteria, but the Regulations do not yet provide granular guidance on experience thresholds, local presence requirements or residency conditions for key individuals, which may create interpretive inconsistencies and hinder uniform supervisory application.
The Regulations establish stringent requirements for ownership transparency by defining controllers as persons holding twenty percent or more of voting power or share capital and mandating disclosure of beneficial owners in accordance with the Anti Money Laundering Act, 2010. The requirement for controller approval prior to AML registration is well aligned with the recommendations of the FATF concerning beneficial ownership transparency. The gap arises where the Regulations acknowledge that controller thresholds will be determined by PVARA in future, which creates legal ambiguity and may discourage potential investors.
Introduction of a clear multi-tier control regime like the European Union and the United Kingdom would enhance certainty and prevent division of interpretation. The AML-CFT requirements in the Regulations are comprehensive reflecting all mandatory elements expected under FATF Recommendation 15, including customer due diligence, enhanced due diligence, targeted financial sanctions screening, transaction monitoring, suspicious activity reporting, enterprise risk assessment and retention of records for seven years.
The Regulations also require documented internal procedures, outsourcing oversight and technical capacity for goAML integration, which align with global norms. The present framework is therefore robust, but the Regulations provide limited guidance on blockchain analytic standards, wallet screening criteria and typology aligned monitoring rules, which are now mandated in advanced VASP jurisdictions. The Government should consider incorporating these elements through either a secondary rulemaking instrument or supervisory guidelines.
The application process under the Regulations requires submission of Form A1 together with a complete AML CFT framework, governance documents, beneficial ownership disclosures and technology architecture details. The Authority is required to assess readiness within sixty days and may conduct interviews, inspections and further information requests.
The model is administratively sound but would benefit from statutory service level guarantees to ensure that processing timelines remain predictable and do not deter market entry. The Regulations should also consider a sandbox based fast track mechanism for low-risk models, consistent with practices in Hong Kong and Japan.
An international comparison indicates that the Pakistani regime aligns with the core elements of FATF Recommendation 15 and broadly resembles regulatory frameworks in the UAE, Singapore and the European Union. Inclusion of controller approval, fit and proper tests, full AML-CFT frameworks, reporting obligations, outsourcing controls and governance structures align with global norms.
The deviation emerges in areas including prudential requirements, operational resilience, disclosure obligations, cybersecurity standards, safeguarding of customer assets and cross border supervisory cooperation, which are expressly provided in mature jurisdictions, absence of which may create vulnerabilities, particularly in custody and exchange services where operational and cyber risks are elevated.
The Regulations present several policy gaps that require attention. No mention of capital adequacy requirements at the NOC stage and that of prudential buffers for AML Registered Services may expose customers and regulators to operators with limited financial resilience.
The absence of mandatory segregation of customer assets, safeguarding requirements and asset recovery rules create challenges in scenarios of insolvency or platform failure. The Regulations do not specify travel rule implementation thresholds or wallet screening protocols, despite these being FATF mandatory requirements.
The Regulations also do not prescribe timelines for transitioning from NOC to full license or consequences for delays beyond revocation, which may allow operators to continue indefinitely under provisional status.
The Government should therefore consider several policy recommendations. Introduction of capital thresholds, minimum safeguarding standards and operational resilience obligations would strengthen customer protection and align Pakistan with the European and Singaporean approach.
Adopting specific requirements for blockchain analytics, travel rule compliance and wallet screening would ensure harmonization with FATF expectations. Inclusion of residency requirements for key individuals and mandatory local presence for MLRO and compliance functions would enhance supervisory effectiveness.
Issuance of supervisory guidelines on risk-based monitoring, sanctions screening, technology outsourcing and governance evaluation would create uniform interpretation and reduce regulatory uncertainty. The establishment of a specialized supervisory unit within PVARA supported by FMU, Security & Exchange Commission (SECP) and State Bank of Pakistan (SBP) technical units would further strengthen oversight.
Introducing ‘No Objection Certificate Regulations 2025’ therefore provides a meaningful regulatory baseline for Pakistan’s transition towards a compliant and investment enabling virtual asset market. The framework requires enhancements to match international best practices, yet it delivers a structured, lawful and supervised framework for market entry.
The Government should now use this opportunity to strengthen enforcement capacity, introduce complementary rules and ensure coordinated implementation so that Pakistan can secure revenue, attract investment and establish itself as a responsible and competitive jurisdiction for virtual asset activity.
_____________________________________________________________________
Huzaima Bukhari & Dr. Ikramul Haq, lawyers and partners of Huzaima & Ikram, are Adjunct Faculty at Lahore University of Management Sciences (LUMS), members Advisory Board and Visiting Senior Fellows of Pakistan Institute of Development Economics (PIDE). Abdul Rauf Shakoori is a corporate lawyer. They have coauthored a book, Pakistan Tackling FATF: Challenges and Solutions