What Is a "Controller" Under the Virtual Assets Act 2026? Understanding the 20% Threshold for Foreign Investors

Understanding the definition of a "Controller" under the Virtual Assets Act 2026 is fundamental for any Virtual Asset Service Provider (VASP) seeking a PVARA license in Pakistan. This designation carries significant regulatory implications, particularly for foreign investors and VASP startups structuring their ownership and governance. The Act establishes a clear 20% threshold for identifying direct or indirect control, alongside a broader criterion for significant influence over management or policies. Compliance with these provisions is paramount for successful VASP licensing and ongoing regulatory adherence within Pakistan's emerging virtual asset market.

The Virtual Assets Act, 2026, establishes the definition of a "Controller" in Section 3(1)(v). A "Controller" is defined as a Person who, alone or together with associates, holds or is entitled to exercise twenty percent (20 %) or more of the voting power, ownership interest, or share capital of a Licensee. Furthermore, this definition extends to any Person who "otherwise exercises significant influence or control over its management or policies, whether directly or indirectly," irrespective of the 20% threshold. The term "Person" encompasses both natural and legal persons, as clarified by Section 3(1)(xxii) of the Act. This broad definition ensures comprehensive regulatory oversight of entities and individuals exerting substantive influence over licensed VASPs. Controllers are explicitly included within the definition of "Insiders" under Section 3(1)(xii), alongside officers, directors, and employees of Licensees, indicating their heightened regulatory scrutiny regarding market conduct. While a "Sponsor" (Section 3(1)(xxix)) may often qualify as a Controller due to initial capital contribution or controlling shareholding, the "Controller" definition specifically outlines the 20% threshold and "significant influence" criteria, making it the definitive measure for regulatory purposes.

-   Licensees are obligated to identify and disclose all Controllers as part of their licensing application and ongoing compliance, stemming from the Authority's mandate to regulate and supervise Virtual Asset Service Providers under the Virtual Assets Act, 2026.

-   Controllers, by virtue of their classification as "Insiders" under Section 3(1)(xii), are subject to specific prohibitions concerning "Inside Information" (Section 3(1)(xi)) and "Market Manipulation or Market Abuse" (Section 3(1)(xvii)). This requires adherence to strict conduct standards to maintain market integrity.

-   The definition of "Controller" in Section 3(1)(v) explicitly includes control exercised "alone or together with associates," necessitating the disclosure of any Person acting in concert to achieve the 20% threshold or exert significant influence. This extends the identification requirement beyond direct individual holdings.

For VASPs operating or seeking to operate in Pakistan, accurately identifying and disclosing all Controllers is a critical compliance function. This requires a thorough due diligence process that extends beyond immediate shareholders to trace ultimate beneficial ownership and assess indirect influence. A common practical pitfall encountered during PVARA application filings involves the incomplete identification of indirect Controllers, particularly within complex international corporate structures. For instance, foreign entities often establish holding companies or utilize nominee arrangements, where no single entity directly holds 20% of the VASP's share capital. However, if multiple associated entities collectively meet or exceed the 20% threshold, or if a Person, through various indirect means, exercises "significant influence or control over its management or policies" as per Section 3(1)(v), they must be disclosed as Controllers. Failure to demonstrate a comprehensive understanding and disclosure of such indirect control, often required in specific sections of the PVARA application forms (e.g., a hypothetical "PVARA Form 1, Schedule B: Shareholding and Control Disclosure"), can lead to application deferrals or rejections. This necessitates a detailed legal and corporate structure analysis to ensure all individuals or entities meeting the Section 3(1)(v) criteria are properly identified and reported. Furthermore, the responsibilities of Controllers, as "Insiders" under Section 3(1)(xii), directly impact the VASP's internal governance and compliance frameworks, aligning with broader principles of **Board Accountability for AML/CFT: Why Pakistani VASP Directors Are Personally Liable for Compliance Failures**.

☐ Identify all direct and indirect shareholders holding twenty percent (20 %) or more of the voting power, ownership interest, or share capital of the Licensee, as specified in Section 3(1)(v).

☐ Assess whether any Person, alone or together with associates, exercises "significant influence or control over its management or policies," irrespective of the 20% threshold, as defined in Section 3(1)(v).

☐ Disclose all identified Controllers, including their associates and the nature of their control, in the VASP licensing application (e.g., hypothetical "PVARA Form 1, Schedule B: Shareholding and Control Disclosure").

☐ Establish and implement internal policies and procedures to prevent Controllers, as "Insiders" (Section 3(1)(xii)), from engaging in "Market Manipulation or Market Abuse" (Section 3(1)(xvii)) or misusing "Inside Information" (Section 3(1)(xi)).

☐ Maintain updated records of all Controller information and report any changes to the Authority as prescribed by Regulations.

A: Yes, Section 3(1)(v) defines a "Controller" as a "Person," and Section 3(1)(xxii) clarifies that "Person" means a natural or legal Person.

A: A "Sponsor" (Section 3(1)(xxix)) may also be a "Controller" if they meet the criteria of holding twenty percent (20 %) or more of the voting power, ownership interest, or share capital, or exercise significant influence or control over the Licensee's management or policies, as specified in Section 3(1)(v). The definitions are distinct but can overlap based on the extent of their ownership or influence.

Understanding the "Controller" definition is fundamental for PVARA compliance and VASP operational integrity. Thorough identification and disclosure are non-negotiable for regulatory approval and ongoing adherence. For assistance with PVARA licensing and Controller identification, CoinConnect provides end-to-end VASP licensing support.