TL;DR. PVARA's No Objection Certificate is the easy part. Phase 2 — the 6 to 12 month operational gauntlet between NOC grant and a working Pakistan VASP licence — is where roughly 40% of NOC holders will stall, fail, or quietly exit. This article maps the five specific chokepoints where the failures will happen, names the structural risks PVARA has not yet addressed, defends the 40% projection against comparable global jurisdictions, and gives you a 10-question self-assessment checklist to know whether your exchange is in the 60% who survive Phase 2 — or the 40% who don't.
1. The Misleading Optimism of the NOC stage
Receiving a PVARA No Objection Certificate feels like the hard part is done. It isn't. The NOC is a regulatory clearance to begin work, not a licence to operate. PVARA's own Regulation 15.4 of the No Objection Certificate Regulations 2025 frames it precisely: the NOC functions as pre-incorporation regulatory clearance — meaning it gives you permission to start the real Phase 2 work of incorporating, banking, and operationalising your AML/CFT systems. Each of those Phase 2 milestones has independent failure modes that the NOC itself does not protect against.
Most foreign exchanges entering Pakistan in 2026 will treat the NOC as 80% of the work. Our analysis of comparable VASP regulatory frameworks — Singapore's MAS Payment Services Act, Dubai's VARA, the EU's MiCA, and Hong Kong's SFC VASP regime — shows that the post-provisional-approval phase consistently produces 30 to 50% attrition between provisional approval and full operational launch. Pakistan's framework is structurally tighter than several of these comparables for reasons we will detail below, so we estimate the
Phase 2 failure rate in the 40% range for the cohort of NOC holders granted between December 2025 and June 2026.
Phase 2 failure rate in the 40% range for the cohort of NOC holders granted between December 2025 and June 2026.
Important framing: this is not a PVARA statistic. PVARA has issued no such projection and does not publish failure rates. The 40% is CoinConnect's analytical projection, defended in Section 7 of this article with comparable-jurisdiction data. We mention this upfront because we have seen the figure repeated without context, and the projection only holds up under the specific assumptions we lay out. Read the workings before quoting the number.
2. Defining Phase 2 — What The Term Actually Means
PVARA's regulations do not formally use the term Phase 2. We use it as operational shorthand for the gap between NOC grant and the issuance of a full VASP licence. During this period, the NOC holder must complete six independent milestones across four different regulators.
| Phase 2 Milestone | Regulator | Realistic Timeline | Independent Failure Risk |
|---|---|---|---|
| Local entity incorporation | SECP | 60–90 days | Low (10–15%) |
| Fit & Proper sign-off — all 7 Key Individuals | PVARA | 30–90 days | Medium (15–25%) |
| FMU goAML registration | FMU | 30–60 days | Low–Medium (10–20%) |
| Corporate banking + Client Money Account opening | SBP-regulated banks | 90–180 days | HIGH (35–50%) |
| Sharia compliance board appointment & product review | PVARA Sharia Advisory Committee | 60–120 days | Medium (15–25%) |
| Full VASP licensing application | PVARA Regs | Pending full Licensing | Unknown — first cohort effect |
The compounding probability problem is what produces the 40% projection. Even if each milestone independently succeeds at the rate above, the joint probability of all six milestones clearing in sequence within 12 months is significantly lower than any individual milestone's success rate. If you multiply the success rates conservatively (say, 88% × 80% × 85% × 60% × 80% × 80%), the joint success probability lands in the 25–30% range — meaning Phase 2 failure rates in the 70%+ range, on a strict reading of the math.
We've moderated our projection to 40% on the understanding that some milestones run in parallel (incorporation and Fit & Proper, for example), some failures are recoverable rather than terminal, and the most diligent operators will pre-stage several milestones before NOC. The 40% reflects a realistic mid-case, not a worst-case multiplication of independent probabilities. For the full sequence of post-NOC milestones, see the master playbook at pvara-guide.
3. The Five Chokepoints — Where The 40% Actually Fails
Chokepoint 1 — Fit & Proper documentation collapse
This is the most under-estimated failure mode, and the one we see foreign exchanges hit hardest in the first 90 days post-NOC. PVARA's Fit & Proper Test, set out in Form A3 of the NOC Regulations 2025, is not a tickbox exercise. Each of the seven Key Individuals — CEO, CFO, Compliance Officer, MLRO, Head of Internal Audit, Head of Risk Management, Head of Information Security — must submit certified documentation including:
⦁ Full employment history with reference letters from prior employers spanning at least the last 10 years
⦁ Educational certificates, notarised, with foreign certificates apostilled under the Hague Convention or equivalent
⦁ Criminal record clearances from every country of residence in the last 10 years (not just country of citizenship)
⦁ Bankruptcy and insolvency searches for the same 10-year window, plus credit reports
⦁ Professional licences and disciplinary records from all professional bodies the individual has been registered with
⦁ Sanctions screening confirmations against OFAC, UN, EU, UK, and Pakistan's domestic TFS list
⦁ Politically Exposed Person status declarations including disclosures for spouse, immediate family, and close associates
⦁ Source of funds disclosure if the individual is also a Controller (defined as ≥20% voting power or share capital under the NOC Regulations)
Where exchanges fail: a single Key Individual with a regulatory blemish in their history — even a closed, settled matter from seven or eight years ago — can derail the entire application. PVARA's Fit & Proper integrity test is binary, not graduated. One Key Individual fails the integrity standard, and the entire application is paused until that role is replaced. Replacing a Compliance Officer or MLRO mid-application typically adds 60 to 90 days of fresh documentation cycles, because the replacement also has to complete the entire Form A3 process from scratch.
The 6 to 9 month preparation rule. Industry guidance is to begin Fit & Proper documentation collection 6 to 9 months before NOC submission, not after. Exchanges that started documentation post-NOC-grant typically slip 4 to 6 months on this milestone alone. By the time the documentation gap is closed, the exchange has burned half of its Phase 2 budget without making progress on the other four chokepoints. For a deeper dive on the Form A3 mechanics, see our companion analysis at [link to /blog/resident-director-pvara-pakistan].
Chokepoint 2 — Banking application stalls
This will be the single largest cause of Phase 2 failure across the 2026 cohort. Under the State Bank of Pakistan's April 2026 VASP banking circular, banks may now open accounts for PVARA-licensed VASPs and Client Money Accounts for authorised transactions — ending the eight-year crypto banking ban that had been in place since the 2018 BPRD circular. But the operational reality is that as of mid-2026, only a handful of Pakistani banks have established internal frameworks for crypto VASP onboarding. Most banks will quietly decline.
The successful banking-onboarding playbook requires four things in place at the moment of application:
⦁ A pre-existing relationship with a corporate banking team at one of the three to five banks that have signaled willingness to take VASP business — typically established at the parent-company level before the NOC was even submitted
⦁ A locally-based authorised signatory with verifiable Pakistani residence, valid CNIC or passport with current visa, and direct authority under the company's board resolutions
⦁ Detailed AML/CFT policy documentation that satisfies not just PVARA but the bank's correspondent banking team — which often imposes higher standards than the regulator because correspondents are unforgiving on de-risking
⦁ Segregation arrangements between the Client Money Account and operational accounts that the bank's compliance officer can independently audit on demand
Exchanges that wait until post-NOC to start banking conversations typically face 90 to 180 days of bank-by-bank shopping, declined applications, multi-round AML documentation requests, and in some cases re-opening the application from scratch when the bank's crypto policy shifts mid-process. Many will still not have a fully functional Client Money Account structure 12 months post-NOC. Without a CMA, you cannot transact — meaning you cannot operate as a VASP in Pakistan even with a valid NOC and a fully incorporated entity. This is the chokepoint that produces silent failures: exchanges that remain technically alive on paper but never actually operate. Full coverage of the new banking framework lives at tax banking.
Chokepoint 3 — AML/CFT framework operationalisation gap
The NOC application requires submission of an AML/CFT framework. The full VASP licence requires the framework to be fully operational — meaning live KYC systems, real-time transaction monitoring, working Suspicious Transaction Report escalation, integrated sanctions screening across OFAC, UN, EU, and Pakistan's TFS list, and a 7-year record retention infrastructure tied to the Anti-Money Laundering Act 2010 record-keeping standard.
The gap between submitted policy documentation and operational system is where many exchanges underestimate effort. PVARA reserves the right under both the NOC Regulations and the Sandbox Guidelines to suspend approval if the participant's framework is not adequately operational. Independent regulatory commentary on the NOC Regulations 2025, including the 12 December 2025 editorial in Business Recorder, has flagged this as a high-risk area where the supervision model assumes operational maturity that newcomers often lack.
Specific failure modes we have seen or expect:
⦁ KYC system that works for the home market but cannot ingest CNIC-format identity (the 13-digit Pakistani national ID number) or NICOP for overseas Pakistanis — meaning the entire onboarding flow has to be re-engineered for the Pakistani market
⦁ Transaction monitoring rules calibrated to USD or EUR thresholds that don't apply to PKR transaction patterns — for example, a USD 10,000 cash equivalent flag does not map cleanly to PKR threshold patterns where everyday legitimate transactions can exceed the equivalent due to currency value differences
⦁ Sanctions screening that doesn't include Pakistan's domestic TFS list of designated persons — a structural gap because most international screening providers don't ingest the Pakistani list automatically
⦁ STR escalation workflow that depends on a non-resident MLRO who cannot meet FMU's same-day expectation under the Anti-Money Laundering Act 2010
⦁ Travel Rule implementation that hasn't been calibrated for the PKR 1 million threshold (approximately USD 3,500) at which originator and beneficiary information becomes mandatory under the Pakistan framework
The fix takes 4 to 8 months of system engineering, vendor integration, and policy localisation. Exchanges that don't budget this time as part of Phase 2 will find themselves operationally non-compliant even after PVARA grants the licence.
Chokepoint 4 — Capital adequacy and financial soundness gaps
PVARA has not yet published explicit minimum capital thresholds for VASP licensing — these are pending in the full Licensing Regulations expected later in 2026. However, the Fit & Proper test for individual Key Individuals already includes financial soundness, and the entity-level evaluation criteria under the Sandbox Guidelines explicitly cite the requirement to demonstrate financial capacity to undertake the proposed business model. The NOC Regulations 2025 carry similar language.
Where exchanges fail: thinly-capitalised startup-stage VASPs that secured an NOC on the strength of their global parent's reputation can be tripped up when PVARA asks for evidence of paid-up capital and operational reserves at the Pakistani entity level. Inter-company support arrangements from the foreign parent may not satisfy this if the Pakistani entity itself has minimal paid-up capital and no committed operational funding ring-fenced for it. The regulator wants to see that the Pakistani entity can survive a 12-month operational stress test on its own — separate from the parent.
The conservative practical floor we recommend, in the absence of a published minimum: a Pakistani VASP entity should have paid-up capital of at least PKR 50 million (approximately USD 175,000) plus 12 months of committed operational funding before NOC submission, even though no rule explicitly requires this number. Anything materially less risks the financial soundness review and may force capital injection mid-application — which then triggers fresh Controller approval requirements under the NOC Regulations.
Chokepoint 5 — The Sharia compliance board (the requirement no other major jurisdiction has)
Pakistan is the only major crypto jurisdiction globally that requires every licensed VASP to have a Sharia compliance board evaluate offerings before they reach customers. This is a structural reflection of Pakistan's Islamic finance framework, with no direct equivalent in MAS, VARA, MiCA, the SFC VASP regime, or any other comparable framework worldwide. The Sharia Advisory Committee at the PVARA Board level provides overall guidance, and licensed VASPs are expected to maintain entity-level Sharia compliance arrangements aligned with Pakistan's Islamic finance jurisprudence.
Why this is a Phase 2 failure mode: identifying credible Sharia advisors — typically scholars who have served on banking-sector Sharia boards under SBP's Islamic Banking Department — getting them retained, and structuring the board's approval workflow into the product launch process is net-new work for most foreign exchanges. The exchanges that approach Phase 2 without having identified Sharia advisors typically lose 60 to 90 days at this milestone.
The compounding risk: Sharia non-compliance findings can require product redesign, not just policy adjustment. An exchange that has built its margin trading or futures product on a riba-bearing structure may discover at the Sharia review that its core offering is non-compliant in Pakistan. Restructuring that mid-launch — finding a Sharia-compliant alternative product structure, re-engineering the platform, re-doing customer disclosures — is materially expensive and can extend Phase 2 by an additional 3 to 6 months.
4. The Early-Stall Versus Late-Stall Failure Pattern
Phase 2 failures cluster into two distinct patterns. Recognising which pattern your exchange is at risk of helps you allocate intervention budget.
Early-Stall Pattern (Months 1–3 Post-NOC)
Cause profile: Fit & Proper documentation gaps combined with premature banking applications. The exchange is still in incorporation phase but already trying to open bank accounts and submit licensing documentation. The bank declines because incorporation isn't complete; Fit & Proper pauses because a Key Individual's documentation has gaps; the team realises the operational gap with the foreign parent. Roughly 25% of total Phase 2 failures present this way.
Recovery profile: Recoverable in 60–90 days if the exchange restructures, brings in a Pakistan-based operational lead, and resequences milestones. Recoverable failures are the lucky failures.
Late-Stall Pattern (Months 6–12 Post-NOC)
Cause profile: AML/CFT framework operationalisation drags combined with Sharia board delays and capital adequacy questions surfacing late. The exchange has incorporated, banked, and registered with FMU, but cannot complete the operational maturity required for the full VASP licence application when the full Licensing Regulations are eventually published. Roughly 75% of total Phase 2 failures present this way.
Recovery profile: Often unrecoverable. Late-stall is the more dangerous pattern because it consumes 6 to 12 months of capital and team time before the failure becomes visible to the parent organisation. Founders typically over-commit before pulling the plug. By the time the parent realises the Pakistan entity is not going to convert to a full licence, the sunk cost is significant — typically USD 500K to USD 2M depending on the parent's investment level.
5. What Separates The 60% Who Succeed
From observation of comparable provisional-licence regimes globally and the structural specifics of PVARA's framework, three characteristics distinguish the exchanges most likely to clear Phase 2:
1. Pre-NOC Pakistan readiness. Fit & Proper documentation prepared 6 to 9 months before NOC submission. Banking conversations initiated pre-NOC, even if formal applications wait until post-NOC. Sharia advisors identified pre-NOC. The exchanges that treat NOC as the start-of-work fail; the ones that treat it as a checkpoint succeed.
2. A Pakistan-based operational lead with real authority. Discussed in detail at [link to /blog/resident-director-pvara-pakistan]. A genuinely empowered Pakistan-based CEO or COO with banking signing authority, direct PVARA engagement responsibility, and the seniority to escalate inside the parent organisation when needed. Nominee directors and part-time consultants do not satisfy this — the regulator and the bank both detect the difference quickly.
3. Forward-compatibility with the full Licensing Regulations. Building structures that anticipate, rather than match exactly, the full VASP Licensing Regulations expected later in 2026. Likely additions include explicit residency for Compliance Officer and MLRO, capital adequacy thresholds, operational maturity requirements, and beneficial ownership reporting cadence. Over-compliance with NOC requirements now is materially cheaper than restructuring after Licensing Regulations publish. Treat the NOC bar as a floor, not a ceiling.
6. Self-Assessment — Are You In The 60% Or The 40%?
Score your readiness across the 10 questions below. Each Yes is one point. 8 or more = you're tracking with the 60% who clear. 5 to 7 = at material risk. 4 or fewer = high probability of Phase 2 failure unless you intervene now.
We've moderated our projection to 40% on the understanding that some milestones run in parallel (incorporation and Fit & Proper, for example), some failures are recoverable rather than terminal, and the most diligent operators will pre-stage several milestones before NOC. The 40% reflects a realistic mid-case, not a worst-case multiplication of independent probabilities. For the full sequence of post-NOC milestones, see the master playbook at pvara-guide.
3. The Five Chokepoints — Where The 40% Actually Fails
Chokepoint 1 — Fit & Proper documentation collapse
This is the most under-estimated failure mode, and the one we see foreign exchanges hit hardest in the first 90 days post-NOC. PVARA's Fit & Proper Test, set out in Form A3 of the NOC Regulations 2025, is not a tickbox exercise. Each of the seven Key Individuals — CEO, CFO, Compliance Officer, MLRO, Head of Internal Audit, Head of Risk Management, Head of Information Security — must submit certified documentation including:
⦁ Full employment history with reference letters from prior employers spanning at least the last 10 years
⦁ Educational certificates, notarised, with foreign certificates apostilled under the Hague Convention or equivalent
⦁ Criminal record clearances from every country of residence in the last 10 years (not just country of citizenship)
⦁ Bankruptcy and insolvency searches for the same 10-year window, plus credit reports
⦁ Professional licences and disciplinary records from all professional bodies the individual has been registered with
⦁ Sanctions screening confirmations against OFAC, UN, EU, UK, and Pakistan's domestic TFS list
⦁ Politically Exposed Person status declarations including disclosures for spouse, immediate family, and close associates
⦁ Source of funds disclosure if the individual is also a Controller (defined as ≥20% voting power or share capital under the NOC Regulations)
Where exchanges fail: a single Key Individual with a regulatory blemish in their history — even a closed, settled matter from seven or eight years ago — can derail the entire application. PVARA's Fit & Proper integrity test is binary, not graduated. One Key Individual fails the integrity standard, and the entire application is paused until that role is replaced. Replacing a Compliance Officer or MLRO mid-application typically adds 60 to 90 days of fresh documentation cycles, because the replacement also has to complete the entire Form A3 process from scratch.
The 6 to 9 month preparation rule. Industry guidance is to begin Fit & Proper documentation collection 6 to 9 months before NOC submission, not after. Exchanges that started documentation post-NOC-grant typically slip 4 to 6 months on this milestone alone. By the time the documentation gap is closed, the exchange has burned half of its Phase 2 budget without making progress on the other four chokepoints. For a deeper dive on the Form A3 mechanics, see our companion analysis at [link to /blog/resident-director-pvara-pakistan].
Chokepoint 2 — Banking application stalls
This will be the single largest cause of Phase 2 failure across the 2026 cohort. Under the State Bank of Pakistan's April 2026 VASP banking circular, banks may now open accounts for PVARA-licensed VASPs and Client Money Accounts for authorised transactions — ending the eight-year crypto banking ban that had been in place since the 2018 BPRD circular. But the operational reality is that as of mid-2026, only a handful of Pakistani banks have established internal frameworks for crypto VASP onboarding. Most banks will quietly decline.
The successful banking-onboarding playbook requires four things in place at the moment of application:
⦁ A pre-existing relationship with a corporate banking team at one of the three to five banks that have signaled willingness to take VASP business — typically established at the parent-company level before the NOC was even submitted
⦁ A locally-based authorised signatory with verifiable Pakistani residence, valid CNIC or passport with current visa, and direct authority under the company's board resolutions
⦁ Detailed AML/CFT policy documentation that satisfies not just PVARA but the bank's correspondent banking team — which often imposes higher standards than the regulator because correspondents are unforgiving on de-risking
⦁ Segregation arrangements between the Client Money Account and operational accounts that the bank's compliance officer can independently audit on demand
Exchanges that wait until post-NOC to start banking conversations typically face 90 to 180 days of bank-by-bank shopping, declined applications, multi-round AML documentation requests, and in some cases re-opening the application from scratch when the bank's crypto policy shifts mid-process. Many will still not have a fully functional Client Money Account structure 12 months post-NOC. Without a CMA, you cannot transact — meaning you cannot operate as a VASP in Pakistan even with a valid NOC and a fully incorporated entity. This is the chokepoint that produces silent failures: exchanges that remain technically alive on paper but never actually operate. Full coverage of the new banking framework lives at tax banking.
Chokepoint 3 — AML/CFT framework operationalisation gap
The NOC application requires submission of an AML/CFT framework. The full VASP licence requires the framework to be fully operational — meaning live KYC systems, real-time transaction monitoring, working Suspicious Transaction Report escalation, integrated sanctions screening across OFAC, UN, EU, and Pakistan's TFS list, and a 7-year record retention infrastructure tied to the Anti-Money Laundering Act 2010 record-keeping standard.
The gap between submitted policy documentation and operational system is where many exchanges underestimate effort. PVARA reserves the right under both the NOC Regulations and the Sandbox Guidelines to suspend approval if the participant's framework is not adequately operational. Independent regulatory commentary on the NOC Regulations 2025, including the 12 December 2025 editorial in Business Recorder, has flagged this as a high-risk area where the supervision model assumes operational maturity that newcomers often lack.
Specific failure modes we have seen or expect:
⦁ KYC system that works for the home market but cannot ingest CNIC-format identity (the 13-digit Pakistani national ID number) or NICOP for overseas Pakistanis — meaning the entire onboarding flow has to be re-engineered for the Pakistani market
⦁ Transaction monitoring rules calibrated to USD or EUR thresholds that don't apply to PKR transaction patterns — for example, a USD 10,000 cash equivalent flag does not map cleanly to PKR threshold patterns where everyday legitimate transactions can exceed the equivalent due to currency value differences
⦁ Sanctions screening that doesn't include Pakistan's domestic TFS list of designated persons — a structural gap because most international screening providers don't ingest the Pakistani list automatically
⦁ STR escalation workflow that depends on a non-resident MLRO who cannot meet FMU's same-day expectation under the Anti-Money Laundering Act 2010
⦁ Travel Rule implementation that hasn't been calibrated for the PKR 1 million threshold (approximately USD 3,500) at which originator and beneficiary information becomes mandatory under the Pakistan framework
The fix takes 4 to 8 months of system engineering, vendor integration, and policy localisation. Exchanges that don't budget this time as part of Phase 2 will find themselves operationally non-compliant even after PVARA grants the licence.
Chokepoint 4 — Capital adequacy and financial soundness gaps
PVARA has not yet published explicit minimum capital thresholds for VASP licensing — these are pending in the full Licensing Regulations expected later in 2026. However, the Fit & Proper test for individual Key Individuals already includes financial soundness, and the entity-level evaluation criteria under the Sandbox Guidelines explicitly cite the requirement to demonstrate financial capacity to undertake the proposed business model. The NOC Regulations 2025 carry similar language.
Where exchanges fail: thinly-capitalised startup-stage VASPs that secured an NOC on the strength of their global parent's reputation can be tripped up when PVARA asks for evidence of paid-up capital and operational reserves at the Pakistani entity level. Inter-company support arrangements from the foreign parent may not satisfy this if the Pakistani entity itself has minimal paid-up capital and no committed operational funding ring-fenced for it. The regulator wants to see that the Pakistani entity can survive a 12-month operational stress test on its own — separate from the parent.
The conservative practical floor we recommend, in the absence of a published minimum: a Pakistani VASP entity should have paid-up capital of at least PKR 50 million (approximately USD 175,000) plus 12 months of committed operational funding before NOC submission, even though no rule explicitly requires this number. Anything materially less risks the financial soundness review and may force capital injection mid-application — which then triggers fresh Controller approval requirements under the NOC Regulations.
Chokepoint 5 — The Sharia compliance board (the requirement no other major jurisdiction has)
Pakistan is the only major crypto jurisdiction globally that requires every licensed VASP to have a Sharia compliance board evaluate offerings before they reach customers. This is a structural reflection of Pakistan's Islamic finance framework, with no direct equivalent in MAS, VARA, MiCA, the SFC VASP regime, or any other comparable framework worldwide. The Sharia Advisory Committee at the PVARA Board level provides overall guidance, and licensed VASPs are expected to maintain entity-level Sharia compliance arrangements aligned with Pakistan's Islamic finance jurisprudence.
Why this is a Phase 2 failure mode: identifying credible Sharia advisors — typically scholars who have served on banking-sector Sharia boards under SBP's Islamic Banking Department — getting them retained, and structuring the board's approval workflow into the product launch process is net-new work for most foreign exchanges. The exchanges that approach Phase 2 without having identified Sharia advisors typically lose 60 to 90 days at this milestone.
The compounding risk: Sharia non-compliance findings can require product redesign, not just policy adjustment. An exchange that has built its margin trading or futures product on a riba-bearing structure may discover at the Sharia review that its core offering is non-compliant in Pakistan. Restructuring that mid-launch — finding a Sharia-compliant alternative product structure, re-engineering the platform, re-doing customer disclosures — is materially expensive and can extend Phase 2 by an additional 3 to 6 months.
4. The Early-Stall Versus Late-Stall Failure Pattern
Phase 2 failures cluster into two distinct patterns. Recognising which pattern your exchange is at risk of helps you allocate intervention budget.
Early-Stall Pattern (Months 1–3 Post-NOC)
Cause profile: Fit & Proper documentation gaps combined with premature banking applications. The exchange is still in incorporation phase but already trying to open bank accounts and submit licensing documentation. The bank declines because incorporation isn't complete; Fit & Proper pauses because a Key Individual's documentation has gaps; the team realises the operational gap with the foreign parent. Roughly 25% of total Phase 2 failures present this way.
Recovery profile: Recoverable in 60–90 days if the exchange restructures, brings in a Pakistan-based operational lead, and resequences milestones. Recoverable failures are the lucky failures.
Late-Stall Pattern (Months 6–12 Post-NOC)
Cause profile: AML/CFT framework operationalisation drags combined with Sharia board delays and capital adequacy questions surfacing late. The exchange has incorporated, banked, and registered with FMU, but cannot complete the operational maturity required for the full VASP licence application when the full Licensing Regulations are eventually published. Roughly 75% of total Phase 2 failures present this way.
Recovery profile: Often unrecoverable. Late-stall is the more dangerous pattern because it consumes 6 to 12 months of capital and team time before the failure becomes visible to the parent organisation. Founders typically over-commit before pulling the plug. By the time the parent realises the Pakistan entity is not going to convert to a full licence, the sunk cost is significant — typically USD 500K to USD 2M depending on the parent's investment level.
5. What Separates The 60% Who Succeed
From observation of comparable provisional-licence regimes globally and the structural specifics of PVARA's framework, three characteristics distinguish the exchanges most likely to clear Phase 2:
1. Pre-NOC Pakistan readiness. Fit & Proper documentation prepared 6 to 9 months before NOC submission. Banking conversations initiated pre-NOC, even if formal applications wait until post-NOC. Sharia advisors identified pre-NOC. The exchanges that treat NOC as the start-of-work fail; the ones that treat it as a checkpoint succeed.
2. A Pakistan-based operational lead with real authority. Discussed in detail at [link to /blog/resident-director-pvara-pakistan]. A genuinely empowered Pakistan-based CEO or COO with banking signing authority, direct PVARA engagement responsibility, and the seniority to escalate inside the parent organisation when needed. Nominee directors and part-time consultants do not satisfy this — the regulator and the bank both detect the difference quickly.
3. Forward-compatibility with the full Licensing Regulations. Building structures that anticipate, rather than match exactly, the full VASP Licensing Regulations expected later in 2026. Likely additions include explicit residency for Compliance Officer and MLRO, capital adequacy thresholds, operational maturity requirements, and beneficial ownership reporting cadence. Over-compliance with NOC requirements now is materially cheaper than restructuring after Licensing Regulations publish. Treat the NOC bar as a floor, not a ceiling.
6. Self-Assessment — Are You In The 60% Or The 40%?
Score your readiness across the 10 questions below. Each Yes is one point. 8 or more = you're tracking with the 60% who clear. 5 to 7 = at material risk. 4 or fewer = high probability of Phase 2 failure unless you intervene now.
| 1 | Have we begun Fit & Proper documentation collection for all seven Key Individuals at least 6 months before NOC submission? | ☐ Yes ☐ No |
| 2 | Have we identified at least one Pakistan-resident operational lead (CEO or COO) with banking signing authority? | ☐ Yes ☐ No |
| 3 | Have we initiated banking conversations with at least three SBP-regulated banks that have signaled openness to VASP onboarding? | ☐ Yes ☐ No |
| 4 | Has our AML/CFT framework been tested against Pakistan-specific requirements (CNIC ingestion, PKR transaction patterns, domestic TFS list)? | ☐ Yes ☐ No |
| 5 | Have we identified credible Sharia advisors with prior banking-sector Sharia board experience? | ☐ Yes ☐ No |
| 6 | Does our Pakistani entity have committed paid-up capital of at least PKR 50 million and 12 months of operational funding? | ☐ Yes ☐ No |
| 7 | Are our Compliance Officer and MLRO Pakistan-resident or have we identified Pakistan-resident replacements? | ☐ Yes ☐ No |
| 8 | Have we documented our exit strategy in case of regulatory change, banking failure, or Sharia non-compliance finding? | ☐ Yes ☐ No |
| 9 | Have we built operational redundancy (alternate director, deputy MLRO) for absences over 90 days? | ☐ Yes ☐ No |
| 10 | Are we forward-compatible with the full VASP Licensing Regulations expected later in 2026 (residency, capital, operational maturity)? | ☐ Yes ☐ No |
If you scored under 8, the right move is not to push harder — it is to pause, restructure the readiness gaps, and re-enter Phase 2 from a stronger starting position. Burning capital while structurally unready is the fastest way to join the 40%. The CoinConnect services team runs this assessment as part of standard market-entry diagnostics; a 60-minute conversation typically surfaces the two or three gaps that matter most.
7. Defending The 40% Projection — Comparable Jurisdiction Analysis
We owe readers the workings behind the 40%. Here is the comparable-jurisdiction data and the structural reasoning that supports the projection.
7. Defending The 40% Projection — Comparable Jurisdiction Analysis
We owe readers the workings behind the 40%. Here is the comparable-jurisdiction data and the structural reasoning that supports the projection.
| Jurisdiction | Provisional → Full License Failure Rate (estimated) | Why this informs Pakistan |
|---|---|---|
| Singapore (MAS Payment Services Act) | ~30% of provisional Major Payment Institution applicants did not complete to operational status, 2020–2021 cohort (industry-reported) | Pakistan banking is less mature than Singapore. Failure rate floor for Pakistan should sit above Singapore's. |
| Dubai (VARA) | ~35% of Initial Approval / Provisional licensees in 2023–2024 did not progress to Operating Licence (industry-reported) | Dubai banking is more crypto-receptive than Pakistan in 2026. Failure rate ceiling for Pakistan should sit above Dubai's. |
| EU (MiCA) | Too early to measure (transition period running through 2026); attrition expected ~25–35% based on national authorisation patterns | MiCA has no Sharia equivalent and a more developed payment infrastructure. Pakistan's structural specifics push its rate higher. |
| Pakistan (PVARA, projection) | CoinConnect projection: 35–45%, midpoint 40% | First-cohort effect, Sharia board novelty, narrow set of crypto-willing banks, AML/CFT operational maturity gap. |
Four structural factors push Pakistan's projected failure rate above the Singapore and Dubai comparables:
1. The Sharia compliance board requirement has no equivalent in Singapore, Dubai, MiCA, or Hong Kong. It is novel work for foreign exchanges and adds a 60 to 120 day milestone with its own product-redesign risk.
2. The narrow set of crypto-willing banks in Pakistan, combined with the eight-year banking ban only being lifted in April 2026, means the banking infrastructure is materially less mature than Singapore (decade-plus of crypto banking) or Dubai (post-2022 framework with broad bank participation).
3. The first-cohort effect. The December 2025 to June 2026 NOC cohort is the first to operate under the new framework. Regulatory mechanics are still being tested. First-cohort failure rates in any new licensing regime tend to be measurably higher than steady-state rates — typical patterns suggest first-cohort rates run 20 to 40% above steady-state.
4. The AML/CFT operational maturity gap. Pakistan's AML supervision model assumes operational maturity that many crypto-native exchanges genuinely lack — they have policies, but not the live monitoring infrastructure regulators expect.
These four factors together support the 35 to 45% Phase 2 failure projection. We've used 40% as a midpoint and rounded for headline use, but the honest range is 35 to 45%, with the upper end more likely if the Pakistan banking infrastructure remains as constrained as it is in mid-2026.
Frequently asked questions
No. PVARA has issued no Phase 2 failure projection and does not publish failure rates. The 40% is CoinConnect's analytical projection, defended in Section 7 against comparable provisional-licence regimes (Singapore MAS, Dubai VARA, EU MiCA). Treat it as an analytical estimate, not a regulator statistic, and quote the methodology when citing the number.
Not necessarily. Most Phase 2 failures are silent — the exchange remains technically alive on paper but never converts to a full VASP licence and quietly winds down operations. The NOC itself remains valid until the full VASP licensing application window expires (3 months after the full Licensing Regulations are promulgated, per PVARA's commitment), at which point continuing operations becomes unlawful under Section 17 of the Virtual Assets Ordinance 2025.
Yes, in principle. PVARA's NOC Regulations allow up to two resubmissions for incomplete applications, and there is no formal blacklist for failed Phase 2 holders. However, a failed Phase 2 attempt typically requires fresh Fit & Proper documentation, a restructured entity, and addressing whatever specific failure cause the regulator flagged. Practically, re-applying is a 12 to 18 month restart, not a quick course correction.
In our analysis, the single biggest predictor is whether the exchange has a Pakistan-based operational lead with real authority by the time the NOC is granted. Exchanges with this in place clear Phase 2 at materially higher rates because the Pakistan-based lead resolves the banking, FMU, and PVARA-engagement chokepoints in parallel rather than sequentially. Exchanges without it tend to discover the gap at chokepoint 2 (banking) and lose the next 6 months trying to retrofit the structure. See our resident-director-pvara-pakistan Blog for a deeper analysis.
Yes, all licensed VASP products distributed to Pakistani users are subject to Sharia review. The intensity of review varies by product — spot trading of established crypto assets typically receives lighter review than derivative or yield-generating products. Riba-bearing structures (interest-bearing lending, certain margin products) face the highest scrutiny and often require structural redesign. PVARA's Sharia Advisory Committee provides framework-level guidance; entity-level Sharia compliance is the VASP's own responsibility.
Start Phase 2 preparation 6 to 9 months before NOC submission, not after NOC grant. Specifically: Fit & Proper documentation collection (6–9 months before), banking relationship initiation (3–6 months before), Sharia advisor identification (3 months before), and Pakistan-based operational lead recruitment (3 months before). Exchanges that compress this preparation into the post-NOC period typically slip 4 to 6 months on the overall Phase 2 timeline.
Yes, the NOC permits a defined set of AML-Registered Services under Regulation 2.3 of the NOC Regulations 2025 — broker-dealer services, custody services, exchange services, and virtual asset derivative services. These are the activities the NOC clears to begin operationally, subject to the conditions imposed by PVARA. Operating any virtual asset service without an NOC or full licence is a criminal offence under Section 17 of the Virtual Assets Ordinance 2025, with penalties up to PKR 50 million in fines plus imprisonment.
The NOC remains valid; the licensing application window resets to begin from the date the Licensing Regulations are eventually promulgated. PVARA's commitment is that full licensing applications must be submitted within 3 months of promulgation. A delay in Licensing Regulations works in NOC holders' favour by extending the operational runway, but does not relieve the obligation to maintain compliance with NOC conditions throughout the period.
The Bottom Line
The NOC is regulatory permission to start. Phase 2 is where you actually become a Pakistan-licensed VASP. The exchanges that internalise this distinction and prepare accordingly will clear; the ones that treat the NOC as victory will join the 40%.
The five chokepoints — Fit & Proper, banking, AML/CFT operationalisation, capital adequacy, and Sharia compliance — are independent failure modes, but they compound. An exchange with a documentation gap at chokepoint 1 is structurally more likely to hit a banking refusal at chokepoint 2, because the bank's compliance officer reads the same Fit & Proper documentation PVARA does. Failures at the early chokepoints make the later chokepoints harder, not easier.
The 60% who clear Phase 2 will have done three things differently: they will have started Fit & Proper preparation 6 to 9 months before NOC, they will have a Pakistan-based operational lead with real authority by NOC grant, and they will have built structures that are forward-compatible with the full VASP Licensing Regulations expected later in 2026. None of these three are difficult in isolation. All three together require deliberate sequencing — which is the entire purpose of Phase 2 planning.
Considering Pakistan market entry, or already holding an NOC and assessing Phase 2 readiness? CoinConnect runs the 10-question Phase 2 assessment as a 60-minute regulatory diagnostic, with a written readiness report identifying the two or three chokepoints most likely to derail your specific structure. Visit services to book, or reach out via contactus
Sources Cited
⦁ PVARA No Objection Certificate Regulations 2025 (in force 2 December 2025). pvara.gov.pk.
⦁ PVARA Sandbox Guidelines 2026, Annexure A Self-Assessment Checklist and Annexure B Undertaking. pvara.gov.pk.
⦁ Virtual Assets Ordinance 2025 / Virtual Assets Act 2026 (Sections 6, 8, 17, 42–45). pakistancode.gov.pk.
⦁ Companies Act 2017 (Sections 153, 154, 460). secp.gov.pk.
⦁ State Bank of Pakistan VASP banking circular, April 2026. sbp.org.pk.
⦁ Anti-Money Laundering Act 2010 and FMU goAML registration framework. fmu.gov.pk.
⦁ Business Recorder editorial commentary on the NOC Regulations 2025, 12 December 2025 (cited as commentary, not as binding authority).
⦁ Comparable jurisdiction analysis: Monetary Authority of Singapore Payment Services Act provisional approval data; Dubai VARA Initial Approval to Operating Licence progression; ESMA MiCA transition reporting. (Failure-rate ranges are industry-reported analytical estimates, not official regulator statistics.)
Article prepared by CoinConnect's regulatory advisory team. The 40% Phase 2 failure rate is CoinConnect's analytical projection, defended in Section 7. Last reviewed against published PVARA, SECP, SBP, and FMU sources as of 7 May 2026. This article is general analysis and not legal or regulatory advice. For engagement-specific advice, contact CoinConnect.