Resident Director Requirement Under PVARA: What Foreign Crypto Exchanges Actually Need in 2026
TL;DR — the honest answer in three lines. PVARA's No Objection Certificate Regulations 2025 do not explicitly require a Pakistani resident director. The Companies Act 2017 does not mandate one either. But every foreign crypto exchange we have worked with ends up appointing one — because corporate banking under SBP's new VASP framework, FMU goAML registration, and PVARA's own engagement expectations all functionally require local presence. This article tells you exactly what the rules say, what they don't say, and what we recommend you actually do.
Why this question keeps coming up?
Every week, a foreign crypto exchange sends us the same question: do we need a Pakistani resident on our board to get the PVARA NOC and operate as a VASP in Pakistan?
The answers exchanges typically receive from law firms fall into two camps:
- "Yes, you must appoint a local resident director." Overstated as a hard legal rule — the Regulations do not say this.
- "No, it's not a legal requirement." Technically correct but practically misleading — the operational reality is different.
Both answers fail the exchange. The real situation is more nuanced, and getting it wrong on either side costs you 60 to 90 days of incorporation rework, a banking application that goes nowhere, or worse — an NOC that gets stalled at the AML/CFT framework review. This article gives you the real answer, sourced directly from the pvara-guide, the
PVARA No Objection Certificate Regulations 2025, the Companies Act 2017, and the State Bank of Pakistan's 2026 VASP banking circular.
What PVARA's NOC Regulations 2025 actually say
The PVARA No Objection Certificate Regulations 2025 came into force on 2 December 2025 and are the binding rules for any entity seeking VASP entry into Pakistan. The Regulations are explicit about who must run a licensed VASP — but completely silent on where those individuals must live.
Under Regulation 5.1 of the NOC Regulations 2025, every applicant must appoint and maintain the following Key Individuals:
- Chief Executive Officer (CEO) — overall accountability for the entity and its compliance posture
- Chief Financial Officer (CFO) — capital adequacy, financial reporting, and SBP foreign-exchange compliance
- Compliance Officer — primary point of contact for PVARA on regulatory compliance matters
- Money Laundering Reporting Officer (MLRO) — designated officer for suspicious transaction reporting under the Anti-Money Laundering Act 2010
- Head of Internal Audit — independent assurance on internal controls
- Head of Risk Management — enterprise risk framework, including operational, market, and ML/TF risk
- Head of Information Security — cybersecurity, key management, and the one-hour incident notification obligation
Each of these individuals must pass the Fit & Proper Test set out in Form A3 of the Regulations. Fit & Proper covers integrity (no record of fraud, financial crime, or designated-persons status under Pakistan's TFS framework), competence (relevant experience and qualifications), and financial soundness (no unresolved bankruptcy or insolvency proceedings).
What the Regulations are silent on
The PVARA NOC Regulations 2025 do not specify any of the following:
- That any Key Individual must be a Pakistani citizen
- That any Key Individual must be a Pakistani tax resident under Section 82 of the Income Tax Ordinance 2001
- That any Key Individual must be physically present in Pakistan for any minimum number of days per year
- That the Compliance Officer or MLRO must operate from a Pakistani office
- That a board observer or local nominee must be appointed
This silence is not an oversight that has gone unnoticed. Independent regulatory commentary published in Business Recorder on 12 December 2025 explicitly identified the gap, recommending the inclusion of residency requirements for Key Individuals and mandatory local presence for MLRO and compliance functions as a future enhancement to the framework. PVARA's own regulatory observers are flagging that residency rules are missing — which strongly suggests the rules are coming, not that they will not.
What the Companies Act 2017 requires
Once an applicant receives an NOC, the next step is incorporation in Pakistan as a private limited company under the Companies Act 2017 — which is the SECP's domain, not PVARA's. The full incorporation walkthrough sits at corporate-setup.
Director minimums and nationality under Section 154
Section 154 of the Companies Act 2017 requires a private limited company to have a minimum of two directors. The Act does not require either director to be a Pakistani citizen or a Pakistani resident. Foreign nationals can serve as directors, with two practical conditions:
- Security clearance from the Ministry of Interior. All foreign directors of a Pakistani company must obtain this clearance post-incorporation. The clearance typically takes 4 to 8 weeks and remains valid as long as the directorship is held.
- NTN exemption confirmation under Section 153. The 2020 amendments confirmed that foreign persons not required to hold a Pakistani National Tax Number are not ineligible to serve as directors. Earlier ambiguity has been resolved.
So a foreign exchange could in theory appoint two non-resident foreign directors and incorporate a fully foreign-controlled VASP entity in Pakistan. The law allows it.
The alternate director rule — the practical wrinkle most law firms miss
Here is where most foreign exchanges miss something important. The Companies Act 2017 provides that if a director is absent from Pakistan for more than 90 consecutive days, an alternate director may be appointed to act in their place during the absence. The alternate director must be acceptable to the Board and is typically required to be available locally.
If your VASP entity has only foreign directors who travel in and out of Pakistan, you will hit the 90-day threshold the moment the regulator asks for an in-person meeting, a board resolution to be signed locally, or an SECP filing requiring physical attendance. The alternate director then becomes the de facto local presence — and you have effectively created a resident director position by accident, without the strategic choice of who fills it. Better to design for it from day one.
Why local presence is functionally mandatory — three operational chokepoints
Even where PVARA and the Companies Act are silent, three operational chokepoints make local presence functionally mandatory for any serious VASP. Skipping local presence is technically legal and practically suicidal.
Chokepoint 1: Corporate banking under SBP's Client Money Account regime
In April 2026, the State Bank of Pakistan ended the eight-year crypto banking ban via the Virtual Assets Act 2026 framework, authorising regulated entities to open accounts for PVARA-licensed VASPs and Client Money Accounts (CMAs) for authorised transactions. Under the SBP circular implementing this framework, every VASP banking application requires the following:
- A Pakistan-based account opening signatory authorised under the company's board resolutions
- KYC verification of the signatory's local address and CNIC or passport with valid Pakistan visa
- Ongoing relationship management with the bank's compliance officer, who expects same-business-day responsiveness
- Strict segregation between Client Money Accounts and operational accounts, with the signatory accountable for that segregation
You cannot complete bank onboarding remotely from Singapore, Dubai, the Cayman Islands, or any other jurisdiction your headquarters happens to sit in. Someone authorised must be physically present at branch level to complete the KYC, sign the account-opening documents, and remain the day-to-day banking relationship contact. The full coverage of the new banking framework lives at tax-banking.
Chokepoint 2: FMU goAML registration
PVARA's NOC explicitly serves as pre-incorporation regulatory clearance for AML registration on the Financial Monitoring Unit's goAML portal — this is set out in Regulation 15.4 of the NOC Regulations 2025. The goAML registration requires a designated MLRO with a verifiable Pakistani contact address who can be reached for STR follow-ups within statutory timelines under the Anti-Money Laundering Act 2010.
If the MLRO is in another country and unreachable when the FMU asks for clarification on a suspicious transaction report, the licence — not just the registration — is at risk. This is why PVARA's own no-outsourcing rule for AML-critical functions (Regulation 6) effectively forces the MLRO function to sit in Pakistan, even though the rule is framed as a no-outsourcing rule rather than a residency rule.
Chokepoint 3: Regulator engagement and the Sandbox
PVARA's Sandbox Guidelines 2026 explicitly require participants to be available for in-person regulator engagement during the testing period. The Sandbox Undertaking (Annexure B) commits the participant to notifying PVARA within one hour of any material incident, risk event, or compliance breach, with a detailed incident report due within 48 hours. A non-resident leadership team is structurally less responsive than a local one. The regulator notices, and the Sandbox Guidelines reserve the Authority's right to suspend or revoke approval for failure to provide requested information or breach of the testing plan.
So what should foreign exchanges actually appoint?
Based on the regulatory text, the operational chokepoints, and the direction the rules are heading, here is the structure we recommend to every foreign exchange entering Pakistan. This is a practical structure, not a legal mandate — but it is the structure that survives PVARA review, banking onboarding, FMU registration, and a sandbox audit.
At incorporation (NOC stage)
- Two directors minimum, with at least one Pakistan-based — the Pakistan-based director should be the appointed CEO of the local entity, or have direct authority to sign banking and regulatory documents
- All foreign directors complete Ministry of Interior security clearance within 30 days of incorporation, in parallel with NOC submission
- An alternate director is pre-identified for any foreign director expected to travel — this avoids scrambling under the 90-day rule
Mapping the seven Key Individual roles to residency reality
- CEO — Pakistan-resident strongly recommended. The CEO signs the goAML registration, the bank account opening, and represents the entity to PVARA in person.
- Compliance Officer — Pakistan-resident effectively mandatory. Cannot be outsourced under PVARA's Regulation 6 no-outsourcing rule for AML-critical functions.
- MLRO — Pakistan-resident effectively mandatory. Same logic as Compliance Officer; the regulator expects same-day STR escalation capability.
- CFO — Can be foreign-resident, but co-sign authority with a Pakistan-based finance lead is needed for SBP foreign-exchange compliance and Client Money Account oversight.
- Head of Internal Audit — Can be foreign-resident with periodic on-site reviews, given the function is independent assurance rather than day-to-day operations.
- Head of Risk Management — Can be foreign-resident with a Pakistan-based deputy, particularly if your enterprise risk function is centralised at headquarters.
- Head of Information Security — Can be foreign-resident with a Pakistan-based deputy. The one-hour incident notification obligation under the Sandbox Undertaking is too tight for a single time-zone-distant officer.
What is likely coming in the full VASP Licensing Regulations
PVARA's website confirms that full VASP licensing regulations are still in development — the NOC Regulations 2025 are the first phase. Based on the regulatory direction signals, three changes are likely in the full Licensing Regulations:
- Explicit residency requirement for the MLRO and Compliance Officer, in line with FATF supervisory expectations and the Business Recorder commentary already on record
- Local presence requirement for the CEO of any Pakistan-licensed VASP, mirroring the Monetary Authority of Singapore and Dubai VARA frameworks
- Beneficial ownership reporting with quarterly attestation for any Controller (≥20% shareholding) — already implied in the NOC Regulations and likely to be formalised with explicit timelines
Building your structure now around these likely future requirements is meaningfully cheaper than restructuring after the rules are published. CoinConnect's services include this kind of forward-compatible structuring as part of the standard market-entry engagement.
Three common mistakes foreign VASPs make on this question
Mistake 1: Appointing a nominee director with no operational authority
Some exchanges try to satisfy the local-presence expectation by appointing a nominee director — typically a friend, lawyer, or local consultant — with no actual signing authority on banking, no awareness of operational risk, and no relationship with the regulator. PVARA's Fit & Proper assessment under Form A3 catches this immediately. A nominee with no real role fails the competence test, and the application stalls.
Mistake 2: Treating the MLRO as a part-time or remote role
MLRO is the single role most likely to break the licence post-NOC. The Anti-Money Laundering Act 2010 places personal liability on the MLRO for STR escalation timelines. A part-time, remote, or shared MLRO who cannot respond within FMU's expected window is a structural risk that no amount of strong policy documentation can compensate for.
Mistake 3: Waiting for the full VASP Licensing Regulations before adjusting the structure
Some exchanges plan to file the NOC with a foreign-only structure and adjust later when full licensing rules drop. This costs more, not less. Rebuilding the entity structure post-incorporation requires shareholder resolutions, SECP filings, fresh security clearances, fresh Fit & Proper documentation, and in some cases re-opening the bank account onboarding from scratch. The conservative move is to over-comply now relative to written rules, not under-comply.
The bottom line
The resident director question is the wrong question. The right question is: who on my Pakistan-based leadership team can sign a banking document, respond to a goAML query, and meet a PVARA officer in person within 24 hours?
If you can answer that question with a name, you are ready to operate as a compliant VASP in Pakistan. If you cannot, you are not — and no amount of clever foreign-only structuring will change that. The rule is not in the regulations; the rule is in the operations.
Designing your Pakistan VASP entity? Book a 30-minute regulatory diagnostic with CoinConnect's team. We map your seven Key Individuals to PVARA NOC Regulations 2025, model your alternate director provisions, and structure for forward compatibility with the full Licensing Regulations expected later in 2026. Visit services or reach out via contactus
Sources cited
PVARA No Objection Certificate Regulations 2025 (in force 2 December 2025). Available at pvara.gov.pk.
PVARA Sandbox Guidelines 2026, including Annexure A Self-Assessment Checklist and Annexure B Undertaking. Available at pvara.gov.pk.Virtual Assets Ordinance 2025 / Virtual Assets Act 2026 (Sections 6, 8, 17, 42–45). Available at pakistancode.gov.pk.
Companies Act 2017 (Sections 153, 154, 460). Available at secp.gov.pk.
State Bank of Pakistan circular on VASP banking and Client Money Accounts, April 2026.
Business Recorder editorial commentary on the NOC Regulations 2025, 12 December 2025 (cited as commentary, not as binding authority).
Article prepared by CoinConnect's regulatory advisory team. Last reviewed against published PVARA, SECP, and SBP sources as of 7 May 2026. This article is general guidance and not legal advice. For engagement-specific advice, contact CoinConnect.
Frequently asked questions
No, not under PVARA's NOC Regulations 2025 or the Companies Act 2017. Both regulations require fit-and-proper directors but do not specify residency. However, a Pakistani resident in either the director or CEO role is functionally required to complete bank onboarding, goAML registration, and SBP foreign-exchange formalities. A more accurate framing is that a Pakistan-based authorised signatory is operationally mandatory, even though no single rule names it as such.
Technically yes, but only until one of them is absent from Pakistan for 90 or more consecutive days, at which point an alternate director must be appointed under the Companies Act 2017. In practice, every Pakistan VASP entity ends up with a local director or local CEO within the first 60 days of operations. Designing for this from day one is materially cheaper than retrofitting it later.
A director is a corporate role under the Companies Act 2017. A Key Individual is a regulatory role under PVARA's NOC Regulations 2025 — specifically the CEO, CFO, Compliance Officer, MLRO, Head of Internal Audit, Head of Risk Management, and Head of Information Security. A person can hold both a director seat and a Key Individual role simultaneously, and most CEOs of small VASPs do.
The Regulations do not state this explicitly. However, the no-outsourcing rule for AML-critical functions under Regulation 6 makes it functionally mandatory. A Compliance Officer based in another country cannot meet the same-day STR escalation expectations of the FMU under the Anti-Money Laundering Act 2010, and PVARA's supervision model assumes the function is on-shore.
All foreign nationals serving as directors of a Pakistani company must obtain security clearance from the Ministry of Interior under Section 460 of the Companies Act 2017. The clearance is filed post-incorporation, typically takes 4 to 8 weeks, and remains valid as long as the directorship is held. Failure to secure clearance can lead to disqualification and forced share transfer under the company's pre-agreed undertaking.
In our experience supporting foreign exchanges through PVARA NOC and licensing, identifying, vetting (through the Form A3 Fit & Proper questionnaire), and onboarding a Pakistan-resident CEO with the right financial-services background takes 6 to 10 weeks. This work should run in parallel with the NOC application, not after it. We help clients shortcut this through our local executive network — see services for engagement options.
No. PVARA's Regulations require the Compliance Officer and MLRO to be independent of the CEO function for governance reasons, mirroring international supervisory practice. The CEO can hold a director seat. The MLRO and Compliance Officer must be separate persons (and in larger VASPs, often separate from each other) — never the CEO.