Fit & Proper Test PVARA: Form A3 Walkthrough for Director and Shareholder Screening (2026)

Form A3 is the Fit & Proper Questionnaire prescribed under the PVARA No Objection Certificate Regulations 2025. It is the form every Key Individual of a Virtual Asset Service Provider must complete and submit, with supporting documentation, as part of the NOC application. Form A3 is not a resume questionnaire. It is a forensic screen of an individual's professional history, financial soundness, and integrity, modelled on the screening regimes of the Monetary Authority of Singapore and Dubai's Virtual Assets Regulatory Authority but adapted to Pakistani regulatory expectations.

PVARA grants or refuses an NOC application substantially on the strength of Form A3 outputs across the applicant's seven Key Individuals plus all Controllers. A defective or weak Form A3 submission is the single most common cause of NOC delays in our experience. A Form A3 that surfaces a serious integrity issue is grounds for outright refusal. Understanding what Form A3 actually screens — and preparing the underlying documentation 6 to 9 months before NOC submission — is the difference between a 60-day NOC turnaround and a 9-month application cycle.

Form A3 is the document that decides your NOC. PVARA's Fit & Proper assessment is binary, not graduated — one Key Individual fails the integrity standard and the entire application pauses until that role is replaced. Replacing a Compliance Officer or MLRO mid-application typically adds 60 to 90 days of fresh documentation cycles.

2. The Four Pillars of Fit & Proper

PVARA's Fit & Proper Test rests on four pillars, each independently assessed. An individual must pass all four to be approved. The Form A3 questionnaire structures its sections around these four pillars.

These four pillars mirror international supervisory practice. Singapore's MAS, Dubai's VARA, the Hong Kong SFC, and the EU's MiCA framework all assess fit-and-proper across substantively the same dimensions. PVARA's framework is structurally aligned, with one important Pakistani specificity: Pakistan's domestic Targeted Financial Sanctions list and PEP definitions are added to the international screens (OFAC, UN, EU, UK).

3. Who Must Submit — The Seven Key Individuals

Under Regulation 5.1 of the NOC Regulations 2025, every NOC applicant must appoint and maintain seven Key Individuals. Each must complete and submit Form A3.
⦁ Chief Executive Officer (CEO) — overall accountability for the entity and its compliance posture
⦁ Chief Financial Officer (CFO) — capital adequacy, financial reporting, SBP foreign exchange compliance
⦁ Compliance Officer — primary contact for PVARA on regulatory compliance
⦁ Money Laundering Reporting Officer (MLRO) — designated officer for STR escalation under AMLA 2010
⦁ Head of Internal Audit — independent assurance on internal controls
⦁ Head of Risk Management — enterprise risk framework
⦁ Head of Information Security — cybersecurity, key management, one-hour incident notification
The seven roles cannot be doubled up beyond limited exceptions. PVARA's regulations specifically require the Compliance Officer and MLRO to be independent of the CEO function. In practice, the CEO can also hold a director seat, but the MLRO and Compliance Officer must be separate persons from the CEO and (in larger VASPs) often separate from each other. The structural reasoning behind the role separation is covered in our [link to /blog/resident-director-pvara-pakistan].

4. Controllers — The 20% Voting Power Threshold

In addition to the seven Key Individuals, every Controller of the applicant must also submit Form A3. PVARA defines Controller, per the NOC Regulations 2025, as any person holding 20% or more of the voting power or share capital of the applicant. Indirect holdings are aggregated up the ownership chain — meaning a beneficial owner with multiple intermediary holding companies is still a Controller if their effective stake crosses 20%.

Why This Matters For Foreign Exchanges
If your Pakistani VASP entity is owned through a chain — say, Pakistani VASP entity owned by a Singapore subsidiary, owned by a Cayman parent, owned by a US-based founding shareholder — the US-based shareholder is a Controller for PVARA purposes if their effective stake in the Pakistani entity is 20% or more. Each Controller in the ownership chain submits Form A3 with full beneficial ownership disclosure under Section 5.

The Pre-AML Registration Approval Requirement
Under Regulation 5 of the NOC Regulations 2025, every Controller must be approved by PVARA before AML registration can be granted. Once registered, no Controller may acquire or increase control above the thresholds determined by PVARA without prior written approval. This means change-of-control transactions post-NOC are not free transactions — they require regulatory approval and fresh Form A3 submission for incoming Controllers.

Practical Impact
Foreign exchanges with VC investors above the 20% threshold often discover at the Controller stage that a particular VC fund's beneficial ownership chain runs into politically exposed persons or sanctioned-jurisdiction connections that complicate the screen. Diligence on your own cap table — including beneficial ownership of fund LPs above 20% — is part of pre-NOC preparation. Surface the issues 6 months before submission, not at the application stage.

5. Pillar 1 — Integrity & Reputation

The integrity pillar is the binary one. PVARA's regulations explicitly disqualify anyone convicted of financial offences or fraud, anyone subject to bankruptcy proceedings, and anyone with previous regulatory sanctions or disqualifications. The Form A3 integrity disclosure requires the individual to declare:

⦁ Criminal convictions — any conviction, anywhere, in any court, for any offence beyond a minor traffic infraction. PVARA does not draw a line at financial offences only; convictions for fraud, money laundering, insider dealing, market abuse, bribery, corruption, or tax evasion are categorically disqualifying
⦁ Pending criminal investigations or proceedings — even where no conviction has occurred, the existence of an active investigation must be disclosed
⦁ Civil judgments for fraud, breach of fiduciary duty, or material dishonesty — these are not categorically disqualifying but require explanation
⦁ Regulatory sanctions — fines, censures, prohibitions, restrictions, or licence revocations from any regulator anywhere, in any sector. This is broader than financial-services regulators alone
⦁ Professional disciplinary actions — sanctions from law societies, accountancy bodies, securities exchanges, or any other professional body
⦁ Director disqualifications — disqualifications under any companies law in any jurisdiction

The 10-Year Window Question

PVARA's Form A3 does not impose a categorical 10-year cutoff for historical disclosures. The questionnaire asks about all matters across an individual's career, with the supervisory expectation that material historical issues are disclosed regardless of age. In practice, settled matters from more than 10 years ago that did not result in a conviction are typically disclosed with mitigating context rather than treated as automatic disqualifiers. Matters from the last 5 to 7 years receive the closest scrutiny.

Closed And Settled Matters
A common foreign-exchange concern: an executive has a settled FCA, MAS, or SEC matter from 5 to 8 years ago that was resolved without admission of wrongdoing or with limited findings. Are they fit and proper? PVARA's assessment is contextual. Settled matters with regulatory cooperation, remediation, and no recurrence are generally compatible with Fit & Proper sign-off. Matters with admission of dishonesty, multiple recurrences, or active enforcement are not. Disclose proactively with full context — non-disclosure that surfaces later via background screening is treated as an integrity breach in itself, often more serious than the underlying matter.

6. Pillar 2 — Competence & Capability

The competence pillar is graduated, not binary. PVARA assesses whether the individual has the qualifications, experience, and demonstrated capability for the specific Key Individual role being undertaken. The assessment varies by role.

Role-Specific Competence Expectations
⦁ CEO — typically 10+ years senior leadership experience, ideally in financial services, fintech, or virtual assets. Experience running a regulated entity is strongly favoured
⦁ CFO — accounting qualification (CA, ACCA, CPA, or equivalent) plus 7+ years senior finance experience. Pakistani-context experience preferred but not required
⦁ Compliance Officer — formal compliance qualification (ICA, ACAMS, or equivalent) plus 5+ years compliance experience in financial services or virtual assets. Pakistan-resident effectively mandatory under the AML-critical no-outsourcing rule
⦁ MLRO — ACAMS certification or equivalent, plus 5+ years AML experience. Pakistan-resident effectively mandatory. Cannot be shared across the parent group's regional entities
⦁ Head of Internal Audit — CIA, CISA, or equivalent qualification plus 7+ years audit experience. Independence of reporting line essential
⦁ Head of Risk Management — formal risk qualification (FRM, PRM, or equivalent) plus 7+ years risk experience covering operational, market, and ML/TF risk
⦁ Head of Information Security — formal security qualification (CISSP, CISM, or equivalent) plus 7+ years information security experience. Crypto-specific experience strongly favoured given the one-hour incident notification obligation

Documentation Required For Competence
⦁ Educational certificates, notarised, with foreign certificates apostilled
⦁ Professional qualification certificates from the issuing body
⦁ Reference letters from at least the last three employers covering the past 10 years
⦁ Detailed CV with role responsibilities, not just job titles
⦁ LinkedIn profile (often verified by PVARA's screening process against the CV)

7. Pillar 3 — Financial Soundness

The financial soundness pillar tests whether the individual is in a position to act objectively and with integrity, free from financial pressure that could distort decision-making. PVARA's NOC Regulations specifically reference no history of bankruptcy or insolvency as part of the Fit & Proper criteria.

What Gets Screened
⦁ Personal bankruptcy or insolvency in any jurisdiction — categorically disqualifying if currently active; closed proceedings older than 5 years are typically not disqualifying with explanation
⦁ Default judgments for material amounts — case-by-case assessment with focus on whether the underlying matter relates to dishonesty
⦁ Credit history — material adverse events, repeated defaults, or current significant arrears
⦁ Tax compliance — outstanding tax liabilities or convictions for tax evasion are disqualifying
⦁ Director liability for unpaid corporate debts where the individual was associated with company failures

Source of Funds — For Controllers
Controllers above the 20% threshold must additionally explain the source of funds used to acquire ownership or control in the applicant. If funds originate offshore, full details of jurisdiction, bank, and transfer pathway are required under Form A3 Section 5. This is the section where ownership structures with thin capital documentation tend to fail — for example, a Cayman-incorporated holding company funded by a single offshore bank transfer with no clear underlying business rationale faces significant explanatory burden.

Practical Mitigation
If your ownership chain has historical capital movements that are difficult to document — common in early-stage crypto entities funded through informal investment rounds, OTC purchases, or pre-2018 transactions — document the chain proactively before NOC submission. Reconstructing a 5-year capital history mid-application is materially harder than building the documentation pre-emptively. Engage a forensic accountant where the chain crosses multiple jurisdictions.

8. Pillar 4 — Sanctions, PEP & Source of Funds

Sanctions Screening

Form A3 requires sanctions screening confirmations against:
⦁ OFAC (US Specially Designated Nationals list)
⦁ UN sanctions (Security Council consolidated list)
⦁ EU sanctions (Common Foreign and Security Policy designations)
⦁ UK sanctions (Office of Financial Sanctions Implementation list)
⦁ Pakistan domestic Targeted Financial Sanctions list — this is the screen that catches most foreign exchanges off guard, because international screening providers don't always ingest the Pakistani list automatically
Match against any of these lists is categorically disqualifying. Near-matches (similar names, common identifiers) require false-positive remediation through documentary disambiguation.

PEP (Politically Exposed Person) Status

Form A3 Section 5 requires disclosure of PEP status for the individual themselves, immediate family members, and close associates. PEP status is not categorically disqualifying — Pakistan, like most FATF-aligned jurisdictions, applies enhanced due diligence (EDD) rather than blanket disqualification. The disclosure must be complete, however; non-disclosed PEP status that surfaces later is treated as an integrity breach.
⦁ Domestic PEPs — current or former senior Pakistani government officials, senior judiciary, senior military officers, senior officials of state-owned enterprises, senior political party officials
⦁ Foreign PEPs — same categories but in foreign governments
⦁ International organisation PEPs — senior officials of international organisations (UN, IMF, World Bank, regional development banks)
⦁ Family members — spouse, parents, siblings, children, in-laws of any of the above
⦁ Close associates — business partners, beneficial owners of joint ventures with PEPs, and other close professional or social associates

9. Documentation Stack You Need to Collect

Across all four pillars, the documentation a single Key Individual needs to assemble for Form A3 submission is substantial. The exchanges that clear Form A3 quickly are the ones that began collection 6 to 9 months before NOC submission. Below is the complete stack.

Document Category	What's Required	Time to Obtain
Identity	Certified passport copy + Pakistan visa (if applicable) + CNIC for Pakistani nationals + NICOP for overseas Pakistanis	1–2 weeks
Education	Notarised educational certificates, apostilled for foreign certificates, with attested translations where original is non-English/Urdu	4–8 weeks
Employment history	Reference letters from each employer in the last 10 years, with dates of employment and role responsibilities	8–12 weeks
Professional qualifications	Original certificates from issuing bodies, with verification letters where the issuing body is foreign	2–4 weeks
Criminal record clearances	Police clearance certificates from every country of residence in the last 10 years (not just country of citizenship)	8–16 weeks (slowest item — start first)
Bankruptcy and insolvency searches	Searches in every country of residence in the last 10 years, plus personal credit reports	2–4 weeks per jurisdiction
Sanctions screening	Independent screening report against OFAC, UN, EU, UK, and Pakistan TFS list — typically through a vendor like World-Check or Refinitiv	1–2 weeks
PEP declarations	Self-certified declarations covering individual, family members, and close associates, with supporting context where PEP status applies	1–2 weeks
Source of funds (Controllers only)	Capital history documentation, bank confirmations, transaction trails, and where applicable, audited financial statements of source entities	4–12 weeks depending on complexity

The longest-lead-time item in this stack is criminal record clearance from foreign jurisdictions. Some countries (notably the US, UK, several EU states, India, and some Gulf states) have multi-month processing times for police clearance certificates. Start this work first, in parallel for every country of residence in the last 10 years, before any other Form A3 work.

10. The Six Most Common Form A3 Failure Modes

1. Incomplete criminal clearance coverage. Submitting clearance only from country of citizenship rather than every country of residence in the last 10 years. PVARA catches this on review and issues a deficiency notice, adding 60 to 120 days while the missing clearances are obtained.

2. Sanctions screening that misses the Pakistan TFS list. Foreign screening providers default to OFAC/UN/EU coverage and don't always include Pakistan's domestic Targeted Financial Sanctions list. Re-running with the Pakistani screen catches names that were missed initially.

3. Reference letters that aren't substantive. Reference letters that merely confirm employment dates without describing role responsibilities don't satisfy the competence pillar. PVARA expects substantive content — what the individual did, what they were responsible for, what outcomes they delivered.

4. Source-of-funds documentation that doesn't reach back far enough. For Controllers, source-of-funds disclosure typically needs to reach back to the original capital event, not just the most recent intermediate transfer. Cayman-style chains with thin documentation between intermediate steps create explanatory gaps.

5. PEP status disclosed only for the individual, not for family. Form A3 explicitly requires PEP screening for spouse, parents, siblings, children, in-laws, and close associates. Non-disclosure of family PEP status is treated more seriously than the underlying status itself.

6. Closed regulatory matters not disclosed because they were 'settled without admission.' Even matters resolved without admission of wrongdoing must be disclosed if they involved a regulator. Non-disclosure that surfaces later via background screening triggers an integrity breach assessment.

11. Timeline — How Long Documentation Realistically Takes

Full Form A3 documentation for seven Key Individuals plus all Controllers above the 20% threshold typically takes 4 to 6 months of dedicated, parallel effort. The wall-clock duration depends on the slowest item, which is almost always foreign criminal clearance.
 

Phase	Timeline	What Happens
Phase 1 — Initiation	Months -9 to -7 before NOC	Identify all seven Key Individuals + Controllers. Issue formal documentation requests. Initiate criminal clearance applications in every country of residence.
Phase 2 — Collection	Months -7 to -3 before NOC	Gather education, employment, qualification, sanctions screening, PEP declarations. Pursue criminal clearances. Begin source-of-funds reconstruction for Controllers.
Phase 3 — Verification	Months -3 to -1 before NOC	Independent verification of all documentation. Internal Form A3 dry run to identify gaps. Address deficiencies before submission.
Phase 4 — Submission	Month 0 (NOC submission)	Form A3 for all Key Individuals and Controllers submitted as part of NOC application. PVARA review begins.
Phase 5 — Remediation	Months 1 to 3 post-submission	Address any PVARA deficiency notices. Some Form A3 supplements typical even on well-prepared applications.

Foreign exchanges that compress this into 2 to 3 months typically slip 6 to 12 months on the overall NOC timeline because the Phase 2 gauntlet post-noc-pakistan-operational-playbook cannot start until Form A3 closes. The 6 to 9 month rule is not optional pacing; it is the actual minimum lead time for foreign criminal clearance and substantive reference collection.

Key Takeaway
Form A3 documentation is the longest-lead-time component of the entire NOC application. Begin 6 to 9 months before NOC. Start with foreign criminal clearance applications for every Key Individual, in every country of residence in the last 10 years, in parallel. Every other Form A3 task is faster than this one and can be paced behind it.

Sources Cited
⦁ PVARA No Objection Certificate Regulations 2025 (Form A3 — Fit & Proper Questionnaire). pvara.gov.pk.
⦁ PVARA Sandbox Guidelines 2026. pvara.gov.pk.
⦁ Virtual Assets Ordinance 2025 (Sections 6, 8, 17). pakistancode.gov.pk.
⦁ Companies Act 2017 (Sections 153, 154, 460 — director eligibility and security clearance). secp.gov.pk
⦁ Anti-Money Laundering Act 2010 (PEP and source-of-funds framework). fmu.gov.pk.
⦁ Pakistan domestic Targeted Financial Sanctions list (NACTA designations). nacta.gov.pk.
⦁ OFAC Specially Designated Nationals list. treasury.gov.
⦁ UN Security Council consolidated sanctions list. un.org/securitycouncil.
⦁ FATF guidance on PEPs (Recommendations 12, 22). fatf-gafi.org.
⦁ MAS Singapore Fit and Proper guidance and Dubai VARA Fit and Proper Test guidance (referenced for international supervisory practice). mas.gov.sg, vara.ae.


Article prepared by CoinConnect's regulatory advisory team. Last reviewed against published PVARA, SECP, FMU sources as of 8 May 2026. This article is general analysis and not legal or regulatory advice.