Enhanced KYC for Corporate Clients: Onboarding VASPs in Pakistan

Onboarding corporate clients in the virtual asset space presents a unique set of challenges compared to individual customers. These entities often have complex ownership structures, multiple layers of management, and diverse operational models. For Virtual Asset Service Providers (VASPs) in Pakistan, understanding and implementing robust Know Your Customer (KYC) and Anti-Money Laundering (AML) checks for these corporate clients is not merely good practice; it is a fundamental regulatory expectation.

The evolving regulatory framework, spearheaded by the Pakistan Virtual Assets Regulatory Authority (PVARA), aims to align Pakistan with international standards set by the Financial Action Task Force (FATF). This alignment necessitates stringent controls to prevent the use of virtual assets for illicit financing, including money laundering and terrorism financing. Corporate entities, due to their potential for obfuscation, are often considered higher risk.

Operators must therefore prepare for comprehensive due diligence requirements that go beyond basic identity verification. A proactive approach to corporate client onboarding will not only ensure compliance but also protect the VASP from significant reputational and financial penalties, highlighting the real cost of non-compliance.

Why do corporate clients require extra checks?

Corporate clients require extra checks because their legal structures can be used to hide the true owners or the source of funds. Unlike individuals, companies can have multiple layers of ownership, making it harder to identify who ultimately controls the entity and benefits from its transactions. This complexity increases the risk of money laundering and terrorism financing.

The inherent complexity of corporate structures makes them attractive vehicles for illicit activities. A corporate entity can be a shell company, a trust, or a partnership, each with varying degrees of transparency. Regulators like PVARA, in line with FATF recommendations, are therefore focused on ensuring that VASPs can “look through” these structures to identify the natural persons who ultimately own or control the client. This process is known as beneficial ownership identification. Failing to properly identify these individuals exposes a VASP to significant risks, as it might inadvertently facilitate transactions for sanctioned entities, politically exposed persons (PEPs), or other high-risk actors. The Securities and Exchange Commission of Pakistan (SECP) also has a role in regulating corporate entities, and its requirements often intersect with those proposed for virtual asset firms, particularly regarding company registration and transparency.

What is corporate Know Your Customer (KYC)?

Corporate Know Your Customer (KYC) involves verifying the identity of a legal entity and understanding its business operations, ownership structure, and the individuals who ultimately control it. This process extends beyond simply checking company registration documents to identify the beneficial owners and assess the associated money laundering and terrorism financing risks.

Effective corporate KYC is a cornerstone of a VASP’s broader Customer Due Diligence (CDD) framework. It involves collecting and verifying a range of information and documents. This is a more involved process than individual KYC, which typically focuses on a single person’s identity and address. For a detailed overview of general CDD practices, operators can refer to our guide on Crypto KYC & CDD for Pakistan’s VASPs. The goal is to build a complete picture of the corporate client, ensuring that the VASP is not unknowingly dealing with illicit actors or facilitating illegal transactions. This process is dynamic and must be revisited regularly, especially if the client’s risk profile changes.

Who is a beneficial owner, and why are they important?

A beneficial owner is the natural person who ultimately owns or controls a legal entity, or the person on whose behalf a transaction is being conducted. They are important because identifying them helps prevent the use of corporate structures to hide illicit funds or activities, ensuring transparency and combating financial crime.

Identifying the beneficial ownership of a corporate client is arguably the most critical component of corporate KYC. PVARA’s proposed rules, mirroring international standards, are expected to require VASPs to identify all natural persons who hold a certain percentage of ownership (e.g., 25% or more of shares or voting rights) or who otherwise exercise control over the entity. This includes individuals who might exert control through other means, such as board positions or significant influence over decision-making, even without direct ownership. Operators need to collect official identification documents for these individuals and verify their identities. Where a VASP identifies a politically exposed person (PEP) among the beneficial owners, enhanced due diligence will be required.

What documents are required for corporate onboarding?

For corporate onboarding, VASPs typically require a wide range of documents including official registration papers, articles of association, shareholder registers, and identification for directors and beneficial owners. Proof of business address, financial statements, and details of the company’s operational activities are also essential.

The exact list of required documents will be detailed in PVARA’s final regulations, but generally, operators should prepare to collect the following:

• Legal Existence and Structure:
  • Certificate of Incorporation or Registration from SECP.
  • Memorandum and Articles of Association (or equivalent constitutional documents).
  • Latest audited financial statements or annual reports.
  • Proof of business address (e.g., utility bill, lease agreement).
• Ownership and Control:
  • Register of Shareholders/Members.
  • Register of Directors/Partners.
  • Organisational chart illustrating the ownership structure, especially if complex.
  • Declarations of beneficial ownership, identifying all natural persons with significant control.
• Individuals Associated with the Entity:
  • National Identity Cards (NICs) or passports for all directors, senior managing officials, and identified beneficial owners.
  • Proof of residential address for these individuals.
  • Details of their roles and responsibilities within the company.
• Business Operations:
  • Description of the company’s business activities and purpose.
  • Information on the anticipated nature of the virtual asset transactions.
  • Details regarding the source of funds and source of wealth for the corporate entity.

How does risk assessment influence corporate onboarding?

Risk assessment significantly influences corporate onboarding by determining the level of due diligence required. Higher-risk corporate clients, identified through factors like complex structures, high-risk jurisdictions, or unusual business activities, will necessitate Enhanced Due Diligence (EDD), while lower-risk clients may undergo simplified procedures.

A robust risk assessment methodology is fundamental to an effective AML programme. Before onboarding, VASPs must assess the money laundering and terrorism financing risk posed by each corporate client. This assessment considers various factors:

• Geographic Risk: Is the company registered or operating in high-risk jurisdictions (e.g., those identified by FATF as having strategic AML/CFT deficiencies)?
• Product/Service Risk: Will the company be using virtual assets or services that are inherently higher risk (e.g., privacy coins, large value transfers)?
• Client Risk: Does the company have a complex or opaque ownership structure? Are any beneficial owners or senior management identified as PEPs or on sanctions lists?
• Transaction Risk: What is the expected volume and value of transactions? Is the purpose of the virtual asset activity clear and consistent with the company’s stated business?

Based on this assessment, the VASP determines whether standard CDD is sufficient or if Enhanced Due Diligence (EDD) is necessary. EDD involves collecting more information, conducting more rigorous verification, and obtaining senior management approval for the relationship.

What is Enhanced Due Diligence (EDD) for corporate clients?

Enhanced Due Diligence (EDD) for corporate clients involves deeper scrutiny due to higher assessed risks. This means collecting more extensive documentation, conducting in-depth background checks on beneficial owners and key personnel, and obtaining senior management approval for the business relationship.

When a corporate client is deemed high-risk, EDD is mandatory. This goes beyond standard CDD and includes measures such as:

1. More Extensive Verification: Independently verifying information through multiple reliable sources. This might involve checking public databases, regulatory filings, or media searches.
2. Increased Understanding of Source of Funds/Wealth: Requiring more detailed evidence regarding the origin of the company’s funds and the wealth of its beneficial owners.
3. Purpose and Nature of Relationship: Gaining a deeper understanding of the rationale behind the company’s virtual asset activities and the expected transaction patterns.
4. Senior Management Approval: Requiring explicit approval from senior management for onboarding and continuing the relationship with high-risk corporate clients.
5. Ongoing Monitoring: Implementing more frequent and rigorous ongoing monitoring of the client’s transactions and activities.

How does a VASP verify corporate information?

A VASP verifies corporate information by cross-referencing documents against official public registers, such as those maintained by the SECP, and by conducting independent searches. This includes verifying the legal existence, registered address, and the identities of directors and beneficial owners through reliable, independent sources.

Verification methods for corporate clients include:

• Official Registries: Checking the company’s registration details against the SECP’s company register. This confirms the company’s legal existence and official address.
• Third-Party Data Providers: Utilising specialised data providers for corporate verification, sanctions screening, and PEP screening.
• Public Information: Reviewing official company websites, annual reports, and reputable news sources to corroborate business activities and management details.
• Direct Contact: Where appropriate and permissible, directly contacting the company’s registered office or a known director to confirm details.
• Independent Document Verification: Using forensic tools or services to check the authenticity of submitted documents, especially for foreign entities.

While PVARA’s proposed rules are at the consultation stage, international best practices strongly suggest these measures.

What are the ongoing monitoring requirements for corporate clients?

Ongoing monitoring for corporate clients involves continuously scrutinising their transactions, updating their KYC information, and reviewing their risk profile to ensure activities align with the VASP’s understanding of their business. This process helps detect unusual patterns or changes in risk.

Once a corporate client is onboarded, the VASP’s obligations continue. Ongoing monitoring is crucial for detecting suspicious activities and ensuring that the client’s risk profile remains accurate. Key aspects include:

• Transaction Monitoring: Implementing systems to analyse transaction patterns, looking for anomalies such as unusually large transfers, frequent transactions with high-risk jurisdictions, or activities inconsistent with the client’s stated business purpose. Our article on Crypto Transaction Monitoring in Pakistan provides further insights.
• Regular Reviews: Periodically reviewing and updating the corporate client’s KYC information, especially for high-risk clients. This includes re-verifying beneficial ownership and checking for changes in directorships or business activities.
• Sanctions and PEP Screening: Regularly re-screening the corporate entity, its beneficial owners, and key management against sanctions lists and PEP databases. Firms should have a robust process for sanctions screening for virtual asset firms in Pakistan.
• Adverse Media Checks: Monitoring for any negative news or adverse media reports related to the corporate client or its key individuals.
• Record Keeping: Maintaining comprehensive records of all due diligence performed, transactions conducted, and any suspicious activity reports filed. Our guide on VASP Record Keeping in Pakistan offers detailed advice.

What are the record-keeping obligations for corporate KYC?

VASPs must retain all corporate KYC documentation, including identification records, beneficial ownership information, risk assessments, and transaction monitoring data, for a prescribed period. These records must be readily accessible to PVARA for auditing and supervisory purposes.

The proposed PVARA framework is expected to align with international standards, which typically require records to be kept for at least five years after the business relationship ends. This includes:

• All documents collected during the initial onboarding process.
• Records of all verification checks performed.
• Details of the risk assessment and any EDD measures applied.
• Correspondence with the client regarding KYC matters.
• Records of ongoing monitoring activities and any internal suspicious activity reports.

Proper record-keeping obligations are vital for demonstrating compliance during regulatory inspections and for assisting law enforcement investigations.

How does this align with FATF recommendations?

Pakistan’s proposed regulatory framework for virtual assets, including corporate onboarding requirements, directly aligns with the Financial Action Task Force (FATF) Recommendation 10 and 24. These recommendations mandate that countries ensure VASPs conduct CDD on legal persons, identify beneficial owners, and take reasonable measures to verify their identity.

FATF Recommendation 10 specifically addresses Customer Due Diligence, requiring financial institutions (including VASPs) to identify and verify their customers and their beneficial owners. Recommendation 24 focuses on transparency and beneficial ownership of legal persons. Pakistan, as an FATF member, is committed to implementing these standards to strengthen its AML/CFT regime. The proposed PVARA regulations, which outline stringent corporate KYC and beneficial ownership identification, are a direct response to these international obligations. Operators can find more details on how these recommendations shape local rules by reading FATF Recommendation 15: Shaping Pakistan’s Virtual Asset Rules.

What role does a Compliance Officer play in corporate onboarding?

A Compliance Officer, often designated as the Money Laundering Reporting Officer (MLRO), plays a central role in corporate onboarding by overseeing the entire KYC/AML process. They are responsible for developing policies, ensuring staff training, reviewing high-risk cases, and reporting suspicious activities to the authorities.

The Compliance Officer is the linchpin of a VASP’s AML/CFT framework. For corporate onboarding, their responsibilities include:

• Policy Development: Designing and implementing robust corporate KYC and EDD policies and procedures, ensuring they meet PVARA’s proposed requirements and international best practices.
• Risk Management: Overseeing the VASP’s risk assessment methodology for corporate clients and ensuring appropriate risk mitigation measures are in place.
• Training: Ensuring that all relevant staff are adequately trained on corporate KYC procedures, beneficial ownership identification, and red flags for suspicious activity.
• Review and Approval: Reviewing and approving high-risk corporate client relationships and EDD cases.
• Reporting: Acting as the primary contact for regulatory bodies and filing Suspicious Transaction Reports (STRs) with the Financial Monitoring Unit if illicit activity is suspected. Understanding what a suspicious transaction report is is critical for this role.

For more on this crucial role, operators can consult our analysis of the MLRO Role in Pakistan’s Virtual Asset Sector.

Comparing Individual and Corporate KYC Requirements

Onboarding both individual and corporate clients requires rigorous Know Your Customer (KYC) checks, but the scope and complexity differ significantly. Corporate onboarding demands a deeper dive into legal structures and beneficial ownership.

This table illustrates that while the underlying principles of AML remain consistent, the practical application for corporate clients is far more intricate and resource-intensive. VASPs in Pakistan must be prepared for this increased complexity as they seek to obtain a VASP licence and serve the corporate sector. For further information on the Pakistan Virtual Assets Regulatory Authority, its mandate, and its role, operators can visit the official PVARA website at https://pvara.org.

About this analysis

This analysis by Sarzif Policy is based on publicly available information regarding proposed virtual asset regulations in Pakistan, including consultation papers and statements from regulatory bodies such as PVARA, SECP, the State Bank of Pakistan, and the FBR. While we strive for accuracy, the regulatory framework for virtual assets in Pakistan is still evolving and subject to change. Specific thresholds, deadlines, and detailed requirements are expected to be finalised by PVARA. Operators are strongly advised to verify all current requirements directly with PVARA or seek independent professional advice. This article is intended for informational purposes only and does not constitute legal or regulatory advice. For more information about our research and editorial standards, please review our editorial policy.