Every question. A straight answer.

Domestic: UN Security Council consolidated list, NACTA Schedule I and IV, federal and provincial SROs and notifications, FIA Redbooks, Punjab and Sindh Police red books and absconder lists, relatives and associates of proscribed persons, and NADRA CNIC status lists. Global: UN, OFAC, BIS, EU, UK OFSI, Canada, Australia DFAT, Switzerland SECO, UAE, INTERPOL Red Notices and World Bank debarment. Global PEPs and adverse media are available as an optional Acuris Risk Intelligence subscription.

SROs and government notifications every 3 hours from 09:00 to 21:00. UN, NACTA, OFAC, UK, EU and UAE lists every 24 hours. Domestic PEPs and state-owned enterprises fortnightly. The reputational risk database weekly. FIA Redbooks, provincial lists and NADRA status lists as they are published.

FPM AML-CHECK runs as SaaS on FPM's own cloud facility in Pakistan. Screening records are retained for five years.

No. Your compliance team can screen through the web portal from day one. The API and batch modes are there when you are ready to automate.

Yes. The sandbox credentials and endpoints are published on the Integration page. No sign-up is needed.

Yes. FPM AML-CHECK covers the customer side of VASP compliance. For sandbox and NOC applicants we also co-source the full AML CFT function: technology, operations and trained staff.

Yes. It is built and operated by First Paramount Modaraba in Karachi, an SECP-regulated, PSX-listed Islamic financial institution.

FPM AML-CHECK runs as SaaS on FPM's own cloud facility in Pakistan.

FPM's own team researches domestic sanctions, PEP and reputational risk data. Global PEP and adverse media come through FPM's partnership with Acuris Risk Intelligence.

Yes. NACTA's proscribed persons (Fourth Schedule) and proscribed organizations (First Schedule) are screened in the same check as UNSC, SROs, FIA Redbooks and police lists.

Muhammad, Mohammad and Muhammed are matched as one name. Father's name, date of birth and CNIC then confirm or clear the hit before it reaches your queue.

Yes. When a new SRO, NACTA entry or PEP lands, only the change runs against your customer base, and new matches reach your queue with their source.

Every query, result and decision is kept for five years and can be exported for inspection.

No. Screening accepts 11 of 13 CNIC digits and a city instead of an address. No financial data is needed.

FPM researches and curates domestic sanctions, PEP and reputational risk data in-house. Global sanctions come from the issuing authorities. Global PEPs and adverse media come from Acuris Risk Intelligence, for which FPM is an authorized distribution partner.

Former office-holders are retained after their term ends. Continuing relevance is reviewed. A match you already reported stays on record even if the PEP record is later corrected or removed.

No. Global PEPs and adverse media are an optional Acuris subscription. The default data set covers domestic data and global sanctions.

Yes. It reads the front and back of the CNIC, and passports, into structured fields, including name, father's or husband's name, CNIC number, dates and address.

Yes. Urdu names on the document are converted to Latin script so they can be screened.

Passive liveness runs silently during the selfie for lower-risk onboarding. Active liveness asks the person to blink, turn or read a number for higher-risk accounts.

Yes. Contactless fingerprints are captured on a phone camera as ISO/IEC 19794-2 and WSQ templates, with NADRA verification where your license allows.

Yes. Factors and weights are mapped to the NRA, and you can add, drop or reweight any factor.

Yes. A sanctions, PEP or adverse media hit raises the rating at once and can open an EDD task with a deadline.

Yes. Every score shows the factors and weights behind it and can be exported.

137 rules in eight families, each with its logic, parameters and test cases. You set the thresholds.

Yes. Thresholds change in the portal without code, and every change is logged.

No. Your Compliance Officer files the STR on goAML. FPM AML-CHECK prepares the case file and keeps the full history behind it.

No. The credentials on this page work as published. The sandbox holds test data only.

Yes. Endpoints, request formats and responses match production. Only the data and the credentials differ.

Most teams make a first screening call within an hour. Moving to live depends on your onboarding flow. Our team works with yours throughout.

Yes. One client ID covers the portal, the API and batch. Results from all three appear in the same case history.

Yes. An AML CFT compliance program is a licensing requirement. Applicants on the NOC track register with the Financial Monitoring Unit, and KYC and AML controls are assessed even at the sandbox stage.

The Board. PVARA's licensing framework keeps responsibility for AML CFT/CPF and market integrity controls with the Board, including oversight of any outsourcing.

FPM AML-CHECK covers the customer side: identity, screening, risk scoring and fiat-side monitoring. Pair it with a blockchain analytics provider for wallet screening. We scope that connection with you.

Yes. Our co-sourcing service supplies the technology, the operations and trained staff, while your Board and Compliance Officer keep accountability.

The Virtual Assets Act, 2026. It makes PVARA the federal regulator for virtual asset services, with powers to license, supervise and enforce, and replaces the 2025 ordinance under which PVARA was first constituted.

The Pakistan Virtual Asset Services Regulations, 2026 (S.R.O. 1419(I)/2026) and the Pakistan Virtual Asset Services Activity Specific Regulations, 2026 (S.R.O. 1420(I)/2026). Both took effect on 21 August 2026.

PVARA states there is no Pakistani shareholding requirement and no foreign ownership cap. The licensee must be a company incorporated in Pakistan with at least three directors.

No. Sandbox admission allows supervised testing within an agreed scope. Successful completion lets you apply for a license without a separate NOC. It does not guarantee one.

Operating an unlicensed virtual asset service is an offense punishable by up to five years' imprisonment, a fine of up to PKR 50 million, or both.

It is an outsourcing arrangement you disclose in your application, with your Board overseeing it. We call it co-sourcing because accountability, the Compliance Officer role and the STR decision stay inside your company.

Yes. We recommend you designate your own Compliance Officer from the start. Our senior practitioner works beside that person, and our analysts do the daily work under their direction.

Your Compliance Officer decides and files through FMU's goAML portal. We prepare the case file, the evidence and the narrative draft.

Before you submit. The AML CFT framework, risk assessment and testing plan are part of the application, and they are easier to build once than to fix after a review.

You choose. Continue co-sourcing at a scale that fits your volumes, or move the function in-house with a documented handover and trained staff.

All ten. Exchanges, broker-dealers, custodians, transfer and settlement providers, and token issuers carry the heaviest customer-side AML CFT load.