Original source: VARA_EN_347_VER20250519
1. Regulatory Context and Scope
1.1 VARA’s mandate
VARA was established under Dubai VA Law No. (4) of 2022 to regulate all VA Activities in Dubai (excluding DIFC).
VASPs must hold a valid Licence and comply with:
- Company Rulebook
- Compliance & Risk Management Rulebook
- Technology & Information Rulebook
- Market Conduct Rulebook
- All activity-specific rulebooks relevant to the VASP
This rulebook specifically governs transfers, settlements, remittances and related VA movements.
1.2 Implications for financial practitioners
Practitioners must treat VA transfer/settlement operations as regulated payments or post-trade settlement processes, subject to:
- Explicit client authority verification
- Full audit trails (records retained 8 years)
- Segregation and protection of client virtual assets
- Cross-border regulatory compliance for multi-jurisdiction flows
- CBUAE-related payment regulations where applicable
2. Part I – Policies, Procedures, and Public Disclosures
2.1 Mandatory Internal Policies
VASPs must maintain and annually review policies governing:
- Error resolution (non-executed, defective, or incomplete transfers, including refund protocols)
- Default Rules (formal mechanisms for addressing client failures to meet obligations)
- Additional policies requested by VARA
2.2 Public Disclosure Requirements
VASPs must prominently publish on their website:
- Conflicts of interest and how they are managed
- Data privacy, whistleblowing, and complaint-handling frameworks
- Client referral arrangements, including economic benefits
- Third-party custodians or accounts holding client assets
- Convictions/prosecutions of senior management/board members, subject to legal constraints
Key takeaway for practitioners:
VARA mandates high-transparency operating models, similar to MiFID-style disclosure.
3. Part II – VA Transfer & Settlement Rules
3.1 General Requirements
3.1.1 Alignment with CBUAE
VASPs must comply with all payment/remittance-related rules issued by the Central Bank of the UAE, including end-to-end enablement standards.
Operational Reality:
VA transfer businesses may fall under both VARA and CBUAE frameworks, requiring dual-compliance—especially when fiat legs, remittances, or payment-like activities are involved.
3.1.2 Cross-jurisdiction compliance
VASPs must ensure transfers/settlements are legally permissible in every jurisdiction touched by the flow, including:
- Origin
- Intermediaries
- Destination
3.1.3 AML/CFT & Travel Rule
VASPs must implement AML/CFT requirements consistent with FATF expectations:
- Full implementation of the Travel Rule
- Continuous compliance with the Compliance & Risk Management Rulebook
4. Property Interests & Client Asset Protection
4.1 Use of Client Assets is Highly Restricted
VASPs are prohibited from:
- Selling
- Lending
- Rehypothecating
- Pledging
- Converting
- Using client assets
…unless the client has provided explicit prior consent.
Consent does not need to be per-transaction unless the client explicitly requires it.
Implication:
This mirrors best practices in securities custody, elevating client-asset segregation to regulatory requirement—no implicit rehypothecation.
5. Authorisation, Execution Responsibility & Liability
5.1 Client Instruction Controls
VASPs must verify that:
- Every transfer or settlement is explicitly authorised by the client
- Actions always follow the client’s instructions
5.2 Liability for Unauthorized or Incorrect Transfers
If a transfer is incorrect, unauthorised, or not executed according to instructions:
- VASP must refund or restore the client’s account within 24 hours of becoming aware
- VASP is liable for direct client loss
5.3 Sender-Side Obligations
When the client is the sender, VASP is responsible for ensuring receipt by the correct recipient.
If the recipient does not receive the assets:
- VASP must trace the transaction immediately
- Must prove non-liability to escape responsibility
5.4 Recipient-Side Requirements
Recipient VASPs must ensure their systems and wallets are technically ready to receive and provide routing information.
Financial practitioner insight:
This creates a shared liability model, closer to international correspondent banking or SWIFT settlement responsibility standards.
6. Client Disclosures
Before onboarding a client for VA transfer/settlement services, VASPs must disclose:
6.1 Material Risks
- Irreversibility of transactions
- Finality tied to blockchain confirmation times
- Technical risks affecting access to VAs
6.2 Terms & Conditions
- Full fee schedule & calculation methodology
- Execution times
- Rights to stop or amend a pre-authorised transfer
- Liability frameworks for errors
- Error-resolution rights
- Account statement rights
- Receipt issuance rights
Retail Client Protections
For retail:
- 60-day notice for unilateral changes
- Right to terminate without charge before changes take effect
- Right to terminate contract anytime (or within max 30-day notice if agreed)
7. Exchange, Trade, or Conversion During Transfers
If a transfer requires exchange or conversion:
- VASP must use a VARA-licensed Exchange VASP, or VARA-approved foreign entity
- Must be transparent about processes, third-party roles, and fees
- Must act in good faith
- Must complete execution unless blockchain malfunction is outside their control
- VASP remains directly responsible to the client end-to-end
Practical impact:
VASPs cannot avoid responsibility by outsourcing liquidity or conversion functions.
8. Receipts & Reporting Requirements
8.1 Initiation Receipt
Issued immediately upon receiving client instructions:
- Confirmation of initiation
- Timestamp
- Asset type and amount
- Unique identifiers
- Routing information
- Fee breakdown
- Exchange/conversion steps
- Liability and refund policy statements
8.2 Completion Receipt
Issued after final settlement:
- Timestamp of credit
- Asset type/amount
- Transaction references
- Full details of conversions (rates, fees, timings)
All records must be retained 8 years.
9. Benchmark Global Standards Compliance
VARA requires VASPs to align with international standards for financial market infrastructures, including:
- Timely discharge of obligations
- Matching arrangements for trade/transfer instructions
- Delivery/payment arrangements across jurisdictions
- Procedures for settlement failures
- Monitoring client settlement performance
10. Default Rules (Client Failure to Meet Obligations)
VARA mandates that VASPs maintain legally enforceable Default Rules that address financial and operational failures.
10.1 Required Components
Default rules must cover:
- Close-out transfers
- Liquidation of client assets
- Use of default funds
- Rights and liabilities post-default
- Segregation & portability arrangements
- Loss-absorption mechanisms
- Restriction or termination of client access
10.2 Detailed Specifications
Rules must explicitly define:
- Triggering circumstances
- Identification mechanisms
- Deviations from normal settlement processes
- Sequencing of actions
- Responsibilities of VASP, defaulting client, non-defaulting clients
- Containment of chain-effects in the ecosystem
- Credit loss allocation frameworks
- Availability of a default contribution fund
- Porting mechanisms (to non-defaulting participants or third parties)
Rules must be tested annually.
TAKEAWAYS
1. VARA is enforcing FMI-grade operations standards
The rulebook essentially positions VA transfer/settlement services as systemically important services requiring:
- High resilience
- High auditability
- High transparency
2. Liability allocation is strict and client-protective
VASPs bear significant execution liability and must prove they are not at fault.
3. Dual-compliance may apply
For services resembling payments/remittances, CBUAE rules also apply, creating operational overlap.
4. Client-asset segregation is uncompromising
Explicit client consent is required for any use of client assets beyond the transfer itself.
5. Retail client protections are strong
Mirrors global standards for consumer safeguarding in financial services.
6. Default management frameworks resemble clearing-house standards
Expectations include:
- Close-out mechanisms
- Portability
- Loss waterfalls
7. Documentation and disclosure burden
VASPs must maintain robust:
- Policies
- Disclosures
- Receipts
- Settlement records
- Governance transparency
