Advisory Services Rulebook is issued by the Dubai Virtual Assets Regulatory Authority (VARA), tailored specifically for financial practitioners, compliance officers, advisory desks, and institutional service providers operating in or servicing clients in Dubai’s virtual asset (VA) sector.
Original source: VARA_EN_215_VER20250519
1. Regulatory Context and Scope
VARA, established under Dubai Law No. 4 of 2022, regulates Virtual Asset Service Providers (VASPs) operating in the Emirate outside of the DIFC.
This Advisory Services Rulebook supplements the overarching Virtual Assets and Related Activities Regulations 2023, and applies to any VASP licensed to provide Advisory Services.
Key point for practitioners:
Advisory Services regulation does not operate in isolation. A VASP giving advice on VAs must also comply with:
- Company Rulebook
- Compliance & Risk Management Rulebook
- Technology & Information Rulebook
- Market Conduct Rulebook
- All other activity-specific rulebooks tied to a VASP’s licensed activities
This layered compliance structure is intentionally similar to traditional financial supervisory regimes and requires multi-disciplinary alignment between governance, compliance, tech infrastructure, and front-office advisory functions.
2. Part I — Policies, Procedures & Public Disclosures
2.1 Internal Policies and Procedures
VASPs must maintain documented, enforceable internal policies addressing:
a. Independence of Advice
- Advice must be demonstrably free from conflicts, inducements, or internal product-pushing pressures.
- Practitioners must ensure advisory rationale is supported by objective analysis, not commercial incentives.
b. Staff Competency Controls
These policies must define:
- Competency thresholds
- Training requirements
- Assessment schedules
- Thresholds to approve advisors for client-facing roles
c. Annual Effectiveness Reviews
All policies must be assessed annually for effectiveness, aligning with global best practices in investment advisory governance.
2.2 Public Disclosure Obligations
VASPs must publish clear, prominent, and comprehensive disclosures on their websites or accessible public channels.
Mandatory Public Disclosures Include:
- Conflicts of Interest Framework
- Identification of actual/potential conflicts
- Mitigation and management strategies
- Key Policies
- Data privacy
- Whistleblowing
- Client complaint handling
- Client Referrals and Introductions
- Whether clients are referred externally
- Terms of such arrangements
- Monetary or non-monetary benefits received
- Use of Third-Party Asset Custody
- Identity of any third-party custodians or account maintainers
- Additional VARA-required disclosures
Additional Optional (but VARA-permitted) Disclosures:
- Past convictions or prosecutions of board or senior management members
- Other information VARA may request
Significance for practitioners:
These requirements mirror MiFID-style transparency standards. They are designed to prevent opaque advisory ecosystems and protect retail and institutional clients from misaligned incentives.
3. Part II — Advisory Services Rules
3.1 Client Suitability & Best Interest Standard
This is the core of the Rulebook. VARA imposes a best-interest obligation, similar to fiduciary-like advisory regimes.
Key Requirements:
a. Risk Comprehension
Clients must understand:
- VA investment risks
- Sector volatility
- Liquidity limitations
- Smart contract, protocol, custody and counterparty risks
Practitioners must maintain documented evidence of risk disclosures provided.
b. Suitability Assessment Factors
Advice must be individually suitable, considering:
- Client knowledge & experience
- Investment objectives:
- Risk tolerance
- Investment horizon
- Targeted VA venues and strategies
- Financial circumstances:
- Ability to absorb losses
- Relative VA exposure as a % of net worth
c. Information Collection & Retention
- VASPs must collect required client information, verify accuracy, and maintain records for 8 years, aligning with international financial sector norms.
d. Suitability Justification
Each advisory recommendation must explicitly state why it is appropriate, referencing the above suitability factors.
e. Anti-Bias Requirements
VASPs must eliminate:
- Conscious bias (discrimination, targeted upselling, product favoritism)
- Non-conscious bias (algorithmic, procedural or behavioural biases)
This indicates VARA’s focus on fair client treatment, particularly for retail and new-to-crypto clients.
3.2 Staff Competency Requirements
Practitioners providing VA advice must meet rigorous competency standards.
Assessment factors include:
- Relevant academic and professional qualifications
- Experience in the VA sector, including international prior roles
- Experience in regulated investment advisory functions
- Working knowledge of the VARA regulatory framework
- Industry standards applicable to VAs
Interpretation:
VARA expects advisors to meet traditional financial advisory competence standards, not merely crypto-native experience.
3.3 Verification of Information
Advisors must:
- Ensure advice does not include misleading or deceptive information
- Verify factual accuracy against reliable source materials
- Use best efforts to ensure continued accuracy over time
This aligns with global regulatory expectations for research integrity and due diligence, echoing standards found in MiFID, FCA COBS, and SEC regulations.
3.4 Advisory Methodology
VASPs must:
- Evaluate a diverse and broad range of Virtual Assets
- Ensure that considered assets sufficiently meet the client’s investment objectives
This explicitly discourages:
- Single-asset recommendations
- Narrow ecosystems
- Recommendations limited to affiliated tokens
Practitioners must maintain a methodologically structured approach to VA assessment (e.g., risk frameworks, protocol evaluations, liquidity profiles, tokenomics assessments).
4. Practical Implications for Financial Practitioners and Advisory Teams
A. Advisory Governance
- Establish VA-specific suitability frameworks modelled on TradFi investment suitability.
- Maintain centrally documented methodologies for evaluating digital assets.
B. Compliance Integration
- Cross-link advisory policies with AML, risk management, cyber, conduct and technology requirements.
- Build audit-ready evidence trails for each piece of advice given.
C. Product & Offering Controls
- Maintain asset selection frameworks that include:
- Liquidity analysis
- Protocol risk
- Counterparty/custody risk
- Token classification
- Concentration metrics
D. Staff Qualification Programs
- Develop in-house or external certification pathways for advisors covering:
- VA market structure
- Regulatory obligations
- Portfolio risk
- Client suitability practices
E. Client Disclosure Engines
- Automate generation of suitability statements and conflict disclosures.
- Implement structured systems for capturing, verifying, and updating client information.
