Exchange Services Rulebook (19 May 2025) is issued by the Virtual Assets Regulatory Authority (VARA), Dubai. It is written for financial practitioners, compliance officers, risk managers, and exchange operators assessing operational, governance, and prudential implications in the context of VARA Dubai’s regulatory framework.
Original source: VARA_EN_258_VER20250519
1. Regulatory Context and Scope
VARA, established under Dubai Law No. 4 of 2022, regulates Virtual Asset Service Providers (VASPs) operating in the Emirate. This Rulebook applies specifically to VASPs licensed for Exchange Services, and functions in addition to the core regulatory suite:
- Company Rulebook
- Compliance & Risk Management Rulebook
- Technology & Information Rulebook
- Market Conduct Rulebook
- Other VA-activity-specific rulebooks
Financial practitioners must note: The regulatory framework is cumulative: if an exchange offers multiple VA activities (e.g., custody, broker-dealer, lending), all relevant rulebooks apply concurrently.
2. Governance Requirements for Exchange Operators (Part I)
2.1 Board Composition & Independence
VARA imposes elevated governance standards on exchange operators:
- Board must include executive and non-executive directors, with at least one independent director.
- Independence is strictly defined with multiple conflict-screening criteria, including:
- No senior management or group roles in past 2 years
- No significant ownership (≥10%)
- No material consulting or audit relationships
- No long tenure (>7 years)
- Board must meet quarterly.
Implication for practitioners:
Expect tight governance scrutiny during licensing and ongoing supervision. VARA’s independence tests align with traditional financial-market governance (akin to DFSA/ESMA norms) and may impact investor-appointed directors.
2.2 Mandatory Board Committees
VASPs must maintain as a minimum:
- Remuneration Committee
- Nomination Committee
- Audit Committee
Committees must operate under formal charters and report directly to the Board.
2.3 Board Remuneration Reporting
Annually, exchanges must report all forms of remuneration for Board and committee members to VARA (kept confidential unless legally required).
Implication:
This aligns with governance transparency in regulated financial markets and signals VARA’s prudential focus on conflicts, incentives, and accountability.
3. Policies, Procedures, and Public Disclosures (Part II)
3.1 Mandatory Internal Policies
Exchanges must maintain robust, written policies for:
- Market abuse detection, deterrence, and sanctions
- Client access and withdrawal assurances, including stress-event scenarios
- Settlement, clearing, and delivery procedures
- Transparent pricing methodology, including market-data usage
Policies must be reviewed at least annually.
3.2 Public Disclosure Obligations
Exchanges must publicly publish:
- Conflicts-of-interest disclosures
- Data-privacy, whistleblowing, and client-complaints handling procedures
- For each traded VA:
- token name/symbol
- issuance date
- market cap / FDV
- circulating supply
- most recent smart contract audit
- largest historical drawdown (absolute & percentage)
- Details on custody arrangements, segregation, and client ownership protections
- Pricing methodology
- (If permissible) past convictions of senior management or board members
Implication:
This is one of the most transparency-heavy frameworks globally.
Token listings require a MiCA-style public risk disclosure, signalling VARA’s market-integrity focus.
4. Exchange Operating Rules (Part III)
4.1 Trading Venue Code of Conduct
Exchanges must publish and enforce a trading-venue code of conduct that enables disciplinary actions, including:
- warnings, reprimands
- training or qualification requirements
- remediation plans & compliance audits
- trading restrictions or suspensions
- cancelling orders
- expulsions
- reporting breaches to VARA or referring criminal cases
VARA reserves the right to impose additional disciplinary measures and may delegate enforcement powers to exchanges.
Implication:
Exchanges are expected to operate similarly to regulated securities exchanges, with active market surveillance and disciplinary authority.
4.2 Market Surveillance Requirements
Exchanges must share surveillance information with VARA, including:
- large exposures
- inventory levels
- position-limit changes
- margin escalations
- OTC derivatives information (if correlated)
Fee structures must be transparent and non-distortive.
4.3 Trading Systems Continuity
Systems must ensure:
- resilience and high-capacity performance during volatility
- ability to reject erroneous or oversized orders
- thorough pre-deployment testing
- disaster-recovery and failover capabilities
4.4 Settlement Standards
Final settlement for trades must complete within 24 hours, except where delays are caused by external DLT factors.
Implication:
VARA is setting T+0 settlement as the norm—much faster than traditional markets—reinforcing crypto-native efficiency but requiring robust operational infrastructure.
5. Margin Trading Framework (Part IV)
This is the most detailed and prudentially sensitive section of the Rulebook, reflecting VARA’s concern for leverage risk in crypto markets.
5.1 Margin Trading Licensing
Margin Trading requires explicit VARA authorisation.
A VASP must demonstrate:
- compliance with capital and prudential standards
- pre-approved Margin Trading Agreement
- adequate systems, controls, and liquidity to meet all obligations
VARA may inspect systems before approval.
5.2 Margin Trading Oversight
VARA may unilaterally order:
- suspension of margin trading for specific VAs or clients
- forced closure of client positions
- increases in margin requirements
Implication:
Regulatory intervention mirrors powers typical of securities regulators during periods of systemic stress.
5.3 Client Suitability & Account Controls
VASPs must:
- perform suitability assessments (financial solvency, risk appetite, experience)
- segregate margin accounts
- prevent rehypothecation across clients
- ensure Initial Margin is deposited before leveraged exposure
- monitor risk at client level, even with multiple accounts
5.4 Notifications & Liquidations
Exchanges must:
- provide early-warning notifications as margin thresholds approach
- notify clients immediately once Maintenance Margin is breached
- liquidate if the client fails to remedy shortfalls
5.5 Collateral Rules
Eligible collateral includes:
- financed VA
- fiat
- USD/AED-referencing stablecoins
Other VAs may only be accepted in distressed scenarios (e.g., trading suspensions).
5.6 Initial & Maintenance Margin Definition
For Retail Investors:
- At least 20% of notional position value, or higher if mandated by VARA.
For Qualified / Institutional Investors:
- Determined by VASP policy, subject to VARA raising thresholds.
5.7 Prudential Concentration Limits
- Total margin-allocated funds must be counted in operational exposure calculations.
- Credit exposure to a single client cannot exceed 10% of total margin-allocated funds.
Implication:
This is a bank-style single-name concentration limit, unusual but prudentially strong for VA markets.
5.8 Margin Trading Agreement Requirements
Agreements must include:
- responsibilities, dispute resolution, termination terms
- rights around withdrawals and use of surplus above Maintenance Margin
- details of financing cost calculation
- full risk disclosure (loss of all funds, margin calls, liquidation triggers)
- explicit client consent
- complete fee schedule
- liquidation scenarios and potential post-liquidation liabilities
Implication:
VARA is imposing MiFID-style conduct rules, forcing exchanges to treat margin clients akin to leveraged-investment clients in traditional finance—significant uplift from typical crypto-exchange practices.
