Original source: VARA_EN_279_VER20250519
1. Regulatory Context & Scope
The Dubai Virtual Assets Regulatory Authority (VARA), established under Dubai VA Law (Law No. 4 of 2022), oversees Virtual Asset Service Providers (VASPs) within the Emirate.
This Lending & Borrowing Services Rulebook supplements the broader Virtual Assets and Related Activities Regulations 2023 and applies to all VASPs licensed to conduct Lending and Borrowing Services in Dubai.
Key Implication for practitioners:
Any firm facilitating crypto lending, yield products, margin lending, or structured borrowing using Virtual Assets (VAs) must comply with these rules in addition to other VARA rulebooks (Company; Compliance & Risk; Technology & Information; Market Conduct).
2. Governance, Policies & Procedures
2.1 Internal Policies (Part I.A)
VASPs must deploy robust written policies covering:
- Client access & withdrawal rights, including operational processes during periods of high uncertainty or extreme volatility.
- Internal reviews of policy effectiveness annually, with corrective actions.
Practical takeaway:
This aligns VA lending operations with traditional financial standards of liquidity risk planning and stress-scenario readiness.
3. Public Disclosures — Transparency & Risk Clarity (Part I.B–D)
3.1 Mandatory Public Disclosures
VASPs must prominently publish:
- Conflicts of interest and management processes.
- Policies on data privacy, whistleblowing, and complaint handling.
- Withdrawal rights and any circumstances that may limit access to VAs.
- Asset-protection arrangements, including custody specifics and how client VAs may be used.
- Whether lending activities are over-collateralised or involve counterparty credit risk.
- Transparent explanations that client VAs may be at risk, including loss likelihood and severity.
- Liquidity-risk management practices.
- Details of any prior convictions or prosecutions involving senior management or board members.
Financial practitioner significance:
These disclosures materially resemble requirements for EU MiCA lending transparency and are designed to prevent “opaque yield products” of the type that triggered failures in Celsius, Voyager, and BlockFi.
3.2 Activity-Specific Disclosure: Interest Terms (Part I.C)
A VASP must clearly disclose:
- The denomination of interest (e.g., paid in-kind or in another VA).
- The APY structure (fixed vs. variable), how it’s calculated, and if estimated.
- Accrual frequency and whether interest is simple or compound.
- Any tiered interest structures.
3.3 Quarterly Lending & Borrowing Asset–Liability Report (Part I.D.2)
Includes:
- VA values held, lent, borrowed.
- Collateral positions.
- How assets are stored or pledged.
This functions similarly to quarterly reserve attestations, strengthening market discipline.
4. Core Operational Requirements (Part II)
4.1 Liquidity & Collateral Adequacy (II.A)
Liquidity Requirements
VASPs must always ensure:
- Sufficient VAs to meet all client obligations.
- Borrowers post adequate collateral, continuously monitored and audited.
Immediate reporting to VARA is required if liquidity may be at risk.
Withdrawal Processing
If withdrawals are permitted within a lending program, VASPs must:
- Enable client withdrawals at all times.
- Process and transfer VAs within 24 hours (unless delays originate from external DLT limitations).
Interpretation:
This is a strong consumer-protection rule, preventing long-term “lock-ups” disguised as flexible lending products.
4.2 Counterparty Due Diligence (CDD) (II.A.6)
VASPs must collect and verify:
- Loan purpose.
- Nature of counterparty business.
- Financial situation & liquidity.
- Other prudent-lender information.
This mirrors bank-grade credit underwriting.
5. Client Reporting & Independent Valuation (Part II.B)
Monthly Client Statements
Must include:
- Total VA holdings.
- All lending/borrowing transactions.
- Interest earned or paid (YTD + monthly).
- Collateral posted.
Independent Valuation Requirement
All client positions must undergo independent valuation.
Implication:
Pricing sources, risk models, and valuation algorithms must be externally verifiable and auditable.
6. Record-Keeping (Part II.C)
VASPs must retain 8 years of:
- All lending/borrowing transactions.
- Client agreements.
- Counterparty info from CDD processes.
Materials must be instantly available for VARA inspection.
This aligns with major financial Recordkeeping mandates (e.g., FCA, MiFID II).
7. Risk Management Expectations (Part II.D)
VASPs must implement:
- Pre-lending risk assessments of each client and each loan.
- Suitability analysis of collateral, including legal pledgeability under UAE law.
- Continuous monitoring of liquidity risk and market risk.
- Continuous monitoring of collateral adequacy and residual risks.
- Independent third-party audits of risk management frameworks.
8. Client Agreements (Part II.E)
Client agreements must detail:
- Assets lent, borrowed, and used as collateral.
- Loan-to-value (LTV) ratios.
- Rights of each party regarding VAs.
- Interest rates, calculation methodologies, variation mechanisms.
- Custody and return process for VAs.
- Client withdrawal rights.
- Statement of risks and potential losses.
- Default events and consequences.
- Complaints procedures.
- Governing law compliance.
Explicit Informed Consent
Critical requirement:
Clients must explicitly and transparently consent to the VASP using their VAs for lending purposes.
This prevents “implied consent” strategies used historically by distressed crypto lenders.
9. Key Themes & Strategic Implications for Market Participants
A. Strong Consumer Protection
VARA is clearly prioritizing investor protection, operational transparency, and liquidity integrity—echoing global post-FTX regulatory sentiments.
B. Institutional-grade Risk Management
Lending businesses must operate like regulated credit institutions, with:
- Counterparty underwriting
- Collateral governance
- Independent valuation
- Rigorous record-keeping
- Third-party audits
C. Alignment With Global Regulatory Trends
The rulebook mirrors elements of:
- EU MiCA Title IV (crypto-asset service providers)
- FCA Consumer Duty
- MAS digital payment token rules
- OCC guidance on custody / lending of digital assets
D. Operational Burden for HNW/Institutional Platforms
Platforms offering:
- yield-bearing accounts
- structured lending pools
- margin facilities
- collateralized VA loans
- staking-enhanced lending products
must now integrate comprehensive legal, risk, treasury, and liquidity frameworks.
10. Practitioner Checklist — Implementation Requirements
Governance & Policies
- Annual review of policies.
- Withdrawals and liquidity stress-plans.
Disclosures
- Website must include all mandatory risk disclosures.
- Quarterly asset–liability reports published.
Due Diligence
- Counterparty KYC + financial assessment.
- Loan purpose verification.
- Ongoing monitoring of liquidity and market risks.
Client Reporting
- Monthly statements fully itemized.
- Independent valuation process in place.
Record Keeping
- 8-year retention system.
- Audit-ready data structure.
Client Agreements
- Transparent, explicit consent for use of VAs.
- Clear rights, LTV, interest mechanics, default terms.
