Central Bank of the UAEchapter by chapter

Article 1(2)-(3)

A VASP must collect and transmit specific identification information for both the Originator and Beneficiary during Virtual Asset Transfers.

Article 1(4)-(5)

The Originator's VASP must verify the counterparty VASP's regulation status before executing transfers and ensure Travel Rule information is validated.

Article 1(6)

Originator VASPs may send only a traceable wallet or account number in domestic virtual asset transfers, providing full travel rule data within three working days on request.

Article 1(7)-(8)

Originator VASPs must maintain risk-based policies to detect when a beneficiary VASP cannot receive required transfer information, and use best efforts to establish alternative communication, considering declining further transfers.

Article 1(9)-(14)

Beneficiary VASPs must identify incomplete transfers, verify identities for amounts over AED 3,500, and maintain risk-based transfer policies.

Article 1(15)

The Beneficiary VASP must report any systemic failure by the Originator VASP in providing required information to its Supervisory Authority.

Article 1(16)

VASPs must keep all collected originator and beneficiary information for virtual asset transfers in line with the AML/CFT Executive Regulation's record-keeping requirements.

Article 2(2)-(5)

Intermediary VASPs must verify the regulatory status of originator and beneficiary VASPs before facilitating transfers, log all transfers including rejected ones, and pass originator and beneficiary information onward.

Article 2(6)-(8)

Intermediary VASPs must identify missing transfer information, request it from the sending VASP, consider delaying or returning transfers, apply risk-based procedures, and report systemic information failures to the Supervisory Authority.

Article 3(2)-(4)

A virtual asset service provider must apply enhanced due diligence, including source of funds verification, before transfers to or from unhosted wallets, and apply risk-based policies to incoming transfers lacking required information.

Article 3(5)-(7)

A VASP instructed to send virtual assets to an unhosted wallet must request missing originator information and decline the transfer if it is not provided, applying risk-based assessment.

Article 4(1)

A VASP must weigh originator and beneficiary information to decide whether to file a suspicious transaction report, and if filed, send it to the UAE Financial Intelligence Unit with all relevant transaction information.

Article 5

No UAE virtual asset service provider may execute a transfer of privacy tokens, except where the firm performs virtual asset activities it is licensed or regulated to conduct by a supervisory authority.

Article 1(16) / Article 2(3),(5)-ret

Originator and beneficiary information collected for virtual asset transfers, and intermediary provider records, must be retained for at least five years from the transfer date or relationship end.