VARA Company Rulebookchapter by chapter

Company Rulebook VIII.B

VARA can suspend or revoke a licence if a Virtual Asset Service Provider ceases activities without proper notification; notice must be provided at least 30 days in advance.

Company Rulebook VIII.C

No changes in control of a Virtual Assets Service Provider can occur without VARA’s prior written approval, requiring a joint application.

I.A.1

Transparent company structure. VARA Company Rulebook Clause I.A.1 requires Virtual Asset Service Providers to maintain a clear and transparent company structure that enables effective VARA supervisory oversight and supports the sound, orderly operation of the business. This is a foundational structural requirement underpinning the ownership-transparency, Board-governance and delegated-authority obligations set out elsewhere in the Company Rulebook, and applies to every VASP regardless of its licensed Virtual Asset Activity, from initial licensing throughout the life of the Licence.

I.A.2

Licensed legal entity requirement. VARA Company Rulebook Clause I.A.2 requires a Virtual Asset Service Provider to have and maintain a legal entity established in the Emirate, formed under a legal form approved by a commercial licensing authority. This ensures every VASP operates through a properly constituted, licensable corporate vehicle recognised under UAE commercial law, rather than an informal or unrecognised arrangement, and forms the jurisdictional and legal-personality basis on which VARA grants and supervises a Virtual Asset Activity Licence.

I.A.3

Chain of ownership and Ultimate Beneficial Owner transparency. VARA Company Rulebook Clause I.A.3 requires a VASP to maintain a company structure with a clear chain of ownership, delegated authority and voting rights, so that VARA can identify the VASP's Controlling Entities and Ultimate Beneficial Owners at all times. This underpins VARA's ability to conduct ownership-based supervisory oversight, fit and proper assessments of controllers, and anti-money laundering beneficial-ownership checks across the full corporate chain, however many layers it involves.

I.A.4

Disclosure of complex or decentralised structures. VARA Company Rulebook Clause I.A.4 requires a VASP adopting a complex structure — such as trusts, nominee arrangements, Decentralised Autonomous Organisations (DAOs) or decentralised governance models — to furnish VARA, both during licensing and on request, with the reasons for adopting that structure, its relationship with any relevant DAO or decentralised entity, the potential compliance impact, and whether such entities are legally recognised in other jurisdictions. This gives VARA the information needed to supervise non-standard corporate and governance arrangements.

I.A.5

Prior approval for material structural change. VARA Company Rulebook Clause I.A.5 requires a VASP to obtain VARA's prior written approval before any material change to its company structure — including changes to Controlling Entities or Ultimate Beneficial Owners — or before adopting decentralised governance. The VASP must supply supporting information, conduct additional due diligence on new owners, and comply with any additional conditions VARA imposes, including Politically Exposed Person and sanctions declarations, before the change may proceed.

I.B.1.a

Board composition and Fit and Proper approval. VARA Company Rulebook Clause I.B.1.a requires the Board of a VASP to comprise suitably qualified individuals possessing the requisite skills, knowledge and expertise for their role. Each Board member must first be assessed by the VASP, and then separately approved by VARA, as a Fit and Proper Person before appointment, linking Board composition directly to the Fit and Proper Requirements set out in Chapter III of the Company Rulebook and giving VARA a supervisory gate over who may sit on a VASP's Board.

I.B.1.b

Board appointment and removal procedures. VARA Company Rulebook Clause I.B.1.b requires a VASP to adopt a clear and effective procedure for selecting and appointing Board members, including filling vacancies, and for removing Board members, and to embed these procedures within its constitutional documents rather than leaving them as informal practice. This ensures Board membership changes follow a documented, repeatable governance process that can be reviewed by VARA and is not left to ad hoc decision-making by Senior Management or existing Board members.

I.B.1.c

Annual Fit and Proper reassessment of Board members. VARA Company Rulebook Clause I.B.1.c requires the Board to reassess and confirm each Board member's Fit and Proper status at least annually, and to promptly reassess any member who may have ceased to meet that status. Where a member is found to no longer be Fit and Proper, the Board must remove them, with written notice, and arrange a replacement. This creates an ongoing, not merely point-in-time, Fit and Proper compliance obligation running throughout a Board member's tenure.

I.B.1.d

Consistency of Board constitutional changes. VARA Company Rulebook Clause I.B.1.d requires any change to the constitution of the Board to comply with the Board composition requirements in Clause I.B.1.a and the appointment/removal procedure requirements in Clause I.B.1.b. This ensures that amendments to how the Board itself is constituted — for example changing its size or structure — cannot be used to circumvent the qualification, Fit and Proper approval, or documented appointment-and-removal procedures otherwise mandated for Board membership.

I.B.1.e

Chairman election process. VARA Company Rulebook Clause I.B.1.e requires the Board of a VASP to establish a process for electing a chairman, who is responsible for overseeing the effective functioning of the Board and its committees. The chairman's role is a governance-structure requirement distinct from the Board's general composition and appointment rules, ensuring there is a clearly designated individual accountable for how Board and committee meetings and processes are run, rather than diffuse or undefined leadership.

I.B.1.f

Annual Board performance assessment. VARA Company Rulebook Clause I.B.1.f requires the Board to carry out an annual assessment — engaging external experts where needed — of the Board as a whole, its committees, and its individual members, to review their performance. This performance-evaluation obligation is distinct from the annual Fit and Proper reassessment under Clause I.B.1.c, focusing instead on the effectiveness and functioning of governance arrangements rather than an individual member's continuing eligibility to serve.

I.B.2.a

Procedural rules and constitutional documents. VARA Company Rulebook Clause I.B.2.a requires the Board to establish, and regularly update, the VASP's procedural rules and constitutional documents describing its organisation, responsibilities and procedures. This is a standing documentation obligation ensuring the VASP's internal governance framework is captured in writing and kept current, rather than being an informal or unwritten set of practices, and forms the reference point against which the VASP's actual governance conduct can be assessed by VARA.

I.B.2.b

Board accountability for compliance culture. VARA Company Rulebook Clause I.B.2.b requires the Board, and each of its members, to take full responsibility for the VASP's fair and orderly operations, for compliance with all applicable laws and regulatory requirements, and for embedding a professional compliance culture throughout the organisation. This establishes personal, collective Board accountability for regulatory compliance, rather than treating compliance as a matter delegated exclusively to Senior Management or the Compliance Officer.

I.B.2.c

Board communication with the business. VARA Company Rulebook Clause I.B.2.c requires the Board to engage in regular, effective communication with its committees, Senior Management, Staff and Group Entities, so that it remains continually and timely apprised of the VASP's business, operations and financial position. This ongoing information-flow obligation ensures the Board's oversight is grounded in current, accurate knowledge of the business rather than periodic or stale reporting.

I.B.2.d

Senior Management authorisation and reporting policies. VARA Company Rulebook Clause I.B.2.d requires the Board to establish and maintain clear policies and procedures setting out the authorisation process within Senior Management, the authority delegated to each Senior Management member, and Senior Management's reporting lines. This documentation requirement gives structure and traceability to who within Senior Management may take which decisions and to whom they report, supporting the Board's oversight of delegated authority.

I.B.2.e

Ongoing supervision of delegated authority. VARA Company Rulebook Clause I.B.2.e requires that, where the Board delegates authority to committees or Senior Management, it must continue to supervise that delegated authority, remain primarily responsible for it, and establish effective systems and procedures to supervise Staff acting under delegation. Delegation therefore does not discharge the Board of ultimate responsibility; it must maintain active oversight mechanisms over how delegated powers are exercised throughout the organisation.

I.B.2.f

Annual review of performance and suitability. VARA Company Rulebook Clause I.B.2.f requires the Board, at least annually, to review the VASP's performance and the practical and professional experience and suitability of Board members and Senior Management, benchmarked against current global Virtual Asset industry standards. This links Board and Senior Management suitability review to evolving sector practice, rather than a static, one-time qualification standard set at appointment.

I.B.2.g

Access to up-to-date policies and procedures. VARA Company Rulebook Clause I.B.2.g requires the Board to ensure that all Entities and contractors performing functions on the VASP's behalf have access to, and understand, the applicable, up-to-date policies and procedures relevant to their functions. This obligation extends the Board's governance responsibility beyond internal Staff to cover any external party — including Outsourced Service Providers — carrying out functions for the VASP.

I.B.2.h.i

Timely internal and external reporting. VARA Company Rulebook Clause I.B.2.h.i requires the Board to define clear reporting requirements so that internal and external reports — including regulatory reports to VARA — can be prepared in a timely manner. This is a governance-level reporting-infrastructure obligation, ensuring the VASP has defined processes capable of producing accurate reports on schedule, rather than relying on ad hoc or reactive report preparation.

I.B.2.h.ii

Record retention policy. VARA Company Rulebook Clause I.B.2.h.ii requires the Board to establish and maintain effective record retention policies that comply with applicable laws and regulations, and that enable the VASP, its auditors, and interested parties — including VARA — to carry out reviews or investigations. This obligation sits at the governance level, requiring the Board itself to own and maintain the record-retention framework rather than treating it as a purely operational or IT matter.

I.B.3.a

New Board member induction and training. VARA Company Rulebook Clause I.B.3.a requires a VASP to ensure new Board members receive training covering the VASP's company structure, corporate governance, business and other relevant matters — including the VASP's background and strategy, financial and operational aspects, Board members' obligations and duties, the functions of committees, and key global Virtual Asset sector risks. This induction-training obligation ensures incoming Board members are equipped to discharge their governance duties from the outset of their tenure.

I.B.3.b

Annual review of Board training programme. VARA Company Rulebook Clause I.B.3.b requires the Board to review the scope and accuracy of its Board training programme annually and to revise it if necessary. This is a distinct, standing quality-control obligation over the training content itself, ensuring the induction and ongoing training curriculum required under Clauses I.B.3.a and I.B.3.c remains current and fit for purpose as the VASP's business and the Virtual Asset sector evolve.

I.B.3.c

Ongoing Board training. VARA Company Rulebook Clause I.B.3.c requires a VASP to provide regular, timely and up-to-date training to all Board members on matters relevant to the VASP's interests and to Virtual Asset markets generally. This ongoing training obligation is distinct from the new-member induction training required under Clause I.B.3.a, extending the training requirement across a Board member's full tenure rather than confining it to onboarding, given the pace of change in Virtual Asset markets and regulation.

I.C.1

Appointment of Responsible Individuals. VARA Company Rulebook Clause I.C.1 requires a VASP to appoint two individuals of sufficient seniority as Responsible Individuals, who are accountable for the VASP's compliance with all of its legal and regulatory obligations. The two-Responsible-Individual requirement creates a defined, named point of personal accountability to VARA for regulatory compliance, distinct from the collective accountability the Board bears under Clause I.B.2.b, and applies to every VASP regardless of size.

I.C.2

Eligibility of Responsible Individuals. VARA Company Rulebook Clause I.C.2 requires each Responsible Individual to be a full-time employee of the VASP, a Fit and Proper Person, and either a UAE resident or a UAE passport holder, and to be notified to, and approved by, VARA during the licensing process. These eligibility conditions ensure Responsible Individuals have both the requisite regulatory standing and a genuine, ongoing UAE nexus and employment relationship with the VASP, rather than being nominal or offshore appointees.

I.C.3

Ongoing eligibility validation for Responsible Individuals. VARA Company Rulebook Clause I.C.3 requires a VASP to ensure its Responsible Individuals continue to meet the eligibility requirements in Clause I.C.2 at all times, validating that continued eligibility and recording the validation on an annual basis. This creates a standing, documented annual check distinct from the one-off approval obtained at appointment, mirroring the annual Fit and Proper reassessment applied to Board members under Clause I.B.1.c.

I.C.4

Notification of change of Responsible Individual. VARA Company Rulebook Clause I.C.4 requires a VASP to notify VARA and obtain approval before any change of Responsible Individual. Where the change arises from unforeseen circumstances and prior notification is not possible, the VASP must instead notify VARA immediately and explain how the eligibility and accountability requirements for Responsible Individuals will continue to be met during the transition, ensuring continuous regulatory coverage of this role.

I.D.1

Senior Management structure documentation. VARA Company Rulebook Clause I.D.1 requires a VASP to establish, document and maintain a management structure that clearly sets out Senior Management's roles, responsibilities, authority and accountability. This documentation obligation gives Senior Management the same kind of documented structural clarity that the Company Rulebook requires of the Board and the wider company structure, ensuring management accountability lines are explicit rather than assumed.

I.D.2

Senior Management competence. VARA Company Rulebook Clause I.D.2 requires a VASP to ensure that Senior Management comprises suitably qualified individuals possessing the requisite skills, knowledge and expertise for the global Virtual Asset sector. This qualification standard applies the same competence expectation to Senior Management as Clause I.B.1.a applies to Board members, reflecting the specialised nature of Virtual Asset business relative to conventional financial services management.

I.D.3

Senior Management appointment procedure. VARA Company Rulebook Clause I.D.3 requires the Board to adopt a clear process for selecting and appointing Senior Management, and to embed that process in the VASP's constitutional documents. As with Board appointments under Clause I.B.1.b, this ensures Senior Management appointments follow a documented, repeatable governance process rather than informal or unstructured selection, covering both new appointments and the filling of vacancies as they arise.

I.D.4

Senior Management's role under Board direction. VARA Company Rulebook Clause I.D.4 requires Senior Management to act under the Board's direction and oversight, managing the VASP's day-to-day activities in compliance with applicable laws and with Board-approved objectives and policies. This clause fixes the governance hierarchy between the Board and Senior Management, confirming that day-to-day management authority is exercised subject to, and within the bounds set by, the Board.

I.D.5

External positions held by Senior Management. VARA Company Rulebook Clause I.D.5 provides that Senior Management members, other than the Compliance Officer or the head of internal audit, may only hold external Board or employee positions with the Board's prior written approval and after conflicts-of-interest screening. The Compliance Officer and the head of internal audit are prohibited outright from holding any external Board position, reflecting the heightened independence expected of those two control functions.

I.D.6

Pre-existing external board positions. VARA Company Rulebook Clause I.D.6 provides that where a Senior Management member already held a position on another Entity's board before joining the VASP, continuation in that position is only permitted where the Board, after screening, is satisfied that no conflicts of interest arise. This extends the conflicts-of-interest control in Clause I.D.5 to pre-existing external appointments, not only new ones sought after joining the VASP.

I.D.7

Board assessment of Senior Management performance. VARA Company Rulebook Clause I.D.7 requires Senior Management to furnish the Board with all information needed to supervise and assess its performance, with the Board's assessment to be conducted at least annually. This information-provision obligation on Senior Management is the operational counterpart to the Board's annual performance-review obligation under Clause I.B.2.f, ensuring the Board has the data it needs to carry out that review.

I.E.1

Independent Company Secretary appointment. VARA Company Rulebook Clause I.E.1 requires the Board to appoint a Company Secretary who is independent of Senior Management and reports directly to the Board, with authority and remuneration set by Board resolution unless the VASP's constitution provides otherwise. The independence requirement separates the Company Secretary function from management influence, positioning the role as a governance-support function accountable to the Board rather than to Senior Management.

I.E.2

Company Secretary's Board administration duties. VARA Company Rulebook Clause I.E.2 requires the Company Secretary to administer Board and committee meetings end-to-end: documenting and signing minutes, keeping Board reports, circulating agendas and papers, giving advance notice of meeting dates, circulating draft minutes for member comment, ensuring members receive full copies of minutes and documents, retaining meeting records, and supporting and coordinating between the Board and Senior Management. This defines the Company Secretary as the custodian of Board process and record-keeping.

I.E.2.i

Communication of Board and committee resolutions. VARA Company Rulebook Clause I.E.2.i requires the Company Secretary to inform Staff, including Senior Management, of Board and committee resolutions relevant to their roles, and to report on the implementation of those resolutions. This ensures Board and committee decisions are actively communicated down through the organisation and their implementation tracked, rather than remaining confined to Board-level minutes and papers.

I.E.2.l

Board disclosure record. VARA Company Rulebook Clause I.E.2.l requires the Company Secretary to regulate the Board's disclosure record in accordance with the Market Conduct Rulebook, and to assist and advise Board members on disclosure matters. This links the Company Secretary's governance-administration function to the VASP's public and regulatory disclosure obligations, positioning the role as the point of coordination for Board-level disclosure compliance.

I.E.3

Outsourced Company Secretary appointments. VARA Company Rulebook Clause I.E.3 provides that where the Board appoints an external entity to act as Company Secretary, that appointment is treated as an Outsourcing arrangement and must comply with the Outsourcing Management requirements set out in Part IV of the Company Rulebook. This ensures external Company Secretary appointments are subject to the same due diligence, agreement-content and monitoring standards as any other Outsourced function.

II.A.1

Staff and Board competence assessment framework. VARA Company Rulebook Clause II.A.1 requires a VASP to establish and maintain policies and procedures ensuring the Board, Senior Management and Staff are suitably qualified for their posts, assessed against criteria including academic credentials, professional qualifications, professional experience, awards and honours, and professional memberships. This corporate-governance-chapter obligation applies the competence principle across the entire organisation, not only to the Board and Senior Management roles separately addressed in Chapter I.

II.A.2

Qualified appointments to supervisory positions. VARA Company Rulebook Clause II.A.2 provides that the Board may only appoint Staff with relevant experience and qualifications to supervisory positions, having regard to the responsibilities of the role and the specific Virtual Asset Activities involved. This narrows the general competence principle in Clause II.A.1 into a specific, enforceable gatekeeping rule that the Board must apply at the point of every supervisory-level appointment.

II.B.1

Segregation of policy, supervisory and operational functions. VARA Company Rulebook Clause II.B.1 requires the Board to ensure that policy formulation, supervisory or advisory functions, and internal review functions are effectively segregated from operational duties, in order to maintain internal controls and avoid undetected errors or abuses. This is a structural internal-controls requirement, preventing the same individuals from both setting and executing policy without independent oversight.

II.B.2

Segregation of operational duties. VARA Company Rulebook Clause II.B.2 requires the Board to ensure that operational duties — including sales, dealing, accounting, settlement, and safekeeping of Virtual Assets — are effectively segregated from one another, to minimise conflicts of interest, errors or abuses. This complements the higher-level segregation required under Clause II.B.1 by mandating separation within the operational functions themselves.

II.B.3

Independence of compliance and internal audit. VARA Company Rulebook Clause II.B.3 requires the Board to ensure that compliance and internal audit functions are effectively segregated from, and independent of, operational and related supervisory functions. This preserves the objectivity of the VASP's control functions, ensuring compliance and internal audit are not compromised by reporting into, or being evaluated by, the business areas they are responsible for monitoring.

II.C.1

Avoidance of conflicts of interest. VARA Company Rulebook Clause II.C.1 requires a VASP to use all reasonable efforts to avoid conflicts of interest arising among the Group, the VASP itself, the Board, Staff, clients and investors, and, where a conflict cannot be avoided, to ensure it is disclosed to affected clients. This establishes avoidance as the primary standard, with disclosure operating as the fallback where avoidance is not achievable.

II.C.2

Disclosure and management of client-transaction conflicts. VARA Company Rulebook Clause II.C.2 requires that, where the VASP, a Board member or Staff has an interest that could impair objectivity in a client transaction, the VASP must promptly disclose the conflict to the affected client and manage or minimise it — for example through information barriers — to protect the client's interests. This applies the general conflicts-avoidance principle in Clause II.C.1 to the specific context of individual client transactions.

II.C.3(a)

Written conflicts of interest policy. VARA Company Rulebook Clause II.C.3(a) requires a VASP to establish and implement written internal policies and procedures for identifying, and then managing or resolving, any actual or potential conflicts of interest. This documentation requirement operationalises the general conflicts-avoidance and disclosure principles in Clauses II.C.1 and II.C.2 into a formal, written policy framework that Staff can apply consistently.

II.C.3(b)

Conflicts of interest register. VARA Company Rulebook Clause II.C.3(b) requires a VASP to maintain a special register recording conflicts of interest and the management or remedial measures taken in respect of each, in detail. This record-keeping obligation provides an auditable trail of how the VASP has identified and addressed conflicts under its Clause II.C.3(a) policy, supporting VARA's supervisory review of the VASP's conflicts-management practice.

II.C.4

Board member conflict disclosure in meetings. VARA Company Rulebook Clause II.C.4 requires that, where a Board member discloses a material interest in a transaction under consideration, the remaining Board members must consider whether that member should continue participating in the meeting, the conflicted member must not vote on the matter, and the Company Secretary must record the conflict in the Board minutes. This sets the specific procedural mechanics for handling a disclosed Board-level conflict of interest in real time.

II.C.5

Independence claims and third-party remuneration. VARA Company Rulebook Clause II.C.5 provides that a VASP representing itself as independent when conducting a Virtual Asset Activity must not receive fees, commissions or other benefits from any Entity other than the end client for that activity, and must not have close links or relationships likely to impair its independence in favour of a third party. This protects the integrity of any independence claim a VASP makes to clients or the market.

II.D.1

Shareholder and stakeholder disclosure policies. VARA Company Rulebook Clause II.D.1 requires the Board to establish and maintain effective policies and procedures to disclose necessary information clearly, correctly and in an orderly manner to shareholders and relevant stakeholders. This is the governance-level policy obligation underpinning the specific public-disclosure and website requirements set out elsewhere in Chapter II, ensuring disclosure is governed by a documented Board-owned framework rather than ad hoc practice.

II.D.2

Website disclosure requirements. VARA Company Rulebook Clause II.D.2 requires a VASP's website to include all information required to be disclosed to the public under applicable laws, the Market Conduct Rulebook, and other applicable VARA Rulebooks. This makes the VASP's website the designated public channel through which statutory and regulatory disclosure obligations originating across multiple Rulebooks must be consolidated and made accessible to clients and the market.

II.D.3

Periodic review of disclosure practice. VARA Company Rulebook Clause II.D.3 requires the Board to periodically review the VASP's disclosure policies and procedures and ensure they comply with Virtual Asset industry best practices. This is a standing quality-assurance obligation over the disclosure framework established under Clause II.D.1, ensuring it keeps pace with evolving market norms rather than remaining static once adopted.

II.E.1

Group Subsidiary governance framework. VARA Company Rulebook Clause II.E.1 requires a VASP to establish a framework for governing its Subsidiaries within the Group, with the Board responsible for determining how Subsidiary governance is addressed and conducted. This extends the VASP's own governance obligations down through its corporate Group, ensuring Subsidiaries are not governed outside the oversight of the licensed entity's Board.

II.E.2

Board approval of Subsidiary governance framework. VARA Company Rulebook Clause II.E.2 requires the Board to approve the Subsidiary governance framework — which sets out the powers exercised within Subsidiaries — and to ensure that Subsidiary boards implement it. This gives the parent VASP's Board formal sign-off authority over, and an implementation-assurance obligation for, how governance actually operates at the Subsidiary level.

II.E.3

Content of the Subsidiary governance framework. VARA Company Rulebook Clause II.E.3 requires the Subsidiary governance framework to address the VASP's rights and roles planning in respect of Subsidiaries, Subsidiary-level policies and procedures, Board participation before electing Subsidiary board members, and restrictions on using Group board information outside the relevant Group company. This sets the minimum substantive content the framework required under Clauses II.E.1 and II.E.2 must cover.

II.E.4

Verification of Subsidiary governance performance. VARA Company Rulebook Clause II.E.4 requires a VASP to verify the performance of its Subsidiary governance framework. This is a standing assurance obligation distinct from establishing and approving the framework itself under Clauses II.E.1 and II.E.2, requiring the VASP to actively confirm the framework is working in practice rather than assuming compliance once it has been adopted.

II.F.1

Governance of insider transactions. VARA Company Rulebook Clause II.F.1 requires the Board to implement rules to govern and monitor transactions undertaken by Board members and Staff, to ensure compliance with the Regulations and the Market Conduct Rulebook. This links the Company Rulebook's internal governance requirements to the market-conduct standards governing personal dealing and insider transactions by those with access to material non-public information.

II.G.1

Board consent for material Related Party transactions. VARA Company Rulebook Clause II.G.1 prohibits a VASP from entering into a transaction with a Related Party that exceeds 5% of its issued share capital without the Board's prior written consent, and requires further written Board consent before proceeding under materially changed terms. The 5%-of-share-capital threshold defines the materiality gate that triggers this Board-level approval requirement for Related Party dealing.

II.G.2

Voting exclusion for interested Related Parties. VARA Company Rulebook Clause II.G.2 provides that a Related Party with an interest in a transaction requiring Board consent must not participate in the Board's vote on that transaction. This voting-exclusion rule preserves the integrity of the Clause II.G.1 consent process by ensuring the interested party cannot influence the very approval decision governing its own transaction.

II.G.5

VARA notification of Related Party transactions. VARA Company Rulebook Clause II.G.5 requires that, when entering a Related Party transaction, the Board give VARA prior notice identifying the Related Party and the transaction details, together with written confirmation that the terms are fair, reasonable and proportional, and must allow clients and shareholders to review company records relating to the transaction. This combines a regulatory pre-notification duty with a stakeholder-transparency right.

II.G.6

Related Party transactions register. VARA Company Rulebook Clause II.G.6 requires a VASP to maintain a register of transactions with Related Parties, recording their names, transaction details, and the actions taken in respect of each. This record-keeping obligation provides an auditable trail of Related Party dealing separate from, but complementary to, the conflicts of interest register required under Clause II.C.3(b), and must be kept current and available for VARA's inspection on request.

II.G.7

Monthly Related Party transaction reporting. VARA Company Rulebook Clause II.G.7 requires a VASP to report all Related Party transactions to VARA on a monthly basis, or upon request, including the details of each transaction. This establishes a standing periodic reporting cadence to VARA over Related Party dealing, in addition to the transaction-specific prior notification required under Clause II.G.5, giving VARA visibility of the VASP's overall Related Party exposure over time.

II.G.8

Provision of Related Party transaction records to VARA. VARA Company Rulebook Clause II.G.8 requires a VASP to provide VARA with any documents or information relating to Related Party transactions that are reasonably requested for supervisory purposes. This is a standing information-access obligation supporting VARA's ability to scrutinise Related Party dealing beyond the register and periodic reports otherwise required, and must be satisfied within the timeframe VARA specifies.

II.H.1

Notification of loans to Board members or Staff. VARA Company Rulebook Clause II.H.1 requires a VASP to notify VARA and obtain approval before making any loan to a Board member, Senior Management member or Responsible Individual, providing full details of the recipient's name, the loan amount, and the loan's purpose. This subjects a specific, high-risk category of internal related-party lending to prior VARA approval, beyond the general Related Party transaction controls in Section II.G.

III.A.1.a

Fit and Proper: academic and professional knowledge. VARA Company Rulebook Clause III.A.1.a requires a VASP to ensure that a Fit and Proper Person possesses the necessary academic qualifications and relevant professional knowledge or industry qualifications appropriate to their role. This is the first of the general Fit and Proper principles in Chapter III, establishing the knowledge and qualification component of the overall Fit and Proper standard applied to Board members, Senior Management and other key roles.

III.A.1.b

Fit and Proper: honesty, integrity and reputation. VARA Company Rulebook Clause III.A.1.b requires a VASP to ensure that a Fit and Proper Person is honest, reputable, has integrity, and upholds the ethical standards expected of their role. This character-based limb of the Fit and Proper standard operates alongside the knowledge, experience, regulatory-understanding and financial-soundness limbs in the remaining sub-clauses of Rule III.A.1.

III.A.1.c

Fit and Proper: sector and management experience. VARA Company Rulebook Clause III.A.1.c requires a VASP to ensure that a Fit and Proper Person possesses adequate relevant experience in the global Virtual Asset sector and in management, or comparable experience from another relevant sector. This experience limb of the Fit and Proper standard is elaborated further by the specific industry-experience and management-experience assessment criteria in Clauses III.C.2 and III.D.1.

III.A.1.d

Fit and Proper: regulatory framework understanding. VARA Company Rulebook Clause III.A.1.d requires a VASP to ensure that a Fit and Proper Person possesses a good understanding of the regulatory framework governing their role and the relevant market. This knowledge-of-regulation limb of the Fit and Proper standard is assessed in practice against the qualification criteria in Clause III.B.1, which references understanding of Regulations, Rules, Directives, Guidance and fiduciary obligations.

III.A.1.e

Fit and Proper: financial soundness. VARA Company Rulebook Clause III.A.1.e requires a VASP to ensure that a Fit and Proper Person is financially sound. This financial-standing limb of the general Fit and Proper principles is given specific negative content by Clause III.E.1, which identifies bankruptcy, receivership and unmet judgment debts as disqualifying financial circumstances, treating financial soundness as a threshold eligibility requirement rather than a discretionary consideration.

III.B.1

Fit and Proper qualification assessment factors. VARA Company Rulebook Clause III.B.1 requires a VASP, when assessing Fit and Proper qualification for a role, to consider whether the individual holds a relevant degree, or equivalent professional or industry qualification or experience, and holds industry qualifications demonstrating understanding of the regulatory framework, applicable Regulations, Rules, Directives and Guidance, fiduciary obligations, the relevant Virtual Asset Activities, and the relevant market. This operationalises the qualification limb of the general Fit and Proper standard in Clause III.A.1.a.

III.C.2

Relevance of industry experience. VARA Company Rulebook Clause III.C.2 requires a VASP, when assessing an individual's industry experience for Fit and Proper purposes, to consider whether the substance of that experience is directly relevant or crucial to the Virtual Asset Activities to be carried out. This substance-over-form test prevents generic or tangential experience from satisfying the experience limb of the Fit and Proper standard.

III.D.1

Assessing management experience. VARA Company Rulebook Clause III.D.1 requires a VASP, when assessing management experience for a Board or Senior Management role, to consider whether the individual has hands-on experience supervising or managing essential Virtual Asset Activities and staff, noting that purely administrative experience is considered less relevant. This gives specific content to the management-experience component of the Fit and Proper assessment for governance-level roles.

III.E.1

Fit and Proper: financial soundness disqualifiers. VARA Company Rulebook Clause III.E.1 provides that an individual is not a Fit and Proper Person if they are an undischarged bankrupt, or recently discharged from or currently subject to bankruptcy proceedings, are subject to receivership or similar proceedings, or have failed to meet a judgment debt. These specific disqualifying circumstances give operative content to the general financial-soundness principle in Clause III.A.1.e.

III.G.1

Continuing Fit and Proper assessment against actual role. VARA Company Rulebook Clause III.G.1 requires a VASP, when assessing whether an individual remains a Fit and Proper Person, to assess the role that individual is actually performing at the time of the assessment, rather than the role they were originally appointed to. This ensures ongoing Fit and Proper reassessments, such as those required annually under Clauses I.B.1.c and I.C.3, are conducted against current, not historical, responsibilities.

Company Rulebook VII.B.1

A VASP in insolvency proceedings must fully cooperate with the Insolvency Appointee to implement the Wind Down Plan or any other suitable plan.

IV.A.1

Scope of the Outsourcing Part. VARA Company Rulebook Clause IV.A.1 requires a VASP to correctly determine whether a given arrangement falls within the scope of Part IV — Outsourcing Management — as an in-scope Outsourcing arrangement, or is instead carved out, such as statutory-required functions, market data services, network infrastructure, non-Outsourcing procurements, or arrangements relating to non-core systems whose failure would not materially impair licence compliance. This scoping exercise determines which of the VASP's third-party arrangements attract the full Part IV Outsourcing requirements.

IV.A.2

Prohibition on control-impairing Outsourcing. VARA Company Rulebook Clause IV.A.2 prohibits a VASP from entering into any Outsourcing arrangement that would materially impair the quality of its internal controls, or impair VARA's or another authority's ability to exercise its statutory rights or to monitor, supervise or audit the VASP's compliance. This sets an absolute limit on Outsourcing that applies regardless of how the arrangement is otherwise structured or documented.

IV.A.3.b

Individual responsibility for outsourced control-function roles. VARA Company Rulebook Clause IV.A.3.b requires that, where a VASP outsources the Money Laundering Reporting Officer, Chief Information Security Officer, or Data Protection Officer role, the individual appointed to that role must agree to individual responsibility to VARA, either during the licensing process or prior to appointment. This ensures outsourcing these key control functions does not dilute the personal accountability normally attaching to them.

IV.A.3.d

VARA direction to insource control-function roles. VARA Company Rulebook Clause IV.A.3.d requires a VASP to comply where VARA directs, in its sole discretion, that the MLRO, CISO or Data Protection Officer role be resourced by a full-time in-house employee rather than an outsourced appointee. This gives VARA an overriding power to require insourcing of these specific control functions notwithstanding the general permissibility of outsourcing them under Clause IV.A.3.b.

IV.A.4.a

Compliance with CBUAE Outsourcing Regulation. VARA Company Rulebook Clause IV.A.4.a requires a VASP to comply, to the extent applicable, with Central Bank of the UAE Circular No. 14 of 2021, the Outsourcing Regulation for Banks, as amended. This incorporates the Central Bank's own outsourcing standard as an applicable benchmark for VASPs falling within its scope, in addition to the VARA-specific Outsourcing requirements in Part IV.

IV.A.4.b

International Outsourcing guiding principles. VARA Company Rulebook Clause IV.A.4.b requires a VASP to also consider, to the extent applicable, international guiding principles for Outsourcing in financial services — such as those issued by IOSCO or the Basel Committee, or other international standard-setters — and any equivalent Outsourcing principles or regulations applicable to the VASP's Group in other jurisdictions. This broadens the reference framework a VASP must draw on beyond UAE-specific requirements.

IV.A.4.c

Primacy of VARA Outsourcing requirements. VARA Company Rulebook Clause IV.A.4.c requires a VASP to comply with all Rules, Directives and Guidance on Outsourcing issued by VARA from time to time, which supersede the other international and Group guidance referenced in Clauses IV.A.4.a and IV.A.4.b. This establishes VARA's own Outsourcing requirements as the controlling standard wherever they conflict with other applicable benchmarks.

IV.A.5

VASP's ultimate responsibility for Outsourced Functions. VARA Company Rulebook Clause IV.A.5 provides that a VASP remains ultimately responsible and accountable to VARA for all Functions Outsourced to a Service Provider, to the same extent as if the function were performed in-house. This non-delegation-of-responsibility principle underpins every other Outsourcing requirement in Part IV, confirming that Outsourcing shifts performance but never regulatory accountability.

IV.B.1

Risk-commensurate mitigation and Material Outsourcing. VARA Company Rulebook Clause IV.B.1 requires that risk-mitigation measures applied to an Outsourcing arrangement be commensurate with the degree of risk it presents, and confirms that Material Outsourcings are subject to additional requirements under Part IV. This proportionality principle, together with the Material Outsourcing concept, calibrates the intensity of the Outsourcing controls a VASP must apply to a given arrangement.

IV.B.2

Outsourcing risk assessment process. VARA Company Rulebook Clause IV.B.2 requires a VASP to have a process for assessing the risk of each proposed Outsourcing arrangement, including variations and renewals, covering factors such as impact on financial position, operations and reputation, compliance impact, scope, complexity and criticality, impact on internal controls, cost proportion, the Service Provider's regulatory status, geographic and cross-border risk, and exit difficulty. The assessment must be performed before the relationship starts and at least annually thereafter.

IV.B.3.a

Pre-selection due diligence on Service Providers. VARA Company Rulebook Clause IV.B.3.a requires a VASP, prior to selecting a Service Provider, to perform detailed due diligence covering the Service Provider's quality of services, technical, managerial and human resources capacity, financial soundness, reputation and experience, licensing and regulatory status, reliance on subcontractors, cultural and strategic compatibility, Virtual Asset industry familiarity, innovation capacity, and other factors such as aggregate exposure, cost and conflicts of interest.

IV.B.3.b

Ongoing review of Service Provider competence. VARA Company Rulebook Clause IV.B.3.b provides that, during the life of an Outsourcing arrangement, a VASP should regularly — at least annually and as circumstances warrant — review the Service Provider to confirm it remains competent to deliver the Outsourced service to the required standard. This extends the pre-selection due diligence in Clause IV.B.3.a into a continuing monitoring obligation for the life of the arrangement.

IV.C.1

Establishment of the Outsourcing Policy. VARA Company Rulebook Clause IV.C.1 requires a VASP, prior to Outsourcing any service and on an ongoing basis, to establish and maintain a comprehensive Outsourcing Policy comprising Outsourcing policies, contingency plans and a risk-management programme. This is the foundational internal-governance document underpinning the VASP's whole Outsourcing control framework, and must be reviewed and updated regularly to remain aligned with the VASP's actual Outsourcing activities and risk profile.

IV.C.2.a

Minimum content of the Outsourcing Policy. VARA Company Rulebook Clause IV.C.2.a requires the Outsourcing Policy to cover, at minimum, the risk-assessment framework including Material Outsourcing identification, procedures for identifying, managing and reporting Outsourcing risks and conflicts of interest, objectives and approval criteria for Outsourcing, Staff roles and responsibilities, the delineation of responsibilities retained by the VASP, procedures for remediating Service Provider breaches, and a mechanism to review and update the Policy in line with regulatory and business developments.

IV.C.2.b

Outsourcing register. VARA Company Rulebook Clause IV.C.2.b requires a VASP to maintain a comprehensive register of all Outsourcing arrangements across the VASP and its Group, recording at minimum the Service Provider's name, a description of the scope, the performance location, the agreement's start and end dates, key contacts, whether the arrangement is a Material Outsourcing, whether it involves storage or processing of Personal Data, and whether it involves confidential information.

IV.C.3.a

Active management of Outsourcing risk. VARA Company Rulebook Clause IV.C.3.a requires a VASP to actively manage the risks associated with each Outsourcing activity and the Service Provider's compliance with its contractual obligations, having regard to the risk the Outsourced activity poses to ongoing business and regulatory obligations. This translates the Outsourcing Policy and risk assessment into an active, ongoing risk-management discipline.

IV.C.3.b.i

Assigned monitoring of Outsourcing arrangements. VARA Company Rulebook Clause IV.C.3.b.i provides that monitoring of each Outsourcing arrangement should be assigned to Staff with appropriate expertise, covering the Service Provider's contractual performance, financial soundness, risk profile, material issues encountered, and remedial or mitigation steps taken. This assigns clear ownership of ongoing Outsourcing monitoring to qualified individuals within the VASP's second line of defence.

IV.C.3.b.ii

Review and audit of Outsourcing monitoring processes. VARA Company Rulebook Clause IV.C.3.b.ii provides that the monitoring and control processes and procedures over Outsourcing should be subject to regular reviews and audits to evaluate their effectiveness and adequacy. This adds a second-line quality-assurance layer over the monitoring activity assigned under Clause IV.C.3.b.i, helping the VASP identify weaknesses in its Outsourcing oversight before they develop into material risk exposures.

IV.D.1

Written Outsourcing agreements. VARA Company Rulebook Clause IV.D.1 requires that all Outsourcing arrangements be documented in a legally binding written agreement clearly setting out the rights, liabilities and obligations of the Service Provider and the VASP, with content commensurate with the arrangement's risk level. This establishes the baseline documentation standard that the detailed clause-by-clause agreement-content requirements elsewhere in Section IV.D build upon.

IV.D.1 (review)

Periodic review of Outsourcing agreements. VARA Company Rulebook Clause IV.D.1 also provides that a VASP should regularly review its Outsourcing agreements to assess whether renegotiation is needed to align with current market standards and the VASP's evolving business strategy. This is a distinct, standing review obligation over existing agreements, separate from the initial documentation requirement in the same Clause, and helps keep contractual terms commercially and operationally current.

IV.D.2

Outsourcing agreement negotiation points. VARA Company Rulebook Clause IV.D.2 provides that, when negotiating an Outsourcing agreement, a VASP should address performance standards and the consequences of failure, the delineation of intellectual property, proprietary information and asset ownership, business continuity and contingency planning, controls and processes for changes to the arrangement, guarantees or indemnities, and dispute resolution mechanisms. These are the key commercial and risk terms a VASP should negotiate into any Outsourcing contract.

IV.D.3.a

Description of the Outsourced Function. VARA Company Rulebook Clause IV.D.3.a requires every Outsourcing agreement to include a clear description of the Outsourced Function to be provided. This is the first of the mandatory minimum-content requirements applicable to all Outsourcing agreements under Section IV.D, ensuring the scope of the arrangement is unambiguously defined for both parties and for VARA's supervisory review of the arrangement's boundaries.

IV.D.3.b

Continuous operation assurance. VARA Company Rulebook Clause IV.D.3.b requires every Outsourcing agreement to contain contractual assurance that the Service Provider can maintain continuous operation of the Outsourced service in line with applicable laws and regulatory requirements. This mandatory content requirement links directly to the business continuity expectations set out elsewhere in the Outsourcing framework, giving the VASP a contractual basis for holding the Service Provider to that standard.

IV.D.3.c

Information security and service delivery standard. VARA Company Rulebook Clause IV.D.3.c requires every Outsourcing agreement to include contractual requirements for the Service Provider to maintain an appropriate level of information security, risk management and service delivery, commensurate with the arrangement's risk profile. This ties the required contractual protections directly to the risk-assessment outcome for that specific Outsourcing arrangement, rather than applying a uniform standard to every arrangement regardless of risk.

IV.D.3.d

Confidentiality and client data protection. VARA Company Rulebook Clause IV.D.3.d requires every Outsourcing agreement to include contractual requirements to protect confidential information and client data. This is one of the mandatory minimum-content protections that must appear in every Outsourcing agreement, regardless of the arrangement's size or materiality, and applies in addition to the enhanced confidentiality and data-protection safeguards required specifically for Material Outsourcing arrangements elsewhere in Section IV.D.

IV.D.3.e

VASP data access rights on termination or insolvency. VARA Company Rulebook Clause IV.D.3.e requires every Outsourcing agreement to allow VASP-owned or VASP-controlled data to be accessed at any time by the VASP or a competent authority, including on the Service Provider's resolution, discontinuation or insolvency. This ensures the VASP's access to its own data cannot be cut off by the Service Provider's own financial or operational failure.

IV.D.3.f

Sub-Outsourcing conditions in the agreement. VARA Company Rulebook Clause IV.D.3.f requires every Outsourcing agreement to set out the conditions to be imposed regarding any sub-Outsourcing by the Service Provider, in accordance with Rule IV.E. This links the mandatory agreement-content requirements in Section IV.D to the separate sub-Outsourcing regime set out in Section IV.E, ensuring the primary agreement itself governs whether and how further sub-contracting may occur.

IV.D.3.g

Data destruction obligation on termination. VARA Company Rulebook Clause IV.D.3.g requires every Outsourcing agreement to clearly set out the Service Provider's obligation, upon termination, to securely destroy data relating to the VASP or its clients. This mandatory content requirement ensures client and VASP data does not persist with a Service Provider once the Outsourcing relationship has ended, subject to any applicable record-retention exceptions.

IV.D.3.h

VASP termination rights. VARA Company Rulebook Clause IV.D.3.h requires every Outsourcing agreement to expressly allow the VASP to terminate in accordance with applicable law, including where the Service Provider breaches applicable laws or regulations, materially breaches the contract, has material weaknesses in data security or management, or where a competent authority — including VARA — instructs termination or expresses significant concern. This gives the VASP a contractual exit route tied to regulatory as well as commercial triggers.

IV.D.4.a

Material Outsourcing: term and notice periods. VARA Company Rulebook Clause IV.D.4.a requires every Material Outsourcing agreement to state the start date, the end date where applicable, and the notice periods applicable to both the Service Provider and the VASP. This is the first of the enhanced, Material-Outsourcing-specific mandatory content requirements that apply in addition to the general Outsourcing agreement content in Section IV.D.3.

IV.D.4.b

Material Outsourcing: financial obligations. VARA Company Rulebook Clause IV.D.4.b requires every Material Outsourcing agreement to set out the financial obligations of the parties. This ensures the cost and payment terms of a Material Outsourcing arrangement are documented as part of the enhanced content standard applicable to arrangements of this heightened risk category, and gives both parties a clear, contractually binding basis for resolving payment disputes.

IV.D.4.c

Material Outsourcing: right to monitor performance. VARA Company Rulebook Clause IV.D.4.c requires every Material Outsourcing agreement to give the VASP the right to monitor the Service Provider's performance on an ongoing basis. This contractual monitoring right underpins the active risk-management and monitoring obligations imposed on the VASP under Clauses IV.C.3.a and IV.C.3.b.i, ensuring that duty is matched by an enforceable contractual entitlement.

IV.D.4.d

Material Outsourcing: service levels and performance standards. VARA Company Rulebook Clause IV.D.4.d requires every Material Outsourcing agreement to set out agreed service levels and performance standards with precise targets enabling timely monitoring and corrective action, including the consequences of failing to meet them. This gives the monitoring right in Clause IV.D.4.c a measurable benchmark against which performance can be assessed.

IV.D.4.e

Material Outsourcing: Service Provider reporting obligations. VARA Company Rulebook Clause IV.D.4.e requires every Material Outsourcing agreement to set out the Service Provider's reporting obligations, including prompt notification of any breach of the VASP's data or confidential information, notification of any development materially affecting its ability to deliver the service in compliance with service level agreements and applicable law, and, as appropriate, internal audit report submission obligations.

IV.D.4.f

Material Outsourcing: business contingency plans. VARA Company Rulebook Clause IV.D.4.f requires every Material Outsourcing agreement to require the implementation and testing of business contingency plans. This embeds business-continuity obligations directly into the contract governing a Material Outsourcing, rather than leaving continuity planning to informal arrangement between the VASP and the Service Provider, reinforcing the wind-down and continuity expectations applicable to Material Outsourcing relationships generally.

IV.D.4.g

Material Outsourcing: cooperation with competent authorities. VARA Company Rulebook Clause IV.D.4.g requires every Material Outsourcing agreement to oblige the Service Provider to cooperate with the VASP's competent authorities, including other Entities they appoint. This ensures VARA's supervisory reach extends contractually to the Service Provider itself, not only to the VASP, reinforcing that Outsourcing does not create a barrier between VARA and the entity actually performing the Function.

IV.D.4.h

Material Outsourcing: inspection and audit rights. VARA Company Rulebook Clause IV.D.4.h requires every Material Outsourcing agreement to grant the VASP and competent authorities the right to inspect and audit the Service Provider, as further specified under Rule IV.G.2. This cross-references the detailed audit-rights regime in Section IV.G, embedding it as a mandatory contractual term for Material Outsourcings, rather than a matter left open to negotiation.

IV.D.4.i

Material Outsourcing: termination and exit assistance. VARA Company Rulebook Clause IV.D.4.i requires every Material Outsourcing agreement to include termination and exit assistance arrangements ensuring smooth transfer of the Outsourced service, including the Service Provider's obligations to cooperate, provide reasonable assistance and transitional services — including data return, destruction or transfer — and, where necessary, a transition period of continued service post-termination.

IV.D.4.j

Material Outsourcing: Service Provider insurance. VARA Company Rulebook Clause IV.D.4.j requires every Material Outsourcing agreement to require the Service Provider to hold relevant and adequate insurance. This is a distinct requirement from the VASP's own insurance obligations under Part VI of the Company Rulebook, addressing risk transfer at the level of the outsourced service itself, independent of any insurance the VASP itself is required to maintain.

IV.D.4.k

Material Outsourcing: location of service and data. VARA Company Rulebook Clause IV.D.4.k requires every Material Outsourcing agreement to specify the location or locations where the Material Outsourcing is provided and, or, where data is kept or processed, including storage location and conditions, and to require notification if the Service Provider proposes to change that location. This underpins the cross-border Outsourcing controls set out in Section IV.F.

IV.D.5.a

Monitoring Service Provider relationships and data confidentiality. VARA Company Rulebook Clause IV.D.5.a requires a VASP to take appropriate steps to monitor its relationships with Service Providers and to ensure adequate measures safeguard the confidentiality and integrity of client data. This is a general oversight obligation running throughout the life of the Outsourcing relationship, distinct from the specific contractual protections required elsewhere in Section IV.D.

IV.D.5.b (consent)

Consent required for third-party data access. VARA Company Rulebook Clause IV.D.5.b also provides that a VASP should ensure Service Providers are not permitted to give any third party access to confidential VASP or client data without the VASP's prior written consent. This consent-gate protects against unauthorised onward disclosure of confidential and client information by an Outsourcing counterparty or its personnel to any other third party.

IV.D.5.b (laws)

Data protection law compliance in Outsourcing. VARA Company Rulebook Clause IV.D.5.b requires a VASP to ensure Outsourcing arrangements comply with all applicable UAE data protection laws and regulations, including the Personal Data Protection Law, and to require the Service Provider to procure sub-contractor compliance with applicable laws where part of the service is sub-contracted. This extends UAE data protection compliance through the full Outsourcing and sub-Outsourcing chain.

IV.D.5.c

VARA notification of data access or breach. VARA Company Rulebook Clause IV.D.5.c requires that, where a VASP is legally or regulatorily required to notify clients or a competent authority of an unauthorised data access or breach, the VASP must also notify VARA within the same legally required time period. This aligns VARA's notification timeline with whatever statutory breach-notification deadline already applies under other UAE data protection law.

IV.D.5.d

Return or destruction of client data on termination. VARA Company Rulebook Clause IV.D.5.d provides that a VASP should ensure all client data is destroyed or returned to the VASP upon termination of an Outsourcing arrangement, subject to applicable laws and recordkeeping requirements. This works alongside the Service Provider's own data-destruction obligation under Clause IV.D.3.g, framed here as an outcome the VASP itself must ensure.

IV.E.1

Risk of permitted sub-Outsourcing. VARA Company Rulebook Clause IV.E.1 requires a VASP, before entering any Outsourcing arrangement, to consider the additional risk posed if the Service Provider is permitted to further sub-contract part of the service to third parties. This opens the dedicated sub-Outsourcing regime in Section IV.E, requiring risk consideration at the outset of the Outsourcing relationship rather than only if sub-Outsourcing later arises.

IV.E.2.a

Conditions for consenting to sub-Outsourcing. VARA Company Rulebook Clause IV.E.2.a provides that consent to sub-Outsourcing should only be given where the sub-contractor undertakes to comply with all applicable laws, regulatory and contractual obligations, and to provide the VASP and its regulators, including VARA, the same contractual rights of access and audit as granted by the Service Provider. This flows the VASP's core Outsourcing protections down to any sub-contractor.

IV.E.2.b

Sub-Outsourcing must not impede Service Provider obligations. VARA Company Rulebook Clause IV.E.2.b provides that a VASP should ensure sub-Outsourcing engaged by the Service Provider does not impede the Service Provider's ability to meet its contractual obligations to the VASP, including confidentiality of client data, information access and audit rights, and business continuity planning. This protects the substance of the primary Outsourcing agreement from being undermined by onward sub-contracting.

IV.E.3.i

Material Outsourcing: sub-Outsourcing permission. VARA Company Rulebook Clause IV.E.3.i provides that, for a Material Outsourcing, the Outsourcing agreement should specify whether or not sub-Outsourcing is permitted at all. This is the threshold decision point governing whether the more detailed sub-Outsourcing contractual conditions in the remaining Clause IV.E.3 sub-points apply, and must be addressed explicitly rather than left silent or implied within the agreement.

IV.E.3.ii.1

Material Outsourcing: prohibited sub-Outsourced activities. VARA Company Rulebook Clause IV.E.3.ii.1 provides that, where sub-Outsourcing is permitted under a Material Outsourcing agreement, the agreement should specify any types of activities that are not permitted to be sub-Outsourced. This lets a VASP carve out especially sensitive or critical elements of the Outsourced Function from further sub-contracting where doing so would conflict with its risk appetite or regulatory obligations.

IV.E.3.ii.2

Material Outsourcing: sub-Outsourcing conditions. VARA Company Rulebook Clause IV.E.3.ii.2 provides that, where sub-Outsourcing is permitted, the agreement should specify the conditions to be complied with in the case of sub-Outsourcing. This gives the VASP contractual control over the terms on which any permitted sub-Outsourcing may actually take place, including any qualification, notification or approval steps the Service Provider must satisfy beforehand.

IV.E.3.ii.3

Material Outsourcing: Service Provider oversight of subcontractors. VARA Company Rulebook Clause IV.E.3.ii.3 provides that, where sub-Outsourcing is permitted, the agreement should require the Service Provider to oversee subcontracted services to ensure its contractual obligations to the VASP continue to be met. This keeps the Service Provider accountable for subcontractor performance rather than allowing responsibility to dissipate down the sub-Outsourcing chain unchecked.

IV.E.3.ii.4

Material Outsourcing: notification of sub-Outsourcing changes. VARA Company Rulebook Clause IV.E.3.ii.4 provides that, where sub-Outsourcing is permitted, the agreement should oblige the Service Provider to inform the VASP of any planned sub-Outsourcing or material changes to it, particularly where this could affect the Service Provider's ability to meet its responsibilities. This gives the VASP advance visibility of changes to its sub-Outsourcing chain.

IV.E.3.ii.5

Material Outsourcing: right to object to sub-Outsourcing. VARA Company Rulebook Clause IV.E.3.ii.5 provides that, where sub-Outsourcing is permitted, the agreement should ensure the VASP has the right to object to, or that explicit approval is required for, an intended sub-Outsourcing or material changes to it. This gives the VASP an active veto or approval gate over sub-Outsourcing decisions, not merely a notification right.

IV.E.3.ii.6

Material Outsourcing: termination right for undue sub-Outsourcing. VARA Company Rulebook Clause IV.E.3.ii.6 provides that, where sub-Outsourcing is permitted, the agreement should give the VASP a contractual right to terminate in the case of undue sub-Outsourcing, such as a material risk increase or unnotified sub-Outsourcing. This is the ultimate contractual remedy backing the sub-Outsourcing controls in the preceding Clause IV.E.3.ii sub-points.

IV.F.1

Cross-border Outsourcing risk factors. VARA Company Rulebook Clause IV.F.1 requires a VASP, for Outsourcing to a Service Provider located outside the UAE, to consider additional jurisdiction-related factors affecting the Service Provider's ability to perform or the VASP's ability to monitor or control the Function, including economic, political and social conditions, differing legal and regulatory systems, technology and infrastructure sophistication, and reputational risk. This opens the cross-border-specific requirements in Section IV.F.

IV.F.2 (contract)

Contractual assurance of overseas information security. VARA Company Rulebook Clause IV.F.2 also requires a VASP to ensure, through adequate contractual and practical arrangements, that overseas Service Providers implement and maintain robust and appropriate levels of information security and service delivery throughout the Outsourcing relationship. This translates the cross-border due diligence obligation into binding contractual and ongoing operational commitments that the VASP can enforce.

IV.F.2 (diligence)

Additional due diligence for overseas Service Providers. VARA Company Rulebook Clause IV.F.2 requires a VASP to take active steps to manage cross-border Outsourcing risks, including conducting additional due diligence on overseas Service Providers to confirm their ability to safeguard confidential and client data, be effectively monitored, and execute business continuity and exit arrangements. This raises the due-diligence bar above the domestic standard in Clause IV.B.3.a for cross-border arrangements.

IV.F.3

Data protection compliance in cross-border Outsourcing. VARA Company Rulebook Clause IV.F.3 requires a VASP to ensure all applicable data protection laws are complied with in cross-border Outsourcing arrangements, including those governing international transfers of Personal Data. This applies UAE and, where relevant, foreign data-transfer law specifically to the cross-border context addressed in Section IV.F, ensuring international transfers do not fall outside the VASP's compliance obligations.

IV.F.4

Client consent for cross-border Outsourcing. VARA Company Rulebook Clause IV.F.4 provides that a VASP should consider the need to notify and obtain client consent for cross-border Outsourcing arrangements, including the jurisdiction of performance and any overseas authority access rights. This client-facing transparency obligation reflects that data may become subject to a different legal regime once processed outside the UAE and potentially subject to a different regulator's access powers.

IV.F.5

Notification of overseas authority access requests. VARA Company Rulebook Clause IV.F.5 provides that, where an overseas authority requests access to the VASP's information, the VASP should notify VARA and any affected clients as soon as possible, subject to compliance with applicable laws. This ensures VARA and affected clients learn promptly if a foreign regulator or authority seeks to access VASP or client data held by an overseas Service Provider.

IV.F.6 (notify)

Prior notification of cross-border Outsourcing. VARA Company Rulebook Clause IV.F.6 requires a VASP to notify VARA prior to undertaking any cross-border Outsourcing arrangement. This is a standalone pre-notification gate applicable specifically to cross-border arrangements, in addition to the general Material Outsourcing notifications required under Section IV.H, giving VARA an opportunity to raise jurisdiction-specific concerns before the arrangement takes legal effect.

IV.F.6 (rights)

Preservation of VARA's rights in cross-border Outsourcing. VARA Company Rulebook Clause IV.F.6 also requires a VASP to ensure that any cross-border Outsourcing arrangement does not impede VARA's ability to exercise its statutory rights and responsibilities, such as rights of access and audit to the VASP's information. This mirrors the general control-impairment prohibition in Clause IV.A.2, applied specifically to the cross-border context.

IV.G.1

General audit rights over Outsourced Functions. VARA Company Rulebook Clause IV.G.1 provides that, for all Outsourcing arrangements, a VASP should ensure the written agreement enables the VASP to review the Outsourced Function, references competent authorities' information-gathering and investigatory powers, and preserves those rights even where Service Providers are located in third countries. This is the baseline audit-rights standard, elaborated further for Material Outsourcings under Clause IV.G.2.

IV.G.2.i

Material Outsourcing: full access rights. VARA Company Rulebook Clause IV.G.2.i provides that, for a Material Outsourcing, the written agreement should grant the VASP, competent authorities including VARA, and any Entity they appoint, full access to all relevant business premises, devices, systems, networks, information, data, personnel and the Service Provider's external auditors. This is the enhanced access standard applicable specifically to Material Outsourcings.

IV.G.2.ii

Material Outsourcing: unrestricted inspection and audit rights. VARA Company Rulebook Clause IV.G.2.ii provides that, for a Material Outsourcing, the written agreement should grant the VASP, competent authorities and any appointed Entity unrestricted rights of inspection and audit to monitor the arrangement and ensure regulatory and contractual compliance. This complements the full-access requirement in Clause IV.G.2.i with an active inspection and audit power.

IV.G.3.a

Pooled audits and third-party certifications. VARA Company Rulebook Clause IV.G.3.a permits a VASP to use pooled audits organised jointly with other clients of the same Service Provider, and, or, to rely on third-party certifications or audit reports, provided the scope covers relevant systems, controls and regulatory compliance and the VASP assesses their content on an ongoing basis and verifies they remain valid, adequate and current, without prejudice to the VASP's ultimate responsibility for the Outsourcing.

IV.G.3.b

Assessing adequacy of third-party certifications. VARA Company Rulebook Clause IV.G.3.b provides that a VASP should assess whether third-party certifications or reports are adequate and sufficient for its regulatory obligations, should not rely solely on them over time, and should retain the contractual right to perform individual audits of the Material Outsourcing at its discretion. This qualifies the reliance permitted under Clause IV.G.3.a with an ongoing adequacy check.

IV.H.1

Immediate notification of material breach or development. VARA Company Rulebook Clause IV.H.1 requires a VASP to immediately notify VARA on becoming aware of a material breach of a Material Outsourcing agreement's terms, or of any other material development regarding a Material Outsourcing that has, or is likely to have, a significant impact on the VASP's operations, financial condition or reputation.

IV.H.2

Notification of compliance-affecting issues. VARA Company Rulebook Clause IV.H.2 requires a VASP to notify VARA immediately of any issues arising that would materially affect its compliance with legal and regulatory obligations. This is a broader notification trigger than the Material Outsourcing-specific breach notification in Clause IV.H.1, capturing compliance-affecting issues more generally, whether or not they arise from an Outsourcing arrangement.

IV.H.3

Advance notification of new or varied Material Outsourcing. VARA Company Rulebook Clause IV.H.3 provides that, before entering a new Material Outsourcing arrangement or materially varying an existing one, a VASP should notify VARA in advance with relevant details, seeking to satisfy VARA that all Part IV requirements have been addressed. This is a pre-emptive notification obligation, distinct from the post-event notifications required elsewhere in Section IV.H.

IV.H.4

Remedying VARA's concerns before proceeding. VARA Company Rulebook Clause IV.H.4 requires that, where VARA objects to, or raises concerns about, a proposed or varied Material Outsourcing arrangement, the VASP must remedy those concerns to VARA's satisfaction before entering into or varying the arrangement. This gives VARA an effective veto over Material Outsourcing arrangements it is not satisfied with, following the advance notification under Clause IV.H.3.

Company Rulebook VIII.A

A VASP must secure prior written approval from VARA for any material changes or new activities beyond its original license scope.

Company Rulebook VIII.D

Written approval from VARA is required for mergers or substantial asset acquisitions involving VASPs, with a filing plan due within 30 working days.

V.A.1

ESG disclosure level and application. VARA Company Rulebook Clause V.A.1 requires a VASP to satisfy the Environmental, Social and Governance disclosure requirements set out in Part V, at the disclosure level — Voluntary, Compliance or Mandatory — determined by VARA and set as a condition of its Licence. This tiered-disclosure-level concept is the organising principle for all the ESG obligations that follow in Part V, with the applicable tier fixed individually for each VASP.

V.D.1

Compliance ESG Disclosure: explaining ESG strategies. VARA Company Rulebook Clause V.D.1 requires a VASP assigned a Compliance ESG Disclosure level to explain its ESG strategies in the UAE — including investment or operational strategies relating to Virtual Asset mining or staking — or otherwise provide relevant ESG information to increase transparency. This is the substantive content obligation attaching to the middle of VARA's three ESG disclosure tiers.

V.D.2

Compliance ESG Disclosure: public availability. VARA Company Rulebook Clause V.D.2 provides that, where VARA requires it, a VASP subject to Compliance ESG Disclosure must make its ESG strategies or related information public and, or, available to Virtual Asset market participants. This gives VARA discretion to convert the Clause V.D.1 disclosure content into a binding public-facing requirement for a given VASP, rather than leaving disclosure at the VASP's own discretion.

V.E.1

Mandatory ESG Disclosure: raising awareness. VARA Company Rulebook Clause V.E.1 requires a VASP assigned a Mandatory ESG Disclosure level to establish practices and procedures to raise awareness of its Environmental, Social and Governance related activities and opportunities, including via its website and, or, social media. This is the entry-level obligation of VARA's most stringent ESG disclosure tier, addressed further by the annual reporting and diversity disclosure duties in the following clauses.

V.E.2

Mandatory ESG Disclosure: annual ESG report. VARA Company Rulebook Clause V.E.2 requires a VASP assigned a Mandatory ESG Disclosure level to publish an annual ESG report disclosing, at minimum, governance policies, metrics and targets on sustainability and diversity risk management, how such risks and opportunities factor into business strategy and Virtual Asset Activity processes, and factual summaries of the environmental and climate impact of data-intensive Virtual Asset activities. This is the core substantive reporting requirement of the Mandatory tier.

V.E.3

Mandatory ESG Disclosure: diversity and inclusion transparency. VARA Company Rulebook Clause V.E.3 requires a VASP assigned a Mandatory ESG Disclosure level to make up-to-date information on its diversity and inclusion initiatives publicly available in a prominent place on its website. This public-facing transparency duty supplements the annual ESG report required under Clause V.E.2 with continuously accessible, up-to-date diversity disclosure available year-round.

V.F.1

Virtual Asset mining and staking energy disclosure. VARA Company Rulebook Clause V.F.1 requires any VASP that invests in, conducts or facilitates Virtual Asset mining or staking activities, including selling related equipment, to publish up-to-date website information on its use of renewable and, or, waste energy and its decarbonisation and emission-reduction initiatives for such activities, regardless of the VASP's assigned ESG disclosure tier under Section V.D or V.E.

V.F.2

Disclosure for other data-intensive activities. VARA Company Rulebook Clause V.F.2 provides that, where VARA requires it, a VASP must provide similar environmental disclosure information in relation to data-intensive activities beyond Virtual Asset mining and staking. This extends the energy and decarbonisation disclosure standard set for mining and staking under Clause V.F.1 to other activities VARA identifies as comparably data-intensive, broadening transparency beyond mining and staking specifically.

VI.A.1

Application of Capital and Prudential Requirements. VARA Company Rulebook Clause VI.A.1 requires every Virtual Asset Service Provider to comply with all Rules set out in Part VI, Capital and Prudential Requirements. This is the scope provision opening the capital adequacy regime covering Paid-Up Capital, Net Liquid Assets, Insurance and Reserve Assets addressed in the remainder of Part VI, and applies irrespective of the VASP's size or the specific Virtual Asset Activity it is licensed to conduct.

VI.B.1

Minimum Paid-Up Capital by Virtual Asset Activity. VARA Company Rulebook Clause VI.B.1 sets minimum Paid-Up Capital by licensed Virtual Asset Activity: AED 100,000 for Advisory Services; AED 400,000 or 15% of fixed annual overheads (higher, Custody-licensed VASP) otherwise AED 600,000 or 25% for Broker-Dealer Services; the VA Issuance Rulebook amount for Category 1 Virtual Asset Issuance; AED 600,000 or 25%, higher, for Custody Services; AED 800,000 or 15% (Custody-licensed VASP) otherwise AED 1,500,000 or 25% for Exchange Services; AED 500,000 or 25%, higher, for Lending and Borrowing, and for Transfer and Settlement Services; and AED 280,000 or 15% (Custody-licensed VASP) otherwise AED 500,000 or 25% for Management and Investment Services.

VI.B.2

Separate Paid-Up Capital for multiple activities. VARA Company Rulebook Clause VI.B.2 requires a VASP licensed for more than one Virtual Asset Activity to hold Paid-Up Capital for each activity separately, calculated using that activity's own fixed annual overheads on a mutually exclusive and collectively exhaustive basis across activities, and to reconcile its Paid-Up Capital on a monthly basis. This prevents a single capital buffer from being counted twice across multiple licensed activities.

VI.B.3

Permitted forms for holding Paid-Up Capital. VARA Company Rulebook Clause VI.B.3 requires Paid-Up Capital to be held at all times in a UAE-licensed bank trust account naming VARA as beneficiary, a surety bond with no end date naming VARA as beneficiary, or another manner specified by VARA at the time of licensing. This defines the acceptable custody arrangements for the capital thresholds set under Clause VI.B.1.

VI.C.1

Net Liquid Assets minimum coverage ratio. VARA Company Rulebook Clause VI.C.1 requires a VASP to hold current liquid assets, defined as Net Liquid Assets, at all times such that the surplus over current liabilities is at least 1.2 times its monthly operating expenses. This liquidity buffer is distinct from, and additional to, the Paid-Up Capital requirement under Section VI.B, addressing short-term liquidity risk rather than longer-term capital adequacy.

VI.C.2

Operational Exposure in Net Liquid Assets calculation. VARA Company Rulebook Clause VI.C.2 requires a VASP, when calculating Net Liquid Assets, to include the VARA-agreed portion of its Operational Exposure to Virtual Assets within current liabilities. This ensures Virtual Asset price and operational risk is reflected in the liquidity ratio required under Clause VI.C.1, rather than allowing that exposure to be excluded from the calculation entirely.

VI.C.3(a)

Daily reconciliation of Net Liquid Assets. VARA Company Rulebook Clause VI.C.3(a) requires a VASP to reconcile its Net Liquid Assets on a daily basis. This daily monitoring cadence supports early detection of any shortfall against the 1.2-times coverage ratio required under Clause VI.C.1, and ensures management has current visibility of the VASP's liquidity position before any shortfall becomes reportable to VARA under Section VI.F.

VI.C.3(b)

Monthly reporting of Net Liquid Assets reconciliation. VARA Company Rulebook Clause VI.C.3(b) requires a VASP to report the results of its Net Liquid Assets reconciliation to VARA on a monthly basis. This gives VARA regular visibility of the VASP's liquidity position underlying the daily reconciliation obligation in Clause VI.C.3(a), forming part of the standing prudential reporting VARA relies on to supervise ongoing solvency and liquidity.

VI.C.4

Permitted composition of Net Liquid Assets. VARA Company Rulebook Clause VI.C.4 provides that Net Liquid Assets may only be maintained as cash or cash equivalents, determined per recognised accounting standards, or as VARA-approved Virtual Assets referencing the value of the US Dollar or the UAE Dirham. This restricts the qualifying asset types counted toward the liquidity ratio under Clause VI.C.1.

VI.D.1

Mandatory Insurance coverage types. VARA Company Rulebook Clause VI.D.1 requires a VASP to hold and maintain adequate Insurance, comprising professional indemnity insurance, directors' and officers' insurance, commercial crime or similar insurance for Virtual Assets held in hot wallets, and any other type of insurance stipulated by VARA, sized appropriately to the VASP's business and as specified in its Licence, reflecting the specific risks presented by its licensed Virtual Asset Activity.

VI.D.2

Insurance must be held with a regulated insurer. VARA Company Rulebook Clause VI.D.2 requires all Insurance held to satisfy Part VI to be placed and maintained with a regulated insurer. This ensures the coverage required under Clause VI.D.1 is backed by an appropriately supervised insurance provider, rather than an unlicensed or informal risk-transfer arrangement that could leave the VASP's cover commercially or legally unenforceable when a claim arises.

VI.D.3

Group Insurance policies naming the VASP. VARA Company Rulebook Clause VI.D.3 provides that, where Insurance is held in the name of another Group Entity, the policy must explicitly name the VASP as an insured party and state the level of cover applicable specifically to the VASP. This prevents a VASP from relying on group-level cover that does not clearly extend protection to itself.

VI.D.4

Alternative risk protection where Insurance is unavailable. VARA Company Rulebook Clause VI.D.4 provides that, if a VASP cannot meet an Insurance requirement for proven reasons and VARA grants discretion at licensing, the VASP must instead protect against the relevant risks through alternative means specified by VARA as a condition of the Licence. This is a narrow, VARA-approved substitute for the Insurance types listed under Clause VI.D.1.

VI.E.1

Reserve Assets: 100% client liability coverage. VARA Company Rulebook Clause VI.E.1 requires a VASP to maintain, at all times, Reserve Assets equivalent to 100% of the liabilities it owes to clients across all its licensed Virtual Asset Activities. This full-backing requirement protects client Virtual Asset holdings independently of the VASP's Paid-Up Capital and Net Liquid Assets buffers, addressing custody and safekeeping risk specifically rather than general solvency.

VI.E.2

Reserve Assets held on a one-to-one basis. VARA Company Rulebook Clause VI.E.2 requires a VASP to hold Reserve Assets on a one-to-one basis in the same Virtual Asset in which liabilities are owed to clients. This prevents substitution of client-owed Virtual Assets with a different, potentially mismatched asset type when meeting the Reserve Assets requirement under Clause VI.E.1, avoiding currency or asset mismatch between what is owed and what is actually held.

VI.E.3(a)

Daily reconciliation of Reserve Assets. VARA Company Rulebook Clause VI.E.3(a) requires a VASP to reconcile its Reserve Assets on a daily basis. This mirrors the daily Net Liquid Assets reconciliation under Clause VI.C.3(a), applied here to the client-liability-backing Reserve Assets under Section VI.E, ensuring any shortfall in client-owed Virtual Assets is identified promptly rather than surfacing only at the six-monthly independent audit.

VI.E.3(b)

Independent audit of Reserve Assets. VARA Company Rulebook Clause VI.E.3(b) requires a VASP's Reserve Assets to be audited by an independent third-party auditor no less frequently than every six months. This periodic independent verification supplements the VASP's own daily reconciliation obligation under Clause VI.E.3(a), giving VARA and clients an externally verified check on the VASP's continuing 100% backing of client liabilities.

VI.E.3(c)

Reserve Assets audit report submitted to VARA. VARA Company Rulebook Clause VI.E.3(c) requires the independent Reserve Assets audit report to be included as part of the VASP's subsequent quarterly report to VARA required under the Compliance and Risk Management Rulebook. This links the six-monthly audit obligation under Clause VI.E.3(b) to VARA's regular quarterly reporting cycle, ensuring VARA receives independently verified Reserve Assets information on a recurring basis.

VI.F.1

Immediate notification of a capital or asset shortfall. VARA Company Rulebook Clause VI.F.1 requires a VASP to notify VARA immediately if it is unable to maintain, or is failing to meet, its Paid-Up Capital, Net Liquid Assets, Insurance or Reserve Assets requirements, including the deficit amount, its causes, remedial actions taken or planned, and the expected timeline for full remediation of the shortfall.

VI.F.2

Daily updates following a shortfall notification. VARA Company Rulebook Clause VI.F.2 requires a VASP, following a shortfall notification made under Clause VI.F.1, to provide VARA with daily updates until VARA is satisfied that the failure has been rectified, unless VARA directs otherwise. This sustains VARA's oversight throughout the remediation period following a capital or liquidity breach, and continues until VARA confirms the shortfall has been fully addressed.

VI.F.3

Procedures to monitor capital and asset risk sources. VARA Company Rulebook Clause VI.F.3 requires a VASP to establish and maintain clear procedures to monitor and identify all sources of risk that could impact its Paid-Up Capital, Net Liquid Assets, Insurance or Reserve Assets levels. This is a preventive, ongoing monitoring obligation supporting early detection ahead of any shortfall requiring notification under Clause VI.F.1.

VI.F.4

VARA discretion to require additional capital buffers. VARA Company Rulebook Clause VI.F.4 provides that, where VARA requires it based on a VASP's size, scope, geographic exposure, complexity and nature of activities, the VASP must hold and maintain additional Paid-Up Capital, Net Liquid Assets, Insurance or Reserve Assets above the baseline requirements set under Sections VI.B through VI.E, calibrated to the elevated risk profile VARA identifies for that VASP.

VII.A.1

Mandatory Wind Down Plan content. VARA Company Rulebook Clause VII.A.1 requires every VASP to establish and maintain a Wind Down Plan covering risk identification and mitigation, resourcing, safekeeping and transfer of client Virtual Assets, personnel and exit arrangements, a communications strategy, knowledge transfer, system redundancy and records retention, ongoing surety bond maintenance, cessation of new client onboarding, itemisation of liabilities, exclusion of client money and Virtual Asset sales from the plan, and VARA's power to intervene in and assume control of client money or Virtual Assets.

VII.A.2(a)

One-day notification of voluntary discontinuation. VARA Company Rulebook Clause VII.A.2(a) requires a VASP electing to voluntarily discontinue its business, while not Insolvent, to notify VARA no later than one day after that decision is made. This tight notification window triggers VARA's oversight of the wind-down process at the earliest possible stage, ahead of the more detailed Wind Down Plan submission and reporting obligations that follow.

VII.A.2(b)

Submission of the current Wind Down Plan on discontinuation. VARA Company Rulebook Clause VII.A.2(b) requires a VASP, at the time of notifying VARA of a voluntary discontinuation under Clause VII.A.2(a), to provide its latest up-to-date Wind Down Plan prepared under Clause VII.A.1. This ensures VARA can immediately assess the adequacy of the VASP's wind-down arrangements as the discontinuation process begins, rather than waiting for a later, separate submission.

VII.A.2(c-d)

Implementation of and changes to the Wind Down Plan. VARA Company Rulebook Clause VII.A.2(c-d) requires a VASP to implement its Wind Down Plan and to make any further changes to it as notified by VARA at any stage during the plan's implementation and completion. This gives VARA an ongoing directive role throughout execution of the voluntary wind-down, rather than a one-off instruction issued only at the outset.

VII.A.2(e)

Weekly reporting during Wind Down Plan implementation. VARA Company Rulebook Clause VII.A.2(e) requires a VASP to report to VARA every week throughout the implementation and completion of its Wind Down Plan. This frequent, close-interval reporting cadence gives VARA continuous visibility of wind-down progress, distinguishing it from the standing quarterly and annual reporting obligations that otherwise generally apply to a VASP.

VII.A.2(f)

Additional wind-down updates on VARA's request. VARA Company Rulebook Clause VII.A.2(f) requires a VASP to provide all other updates and, or, reports requested by VARA at any time during the wind-down process, beyond the standing weekly reporting required under Clause VII.A.2(e). This gives VARA flexibility to request supplementary information tailored to developments in a specific wind-down, rather than being limited to the fixed weekly reporting cycle.

VII.B.1

Cooperation with an Insolvency Appointee. VARA Company Rulebook Clause VII.B.1 requires a VASP subject to Insolvency Proceedings to cooperate fully with the Insolvency Appointee to implement the Wind Down Plan required under Clause VII.A.1, or any other plan, procedure or scheme the Insolvency Appointee deems commensurate with the Insolvency Proceedings. This duty ensures the safeguards built into the Wind Down Plan continue to operate once formal Insolvency Proceedings have begun.

VIII.A.1(a)

Prior approval for any Material Change to the VASP. VARA Company Rulebook Clause VIII.A.1(a) requires a VASP to obtain VARA's prior written approval before facilitating any development or occurrence of a Material Change to itself. This is the general gatekeeping rule opening the Material Change regime in Part VIII, applying irrespective of whether the change originates internally or is prompted by an external event or transaction.

VIII.A.1(b)

Approval before entering new business or Virtual Asset Activity. VARA Company Rulebook Clause VIII.A.1(b) requires a VASP to obtain VARA's prior written approval before entering into any business or conducting any Virtual Asset Activity, directly or indirectly, other than the business and activities in which it and its Subsidiaries were engaged and authorised as of the date its Licence was granted.

VIII.A.2

Prohibition on debt that could cause a Material Change. VARA Company Rulebook Clause VIII.A.2 prohibits a VASP from creating, incurring, assuming, or permitting to exist, any debt that could reasonably be expected to cause a Material Change. This debt-specific restriction is one of several triggers identified across Section VIII.A that could give rise to an unauthorised Material Change if left unchecked.

VIII.A.3

Immediate cessation of a Material-Change-triggering transaction. VARA Company Rulebook Clause VIII.A.3 prohibits a VASP from causing a Material Change and requires that, if a proposed acquisition or disposal could reasonably be expected to cause one, the VASP must immediately cease that acquisition or disposal. This gives the prohibition on unauthorised Material Change a concrete, self-executing stop obligation that applies as soon as the risk becomes apparent.

VIII.A.4

Approval required for changes to authorised Virtual Asset Activities. VARA Company Rulebook Clause VIII.A.4 prohibits a VASP, without VARA's prior written approval, from implementing changes to its authorised Virtual Asset Activities, including adding a new Virtual Asset Activity or materially modifying the scope of an existing one. This ensures the scope of a VASP's licensed business remains within the boundaries VARA has assessed and approved at any given time.

VIII.A.5

Business plan changes must not cause a Material Change. VARA Company Rulebook Clause VIII.A.5 requires a VASP to ensure that changes to its business plan, covering internal controls, organisational structure, contingency plans and related matters, could not reasonably be expected to cause a Material Change. This extends the Material Change control to business-plan amendments specifically, capturing structural and operational changes that might not otherwise be classified as a transaction.

VIII.A.6

Aggregate effect of changes must not cause a Material Change. VARA Company Rulebook Clause VIII.A.6 requires a VASP to ensure that the aggregate, cumulative effect of all changes made under Rules VIII.A.1 through VIII.A.5 could not reasonably be expected to cause a Material Change. This closes a potential gap where no single change breaches the threshold but their combination does.

VIII.B.1

Notification of a plan to resume dormant activities. VARA Company Rulebook Clause VIII.B.1 requires a VASP that does not carry out its authorised Virtual Asset Activities for an extended period to notify VARA of its plan to reinstate or resume the relevant activities, in order to avoid Licence revocation or suspension for that inactivity. This gives a dormant VASP a defined path to preserve its Licence rather than facing automatic regulatory action.

VIII.B.2

Notification and Licence revocation request on ceasing activities. VARA Company Rulebook Clause VIII.B.2 requires a VASP intending to cease carrying out Virtual Asset Activities under its Licence to notify VARA and request revocation of the whole Licence, if ceasing all activities, or revocation of the specific Virtual Asset Activities being ceased, if ceasing only some of them, so its Licence accurately reflects the activities it continues to carry out.

VIII.B.3

30 Working Day advance notice of intended cessation. VARA Company Rulebook Clause VIII.B.3 requires a VASP to notify VARA of an intended cessation of Virtual Asset Activities as soon as reasonably practicable, and in any event not later than 30 Working Days before the intended cessation date. This sets the minimum lead time for the cessation notification required under Clause VIII.B.2.

VIII.C.1

Prior approval required for any Change of Control. VARA Company Rulebook Clause VIII.C.1 prohibits any action being taken that would result in a change of Control of a VASP without VARA's prior written approval. This is the general prohibition opening the Change of Control regime under Section VIII.C, ensuring VARA can assess the suitability of any new controlling party before that change of Control takes legal effect.

VIII.C.2

Joint application for a Change of Control. VARA Company Rulebook Clause VIII.C.2 requires that, prior to any change of Control, the VASP and the acquiring Entity must jointly submit a written application to VARA, in a form and substance acceptable to VARA, including detailed information about the acquiring Entity. This is the mandatory application process supporting the approval requirement under Clause VIII.C.1.

VIII.D.1

Prior approval required for mergers or acquisitions. VARA Company Rulebook Clause VIII.D.1 prohibits any action being taken that would result in a merger or acquisition of all or a substantial part of a VASP's assets without VARA's prior written approval. This mirrors the Change of Control prohibition under Clause VIII.C.1, applied to merger and asset-acquisition transactions rather than transactions affecting ownership or voting control specifically.

VIII.D.2

Written plan required for mergers or acquisitions. VARA Company Rulebook Clause VIII.D.2 requires that, prior to any merger or acquisition, the merging Entities or the acquiring Entity must submit to VARA a written plan of merger or acquisition, in form and substance satisfactory to VARA, specifying the merging, surviving and acquiring Entities and describing the terms, conditions and mode of carrying the transaction into effect.

Company Rulebook VII.A.2

A VASP must notify VARA within one day of discontinuing operations, submit a Wind Down Plan, and report weekly until completion.

Company Rulebook VII.A.1

All VASPs must maintain a Wind Down Plan addressing risks, resources, staff exit arrangements, and client communications during winding down.