VARA Compliance and Risk Management Rulebookchapter by chapter

I.A (chapeau)

Seven conduct principles applied in spirit. VARA Compliance and Risk Management Rulebook Clause I.A (chapeau) requires a Virtual Asset Service Provider to comply with the spirit of the seven listed conduct principles, comprising integrity, diligence, capability, client asset protection, effective disclosure, compliance strategy, and open dealings with regulators, in all business conducted from, through or servicing the Emirate. This overarching standard frames every specific obligation set out in the remainder of the Rulebook.

I.B.1

Establishment of a Compliance Management System. VARA Compliance and Risk Management Rulebook Clause I.B.1 requires a VASP to establish and maintain an effective Compliance Management System covering all operational aspects, independent of business functions, with prompt escalation of material non-compliance to the Compliance Officer, adequate resources and competence, and a risk-based testing and monitoring programme. This is the foundational governance structure underpinning the compliance obligations elsewhere in Chapter I.

I.B.2(a)

Compliance Officer's ultimate responsibility for the CMS. VARA Compliance and Risk Management Rulebook Clause I.B.2(a) provides that the Compliance Officer is ultimately responsible for establishing and administering the Compliance Management System required under Clause I.B.1. This fixes personal, named accountability for the CMS in the Compliance Officer role, distinct from the Board's broader governance oversight, and cannot be discharged by delegation alone under Clause I.C.3.

I.B.2(b)

Compliance Officer notification of material non-compliance. VARA Compliance and Risk Management Rulebook Clause I.B.2(b) requires the Compliance Officer to notify VARA and other relevant authorities whenever material non-compliance occurs within the VASP, its Board or Staff. This gives the Compliance Officer a direct, mandatory external-reporting duty triggered by material non-compliance detected through the CMS, operating alongside the self-reporting duty under Clause I.I.2.

I.B.3

Written compliance policies and procedures. VARA Compliance and Risk Management Rulebook Clause I.B.3 requires a VASP to establish, maintain and enforce clear compliance policies and procedures enabling Staff and the Board to comply with all legal and regulatory requirements, including record-keeping, business practices, AML/CFT and dealing requirements, to handle client complaints properly, and to access information needed to perform transactions.

I.B.4

Periodic review of the CMS and compliance policies. VARA Compliance and Risk Management Rulebook Clause I.B.4 requires the Compliance Management System and compliance policies and procedures to be reviewed and updated periodically to remain aligned with the evolving business and regulatory landscape of the global Virtual Asset sector. This ensures the CMS established under Clause I.B.1 does not become outdated as the sector and applicable law develop.

I.B.5

Fit and Proper standard for compliance Staff. VARA Compliance and Risk Management Rulebook Clause I.B.5 requires all Staff performing compliance functions to be Fit and Proper Persons with the necessary skills, qualifications and experience for their roles. This applies the Company Rulebook's Fit and Proper standard specifically to individuals staffing the compliance function, not only to the Compliance Officer named under Clause I.C.1.

I.B.6

Compliance with foreign law for overseas VA Activities. VARA Compliance and Risk Management Rulebook Clause I.B.6 requires that, where a VASP carries out Virtual Asset Activities outside the Emirate, it must comply with all applicable laws and regulatory requirements of every jurisdiction in which it operates. This extends the VASP's compliance obligations beyond the Emirate to every jurisdiction its Virtual Asset Activities reach.

I.C.1

Compliance Officer appointment eligibility. VARA Compliance and Risk Management Rulebook Clause I.C.1 requires a VASP to appoint a Compliance Officer who has at least five years' relevant compliance experience, is a Fit and Proper Person approved by VARA, is a UAE resident or passport holder, is a full-time employee, and reports directly to the Board. This sets the minimum eligibility and reporting-line standard for the Compliance Officer role.

I.C.1 (annual review)

Annual review of the Compliance Officer's appointment. VARA Compliance and Risk Management Rulebook Clause I.C.1 also requires the Compliance Officer's appointment to be reviewed annually to confirm continued Fit and Proper status and capability to discharge duties, with evidence available to VARA on request. This is a standing annual check distinct from the one-off eligibility assessment made at initial appointment under Clause I.C.1.

I.C.2

Compliance Officer's core duties. VARA Compliance and Risk Management Rulebook Clause I.C.2 makes the Compliance Officer responsible for ensuring Staff and Senior Management training on legal and regulatory compliance, including consumer protection and AML/CFT, developing and implementing compliance policies including the Business Continuity and Disaster Recovery Plan, assessing emerging risks and issues, reporting compliance activities and audits to the Board, and ensuring corrective actions are taken for CMS deficiencies or non-compliance.

I.C.3

Delegation of compliance activities without loss of accountability. VARA Compliance and Risk Management Rulebook Clause I.C.3 permits compliance activities to be delegated to appropriate professionals, but the Compliance Officer remains accountable for all Compliance Management System responsibilities, and any delegation or outsourcing must comply with Company Rulebook outsourcing requirements. This preserves personal accountability notwithstanding delegation, mirroring the equivalent principle applied to the MLRO under Clause III.A.3.

I.C.4

Compliance Officer holding additional roles. VARA Compliance and Risk Management Rulebook Clause I.C.4 permits the Compliance Officer to hold additional non-client-facing roles, such as Money Laundering Reporting Officer or head of the risk function, subject to Company Rulebook requirements and provided this does not create conflicting duties. This gives smaller VASPs flexibility in staffing key control functions while guarding against role conflicts.

I.D.1

Establishment of an effective risk management function. VARA Compliance and Risk Management Rulebook Clause I.D.1 requires a VASP to establish and maintain an effective risk management function, policies and procedures, and risk measurement and reporting methodologies commensurate with its nature, size, complexity and risk profile, to identify, measure, manage and monitor all risks. This is the foundational risk management obligation opening Section I.D.

I.D.2

Head of the risk function qualifications and reporting line. VARA Compliance and Risk Management Rulebook Clause I.D.2 requires the head of the risk function to have appropriate qualifications and authority to oversee and monitor the VASP's overall risk exposure, and, if this role is separate from the Compliance Officer, requires the head of risk to also report directly to the Board.

I.D.3

Ongoing review of risk management policies. VARA Compliance and Risk Management Rulebook Clause I.D.3 requires the Board to ensure risk management policies undergo ongoing comprehensive review, particularly following material changes in business, operations, Senior Management or Staff, market conditions or applicable laws. This keeps the risk management function required under Clause I.D.1 responsive to material change rather than reviewed only on a fixed periodic cycle.

I.D.4

Quarterly risk exposure reporting to the Board. VARA Compliance and Risk Management Rulebook Clause I.D.4 requires the head of the risk function to submit risk exposure reports identifying all actual or potential risks to the Board at least quarterly, or more frequently if a specific identified risk requires it. This gives the Board's risk oversight a defined minimum reporting cadence.

I.D.5 (chapeau)

Key risk categories in risk exposure reporting. VARA Compliance and Risk Management Rulebook Clause I.D.5 (chapeau) requires a VASP to consider and report on defined key risk categories, comprising financial stability, market conduct, compliance and risk management, and consumer protection risks, in its risk exposure reporting, and to adopt appropriate mitigating measures for each, to the extent applicable. This sets the mandatory risk-category scope for the reporting required under Clause I.D.4.

I.D.5.a.ii

Market risk mitigation measures. VARA Compliance and Risk Management Rulebook Clause I.D.5.a.ii requires a VASP, for market risk, to adopt mitigating measures including regular control techniques such as reviews of financial statements and Virtual Asset holding values, and risk-quantification methods addressing adverse market movements, individual market factor sensitivity, and stress testing, feeding into the risk exposure reporting required under Clause I.D.4.

I.D.5.a.iii

Credit risk mitigation measures. VARA Compliance and Risk Management Rulebook Clause I.D.5.a.iii requires a VASP, for credit risk, to adopt mitigating measures including an effective credit rating system, objective criteria to evaluate and set credit, trading and position limits for clients and counterparties enforced at all times, and quantitative methodologies to monitor pre-settlement and settlement credit exposure across all counterparty relationships.

I.D.5.a.iii(4)

Margin policy requirements. VARA Compliance and Risk Management Rulebook Clause I.D.5.a.iii(4) requires that, where margin is applicable to a VASP's Virtual Asset Activities, it must establish and maintain a margin policy covering permitted margin types, rates and calculation methods, acceptable payment and collateral methods, circumstances for margin and additional margin calls and the consequences of failure to meet them, and escalation procedures for successive missed margin calls.

I.D.5.a.iv

Liquidity risk mitigation measures. VARA Compliance and Risk Management Rulebook Clause I.D.5.a.iv requires a VASP, for liquidity risk, to adopt mitigating measures including concentration limits by product, market or counterparty, regular monitoring of maturity mismatches and concentrations, and clear default procedures alerting Staff and Senior Management to potential liquidity problems before they crystallise into a funding shortfall. This obligation is set out in I.D Risk management of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

I.E.1

Effective operational policies and processes. VARA Compliance and Risk Management Rulebook Clause I.E.1 requires a VASP to establish and maintain effective operational policies and processes ensuring regular information exchange with clients, Group and counterparties, fair dealing, safeguarding of assets including Client Virtual Assets, reliable record-keeping, and Staff compliance with all applicable requirements across day-to-day operations. This requirement forms part of I.E Operation management under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

I.E.2

Communication of account-operation procedures to clients. VARA Compliance and Risk Management Rulebook Clause I.E.2 requires that, where a VASP acts on a client's behalf in operating an account, it must clearly communicate the applicable procedures and terms and conditions consistent with the client's stated objectives, and strictly follow those procedures once communicated, without unilateral departure from the agreed terms. This requirement is drawn from I.E Operation management of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

I.E.3

Safeguards against misuse of confidential or Inside Information. VARA Compliance and Risk Management Rulebook Clause I.E.3 requires a VASP to establish and enforce procedures safeguarding against Staff or Board members taking advantage of confidential information or Inside Information. This operational-management obligation reinforces the confidentiality and market-conduct protections found in the Technology and Information and Market Conduct Rulebooks. This obligation sits within I.E Operation management of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

I.E.4

Protecting Virtual Assets and Client VAs from theft or fraud. VARA Compliance and Risk Management Rulebook Clause I.E.4 requires a VASP to establish and maintain robust procedures to protect Virtual Assets and Client Virtual Assets from theft, fraud and misappropriation, with Staff and Board following internal protocols for any acquisition, transfer or disposal of such assets. This obligation sits within I.E Operation management of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

I.E.5

Reconciling records to identify errors or misplacement. VARA Compliance and Risk Management Rulebook Clause I.E.5 requires a VASP to regularly check records and reports, including third-party reports from banks or other VASPs, and system-recorded information, including on distributed ledgers, and reconcile these with internal records to identify errors, omissions or asset misplacement before they compound into larger discrepancies. This requirement forms part of I.E Operation management under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

I.E.6

Compliance with VARA-mandated committees. VARA Compliance and Risk Management Rulebook Clause I.E.6 requires that, where VARA requires a VASP to establish specific committees, whether as a Licence condition or otherwise, the VASP must comply with such requirements. This gives VARA discretion to mandate additional governance committees beyond those generally required under the Company Rulebook for a particular VASP's circumstances. This requirement forms part of I.E Operation management under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

I.F.1

Books and records content requirements. VARA Compliance and Risk Management Rulebook Clause I.F.1 requires a VASP to keep books and records properly in original or native format, including on distributed ledgers where appropriate, covering transaction audit trails, third-party client information, compliance evidence including AML/CFT, audit-enabling records, the general ledger, client statements and valuations, Board minutes, complaint and investigation records, and the conflicts of interest register.

I.F.2

Eight-year minimum record retention. VARA Compliance and Risk Management Rulebook Clause I.F.2 requires a VASP to retain each record required under Clause I.F.1 for no less than eight years, or indefinitely for any records relating to UAE national security. This sets the minimum retention period applicable to the full range of books and records mandated under Clause I.F.1, mirroring retention periods applied elsewhere in the Rulebook.

I.F.3

Furnishing records to VARA. VARA Compliance and Risk Management Rulebook Clause I.F.3 requires a VASP to furnish copies of records to VARA in accordance with applicable Regulations, Rules or Directives. This gives VARA a standing right of access to the books and records the VASP is required to keep and retain under Clauses I.F.1 and I.F.2, without requiring a separate legal basis for each request.

I.G.1.a (auditor appointment)

Appointment of an independent auditor. VARA Compliance and Risk Management Rulebook Clause I.G.1.a requires a VASP to appoint an independent third-party auditor to audit its financial statements and produce an annual report. This is the foundational external-audit requirement underpinning the further auditor-related obligations in the remainder of Section I.G, including notification and cooperation duties. This obligation sits within I.G Audit of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

I.G.1.a (notification)

Notification of the appointed auditor to VARA. VARA Compliance and Risk Management Rulebook Clause I.G.1.a also requires a VASP to promptly notify VARA of the full name and contact details of the appointed auditor upon appointment. This gives VARA immediate visibility of who has been engaged to satisfy the independent audit requirement, supporting VARA's ability to liaise directly with the auditor if needed.

I.G.1.b

Making the annual report available. VARA Compliance and Risk Management Rulebook Clause I.G.1.b requires a VASP to promptly make the annual report produced under Clause I.G.1.a available to its clients and to VARA upon request. This ensures the audited annual report reaches both the VASP's clients and its regulator without unnecessary delay following completion of the audit. This requirement is drawn from I.G Audit of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

I.G.1.d

Accounting standards for the annual report. VARA Compliance and Risk Management Rulebook Clause I.G.1.d requires the accounting information in the annual report to be prepared in accordance with generally accepted accounting principles. This sets the applicable accounting standard governing the content of the annual report required under Clause I.G.1.a, ensuring comparability and reliability of the reported figures. This obligation is set out in I.G Audit of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

I.G.1.e

Counterparty cooperation with the auditor. VARA Compliance and Risk Management Rulebook Clause I.G.1.e requires that, if requested, a VASP must procure relevant counterparties to cooperate with the auditor and provide all information necessary for the audit. This extends the VASP's audit-facilitation obligation to third parties whose cooperation the auditor may need to complete the annual audit. This requirement is drawn from I.G Audit of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

I.G.1.f

VARA-directed change of auditor. VARA Compliance and Risk Management Rulebook Clause I.G.1.f requires that, where VARA requires a VASP to appoint an alternative auditor, for example if existing auditors are deemed inappropriate, the VASP must comply. This gives VARA an overriding power to require a change of external auditor independent of the VASP's own preference. This obligation is set out in I.G Audit of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

I.G.2.a

Independent internal audit function. VARA Compliance and Risk Management Rulebook Clause I.G.2.a requires that, where applicable, a VASP establish and maintain an objective internal audit function, independent of the operational function, submitting regular reports directly to Senior Management. This is distinct from the external audit requirement under Clause I.G.1.a, addressing internal control assurance on a continuing basis. This requirement forms part of I.G Audit under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

I.G.2.b

Policies on internal and external auditor roles. VARA Compliance and Risk Management Rulebook Clause I.G.2.b requires a VASP to establish and maintain clear policies defining the roles and responsibilities of, and working relationship between, internal and external auditors. This ensures the two audit functions required under Clauses I.G.1.a and I.G.2.a operate with clearly delineated, non-overlapping mandates and reporting lines. This requirement, found in I.G Audit of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

I.G.2.c

Quarterly internal audit work and follow-up. VARA Compliance and Risk Management Rulebook Clause I.G.2.c requires the internal audit function to perform audit work at least quarterly, inform Senior Management of findings and recommendations, and follow up to resolve matters or risks highlighted in reports. This sets the minimum cadence and follow-through standard for the internal audit function required under Clause I.G.2.a.

I.H.1

Monthly regulatory reporting package. VARA Compliance and Risk Management Rulebook Clause I.H.1 requires a VASP to submit a monthly regulatory reporting package to VARA including the balance sheet and off-balance sheet items, profit and loss statement, income statement, cashflow statements, Virtual Asset Wallet addresses, a list of Group entities investing in Virtual Assets with related transaction records, and Related Party transactions.

I.H.2

Quarterly regulatory reporting package. VARA Compliance and Risk Management Rulebook Clause I.H.2 requires a VASP to submit a quarterly regulatory reporting package to VARA including Board and committee meeting minutes, a statement of compliance with VARA financial requirements including Reserve Assets, financial projections and strategic plans, and the quarterly risk exposure report required under Clause I.D.4, on the same quarterly cadence.

I.H.3

Annual regulatory reporting package. VARA Compliance and Risk Management Rulebook Clause I.H.3 requires a VASP to submit an annual regulatory reporting package to VARA including audited financial statements with the auditor's internal-control opinion, Senior Management's compliance assessment, Board or Responsible Individual certification of financial statements, a sample of client onboarding documentation covering the first 100 clients of the year, product offering descriptions, Group structure and Ultimate Beneficial Owner chart, Board and Senior Management biographies and outside positions, independent director identification, committee membership and activity details, and meeting attendance records.

I.H.4

Additional information on VARA's request. VARA Compliance and Risk Management Rulebook Clause I.H.4 requires a VASP to provide any additional information VARA requests beyond the standard monthly, quarterly and annual reporting items required under Clauses I.H.1 through I.H.3. This gives VARA a residual power to request further information outside the fixed reporting calendar as supervisory needs arise. This requirement, found in I.H Regulatory reporting of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

I.I.1(a)

Notification of changes to annual submission items. VARA Compliance and Risk Management Rulebook Clause I.I.1(a) requires a VASP to notify VARA in writing of any changes to the items reported in the annual submission under Clause I.H.3, for example Board or Senior Management changes, Ultimate Beneficial Owner or Group structure changes, product offerings, or committee composition, as and when such changes occur.

I.I.1(b)

Immediate notification of legal actions or investigations. VARA Compliance and Risk Management Rulebook Clause I.I.1(b) requires a VASP to notify VARA in writing, immediately after commencement, of any criminal or material civil action, charge, proceeding or Insolvency Proceedings, or investigations, inspections or enquiries that may lead to such, against the VASP or its Board members, Ultimate Beneficial Owners or Senior Management.

I.I.2

Immediate reporting of legal or regulatory violations. VARA Compliance and Risk Management Rulebook Clause I.I.2 requires a VASP to submit a report to VARA immediately upon discovering any violation or breach of any law, Regulation, Rule or Directive related to conduct of any Virtual Asset Activity. This is a self-reporting obligation triggered by the VASP's own discovery of non-compliance, independent of the Compliance Officer's own notification duty under Clause I.B.2(b).

I.I.3

Disclosure of activities outside the Emirate. VARA Compliance and Risk Management Rulebook Clause I.I.3 requires a VASP, upon request from VARA, to disclose information regarding its activities in jurisdictions other than the Emirate. This gives VARA visibility of a VASP's cross-border footprint on request, complementing the general foreign-law compliance duty under Clause I.B.6. This requirement is drawn from I.I Regulatory notifications of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

I.I.4

Notification of cybersecurity breach incidents. VARA Compliance and Risk Management Rulebook Clause I.I.4 requires a VASP to comply with Technology and Information Rulebook requirements to notify VARA of cybersecurity breach incidents, including those involving loss of information or affecting Personal Data. This cross-references the notification timelines set in the Technology and Information Rulebook, including the 72-hour reporting deadline it imposes.

I.J.1

Employing suitably qualified individuals. VARA Compliance and Risk Management Rulebook Clause I.J.1 requires a VASP to implement procedures ensuring it only employs suitably qualified individuals with the requisite skills, knowledge and expertise, duly registered with applicable professional bodies as required. This is the foundational Staff-quality obligation opening Section I.J and underpinning the training duties that follow. This requirement is drawn from I.J Staff management and training of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

I.J.2

Adequate Staff numbers for effective supervision. VARA Compliance and Risk Management Rulebook Clause I.J.2 requires a VASP to employ appropriate numbers of Staff to discharge relevant duties effectively, ensuring supervisory, monitoring and enforcement functions operate effectively to VARA's satisfaction even if Staff are not physically located in the Emirate at the time. This obligation is set out in I.J Staff management and training of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

I.J.3

Up-to-date policy information for Staff. VARA Compliance and Risk Management Rulebook Clause I.J.3 requires a VASP to ensure all Staff are provided with adequate and up-to-date information regarding all applicable policies and procedures. This general information-access obligation supports Staff's ability to comply with the policies established throughout the Rulebook and complements the specific new-hire timeline under Clause I.J.6. This obligation is set out in I.J Staff management and training of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

I.J.4

Role-appropriate Staff training. VARA Compliance and Risk Management Rulebook Clause I.J.4 requires a VASP to provide adequate training suitable to each Staff member's role, both at the start of employment and on an ongoing basis. This general training standard complements the AML/CFT-specific training obligation under Clause I.J.5 and the anti-bribery training under Clause VI.D.1. This requirement, found in I.J Staff management and training of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

I.J.5

AML/CFT training and monitoring. VARA Compliance and Risk Management Rulebook Clause I.J.5 requires a VASP to implement and provide regular AML/CFT training for all Staff and monitor Staff compliance with established AML/CFT procedures. This is the training-specific counterpart to the substantive AML/CFT obligations set out in Chapter III of the Rulebook and the MLRO's own training duty under Clause III.A.2(a).

I.J.6

30-day policy communication to new hires. VARA Compliance and Risk Management Rulebook Clause I.J.6 requires a VASP to ensure operational policies and procedures are communicated to new hires within their first 30 calendar days of employment. This sets a fixed deadline for onboarding Staff to receive the policy information required more generally under Clause I.J.3, giving new Staff a defined window to become compliant.

I.J.7

Prompt communication of policy updates. VARA Compliance and Risk Management Rulebook Clause I.J.7 requires that, when operational policies or procedures are updated, a VASP must promptly communicate the changes to all Staff and ensure updated policies remain available to all Staff at all times. This keeps the Staff information standard under Clause I.J.3 current as policies evolve, avoiding reliance on outdated guidance.

II.1

Ongoing tax reporting compliance. VARA Compliance and Risk Management Rulebook Clause II.1 requires a VASP to at all times comply with all tax reporting obligations under applicable laws, regulations, rules, guidance and national, international and industry best practices, including the US Foreign Account Tax Compliance Act where applicable. This is the standalone obligation comprising the whole of Chapter II, Tax Reporting and Compliance.

III.A.1(a)

MLRO appointment eligibility. VARA Compliance and Risk Management Rulebook Clause III.A.1(a) requires a VASP to appoint a Money Laundering Reporting Officer who has at least two years of AML/CFT experience and satisfies the Fit and Proper Person test. This is the foundational eligibility standard for the MLRO role opening Section III.A, paralleling the Compliance Officer's own eligibility standard under Clause I.C.1.

III.A.1(b)

Annual review of the MLRO's appointment. VARA Compliance and Risk Management Rulebook Clause III.A.1(b) requires a VASP to review the MLRO's appointment annually to confirm continued fit-and-proper status and capability to perform MLRO duties. This mirrors the annual Compliance Officer review required under Clause I.C.1, applied specifically to the MLRO role and its AML/CFT duties. This requirement forms part of III.A Appointment and duties of Money Laundering Reporting Officer under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.A.2(a)

MLRO responsibility for AML/CFT training. VARA Compliance and Risk Management Rulebook Clause III.A.2(a) requires the MLRO to ensure the Board and Staff are properly and adequately trained on applicable AML/CFT laws and requirements relevant to Virtual Asset Activities. This is the first of the MLRO's specific duties enumerated across Clause III.A.2, feeding into the general Staff training obligation under Clause I.J.5.

III.A.2(b)

MLRO responsibility for AML/CFT policies and procedures. VARA Compliance and Risk Management Rulebook Clause III.A.2(b) provides that the MLRO is responsible for developing and implementing the VASP's AML/CFT policies and procedures as required under Rule III.B. This ties ownership of the Section III.B policy framework directly to the MLRO role, rather than leaving it to general Compliance Officer oversight. This obligation sits within III.A Appointment and duties of Money Laundering Reporting Officer of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.A.2(c)

MLRO responsibility for risk assessments. VARA Compliance and Risk Management Rulebook Clause III.A.2(c) requires the MLRO to conduct AML/CFT risk assessments under Rule III.D and implement changes to policies and procedures to address identified issues and risks. This links the MLRO role to the risk assessment obligations set out in Section III.D, both at business and client level. This requirement forms part of III.A Appointment and duties of Money Laundering Reporting Officer under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.A.2(d)

MLRO responsibility for Suspicious Transaction reporting. VARA Compliance and Risk Management Rulebook Clause III.A.2(d) requires the MLRO to monitor for and report Suspicious Transactions in accordance with Rule III.F. This ties ownership of the Section III.F monitoring and reporting regime directly to the MLRO role, including filing AML-CFT Reports with the UAE FIU. This requirement, found in III.A Appointment and duties of Money Laundering Reporting Officer of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.A.2(e)

MLRO responsibility for corrective action. VARA Compliance and Risk Management Rulebook Clause III.A.2(e) requires the MLRO, where necessary, to ensure appropriate corrective actions are taken in response to non-compliance with Federal AML-CFT Laws. This gives the MLRO an active remediation role beyond monitoring and reporting alone, closing the loop on identified AML/CFT weaknesses. This obligation sits within III.A Appointment and duties of Money Laundering Reporting Officer of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.A.2(f)

Quarterly MLRO reporting to the Board. VARA Compliance and Risk Management Rulebook Clause III.A.2(f) requires the MLRO to report to the Board quarterly on the effectiveness of the VASP's AML/CFT policies and procedures, identifying any failures or instances of non-compliance. This gives the Board a defined minimum cadence of AML/CFT oversight reporting distinct from the MLRO's other duties. This requirement, found in III.A Appointment and duties of Money Laundering Reporting Officer of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.A.2(g)

Anonymity-Enhanced Transaction summary in Board reports. VARA Compliance and Risk Management Rulebook Clause III.A.2(g) requires the MLRO's quarterly Board reports to include a summary of all Anonymity-Enhanced Transactions and the clients involved during the quarter. This is a mandatory content item within the quarterly reporting obligation established under Clause III.A.2(f), linked to the enhanced controls required under Clause III.D.5. This requirement, found in III.A Appointment and duties of Money Laundering Reporting Officer of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.A.2(h)

Availability of quarterly MLRO reports to VARA. VARA Compliance and Risk Management Rulebook Clause III.A.2(h) requires the MLRO to make the quarterly reports required under Clause III.A.2(f) available to VARA upon request. This gives VARA direct access to the same reporting the MLRO provides to the Board, without requiring a separate formal information request process. This requirement is drawn from III.A Appointment and duties of Money Laundering Reporting Officer of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.A.3

Delegation of AML/CFT activities without loss of accountability. VARA Compliance and Risk Management Rulebook Clause III.A.3 provides that, where AML/CFT activities are delegated to other entities, the MLRO must remain accountable for all related responsibilities, and all applicable Company Rulebook outsourcing requirements must be complied with. This mirrors the Compliance Officer's non-delegable accountability under Clause I.C.3, applied to AML/CFT functions.

III.B.1

AML/CFT policies aligned to Federal Law and FATF standards. VARA Compliance and Risk Management Rulebook Clause III.B.1 requires a VASP to establish and implement AML/CFT policies and procedures that comply with Federal AML-CFT Laws and specified FATF and Executive Office for Control and Non-Proliferation standards and guidance, including FATF Virtual Asset reviews, FATF Recommendations, counter-proliferation financing guidance, and the Local Terrorist List.

III.B.2(a)

Prohibition on anonymous or fictitious accounts. VARA Compliance and Risk Management Rulebook Clause III.B.2(a) requires AML/CFT policies to ensure the VASP refrains from opening accounts or conducting transactions under anonymous, fictitious, pseudonymous or numbered identities, and from maintaining relationships or providing services to such identities, regardless of the underlying purpose of the account. This requirement, found in III.B Policies and procedures of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.B.2(b)

Prompt application of UNSC sanctions directives. VARA Compliance and Risk Management Rulebook Clause III.B.2(b) requires AML/CFT policies to ensure prompt application of UAE competent authority directives implementing United Nations Security Council resolutions on terrorism, terrorist financing and proliferation financing, and compliance with related sanctions laws as they are updated from time to time. This requirement, found in III.B Policies and procedures of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.B.2(c)

Transaction record maintenance and VARA access. VARA Compliance and Risk Management Rulebook Clause III.B.2(c) requires AML/CFT policies to ensure the VASP maintains all records, documents and data for all local and international transactions, and makes this information available to VARA upon request, supporting the wider record-keeping regime under Section III.I. This obligation is set out in III.B Policies and procedures of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.B.2(d)

Compliance with wider AML/CFT guidance. VARA Compliance and Risk Management Rulebook Clause III.B.2(d) requires AML/CFT policies to ensure full compliance with any other AML/CFT requirements and applicable laws, regulations and guidelines issued by VARA, UAE federal bodies, FATF or MENAFATF from time to time. This is a residual compliance requirement capturing evolving AML/CFT standards beyond those specifically enumerated elsewhere in Section III.B.

III.B.3

Risk-based client and transaction screening rules. VARA Compliance and Risk Management Rulebook Clause III.B.3 requires a VASP to establish adequate risk rules to screen clients, Ultimate Beneficial Owners, Virtual Asset transactions and Virtual Asset wallet addresses to identify potential illicit activity, adverse information and sanctions exposure, and to alert operations and compliance teams to impose restrictions and investigate further where warranted.

III.B.4(a)

Third-party attestation of AML/CFT policies. VARA Compliance and Risk Management Rulebook Clause III.B.4(a) requires the AML/CFT policies and procedures established under Rule III.B.1 to be attested by a competent third party. This introduces an independent verification step over the VASP's own AML/CFT policy framework before it is relied upon or submitted to VARA. This obligation is set out in III.B Policies and procedures of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.B.4(b)

Submission of attested policies to VARA. VARA Compliance and Risk Management Rulebook Clause III.B.4(b) requires attested AML/CFT policies and procedures to be submitted to VARA during licensing and within 21 calendar days of any subsequent changes taking effect. This gives VARA a defined, recurring deadline for receiving the attested policies required under Clause III.B.4(a) as they are updated. This obligation sits within III.B Policies and procedures of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.C.1

Effective AML/CFT controls and systems. VARA Compliance and Risk Management Rulebook Clause III.C.1 requires a VASP to maintain effective AML/CFT controls and systems capable of adequately managing AML/CFT risks relevant to its Virtual Asset Activities, including use of distributed ledger analytics and other investigative tools to monitor and screen transactions on an ongoing basis. This requirement, found in III.C AML/CFT controls of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.C.2

Review of distributed ledger analytics tool capabilities. VARA Compliance and Risk Management Rulebook Clause III.C.2 requires that, for any distributed ledger analytics tools used, a VASP must review and document the tools' capabilities and weaknesses and design controls to monitor clients' interaction with Virtual Asset Activities, ensuring gaps in tool coverage are identified and addressed. This requirement is drawn from III.C AML/CFT controls of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.C.3

Ongoing review of analytics tool performance. VARA Compliance and Risk Management Rulebook Clause III.C.3 requires that, given the dynamic nature of Virtual Asset transactions and wallet addresses, a VASP must review and document the performance and function of any distributed ledger analytics tools used for ongoing monitoring. This supplements the capability review required under Clause III.C.2 with a recurring performance check.

III.C.4

FATF Red Flag Indicators in transaction monitoring. VARA Compliance and Risk Management Rulebook Clause III.C.4 requires that, where applicable, a VASP must implement internal controls addressing the FATF Virtual Assets Red Flag Indicators of September 2020, as updated, when designing transaction monitoring scenarios and thresholds used in its ongoing AML/CFT screening processes. This requirement, found in III.C AML/CFT controls of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.D.1

AML/CFT business risk assessment. VARA Compliance and Risk Management Rulebook Clause III.D.1 requires a VASP to conduct AML/CFT business risk assessments as part of implementing adequate policies, procedures and controls to detect and prevent illicit activity. This opens the risk assessment regime elaborated in the remainder of Section III.D, distinct from the client-level assessment under Clause III.D.6. This obligation is set out in III.D Risk assessments of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.D.2

Business risk assessment content. VARA Compliance and Risk Management Rulebook Clause III.D.2 requires business risk assessments to identify and assess money-laundering risks specific to the VASP's business and operations, considering nature, size and complexity, including risks from new or existing Virtual Assets, Virtual Asset-related technology, products and services, business practices, other emerging technologies, and other emerging risks facing the sector.

III.D.3

Quarterly business risk assessment cadence. VARA Compliance and Risk Management Rulebook Clause III.D.3 requires business risk assessments to be carried out at intervals no longer than every three months, and additionally whenever there is a significant change or advancement in any relevant risk area. This sets the minimum recurring frequency for the assessments required under Clause III.D.1, on top of any event-driven trigger.

III.D.4

Risk assessment outcomes informing policy updates. VARA Compliance and Risk Management Rulebook Clause III.D.4 requires a VASP to ensure, and be able to demonstrate to VARA on request, that business risk assessment outcomes directly inform updates to AML/CFT policies, procedures, systems and controls and the prioritization of resource allocation across the compliance function. This requirement forms part of III.D Risk assessments under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.D.5

Enhanced controls for Anonymity-Enhanced Transactions. VARA Compliance and Risk Management Rulebook Clause III.D.5 requires VASPs enabling Anonymity-Enhanced Transactions to implement proportionately enhanced controls, including enhanced client due diligence on each client using such services, re-verified every six months, reflecting the elevated money-laundering risk such transactions present. This requirement, found in III.D Risk assessments of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.D.6

AML/CFT client risk assessment. VARA Compliance and Risk Management Rulebook Clause III.D.6 requires a VASP to conduct AML/CFT client risk assessments as part of implementing adequate policies, procedures and controls to detect and prevent illicit activity. This is the client-level counterpart to the business risk assessment required under Clause III.D.1, feeding the client due diligence process under Section III.E. This obligation is set out in III.D Risk assessments of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.D.7

Client risk assessment content. VARA Compliance and Risk Management Rulebook Clause III.D.7 requires client risk assessments to identify and assess money-laundering risks specific to the client base, including criteria and methodology for client risk categorization, how assessments are documented with associated action plans by risk tier, and requirements for maintaining comprehensive audit trails supporting each rating decision. This obligation sits within III.D Risk assessments of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.D.8

Quarterly client risk assessment cadence. VARA Compliance and Risk Management Rulebook Clause III.D.8 requires client risk assessments to be carried out at intervals no longer than every three months. This mirrors the business risk assessment frequency required under Clause III.D.3, applied to the client-level assessments required under Clause III.D.6. This requirement is drawn from III.D Risk assessments of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.E.1

Risk-based approach to client due diligence. VARA Compliance and Risk Management Rulebook Clause III.E.1 requires a VASP to adopt a risk-based approach to client due diligence measures in accordance with the Federal AML-CFT Laws. This is the general standard opening the client due diligence regime in Section III.E, calibrating CDD intensity to assessed risk. This requirement forms part of III.E Client due diligence under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.E.2

Risk-based client assessment and rating. VARA Compliance and Risk Management Rulebook Clause III.E.2 requires a VASP to perform a risk-based assessment of every client, using the client risk assessment criteria and methodology required under Clause III.D.7, and assign each client a risk rating proportionate to assessed AML/CFT risk, which then drives the applicable CDD intensity. This requirement is drawn from III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.E.3

Identity verification before establishing a relationship. VARA Compliance and Risk Management Rulebook Clause III.E.3 requires a VASP to verify the identity of the client and any Ultimate Beneficial Owner through client due diligence measures before or during establishment of a business relationship, or before executing a transaction for a client with no existing relationship, subject to the specific triggers under Clause III.E.4.

III.E.4(a)

CDD trigger: establishing a business relationship. VARA Compliance and Risk Management Rulebook Clause III.E.4(a) requires a VASP to undertake client due diligence measures when establishing a business relationship with a client for Virtual Asset Activities. This is the first of five specific CDD triggers enumerated across Clause III.E.4, applicable before any services are provided. This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.E.4(b)

CDD trigger: occasional transactions above AED 3,500. VARA Compliance and Risk Management Rulebook Clause III.E.4(b) requires a VASP to undertake client due diligence measures for occasional transactions, whether single or linked, equal to or exceeding AED 3,500 for a client without an ongoing relationship. This threshold aligns with the Travel Rule threshold in Clause III.G.2. This requirement forms part of III.E Client due diligence under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.E.4(c)

CDD trigger: handling a potential Suspicious Transaction. VARA Compliance and Risk Management Rulebook Clause III.E.4(c) requires a VASP to undertake client due diligence measures when instructed by a client to handle a potential Suspicious Transaction, ensuring identity and background information is available to support any resulting AML-CFT Report. This obligation sits within III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.E.4(d)

CDD trigger: doubts about prior identification information. VARA Compliance and Risk Management Rulebook Clause III.E.4(d) requires a VASP to undertake client due diligence measures where there are doubts about the veracity or adequacy of previously obtained client identification information, prompting a fresh verification exercise regardless of the client's tenure. This requirement is drawn from III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.E.4(e)

CDD trigger: transactions for high-risk clients. VARA Compliance and Risk Management Rulebook Clause III.E.4(e) requires a VASP to undertake client due diligence measures when carrying out any transaction for clients characterized as high-risk under the Federal AML-CFT Laws, feeding into the enhanced due diligence regime under Clause III.E.10. This requirement is drawn from III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.E.5

Ongoing client due diligence during relationships. VARA Compliance and Risk Management Rulebook Clause III.E.5 requires a VASP to apply ongoing client due diligence measures during business relationships, including auditing transactions for consistency with client information and risk profile, including source of funds where necessary, and periodically reviewing and updating CDD records, particularly for high-risk clients identified under Section III.D. This requirement, found in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.E.6(a)

Identity verification for individual clients. VARA Compliance and Risk Management Rulebook Clause III.E.6(a) requires a VASP, for individual clients, to verify identity using reliable independent-source documents or data covering full name, a copy of an identification or travel document, nationality, address, place of birth, and employer name and address, before or during onboarding. This requirement, found in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.E.6(a)(vi)

MLRO and Senior Management approval for PEP individuals. VARA Compliance and Risk Management Rulebook Clause III.E.6(a)(vi) requires that, if an individual client is a Politically Exposed Person, the VASP must obtain approval from the MLRO and a member of Senior Management before establishing the business relationship, reflecting the heightened risk such clients present. This obligation sits within III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.E.6(b)

Identity verification for Entity clients. VARA Compliance and Risk Management Rulebook Clause III.E.6(b) requires a VASP, for Entity clients, to verify identity using reliable independent-source documents or data covering the full Entity name, Entity type, attested constitutional documents, principal place of business, and names of Senior Management position holders, mirroring the individual verification standard in Clause III.E.6(a). This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.E.6(b)(vi)

MLRO and Senior Management approval for PEP-linked Entities. VARA Compliance and Risk Management Rulebook Clause III.E.6(b)(vi) requires that, if an Entity client's Ultimate Beneficial Owner is a Politically Exposed Person, the VASP must obtain approval from the MLRO and a member of Senior Management before establishing the business relationship, mirroring the individual-client requirement in Clause III.E.6(a)(vi). This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.E.7(a)

Verifying authority to act on a client's behalf. VARA Compliance and Risk Management Rulebook Clause III.E.7(a) requires a VASP to verify that any Entity purporting to act on behalf of a client is duly authorised, and to verify that Entity's identity in accordance with Rule III.E.6, before accepting instructions from that Entity. This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.E.7(b)

Understanding the purpose and nature of relationships. VARA Compliance and Risk Management Rulebook Clause III.E.7(b) requires a VASP to understand the intended purpose and nature of the business relationship with each client, obtaining further information when necessary. This substantive understanding requirement goes beyond mere identity verification under Clause III.E.6 and feeds the ongoing monitoring obligation in Clause III.E.5. This obligation sits within III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.E.7(c)

Understanding client business, ownership and clientele. VARA Compliance and Risk Management Rulebook Clause III.E.7(c) requires that, where a client is a business or serves other clientele, a VASP must understand the client's business, ownership and control structure, including Ultimate Beneficial Owner identity, whether the structure includes Decentralised Autonomous Organisations and their purpose, and the nature of the client's own clientele, performing due diligence on that clientele where necessary.

III.E.8

No relationship without adequate CDD. VARA Compliance and Risk Management Rulebook Clause III.E.8 provides that, if a VASP cannot conduct appropriate client due diligence on a client, it must not establish or maintain a business relationship with that client, or execute any transaction for them. This is the ultimate consequence attaching to a failed or incomplete CDD process under Section III.E.

III.E.9

Continuing liability when relying on third-party CDD. VARA Compliance and Risk Management Rulebook Clause III.E.9 provides that, where a VASP relies on third parties to perform client due diligence, it remains liable for ensuring the third party's CDD is performed in accordance with all relevant Rules and Directives, and must implement adequate measures to ensure this, rather than treating reliance as a full transfer of responsibility.

III.E.10(a)

Enhanced due diligence information for high-risk clients. VARA Compliance and Risk Management Rulebook Clause III.E.10(a) requires that, for high-risk or Politically Exposed Person-linked clients, a VASP must obtain enhanced information, comprising additional identification details for the client and all Ultimate Beneficial Owners, additional information on the intended nature of the business relationship, and information on the reasons for a transaction.

III.E.10(b)

More frequent CDD updates for high-risk clients. VARA Compliance and Risk Management Rulebook Clause III.E.10(b) requires that, for high-risk or Politically Exposed Person-linked clients, a VASP must update client due diligence information held on the client and any Ultimate Beneficial Owner more regularly than for standard clients, reflecting the heightened ongoing risk such clients present. This obligation sits within III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.E.10(c)

Source of funds and wealth verification for high-risk clients. VARA Compliance and Risk Management Rulebook Clause III.E.10(c) requires that, for high-risk or Politically Exposed Person-linked clients, a VASP must identify and verify the source of funds and, where applicable, the source of wealth of the client and any Ultimate Beneficial Owners, beyond the standard CDD required under Clause III.E.6. This requirement, found in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.E.10(d)

Enhanced monitoring for high-risk clients. VARA Compliance and Risk Management Rulebook Clause III.E.10(d) requires that, for high-risk or Politically Exposed Person-linked clients, a VASP must carry out enhanced monitoring of the business relationship by increasing the frequency and intensity of controls and identifying transaction groups requiring further examination beyond standard monitoring levels. This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.E.10(e)

Senior Management approval before onboarding high-risk clients. VARA Compliance and Risk Management Rulebook Clause III.E.10(e) requires that, for high-risk or Politically Exposed Person-linked clients, a VASP must obtain Senior Management approval before commencing the business relationship, mirroring the specific PEP approval requirements in Clauses III.E.6(a)(vi) and III.E.6(b)(vi). This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.E.10(f)

First transaction sourced from a licensed institution. VARA Compliance and Risk Management Rulebook Clause III.E.10(f) requires that, for high-risk or Politically Exposed Person-linked clients, the first transaction into the client's account must be carried out through an account in the client's own name at a licensed institution subject to AML/CFT laws and regulation in a jurisdiction with FATF-equivalent standards, providing an initial layer of verified provenance.

III.E.10(g)

Residential address verification for high-risk natural persons. VARA Compliance and Risk Management Rulebook Clause III.E.10(g) requires that, for high-risk or Politically Exposed Person-linked clients who are natural persons, a VASP must verify the client's current residential address, excluding a post office box, supplementing the identification requirements in Clause III.E.6(a). This obligation is set out in III.E Client due diligence of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.F.1(a)

Continuous monitoring for Suspicious Transactions. VARA Compliance and Risk Management Rulebook Clause III.F.1(a) requires a VASP to employ methods appropriate to its circumstances to continuously monitor business relationships to identify Suspicious Transactions requiring an AML-CFT Report, ensure no tipping-off occurs, and ensure all Suspicious Transactions are immediately reported to the MLRO for further action. This requirement is drawn from III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.F.1(b)

Documented and approved monitoring methods. VARA Compliance and Risk Management Rulebook Clause III.F.1(b) requires a VASP to document its Suspicious Transaction monitoring methods, obtain Senior Management approval for them, and periodically review and update them for effectiveness. This governance layer applies to the monitoring methods deployed under Clause III.F.1(a) on an ongoing basis. This obligation sits within III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.F.2

Indicators used to identify Suspicious Transactions. VARA Compliance and Risk Management Rulebook Clause III.F.2 requires a VASP to put in place and regularly update indicators used to identify possible Suspicious Transactions requiring an AML-CFT Report. This supports the continuous monitoring obligation under Clause III.F.1(a) with defined, updatable detection criteria reflecting current typologies. This requirement forms part of III.F Suspicious Transaction monitoring and reporting under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.F.3(a)

Immediate MLRO reporting to the UAE FIU. VARA Compliance and Risk Management Rulebook Clause III.F.3(a) requires that, upon suspicion of a Suspicious Transaction, the MLRO must immediately report it to the UAE Financial Intelligence Unit in accordance with Rule III.F.4, without unnecessary delay once suspicion is formed. This obligation is set out in III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.F.3(b)

48-hour response to FIU or VARA information requests. VARA Compliance and Risk Management Rulebook Clause III.F.3(b) requires the MLRO to respond to all additional information requests from the UAE Financial Intelligence Unit and, or, VARA promptly, and in any event within 48 hours of the request, regardless of the complexity of the information sought. This obligation is set out in III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.F.3(c)

Undertaking actions requested by the FIU or VARA. VARA Compliance and Risk Management Rulebook Clause III.F.3(c) requires the MLRO to undertake any additional actions requested by the UAE Financial Intelligence Unit and, or, VARA within any timeframe specified in such requests, whether or not those actions are separately mandated elsewhere in the Rulebook. This requirement, found in III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

III.F.3(d)

Internal notification of a filed Suspicious Transaction Report. VARA Compliance and Risk Management Rulebook Clause III.F.3(d) requires that, where the MLRO is not the same person as the Compliance Officer, the MLRO must immediately report to the Compliance Officer that a Suspicious Transaction Report has been made, provided doing so does not constitute tipping-off under applicable law. This requirement is drawn from III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.F.4

Filing AML-CFT Reports via goAML. VARA Compliance and Risk Management Rulebook Clause III.F.4 requires AML-CFT Reports to be filed with the UAE Financial Intelligence Unit via the goAML platform, or other approved means, in the form and content required by the UAE Financial Intelligence Unit and, or, VARA, and in accordance with VARA guidance issued from time to time. This obligation is set out in III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.F.5

Continued monitoring after an AML-CFT Report. VARA Compliance and Risk Management Rulebook Clause III.F.5 requires a VASP to continue monitoring, on a near real-time basis where appropriate, any transactions that are the subject of an AML-CFT Report filed under Clause III.F.4, rather than treating the filing as closing the matter. This obligation is set out in III.F Suspicious Transaction monitoring and reporting of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.G.1

Application of the FATF Travel Rule. VARA Compliance and Risk Management Rulebook Clause III.G.1 requires a VASP to comply with all Federal AML-CFT Laws, including Travel Rule requirements, and to additionally comply with Rule III.G as a minimum standard which may be supplemented by Federal law. This opens the Travel Rule regime elaborated across the remainder of Section III.G, including originator and beneficiary information requirements.

III.G.2

Originator information for outgoing transfers above AED 3,500. VARA Compliance and Risk Management Rulebook Clause III.G.2 requires that, before initiating any Virtual Asset transfer worth more than AED 3,500, the originating VASP must obtain and hold required accurate originator and beneficiary information and make it available to VARA and other authorities on request, in line with the minimum data fields under Clause III.G.4.

III.G.3

Beneficiary information for incoming transfers above AED 3,500. VARA Compliance and Risk Management Rulebook Clause III.G.3 requires that, before permitting client access to Virtual Assets received from a transfer worth more than AED 3,500, the beneficiary VASP must obtain and hold required originator and accurate beneficiary information and make it available to VARA and other authorities on request, mirroring the originating VASP's duty under Clause III.G.2.

III.G.4(a)

Minimum originator information: name. VARA Compliance and Risk Management Rulebook Clause III.G.4(a) requires that the minimum required originator information for Travel Rule transfers must include the originator's name. This is the first of three minimum originator data fields listed across Clause III.G.4, applicable to every qualifying transfer. This requirement is drawn from III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.G.4(b)

Minimum originator information: account or wallet address. VARA Compliance and Risk Management Rulebook Clause III.G.4(b) requires that the minimum required originator information for Travel Rule transfers must include the originator's account number or Virtual Asset wallet address, enabling the beneficiary VASP to trace the transfer's source. This obligation sits within III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.G.4(c)

Minimum originator information: address. VARA Compliance and Risk Management Rulebook Clause III.G.4(c) requires that the minimum required originator information for Travel Rule transfers must include the originator's residential or business address, completing the minimum data set required under Clause III.G.4. This obligation is set out in III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.G.5(a)

Minimum beneficiary information: name. VARA Compliance and Risk Management Rulebook Clause III.G.5(a) requires that the minimum required beneficiary information for Travel Rule transfers must include the beneficiary's name, mirroring the originator name requirement under Clause III.G.4(a). This requirement is drawn from III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.G.5(b)

Minimum beneficiary information: account or wallet address. VARA Compliance and Risk Management Rulebook Clause III.G.5(b) requires that the minimum required beneficiary information for Travel Rule transfers must include the beneficiary's account number or Virtual Asset wallet address, mirroring the originator data field required under Clause III.G.4(b). This obligation is set out in III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.G.6

Risk-based due diligence on counterparty VASPs. VARA Compliance and Risk Management Rulebook Clause III.G.6 requires that, before entering into a transaction with a counterparty VASP or virtual asset service provider in another jurisdiction, the VASP must complete risk-based due diligence on that counterparty to mitigate AML/CFT risk, though not necessarily for every subsequent transaction absent heightened risk indicators. This requirement forms part of III.G FATF Travel Rule under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.G.7(a)

Risks from Travel Rule-compliant and non-compliant transfers. VARA Compliance and Risk Management Rulebook Clause III.G.7(a) requires that, in complying with the Travel Rule, a VASP must consider and address risks associated with deposits and withdrawals that are compliant with, or non-compliant with, the Travel Rule, adjusting controls accordingly. This obligation sits within III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.G.7(b)

Risks from unhosted wallets. VARA Compliance and Risk Management Rulebook Clause III.G.7(b) requires that, in complying with the Travel Rule, a VASP must consider and address risks associated with non-obliged entities, meaning unhosted Virtual Asset wallets, which fall outside the standard originator and beneficiary information exchange. This requirement is drawn from III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.G.7(c)

Risks from Anonymity-Enhanced Transactions under the Travel Rule. VARA Compliance and Risk Management Rulebook Clause III.G.7(c) requires that, in complying with the Travel Rule, a VASP must consider and address risks associated with Anonymity-Enhanced Transactions, aligning with the enhanced controls required under Clause III.D.5. This requirement forms part of III.G FATF Travel Rule under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.G.8(a)

Demonstrating Travel Rule compliance at licensing. VARA Compliance and Risk Management Rulebook Clause III.G.8(a) requires a VASP to be able to demonstrate to VARA how it complies with the Travel Rule during the licensing process, and to submit its relevant policies and controls for VARA's review before authorisation is granted. This obligation sits within III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.G.8(b)

Addressing the Travel Rule sunrise issue. VARA Compliance and Risk Management Rulebook Clause III.G.8(b) provides that a VASP should include its plan to achieve Travel Rule compliance with virtual asset service providers in jurisdictions where the Travel Rule is not yet a legislative requirement, referred to as the sunrise issue, as part of its Travel Rule compliance submission. This requirement forms part of III.G FATF Travel Rule under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.G.9

Monitoring for Travel Rule threshold circumvention. VARA Compliance and Risk Management Rulebook Clause III.G.9 requires a VASP to monitor for any transaction or series of transactions seeking to circumvent regulatory thresholds to bypass Travel Rule requirements, guided by FATF's Interpretive Note to Recommendation 15 and applicable guidance issued by VARA. This obligation is set out in III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.G.10

Reporting on Travel Rule compliance effectiveness. VARA Compliance and Risk Management Rulebook Clause III.G.10 requires a VASP to report on its Travel Rule compliance and the effectiveness of its implementing policies and controls in accordance with Federal AML-CFT Laws and any additional VARA requirements, including when VARA specifically requests such reporting. This requirement is drawn from III.G FATF Travel Rule of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.H.1

Screening against designated-entity sanctions lists. VARA Compliance and Risk Management Rulebook Clause III.H.1 requires a VASP to screen all clients and transactions against designated-entity lists maintained under United Nations Security Council sanctions frameworks and Federal AML-CFT Laws. This opens the targeted financial sanctions regime in Section III.H, feeding the automated screening required under Clause III.H.2. This obligation sits within III.H Compliance with targeted financial sanctions of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

III.H.2

Automated, real-time sanctions screening systems. VARA Compliance and Risk Management Rulebook Clause III.H.2 requires a VASP to implement automated screening systems to identify and flag transactions involving designated entities, and to ensure such systems are updated regularly with the latest sanctions lists and operate in real time, minimising the risk of a missed match. This requirement is drawn from III.H Compliance with targeted financial sanctions of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

III.H.3

Immediate freezing of designated-party assets. VARA Compliance and Risk Management Rulebook Clause III.H.3 requires a VASP to take immediate action to freeze any assets, including Virtual Assets and money, associated with individuals or entities identified as designated under United Nations Security Council or Federal sanctions frameworks, and to ensure no withdrawals, transfers or use of frozen assets occur during the freeze.

III.H.4

Eight-year retention of sanctions freezing records. VARA Compliance and Risk Management Rulebook Clause III.H.4 requires a VASP to maintain records of all sanctions-related asset freezing actions and associated transactions for a minimum of eight years, under internal policies enforcing immediate freezing upon a designated-entity match, mirroring the retention period under Clause III.I.2. This obligation is set out in III.H Compliance with targeted financial sanctions of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.H.5

Blocking sanctioned and circumvention transactions. VARA Compliance and Risk Management Rulebook Clause III.H.5 requires a VASP to block and prohibit transactions involving individuals, organisations or entities listed under United Nations Security Council or Federal sanctions frameworks, and to block attempts by clients to bypass such sanctions through structuring or other means. This obligation is set out in III.H Compliance with targeted financial sanctions of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

III.I.1

AML/CFT record retention scope. VARA Compliance and Risk Management Rulebook Clause III.I.1 requires a VASP to retain AML/CFT-related records in accordance with Federal AML-CFT Laws, covering Virtual Asset transaction records, client due diligence records, third-party CDD information, ongoing monitoring records, and Suspicious Transaction reports generated across the AML/CFT programme. This requirement forms part of III.I Record keeping under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

III.I.2

Eight-year AML/CFT record retention period. VARA Compliance and Risk Management Rulebook Clause III.I.2 requires a VASP to retain all AML/CFT records required under Rule III.I.1 for a period of no less than eight years. This sets the minimum retention period for the record categories identified under Clause III.I.1, matching the general books and records retention under Clause I.F.2. This requirement forms part of III.I Record keeping under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

IV.B.1

Client Money policies, systems and controls. VARA Compliance and Risk Management Rulebook Clause IV.B.1 requires a VASP to maintain policies, systems and controls appropriate to the nature and scale of its operations to ensure compliance with the Client Money Rules. This is the foundational obligation opening the Client Money Rules regime in Chapter IV, underpinning the segregation requirements that follow.

IV.B.2

Legal segregation of Client Money. VARA Compliance and Risk Management Rulebook Clause IV.B.2 requires that Client Money held by a VASP must be kept in a Client Account and is legally segregated from the VASP's own estate, so it is protected in the event of the VASP's insolvency. This is the core client-asset protection principle underpinning Chapter IV, mirrored for Virtual Assets under Clause V.B.3.

IV.B.3

Client Account title must say 'Client Account'. VARA Compliance and Risk Management Rulebook Clause IV.B.3 requires every Client Account to include the words 'Client Account' in its account title. This labelling requirement makes the legal segregation required under Clause IV.B.2 externally verifiable by the Third-Party Bank and by VARA. This obligation is set out in IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

IV.B.4

Systems ensuring Client Money is identifiable and secure. VARA Compliance and Risk Management Rulebook Clause IV.B.4 requires a VASP to have systems and controls in place so that Client Money is identifiable and secure at all times. This operational obligation supports the segregation and labelling requirements under Clauses IV.B.2 and IV.B.3 throughout the client relationship. This requirement is drawn from IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

IV.B.5.a

One-day deposit deadline for Client Money. VARA Compliance and Risk Management Rulebook Clause IV.B.5.a requires that Client Money received must be paid into a Client Account within one calendar day of receipt, subject to the limited exceptions in Rule IV.B.6, minimising the period Client Money sits outside a segregated account. This requirement is drawn from IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

IV.B.5.b-c

UAE Third-Party Bank location for Client Money. VARA Compliance and Risk Management Rulebook Clause IV.B.5.b-c requires Client Money for UAE clients to be held in Client Accounts with Third-Party Banks in the UAE, and provides that Client Money for non-UAE clients may initially be deposited outside the UAE but must be moved to and maintained with a UAE Third-Party Bank, with the transfer initiated within 24 hours of receipt.

IV.B.7

Client Account deposit after failed exemption. VARA Compliance and Risk Management Rulebook Clause IV.B.7 requires that, where Client Money was temporarily exempt from the Client Account requirement, for example delivery-versus-payment funds, but the delivery or payment obligation is not fulfilled within three calendar days of receipt, the VASP must pay that Client Money into a Client Account without further delay.

IV.B.8

Records of Client Money payments received. VARA Compliance and Risk Management Rulebook Clause IV.B.8 requires a VASP to keep adequate records of every Client Money payment received, including date of receipt, client identity, payer identity, transaction reference, and date presented to the Third-Party Bank, supporting the reconciliation duty under Clause IV.E.1. This obligation is set out in IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

IV.B.9.a

Removing money that must not be held in a Client Account. VARA Compliance and Risk Management Rulebook Clause IV.B.9.a requires a VASP to maintain systems and controls to identify money that must not be held in a Client Account and to transfer it out without delay, preserving the integrity of the segregated balance. This requirement, found in IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

IV.B.9.b

Restrictions on the VASP's own money in Client Accounts. VARA Compliance and Risk Management Rulebook Clause IV.B.9.b prohibits a VASP from depositing its own money into a Client Account, except for a minimum sum to open or keep the account open, mixed remittances with excess removed within one day, excess interest removed within 20 calendar days, or to cover a temporary shortfall.

IV.B.10.a

Authorisation procedures for Client Account withdrawals. VARA Compliance and Risk Management Rulebook Clause IV.B.10.a requires a VASP to have procedures ensuring that all withdrawals from a Client Account are authorised. This opens the withdrawal-control requirements elaborated across the remainder of Clause IV.B.10, including permitted release circumstances. This obligation is set out in IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

IV.B.10.b

Permitted circumstances for Client Money release. VARA Compliance and Risk Management Rulebook Clause IV.B.10.b requires that Client Money must remain in a Client Account until it becomes due and payable to the VASP, is paid to or on the instruction of the client, is required to meet the client's payment obligations, or is otherwise authorised for release by VARA, closing off any other basis for withdrawal.

IV.B.10.c

Prohibition on cross-client use of Client Money. VARA Compliance and Risk Management Rulebook Clause IV.B.10.c prohibits a VASP from using one client's Client Money to satisfy an obligation owed to another client or to any other Entity, including for the VASP's own liquidity, capital ratio or balance sheet purposes, regardless of any temporary need. This obligation is set out in IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

IV.B.10.d

No off-setting or debit balances in Client Accounts. VARA Compliance and Risk Management Rulebook Clause IV.B.10.d requires a VASP to have a system to ensure no off-setting or debit balances occur in Client Accounts. This protects the integrity of the segregated Client Account balances required under Clause IV.B.2 from being eroded by internal accounting practices. This requirement forms part of IV.B Treatment of Client Money under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

IV.B.11

No VASP ownership of Client Money. VARA Compliance and Risk Management Rulebook Clause IV.B.11 prohibits a VASP from taking ownership of Client Money under any Client Agreement, in addition to the Market Conduct Rulebook requirements. This reinforces the client-ownership statement required in Client Agreements under Clause II.B.1(j) of the Market Conduct Rulebook. This requirement, found in IV.B Treatment of Client Money of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

IV.B.12

Trust arrangements for Client Money. VARA Compliance and Risk Management Rulebook Clause IV.B.12 provides that, where a VASP takes ownership of Client Money solely to place it into a trust, as founder, with clients as beneficiaries, it must transfer ownership to the trust in accordance with the Client Money Rules and must continue to comply with all other Part IV requirements at all times.

IV.C.1

Third-Party Bank eligibility criteria. VARA Compliance and Risk Management Rulebook Clause IV.C.1 provides that Client Accounts may only be maintained at Third-Party Banks that are validly authorised or licensed to accept deposits in their jurisdiction and that are not in the same Group as the VASP. This ensures independence and regulatory legitimacy of the banks holding Client Money on behalf of clients.

IV.C.2

Transaction-linked passing of Client Money. VARA Compliance and Risk Management Rulebook Clause IV.C.2 provides that Client Money may only be passed to a Third-Party Bank where it relates to a transaction, or series of transactions, for that client and the Third-Party Bank is appropriately authorised as required under Rule IV.C.1, preventing unrelated commingling of funds. This requirement is drawn from IV.C Third-Party Bank of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

IV.C.3

Written acknowledgement from the Third-Party Bank. VARA Compliance and Risk Management Rulebook Clause IV.C.3 requires that, when opening a Client Account with a Third-Party Bank, a VASP must promptly obtain a written acknowledgement from the bank confirming the money is held as agent, not subject to the bank's set-off or lien rights against the VASP's other accounts, and that the account title distinguishes it from the VASP's own money.

IV.C.4

Withdrawal where a bank does not provide acknowledgement. VARA Compliance and Risk Management Rulebook Clause IV.C.4 requires that, if a Third-Party Bank does not promptly provide the required acknowledgement under Clause IV.C.3, the VASP must stop making further deposits of Client Money with that bank and withdraw any Client Money already held there without delay. This requirement forms part of IV.C Third-Party Bank under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

IV.D.1

Record-keeping for Client Money reconciliation. VARA Compliance and Risk Management Rulebook Clause IV.D.1 requires a VASP to keep proper, up-to-date records of all Client Money receipts, payments and internal movements sufficient to enable reconciliation, with procedures covering all receipt channels, including via agents such as banks or payment processors, and must be able to produce these records to VARA on request.

IV.D.2

Monthly Client Money statements to clients. VARA Compliance and Risk Management Rulebook Clause IV.D.2 requires a VASP to send clients a Client Money statement at least monthly, or as otherwise agreed, showing total Client Money balance, all credits and debits since the last statement, and interest earned or charged, prepared within 25 calendar days of the statement date and issued promptly thereafter.

IV.E.1

Daily Client Account reconciliation system. VARA Compliance and Risk Management Rulebook Clause IV.E.1 requires a VASP to maintain a system for carrying out accurate reconciliations of Client Accounts on a daily basis, covering individual client credit and debit ledger balances, outstanding lodgements, Client Account cash book balances, and formal Third-Party Bank statements as at the reconciliation date, mirroring the Client VA reconciliation under Clause V.D.1.

IV.E.2-3

Daily reconciliation and shortfall remediation. VARA Compliance and Risk Management Rulebook Clause IV.E.2-3 requires a VASP to reconcile individual client credit ledgers, the Client Account cash book and Third-Party Bank balances daily, confirm the prior day's closing Client Account balance was at least equal to the aggregate client credit ledger balances, and investigate and take corrective action, including using the VASP's own funds where necessary, on any shortfall, excess or unresolved difference other than pure timing differences as soon as possible.

IV.E.4

Reconciliation free of conflicts of interest. VARA Compliance and Risk Management Rulebook Clause IV.E.4 requires the Client Money reconciliation process to be performed in a manner that does not give rise to a conflict of interest. This integrity safeguard protects the reliability of the reconciliation required under Clauses IV.E.1 through IV.E.3 from internal influence. This obligation is set out in IV.E Reconciliation of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

IV.E.5

VARA notification of unrectified reconciliation discrepancies. VARA Compliance and Risk Management Rulebook Clause IV.E.5 requires a VASP to notify VARA where a material discrepancy identified in reconciliation has not been rectified. This is the escalation trigger where the remediation required under Clause IV.E.2-3 has not resolved a material shortfall within a reasonable time. This requirement, found in IV.E Reconciliation of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

IV.F.1

One-day notification of Client Money non-compliance. VARA Compliance and Risk Management Rulebook Clause IV.F.1 requires that a VASP that becomes aware it is not complying with any Part IV Client Money Rule must notify VARA in writing within one calendar day of becoming aware, mirroring the notification timeline for voluntary discontinuation under the Company Rulebook. This requirement forms part of IV.F Failure to comply under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

IV.F.2

Compliance with VARA-instructed corrective action. VARA Compliance and Risk Management Rulebook Clause IV.F.2 requires that, where VARA instructs corrective actions in response to a Part IV non-compliance notified under Clause IV.F.1, the VASP must comply with all such corrective actions as instructed, within the timeframe VARA specifies. This requirement is drawn from IV.F Failure to comply of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

V.B.1

Client Virtual Assets policies, systems and controls. VARA Compliance and Risk Management Rulebook Clause V.B.1 requires a VASP to maintain policies, systems and controls appropriate to the nature and scale of its operations to ensure compliance with the Client Virtual Assets Rules. This mirrors the foundational Client Money obligation under Clause IV.B.1, applied to Client Virtual Assets and their safekeeping.

V.B.3

Segregated, labelled Client VA Wallets. VARA Compliance and Risk Management Rulebook Clause V.B.3 requires a VASP to hold Client Virtual Assets in Virtual Asset Wallets that are kept separate from the VASP's own Virtual Assets, and requires every wallet holding Client Virtual Assets to be labelled 'Client VA Wallet' in the VASP's books and records at all times, mirroring the Client Money segregation principle in Clause IV.B.2.

V.B.4

One-to-one holding and no rehypothecation of Client VAs. VARA Compliance and Risk Management Rulebook Clause V.B.4 requires a VASP to hold Client Virtual Assets on a one-to-one basis and not rehypothecate them, unless the client has given explicit prior consent for discretionary use and the VASP is appropriately Licensed by VARA for the relevant Virtual Asset Activity, protecting clients from unauthorised re-use of their holdings.

V.B.5

Client entitlement to airdrop and staking proceeds. VARA Compliance and Risk Management Rulebook Clause V.B.5 requires that proceeds related to Client Virtual Assets, such as airdrops or staking gains, must accrue to the client's benefit unless the client has given prior consent, in a written agreement or otherwise, for the VASP to retain them, subject to applicable disclosure and acceptance requirements.

V.B.6

No VASP ownership of Client Virtual Assets. VARA Compliance and Risk Management Rulebook Clause V.B.6 prohibits a VASP from taking ownership of Client Virtual Assets under any Client Agreement, in addition to the Market Conduct Rulebook requirements. This mirrors the Client Money ownership prohibition under Clause IV.B.11, applied to Virtual Assets rather than money. This requirement is drawn from V.B Treatment of Client VAs of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

V.B.7

One-day trust transfer for Client Virtual Assets. VARA Compliance and Risk Management Rulebook Clause V.B.7 provides that, where a VASP takes ownership of Client Virtual Assets solely to place them into a trust, as founder, with clients as beneficiaries, ownership must be transferred to the trust within one calendar day of the VASP receiving the Virtual Assets, and the VASP must continue to comply with all other Part V requirements at all times.

V.C.1

Proof-of-reserves requirements for Client VAs. VARA Compliance and Risk Management Rulebook Clause V.C.1 requires that, in addition to the Reserve Assets requirements in the Company Rulebook, a VASP must comply with all proof-of-reserves requirements stipulated by VARA from time to time, including as part of licensing, to demonstrate that reserve assets cover all liabilities to clients in respect of Client Virtual Assets.

V.D.1

Daily reconciliation of client-owned Virtual Assets. VARA Compliance and Risk Management Rulebook Clause V.D.1 requires a VASP to maintain a system to carry out accurate reconciliations of the Virtual Assets owned by each client on a daily basis, including full lists of individual client credit and debit ledger balances. This mirrors the daily Client Money reconciliation requirement under Clause IV.E.1.

V.D.2

VARA notification of unrectified Client VA discrepancies. VARA Compliance and Risk Management Rulebook Clause V.D.2 requires a VASP to notify VARA where a material discrepancy identified in the Client Virtual Assets reconciliation has not been rectified. This mirrors the Client Money escalation trigger under Clause IV.E.5, applied to the daily VA reconciliation under Clause V.D.1. This requirement forms part of V.D Reconciliation under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VI.A.1

Effective anti-bribery and corruption policy. VARA Compliance and Risk Management Rulebook Clause VI.A.1 requires a VASP to establish and maintain an effective anti-bribery and corruption policy requiring the Board and all Staff to comply with applicable anti-bribery laws in every jurisdiction of operation, and requires the policy to allow external parties to make reports while protecting the reporter's identity and confidentiality.

VI.A.2

Zero-tolerance approach to bribery and corruption. VARA Compliance and Risk Management Rulebook Clause VI.A.2 requires a VASP to conduct all business honestly and ethically with a zero-tolerance approach to bribery and corruption, and requires the Board and all Staff to act professionally, fairly and with integrity in all business dealings, consistent with the general conduct principles in Clause I.A. This obligation sits within VI.A General principles of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VI.A.3(a,b,c,e)

Prohibition on giving, offering or accepting bribes. VARA Compliance and Risk Management Rulebook Clause VI.A.3(a,b,c,e) prohibits the VASP, Board members and Staff from giving, offering or accepting bribes, facilitation payments, or other improper payments, gifts or hospitality intended to secure or reward a business advantage, and from engaging in any activity that could breach the Part VI anti-bribery Rules, whether in the UAE or overseas.

VI.A.3(d)

Prohibition on retaliation against anti-bribery whistleblowers. VARA Compliance and Risk Management Rulebook Clause VI.A.3(d) requires a VASP to prohibit any threats or retaliation against a Board member or Staff member who refuses to commit a bribery offence or who raises anti-bribery concerns. This whistleblower-protection rule supports the reporting channel required under Clause VI.C.1 and the escalation duty under Clause VI.C.2.

VI.A.4

Gifts and hospitality policy standard. VARA Compliance and Risk Management Rulebook Clause VI.A.4 provides that, while reasonable hospitality is not prohibited, a VASP's own gifts and hospitality policy must comply with applicable laws and clearly set out what gifts and hospitality are and are not appropriate, giving Staff a practical benchmark for day-to-day decisions. This requirement is drawn from VI.A General principles of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

VI.A.5

Compliance Officer monitoring of the ABC policy. VARA Compliance and Risk Management Rulebook Clause VI.A.5 requires the Compliance Officer to monitor the effectiveness of the anti-bribery and corruption policy on a regular basis and ensure any identified deficiencies are addressed promptly, consistent with the Compliance Officer's day-to-day ABC responsibility under Clause VI.E.2. This obligation sits within VI.A General principles of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VI.B.1

Prohibition on payments that may fund corruption. VARA Compliance and Risk Management Rulebook Clause VI.B.1 prohibits the VASP and its Board, Staff, consultants, contractors, Group companies, agents, business partners and suppliers from making any payment to a third party where there is reason to believe any part of it will fund a bribe or facilitate corruption, regardless of how the payment is characterised.

VI.B.2

Payments must be genuine compensation for services. VARA Compliance and Risk Management Rulebook Clause VI.B.2 requires all payments made by a VASP for services to be appropriate and justifiable as compensation for genuinely rendered legitimate services. This guards against payments structured to disguise improper benefits prohibited under Clause VI.B.1 as legitimate fees. This requirement forms part of VI.B No corrupt payments under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VI.C.1

Published anti-bribery reporting channels. VARA Compliance and Risk Management Rulebook Clause VI.C.1 requires a VASP to establish, maintain and publish reporting channels, including at minimum a telephone line, through which violations or suspected violations of anti-bribery and corruption requirements can be reported by Staff or external parties alike. This requirement forms part of VI.C Investigation and reporting under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VI.C.2

Staff duty to report suspected bribery to the CO. VARA Compliance and Risk Management Rulebook Clause VI.C.2 requires any Board or Staff member to report to the Compliance Officer as soon as possible if they believe or suspect an anti-bribery violation has occurred, may occur, or has been solicited, triggering the investigation process under Clause VI.C.3. This requirement, found in VI.C Investigation and reporting of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

VI.C.3(a-b)

Investigation file opening and independent investigator. VARA Compliance and Risk Management Rulebook Clause VI.C.3(a-b) requires that, on receiving a report, the Compliance Officer must open an investigation file, with a written summary for oral reports, and appoint an independent party to promptly conduct and document the investigation, including facts, entities involved, and timing, without delay once a report is received.

VI.C.3(c)

Board notification of an anti-bribery investigation. VARA Compliance and Risk Management Rulebook Clause VI.C.3(c) requires the Compliance Officer to advise the Board of the existence of any anti-bribery investigation opened under Clause VI.C.3(a-b), keeping the Board informed even before findings are reached. This obligation sits within VI.C Investigation and reporting of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VI.C.3(d)

Confidentiality of investigation informants. VARA Compliance and Risk Management Rulebook Clause VI.C.3(d) requires that the identity of any individual disclosing information to the Compliance Officer in connection with an investigation must be treated in accordance with applicable UAE confidentiality laws, supporting the whistleblower protection under Clause VI.A.3(d). This obligation is set out in VI.C Investigation and reporting of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VI.C.3(e-f)

Investigation report and remedial action. VARA Compliance and Risk Management Rulebook Clause VI.C.3(e-f) requires that, on completion, the independent investigator must provide the Compliance Officer a written investigation report, and, if unlawful conduct is found, the Compliance Officer must inform the Board and the VASP must take Board-approved remedial action, with the investigator preparing a written summary of remedial actions taken.

VI.C.3(g)

Eight-year retention of investigation reports. VARA Compliance and Risk Management Rulebook Clause VI.C.3(g) requires the written investigation report and written summary of remedial actions to be retained by the Compliance Officer for at least eight years from completion of the remedial action, and to be made available to VARA upon request, mirroring the record retention period under Clause I.F.2. This requirement forms part of VI.C Investigation and reporting under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VI.D.1

Regular, mandatory anti-bribery training. VARA Compliance and Risk Management Rulebook Clause VI.D.1 requires a VASP to implement and provide a regular anti-bribery and corruption training programme for the Board and all Staff, monitor their compliance with established procedures, and require mandatory participation, complementing the general training obligation under Clause I.J.4. This requirement, found in VI.D Information and trainings of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

VI.D.2

Ongoing access to the ABC policy. VARA Compliance and Risk Management Rulebook Clause VI.D.2 requires a VASP to ensure the Board and all Staff have full, ongoing access to the most up-to-date anti-bribery and corruption policy and are informed of any changes to it, mirroring the general policy access obligation under Clause I.J.3. This obligation sits within VI.D Information and trainings of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VI.E.1

Board responsibility for the ABC policy. VARA Compliance and Risk Management Rulebook Clause VI.E.1 provides that the Board has overall responsibility for ensuring the anti-bribery and corruption policy remains up-to-date and compliant with applicable laws in every jurisdiction where the VASP operates, mirroring the Board's overall CMS responsibility under Clause I.B.1. This obligation is set out in VI.E Responsibility for the policy of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VI.E.2

Compliance Officer's day-to-day ABC responsibility. VARA Compliance and Risk Management Rulebook Clause VI.E.2 provides that the Compliance Officer holds primary, day-to-day responsibility for implementing the anti-bribery and corruption policy and monitoring its effectiveness, distinct from the Board's overall responsibility under Clause VI.E.1 and mirroring Clause VI.A.5. This requirement, found in VI.E Responsibility for the policy of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

VI.F.2

Reporting unlawful conduct to VARA. VARA Compliance and Risk Management Rulebook Clause VI.F.2 provides that a VASP should immediately report to VARA any finding of unlawful conduct in breach of the Part VI anti-bribery and corruption Rules. This closes the anti-bribery and corruption regime with a mandatory regulatory notification obligation following any confirmed breach. This obligation sits within VI.F Consequences of breach of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VII.B.1

VARA approval required to act as a Regulated Sponsor. VARA Compliance and Risk Management Rulebook Clause VII.B.1 requires a VASP to obtain VARA's approval under Rule VII.C before it may act as a Regulated Sponsor of other entities' virtual asset activities. This is the threshold gatekeeping requirement opening the Sponsored VASP regime in Chapter VII, before any sponsorship relationship may be established.

VII.C.1

Prescribed Regulated Sponsor application process. VARA Compliance and Risk Management Rulebook Clause VII.C.1 requires a VASP seeking Regulated Sponsor approval to follow the application process prescribed by VARA from time to time. This gives VARA control over the procedural pathway to obtaining Regulated Sponsor status required under Clause VII.B.1 before any Sponsored VASP may be onboarded. This requirement forms part of VII.C Application process under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VII.C.2

Demonstrating capability to oversee Sponsored VASPs. VARA Compliance and Risk Management Rulebook Clause VII.C.2 requires the Regulated Sponsor approval application to, at minimum, demonstrate the applicant's ability to comply with Part VII and its ability to ensure Sponsored VASPs comply on an ongoing basis with all applicable Regulations, Marketing Regulations, Rules and Directives, not merely at the point of application.

VII.D.1(a)

Common control requirement for sponsorship. VARA Compliance and Risk Management Rulebook Clause VII.D.1(a) requires that, to establish a Sponsored VASP relationship, the Regulated Sponsor must be the Controlling Entity of, or share the same Controlling Entity as, the Sponsored VASP. This corporate-structure condition anchors the sponsorship relationship in common ownership or control rather than a purely commercial arrangement. This requirement, found in VII.D Establishing a Sponsored VASP relationship of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

VII.D.1(b)

Mandatory sponsorship agreement content. VARA Compliance and Risk Management Rulebook Clause VII.D.1(b) requires the Regulated Sponsor to have a written agreement with each Sponsored VASP that defines the permitted business and Virtual Asset Activities, apportions liability for uncovered compliance areas, sets termination terms, grants the Sponsor audit rights, and requires the Sponsored VASP to report regularly on its compliance. This requirement forms part of VII.D Establishing a Sponsored VASP relationship under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VII.D.1(c)

Due diligence before sponsoring a VASP. VARA Compliance and Risk Management Rulebook Clause VII.D.1(c) requires the Regulated Sponsor to conduct detailed due diligence on each prospective Sponsored VASP to confirm it is fit and proper, financially stable and suitable to carry out its proposed Virtual Asset Activities before sponsoring it, mirroring the Company Rulebook's Fit and Proper standard. This obligation is set out in VII.D Establishing a Sponsored VASP relationship of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.D.1(d)

Sponsorship must not breach competition law. VARA Compliance and Risk Management Rulebook Clause VII.D.1(d) requires the Regulated Sponsor to ensure that establishing a Sponsored VASP relationship does not contravene UAE Federal Competition Law. This condition sits alongside the other formation requirements in Clause VII.D.1 and must be assessed before the relationship is established. This requirement forms part of VII.D Establishing a Sponsored VASP relationship under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VII.D.1(e)

VARA approval before Sponsored VASP activities commence. VARA Compliance and Risk Management Rulebook Clause VII.D.1(e) requires the Regulated Sponsor to obtain VARA's approval, through VARA's prescribed process, before the Sponsored VASP commences any Virtual Asset Activities under the sponsorship relationship, preventing activities from beginning ahead of regulatory sign-off. This obligation is set out in VII.D Establishing a Sponsored VASP relationship of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.D.2

Sponsored VASP must remain a proper legal entity. VARA Compliance and Risk Management Rulebook Clause VII.D.2 requires the Regulated Sponsor to ensure that each Sponsored VASP is and remains a legal entity, in a legal form approved by a commercial licensing authority, in the Emirate. This mirrors the legal entity requirement the Company Rulebook applies to VARA-licensed VASPs generally. This obligation sits within VII.D Establishing a Sponsored VASP relationship of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VII.E.2

Marketing disclosure of Sponsored VASP status. VARA Compliance and Risk Management Rulebook Clause VII.E.2 requires the Regulated Sponsor to ensure that all Marketing by Sponsored VASPs complies with the Marketing Regulations, states the Regulated Sponsor's name and licence number, and clearly identifies the entity as a Sponsored VASP rather than a VARA-licensed VASP, avoiding any client confusion about regulatory status.

VII.E.3

Website disclosure requirements for Sponsored VASPs. VARA Compliance and Risk Management Rulebook Clause VII.E.3 requires the Regulated Sponsor to ensure each Sponsored VASP publishes, in an accessible machine-readable format kept accurate and current, the Sponsor's name and licence number, the Sponsored VASP's own authorisation number, the authorised Virtual Asset Activities with restrictions and validity period, and the name of its Responsible Officer.

VII.F.1

Sponsor's ongoing responsibility for compliance. VARA Compliance and Risk Management Rulebook Clause VII.F.1 requires the Regulated Sponsor to ensure and remain responsible for the ongoing compliance of its Sponsored VASPs with all applicable Regulations, Marketing Regulations, Rules and Directives at all times. This is the core accountability principle underpinning the sponsorship relationship established under Chapter VII. This requirement is drawn from VII.F Compliance responsibility of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

VII.F.2

Sponsor's resourcing to meet Part VII obligations. VARA Compliance and Risk Management Rulebook Clause VII.F.2 requires the Regulated Sponsor to ensure it has sufficient resources, knowledge and expertise at all times to meet its Part VII obligations in respect of each individual Sponsored VASP and all Sponsored VASP relationships collectively, not merely at onboarding. This obligation is set out in VII.F Compliance responsibility of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.F.3

Sponsor's responsibility for core Rulebook compliance. VARA Compliance and Risk Management Rulebook Clause VII.F.3 requires the Regulated Sponsor to ensure and remain responsible for each Sponsored VASP's ongoing compliance with the compulsory Company, Compliance and Risk Management, Technology and Information, and Market Conduct Rulebooks, mirroring the compliance standard applied to directly licensed VASPs. This obligation sits within VII.F Compliance responsibility of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VII.F.4

Sponsor's responsibility for activity-specific Rulebooks. VARA Compliance and Risk Management Rulebook Clause VII.F.4 requires the Regulated Sponsor to ensure and remain responsible for each Sponsored VASP's compliance with all activity-specific Rulebooks, such as Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Virtual Asset Management and Investment, and Virtual Asset Transfer and Settlement, relevant to its authorised Virtual Asset Activities under the sponsorship.

VII.F.5

Segregation of Sponsored VASPs' Personal Data. VARA Compliance and Risk Management Rulebook Clause VII.F.5 requires the Regulated Sponsor to ensure Personal Data collected by each Sponsored VASP remains segregated from the Sponsor's own data and from that of its other Sponsored VASPs, in addition to Part II Technology and Information Rulebook requirements, protecting each Sponsored VASP's client data. This requirement forms part of VII.F Compliance responsibility under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VII.G.1

Appointment of a Sponsored VASP Responsible Officer. VARA Compliance and Risk Management Rulebook Clause VII.G.1 requires the Regulated Sponsor to ensure each Sponsored VASP appoints one individual of sufficient seniority as its Responsible Officer, accountable for the Sponsored VASP's compliance with all legal and regulatory obligations, mirroring the Responsible Individual role under the Company Rulebook. This requirement is drawn from VII.G Responsible Officer of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

VII.G.2

Responsible Officer eligibility requirements. VARA Compliance and Risk Management Rulebook Clause VII.G.2 requires the Responsible Officer to be a full-time employee of the Sponsored VASP, to be notified to and approved by VARA during the application process, and to meet the requirements of Rule I.C.2 of the Company Rulebook, ensuring a genuine UAE nexus and employment relationship. This obligation sits within VII.G Responsible Officer of the VARA Compliance and Risk Management Rulebook and applies as a standing operational requirement for every Virtual Asset Service Provider licensed to conduct the relevant Virtual Asset Activity.

VII.G.3

Annual validation of Responsible Officer eligibility. VARA Compliance and Risk Management Rulebook Clause VII.G.3 requires the Regulated Sponsor to ensure the Responsible Officer continues to meet the eligibility requirements at all times and to validate and record this validation on an annual basis, mirroring the Responsible Individual annual validation under the Company Rulebook's Clause I.C.3. This requirement, found in VII.G Responsible Officer of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

VII.G.4

Approval before changing a Responsible Officer. VARA Compliance and Risk Management Rulebook Clause VII.G.4 requires the Regulated Sponsor to notify and obtain VARA's approval before changing a Sponsored VASP's Responsible Officer, except in reasonably unforeseen circumstances, in which case it must notify VARA immediately and explain how Responsible Officer coverage will continue during the transition. This obligation is set out in VII.G Responsible Officer of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.H.1

Capital and prudential requirements for Sponsored VASP relationships. VARA Compliance and Risk Management Rulebook Clause VII.H.1 requires that, in addition to its own licensing obligations, the Regulated Sponsor must comply with the Part VI Capital and Prudential Requirements of the Company Rulebook in respect of each Sponsored VASP relationship, ensuring adequate capital backs every sponsorship. This obligation is set out in VII.H Capital and prudential requirements of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.I.1-2

Segregated accounts per Sponsored VASP. VARA Compliance and Risk Management Rulebook Clause VII.I.1-2 requires that, where a Regulated Sponsor establishes Client Money, business or operating, or Paid-Up Capital accounts in its own name on behalf of a Sponsored VASP, it must ensure a separate, unshared account exists per Sponsored VASP, that each account title includes the Sponsored VASP's name, and that segregation is maintained across all books and records.

VII.J.1

Sponsor's responsibility for complaints-handling compliance. VARA Compliance and Risk Management Rulebook Clause VII.J.1 requires the Regulated Sponsor to ensure and remain responsible for each Sponsored VASP's compliance with the Part III complaints-handling requirements of the Market Conduct Rulebook, extending the Sponsor's oversight to client complaints. This requirement is drawn from VII.J Complaints handling requirements of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

VII.J.2

Separate complaints procedure for each Sponsored VASP. VARA Compliance and Risk Management Rulebook Clause VII.J.2 requires the Regulated Sponsor to establish, or ensure that each Sponsored VASP establishes, its own separate complaints-handling procedure as required under Part III.B of the Market Conduct Rulebook, rather than relying on a single shared procedure. This requirement forms part of VII.J Complaints handling requirements under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VII.K.1(a)

Ongoing oversight of Sponsored VASP activities. VARA Compliance and Risk Management Rulebook Clause VII.K.1(a) requires the Regulated Sponsor to review and maintain ongoing oversight of each Sponsored VASP's activities, business and senior management. This opens the governance and reporting responsibilities enumerated across Clause VII.K.1, extending beyond the initial onboarding due diligence. This requirement, found in VII.K Governance and reporting responsibilities of the VARA Compliance and Risk Management Rulebook, is one of the standing operational controls VARA expects a Virtual Asset Service Provider to embed into its day-to-day compliance practice.

VII.K.1(b)

Managing Sponsored VASP performance under the agreement. VARA Compliance and Risk Management Rulebook Clause VII.K.1(b) requires the Regulated Sponsor to monitor and actively manage each Sponsored VASP's performance of its obligations under the written sponsorship agreement required under Clause VII.D.1(b), rather than treating the agreement as self-executing. This requirement is drawn from VII.K Governance and reporting responsibilities of the VARA Compliance and Risk Management Rulebook and supports VARA's ability to supervise the VASP's compliance on an ongoing, evidenced basis rather than only at the point of licensing.

VII.K.1(c)

Sufficient skills and resources to oversee Sponsored VASPs. VARA Compliance and Risk Management Rulebook Clause VII.K.1(c) requires the Regulated Sponsor to ensure it has the skills and resources to oversee all its Sponsored VASPs at all times, including when a Sponsored VASP's business changes or expands, requiring the Sponsor to scale its oversight capacity accordingly. This obligation is set out in VII.K Governance and reporting responsibilities of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.K.1(d)

Ensuring Sponsored VASPs continue to meet VARA standards. VARA Compliance and Risk Management Rulebook Clause VII.K.1(d) requires the Regulated Sponsor to ensure each Sponsored VASP continues to meet the standards required by VARA in respect of its authorised Virtual Asset Activities, on an ongoing rather than one-off basis. This requirement forms part of VII.K Governance and reporting responsibilities under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.

VII.K.1(e)

Financial resources across all Sponsored VASPs. VARA Compliance and Risk Management Rulebook Clause VII.K.1(e) requires the Regulated Sponsor to maintain adequate financial resources, taking into account the combined business and Virtual Asset Activities of all its Sponsored VASPs. This aggregate resourcing standard supplements the individual capital requirement under Clause VII.H.1 applied per relationship. This obligation is set out in VII.K Governance and reporting responsibilities of the VARA Compliance and Risk Management Rulebook and forms part of the broader governance and control framework a VASP must maintain and be able to demonstrate to VARA on request.

VII.K.2

Annual reporting per Sponsored VASP. VARA Compliance and Risk Management Rulebook Clause VII.K.2 requires the Regulated Sponsor to submit to VARA, on an annual basis and for each Sponsored VASP, complaints data, full audited accounts, and any other data VARA requires. This closes Chapter VII with a standing annual reporting obligation covering every sponsorship relationship the Regulated Sponsor maintains. This requirement forms part of VII.K Governance and reporting responsibilities under the VARA Compliance and Risk Management Rulebook and reflects VARA's expectation that Virtual Asset Service Providers maintain auditable, risk-appropriate controls across their operations.