VARA Custody Services Rulebook (version dated 19 May 2025)chapter by chapter

Part I.A.1-4Part I.A Board constitution

Boards must include executive, non-executive and at least one independent director, meet at least quarterly, and apply independence tests on prior roles, contracts, tenure and ownership.

Part I.B.1-3Part I.B Board committees

Boards must set up remuneration, nomination and audit committees with charters and regular reporting, and keep board and committee minutes for at least eight years.

Part I.C.1Part I.C Board remuneration reporting

VASPs must submit to VARA annually details of all Board and committee member compensation and remuneration, including type, nature, conditions and reasons.

Part II.A.1-2Part II.A Policies and procedures

VASPs must have written policies for client access to virtual assets, reviewing their effectiveness at least annually.

Part II.B.1-3Part II.B Public disclosures

VASPs must publish on their websites conflicts of interest and data privacy policies, whistleblowing and complaints policies, whether third parties hold client assets, and any lawful past convictions of senior management.

Part III.A.1-3Part III.A General requirements

Custody Services may be provided only on verified client instructions or those of an authorised agent with valid legal authority, and Custody rules prevail over inconsistent client VA rules.

Part III.B.1-4Part III.B Segregation and control

VASPs must hold each client's Virtual Assets in separate wallets, prohibiting rehypothecation and retaining control over the assets.

Part III.B.5-6Part III.B Segregation and control - separate legal entity

VASP providing Custody Services must operate as a separate legal entity from its group members, with exceptions subject to VARA approval for certain services.

Part III.B.7Part III.B Segregation and control - operational segregation

VASPs must keep Custody Services operationally and physically segregated from other core businesses and Group VA Activities, using a separate custody-only team free of conflicting duties or information access.

Part III.C.1.a-cPart III.C.1 Hot and cold storage

VASPs must maintain industry best-practice certifications for safekeeping Virtual Assets, perform risk-based analysis of hot or cold storage, and document wallet-transfer methodologies subject to internal controls and independent audit.

Part III.C.2.a-ePart III.C.2 Seed and key management

Virtual asset service providers must use best-practice seed and key generation, encryption, secure storage, split mnemonic phrases, and consider multi-signature controls against collusion.

Part III.C.3.aPart III.C.3 Lost or stolen keys

VASPs must maintain policies for lost or compromised seeds or keys covering asset recovery, client and counterparty communication, law enforcement cooperation, and wind-down arrangements with public disclosure.

Part III.D.1.aPart III.D.1 Client agreements

Client Agreements must outline the custodial framework, asset return protocols, settlement details, and security measures, addressing cybersecurity and data privacy.

Part III.D.2.a-bPart III.D.2 Relationship and register

VASPs providing custody services must keep a register and reconciliation record of each client's virtual asset positions, alongside reserve asset requirements.

Part III.D.3.a-bPart III.D.3 Outsourcing and third-party suppliers

VASPs must remain compliant with laws when outsourcing Custody Services, ensuring clear roles and responsibilities while only authorized employees execute core functions.

Part III.D.4 Account statements

VASPs must provide monthly account statements to clients detailing all Virtual Asset transactions, including dates and balances.

Part III.D.5 Audit trail

VASPs should keep a complete audit trail of client account transaction activity for at least eight years, including timestamps, transaction types, signatories and Virtual Assets involved.

Part IV.A.1-6Part IV.A Staking authorisation

Staking from Custody Services requires explicit VARA authorisation stated in the Licence, incurs incremental fees, applies only to custodied Virtual Assets, and VARA may suspend or revoke such authorisation.

Part IV.B.1-3Part IV.B Staking client instructions

Custody providers may stake client assets only on explicit client instructions, including governance votes; pre-authorised instructions must be specific, with foreseeable circumstances communicated in advance, and staking cannot be opt-out.

Part IV.C.1-4Part IV.C Staking segregation

Staked client assets must stay segregated in separate wallets with no pooling, each node serving one client, while the VASP keeps safekeeping responsibility and withdrawal key control.

Part IV.D.1-3Part IV.D Node management

VASPs must ensure compliance with DLT operational requirements and wallet management standards to minimize operational risks.

Part IV.E.1-4Part IV.E DLT Standards

VASPs must establish DLT Standards covering security, operating history, staking protocol soundness, rewards, and conflicts of interest, conduct due diligence before staking any DLT, and monitor ongoing compliance.

Part IV.E.5-6Part IV.E.5 DLT standards breach

A VASP that learns its DLT no longer meets DLT standards must immediately notify clients and VARA, stop accepting new virtual assets for staking, and cease staking as soon as practicable under VARA direction.

Part IV.E.7 Staking assessment records

Records of DLT Standards assessments must be kept for eight years and produced to VARA for inspection on request.

Part IV.F.1-2Part IV.F Staking risk disclosure

Staking clients must receive a separate risk disclosure statement before staking, with confirmation of acceptance required.

Part IV.G.1.a-lPart IV.G Staking client agreements

Staking client agreements must cover, where applicable, asset descriptions, DLT requirements, party rights, reward sources and calculation, fees, withdrawal terms, risk warnings, variation and termination, complaints procedures, and third-party remuneration.

Part V.A.1-6Part V.A Collateral Wallet authorisation

Only Custody-licensed virtual asset service providers may offer collateral wallet services, and only when expressly authorised in their licence; VARA may limit, suspend or revoke that authorisation.

Part V.B.1-4Part V.B Collateral client instructions

Custodians must act only on explicit client instructions for collateral wallet services; pre-authorised instructions must be specific, foreseeable circumstances must be communicated, and the service cannot be opt-out.

Part V.C.1-2Part V.C Collateral receipts

VASPs must give clients a receipt immediately after a transfer instruction to a collateral wallet and again on transaction completion, showing status, amounts, fees, rates and balances.

Part V.D.1-3Part V.D Collateral wallets

VASPs must use designated client VA wallets only for collateral wallet services, record them as such in books and records, never repurpose them, and remain responsible for safekeeping despite segregation exemption.

Part V.E.1-4Part V.E Exchange integration

Collateral Wallet Services may be provided only for VARA-licensed Exchange venues, with one Exchange per client wallet and all Exchange conflicts of interest disclosed.

Part V.F.1-2Part V.F Collateral risk disclosure

Clients of custody services must receive a separate risk disclosure covering co-mingling, safekeeping and Exchange rights, and must accept it independently before the service begins.

Part V.G.1.a-ePart V.G Collateral client agreements

Collateral wallet client agreements must cover the asset description, parties' rights, withdrawal and control rights and limits, risk statement, and third-party remuneration disclosure.

Part V.H.1.a-cPart V.H.1 Collateral monthly reporting

A VASP must report monthly to VARA on virtual assets held in client wallets, their AED value, number of clients served, and exchanges with integrations or rights over those wallets.

Part V.H.2.a-bPart V.H.2 Collateral notifications

VASPs must immediately notify VARA of any system, reporting or reconciliation delay or failure, and any error in recording a client balance.

Part I.B.3-retRecord Retention — Board and committee minutes

Custody service providers must retain board and committee minutes for eight years from the meeting date.

Part III.D.5-retRecord Retention — Client account transaction audit trail (date/time, type, signatories, Virtual As

Client account transaction records must be retained for eight years, documenting essential transaction details.

Part IV.E.7-retRecord Retention — DLT Standards assessment records (Staking from Custody)

Records of DLT standards assessments for staking from custody must be retained for eight years from the assessment date under VARA custody record retention requirements.