VARA Market Conduct Rulebookchapter by chapter

I.A.1

Compliance with the VARA Marketing Regulations. VARA Market Conduct Rulebook Clause I.A.1 requires every Virtual Asset Service Provider to comply, at all times, with the Regulations on the Marketing of Virtual Assets and Related Activities 2024. This standalone compliance duty incorporates VARA's separate marketing-specific regulation as a binding, ongoing obligation on every VASP conducting marketing, advertising or promotional activity in or from the Emirate, regardless of the specific Virtual Asset Activity licensed.

II.A.1

Requirement for a written Client Agreement. VARA Market Conduct Rulebook Clause II.A.1 requires a VASP to enter into a written Client Agreement with each client, specifying the VASP's duties and responsibilities when providing services, including all Virtual Asset Activities offered. This is the foundational documentation requirement opening the Client Agreement regime in Chapter II, ensuring the client relationship is governed by an express, written contract rather than an informal understanding.

II.A.2

Ongoing compliance with Client Agreement terms. VARA Market Conduct Rulebook Clause II.A.2 requires a VASP to comply with the terms of its Client Agreements at all times. This standing performance obligation makes the written Client Agreement required under Clause II.A.1 legally binding in substance, not merely a documentation formality, and applies throughout the life of the client relationship rather than only at its formation.

II.A.3

Client Agreement legality and fair-treatment standard. VARA Market Conduct Rulebook Clause II.A.3 requires Client Agreements to comply with all applicable laws, including consumer protection laws, and with the general requirement to act honestly, fairly, and in the best interests of clients and market integrity. This embeds the overarching fair-treatment principle directly into the content standard applicable to every Client Agreement.

II.A.4

Fair, clear and not misleading Client Agreements. VARA Market Conduct Rulebook Clause II.A.4 requires Client Agreements to be fair, clear, transparent, accurate and not misleading at all times, and sufficiently clear to the client given the nature of the services and intended market. This clarity standard is the benchmark against which the specific mandatory content requirements in Section II.B are also measured, including where policies are incorporated by reference under Clause II.B.3.

II.A.5

Valid client acceptance before providing services. VARA Market Conduct Rulebook Clause II.A.5 requires a VASP to obtain valid client acceptance of the Client Agreement, in a form compliant with applicable laws, before providing any Virtual Asset Activities to that client. This acceptance gate ensures no services are rendered to a client who has not first affirmatively agreed to the governing Client Agreement in a legally recognised form.

II.A.6

Provision of the executed Client Agreement to the client. VARA Market Conduct Rulebook Clause II.A.6 requires a VASP to send a copy of the Client Agreement to each client after it has been entered into. This ensures the client retains their own record of the binding terms under which services are provided, distinct from the acceptance requirement in Clause II.A.5.

II.A.7

30-day advance notice of Client Agreement changes. VARA Market Conduct Rulebook Clause II.A.7 requires a VASP to notify clients of any change to the Client Agreement at least 30 calendar days before the change takes effect. This minimum notice period gives clients a defined window to review and respond to amended terms before those terms become binding, and applies to any amendment regardless of how minor or significant the change may be.

II.A.8

Disclosure of unilateral variation rights. VARA Market Conduct Rulebook Clause II.A.8 requires that any VASP right to unilaterally change a service, or part of a service or Virtual Asset Activity, be made explicit in the Client Agreement. This prevents a VASP from relying on an implied or undisclosed right to vary the service being provided, tying any such right to the 30-day notice requirement under Clause II.A.7.

II.A.9

Record of Client Agreement versions and changes. VARA Market Conduct Rulebook Clause II.A.9 requires a VASP to maintain a record of all versions of its Client Agreements and to be able to identify all changes made between versions. This version-control record supports VARA's ability to verify historical compliance with the notice and content requirements applicable to Client Agreements at any point in time.

II.B.1(a)

Client Agreement content: party identification. VARA Market Conduct Rulebook Clause II.B.1(a) requires the Client Agreement to include the identities of the client and the VASP, including the VASP's legal name and registered address. This is the first of the mandatory minimum-content items applicable to every Client Agreement under Section II.B, establishing basic contracting-party identification that VARA and the client can both independently verify.

II.B.1(b)

Client Agreement content: description of the VASP's Group. VARA Market Conduct Rulebook Clause II.B.1(b) requires the Client Agreement to include a description of the VASP's Group. This gives the client visibility of the corporate group the VASP belongs to, supplementing the party-identification requirement in Clause II.B.1(a) with wider corporate context relevant to the client's understanding of who it is contracting with.

II.B.1(c)

Client Agreement content: description of services. VARA Market Conduct Rulebook Clause II.B.1(c) requires the Client Agreement to include a description of the services to be provided. This mandatory content item ensures the scope of the VASP's contractual undertaking to the client is explicitly set out rather than left implicit or assumed, forming the baseline against which performance of the agreement can later be measured.

II.B.1(d)

Client Agreement content: communication methods. VARA Market Conduct Rulebook Clause II.B.1(d) requires the Client Agreement to specify the methods the VASP and client will use to communicate regarding the services. This ensures the client and VASP have an agreed, documented channel and method for service-related communication from the outset of the relationship, reducing scope for later disputes over how notices should be given.

II.B.1(e)

Client Agreement content: fee disclosure. VARA Market Conduct Rulebook Clause II.B.1(e) requires the Client Agreement to disclose all fees charged by the VASP for the services. This fee-transparency requirement ensures clients are informed of the full cost of the services before, and throughout, the contractual relationship, supporting the fair and clear disclosure standard in Clause II.A.4 and preventing undisclosed or hidden charges.

II.B.1(f)

Client Agreement content: governing law. VARA Market Conduct Rulebook Clause II.B.1(f) requires the Client Agreement to specify the law applicable to the agreement. This governing-law clause gives the client certainty as to the legal framework under which the Client Agreement will be interpreted and enforced, and is one of the baseline items every Client Agreement must contain under Section II.B.

II.B.1(g)

Client Agreement content: third-party and Group service providers. VARA Market Conduct Rulebook Clause II.B.1(g) requires the Client Agreement to identify any third-party service providers or Group Entities utilised by the VASP that are necessary for the services, for which a description of their functions is sufficient. This gives the client visibility of other parties involved in delivering the contracted services.

II.B.1(h)

Client Agreement content: control and liability for Virtual Assets. VARA Market Conduct Rulebook Clause II.B.1(h) requires the Client Agreement to clearly identify when Virtual Assets are no longer under the VASP's control during provision of a Virtual Asset Activity, and to describe which Entity is liable for the Virtual Assets at all times, including their location. This addresses a central risk disclosure point for clients regarding custody and liability.

II.B.1(i)

Client Agreement content: no deposit protection statement. VARA Market Conduct Rulebook Clause II.B.1(i) requires the Client Agreement to include a clear statement that neither Client Virtual Assets nor Client Money benefit from any form of deposit protection. This mandatory disclosure corrects any potential client assumption that Virtual Asset or money holdings are protected in the way bank deposits typically are.

II.B.1(j)

Client Agreement content: client ownership of assets. VARA Market Conduct Rulebook Clause II.B.1(j) requires the Client Agreement to include a clear statement that all client assets, including Client Money and Client Virtual Assets, remain owned by the client. This ownership statement is a core client-protection disclosure, reinforcing that the VASP does not acquire title to client assets it services, subject only to the specific exceptions required to be identified under Clause II.B.1(k).

II.B.1(k)

Client Agreement content: exceptions to client ownership. VARA Market Conduct Rulebook Clause II.B.1(k) requires the Client Agreement to clearly identify if, and when, any assets, whether money or Virtual Assets, will not be owned by the client at any time. This is the necessary carve-out disclosure complementing the general client-ownership statement required under Clause II.B.1(j), ensuring no ownership exception is left undisclosed.

II.B.2(a)

Client Agreement content: supported Virtual Assets. VARA Market Conduct Rulebook Clause II.B.2(a) requires the Client Agreement, to the extent applicable, to specify which Virtual Assets are, or will be, supported. This lets the client know the precise scope of Virtual Assets the VASP's services cover, distinct from the general service description required under Clause II.B.1(c), and is updated as the VASP's supported Virtual Assets change.

II.B.2(b)

Client Agreement content: handling of airdrops and forks. VARA Market Conduct Rulebook Clause II.B.2(b) requires the Client Agreement to describe how the VASP will respond to newly created Virtual Assets, such as an airdrop, or a previously supported Virtual Asset no longer being supported, such as a fork, including assessing the impact of such change promptly and communicating clearly with affected clients throughout.

II.B.2(c)

Client Agreement content: risk of service failure. VARA Market Conduct Rulebook Clause II.B.2(c) requires the Client Agreement, to the extent applicable, to address the risk of loss that may result from a failure of the VASP's services, including Custody Services, and to outline the mitigation measures in place. This ensures operational-failure risk is disclosed to clients alongside market and product risk, rather than being omitted from the contractual risk profile.

II.B.3

Incorporating published policies into the Client Agreement. VARA Market Conduct Rulebook Clause II.B.3 provides that, where a VASP satisfies the Clause II.B.2 content requirements by directing clients to published policies or procedures instead of including the content directly, those policies must meet the fairness and clarity standard of Clause II.A.4, and all links or references to them must be kept accurate and maintained at all times.

III.A.1(a)

One-week complaint acknowledgement deadline. VARA Market Conduct Rulebook Clause III.A.1(a) requires a VASP to acknowledge all complaints within one week of the complaint being made. This is the first of the mandatory complaint-handling service standards in Chapter III, ensuring clients receive prompt confirmation that their complaint has been received and is being actioned, ahead of the four-week resolution deadline set under Clause III.A.1(b).

III.A.1(b)

Four-week complaint resolution deadline. VARA Market Conduct Rulebook Clause III.A.1(b) requires a VASP to resolve complaints within four weeks of the complaint being made, except in extraordinary circumstances, in which case the VASP must update the client and explain the delay within four weeks and resolve the complaint no later than eight weeks from when it was made. This sets the binding resolution timeline for the complaints-handling process, with a defined extended deadline for exceptional cases.

III.A.2

Accessible complaint submission channels. VARA Market Conduct Rulebook Clause III.A.2 requires a VASP to make available to clients an easy-to-use template form for filing complaints and to provide accessible means and clear instructions for submission, without limiting clients to only one channel or form. This ensures clients are not obstructed from raising a complaint by an unduly narrow or inaccessible submission process.

III.A.3

Responsibility for complaints involving third parties. VARA Market Conduct Rulebook Clause III.A.3 requires that, where services involve third-party Entities, a VASP establish procedures to facilitate complaint handling between clients and such third parties, and remain responsible for the resolution of such complaints. This prevents a VASP from disclaiming responsibility for complaints simply because a third party was involved in providing the service.

III.A.4

No fees for complaint submission or handling. VARA Market Conduct Rulebook Clause III.A.4 prohibits a VASP from imposing any fees or charges for the submission or handling of complaints. This ensures cost cannot operate as a barrier to a client exercising their right to complain, reinforcing the accessible-channels requirement in Clause III.A.2 and the acknowledgement and resolution deadlines in Clause III.A.1.

III.A.5

Complaint record-keeping. VARA Market Conduct Rulebook Clause III.A.5 requires a VASP to keep a record of all complaints received, all measures taken in response, and the resolution of all complaints. This record-keeping obligation supports VARA's supervisory review of complaint handling and underpins the root-cause analysis required for recurring or systemic problems under Clause III.B.3, giving VARA an auditable trail of the VASP's complaint-handling performance.

III.B.1

Written, published complaints handling procedures. VARA Market Conduct Rulebook Clause III.B.1 requires a VASP to establish and maintain effective procedures for the prompt, fair and consistent handling of complaints, and to disclose those procedures on its website in a clear and easy-to-understand manner. This is the foundational procedural framework underpinning the specific complaint-handling standards and deadlines set elsewhere in Chapter III.

III.B.2

Defining when a complaint is made. VARA Market Conduct Rulebook Clause III.B.2 requires the complaints procedures to establish when a complaint is considered to have been made and the mediums or channels through which the VASP will monitor and recognise complaints. This threshold definition anchors the acknowledgement and resolution deadlines set under Clauses III.A.1(a) and III.A.1(b) to a clear, documented starting point.

III.B.3

Root-cause analysis of recurring complaints. VARA Market Conduct Rulebook Clause III.B.3 requires a VASP to take reasonable steps to identify and remedy recurring or systemic complaint problems, including analysing root causes, considering whether those causes affect other processes, services or products, and correcting the root causes. This moves complaint handling beyond individual case resolution into systemic, organisation-wide quality improvement, drawing on the complaint records maintained under Clause III.A.5.

IV.A.1

Investor classification and permitted VA Activities. VARA Market Conduct Rulebook Clause IV.A.1 requires a VASP to only carry out, or attempt to carry out, a Virtual Asset Activity in relation to investor classifications permitted by VARA, subject to restrictions in the Regulations, Rules, Directives, the VASP's Licence conditions, and any further VARA conditions, and requires the VASP to correctly classify each client as a Retail Investor, Qualified Investor, or Institutional Investor using the defined net-asset, income, regulatory-status and other tests before providing services.

V.Intro

Accessible, current public disclosure. VARA Market Conduct Rulebook Clause V.Intro requires a VASP to ensure all information required under Part V, Public Disclosures, is provided in an easily accessible location on its website in a machine-readable format and is kept accurate and up-to-date at all times. This general standard governs how each specific disclosure item required under Chapter V must be presented and maintained.

V.A.1

Publication of the VARA Licence number. VARA Market Conduct Rulebook Clause V.A.1 requires a VASP to publish the Licence number issued to it by VARA. This is the first of the mandatory public disclosure items under Section V.A, giving clients and the market a verifiable reference point to the VASP's regulatory status and standing with VARA, alongside the further Licence details required under Clause V.A.2.

V.A.2

Publication of authorised Virtual Asset Activities. VARA Market Conduct Rulebook Clause V.A.2 requires a VASP to publish all Virtual Asset Activities it is Licensed to carry out in the Emirate, including any restrictions stated by VARA as a Licence condition, and the validity period of the Licence. This gives clients and the market clear, current visibility of the precise scope and duration of the VASP's authorisation.

V.A.3

Publication of Responsible Individuals. VARA Market Conduct Rulebook Clause V.A.3 requires a VASP to publish the names of all Responsible Individuals appointed under the Company Rulebook. This public disclosure gives clients and the market visibility of the named individuals accountable to VARA for the VASP's compliance with its legal and regulatory obligations, complementing the Licence and activity disclosures required under Clauses V.A.1 and V.A.2.

V.B.1

Detailed public risk disclosure statement. VARA Market Conduct Rulebook Clause V.B.1 requires a VASP to publish a detailed risk disclosure statement covering all material risks of Virtual Assets, including volatility and loss of value, transferability and irreversibility limits, illiquidity, public distributed-ledger recording, and fraud, manipulation or theft risk with no legal protection. This ensures prospective and existing clients have prominent, comprehensive warning of the inherent risks of dealing in Virtual Assets.

VI.A.1

Maintenance of Insider Lists. VARA Market Conduct Rulebook Clause VI.A.1 requires a VASP to maintain complete and up-to-date Insider Lists of all Entities, including Board members, Staff, Group Entities, advisors, accountants and other third-party agents or service providers, with access to Inside Information, updating the list while such information remains Inside Information. This is the foundational record supporting the market-transparency and insider-dealing controls set out in the remainder of Section VI.A.

VI.A.2

Eight-year retention of Insider Lists. VARA Market Conduct Rulebook Clause VI.A.2 requires a VASP to retain each Insider List for at least eight years after it is drawn up or updated, and to provide it to VARA upon request. This long retention period ensures historical Insider List records remain available for VARA's supervisory or investigatory purposes well after the underlying access to Inside Information has ended.

VI.A.3

Minimum content of the Insider List. VARA Market Conduct Rulebook Clause VI.A.3 requires the Insider List to include, at minimum, the identity of each Entity with access to Inside Information, the reason for inclusion, the date and time access was obtained, and the date the list was drawn up. This sets the minimum data fields the maintenance obligation under Clause VI.A.1 must capture for each listed Entity.

VI.A.4

Prompt updating of the Insider List. VARA Market Conduct Rulebook Clause VI.A.4 requires a VASP to update the Insider List promptly, with the date of update, whenever the reason for inclusion changes, a new Entity gains access to Inside Information, or an Entity ceases to have such access, with each update specifying the date and time the triggering change occurred. This keeps the list required under Clause VI.A.1 current on an event-driven, not merely periodic, basis.

VI.A.5

Insider acknowledgement of duties and sanctions. VARA Market Conduct Rulebook Clause VI.A.5 requires a VASP to take all reasonable steps to ensure each Entity on the Insider List acknowledges in writing the legal and regulatory duties entailed and is aware of the sanctions applicable to Insider Dealing and unlawful disclosure of Inside Information. This ensures listed individuals cannot claim ignorance of their obligations or the consequences of breaching them.

VI.B.1

Policy governing Board and Staff personal positions. VARA Market Conduct Rulebook Clause VI.B.1 requires a VASP, in addition to Company Rulebook requirements, to implement policies to govern and monitor the transactions and positions of Board members and Staff, specifying prohibited Virtual Asset positions or transactions, prohibited shareholdings or directorships, and the approval or notification forms required. This is the foundational personal-account-dealing policy underpinning the specific approval and reporting duties in the remainder of Section VI.B.

VI.B.2

Prior approval for personal transactions and outside interests. VARA Market Conduct Rulebook Clause VI.B.2 requires all Board members and Staff to obtain written approval from the VASP before opening, modifying or closing Virtual Asset positions on their own account, changing shareholdings in other legal entities, taking up outside directorships, or taking any other action specified in the Clause VI.B.1 policy that is reasonably likely to cause a conflict of interest.

VI.B.3

Six-monthly disclosure of positions and outside interests. VARA Market Conduct Rulebook Clause VI.B.3 requires a VASP, at least every six months, to require Board members and Staff to notify it of all Virtual Asset positions held, including description, size and transaction nature or history, and all shareholdings or directorships in other legal entities, including entity name and jurisdiction, purpose, shareholding percentage, and remuneration.

VI.B.4

Removing conflicts arising from personal positions. VARA Market Conduct Rulebook Clause VI.B.4 requires that, where a VASP has information or reason to believe a Board member or Staff member is likely to cause, or has caused, an actual or potential conflict of interest, it must take all necessary action to remove the conflict, including requiring divestment of the relevant position or shareholding or resignation from the other board.

VI.B.5

Notification of Section VI.B obligations before appointment. VARA Market Conduct Rulebook Clause VI.B.5 requires a VASP to notify all Board members and Staff of their Section VI.B obligations in writing prior to the start of their employment or appointment. This ensures individuals are aware of the personal-dealing and conflicts obligations under Clauses VI.B.1 through VI.B.4 before they take up their role.

VII.A.1

General prohibition on proprietary trading. VARA Market Conduct Rulebook Clause VII.A.1 prohibits a VASP from actively investing its own, or its Group's, portfolio of Virtual Assets or any other assets. This is the general trading-own-account prohibition opening Chapter VII, subject only to the narrow carve-out for prudential and treasury management set out in Clause VII.A.2, and applies regardless of the specific Virtual Asset Activity the VASP is licensed for.

VII.A.2

Carve-out for prudential and treasury transactions. VARA Market Conduct Rulebook Clause VII.A.2 provides that the general prohibition in Clause VII.A.1 does not prevent transactions for prudent management of required Net Liquid Assets or the VASP's treasury or balance sheet, provided full records of all such transactions are maintained for a minimum of eight years. This narrow exception preserves the VASP's ability to manage its own regulatory capital and liquidity.

VII.B.1

Emirate-wide Group compliance with Regulation IV.A.7. VARA Market Conduct Rulebook Clause VII.B.1 requires all Entities in the Emirate, including those in the same Group as a VASP, to comply with Regulation IV.A.7, if applicable. This extends the trading-own-account controls applicable to the VASP itself to other Group Entities operating within the Emirate, not only the licensed VASP, closing a route by which the proprietary-trading prohibition might otherwise be circumvented at Group level.

VII.B.2

Reporting on Group Entity proprietary trading. VARA Market Conduct Rulebook Clause VII.B.2 requires a VASP to comply with the reporting requirements set out in the Compliance and Risk Management Rulebook in respect of any Group Entity that actively invests its own, or the Group's, portfolio of Virtual Assets or other assets. This gives VARA visibility of proprietary trading occurring elsewhere within the VASP's Group.

VIII.A.1

Requirement to establish VA Standards. VARA Market Conduct Rulebook Clause VIII.A.1 requires a VASP to establish standards for the Virtual Assets in relation to which it provides Virtual Asset Activities, defined as VA Standards. This is the foundational obligation opening Chapter VIII, underpinning the due diligence, disclosure and ongoing monitoring requirements set out in the remainder of the Chapter for each Virtual Asset the VASP deals in.

VIII.A.2

Due diligence to ensure Virtual Assets meet VA Standards. VARA Market Conduct Rulebook Clause VIII.A.2 requires a VASP to take all reasonable steps, including conducting relevant due diligence, to ensure all Virtual Assets meet the VA Standards prior to, and at all times during, providing Virtual Asset Activities in relation to them. This makes VA Standards compliance a continuing, not merely onboarding, obligation.

VIII.A.3

Public disclosure of VA Standards. VARA Market Conduct Rulebook Clause VIII.A.3 requires a VASP to disclose its VA Standards on its website. This public-transparency requirement lets clients and the market see the criteria a VASP applies before offering services in relation to a particular Virtual Asset, complementing the Chapter V public disclosure obligations and the detailed minimum-content standard set out in Clause VIII.A.4.

VIII.A.4

Minimum content of VA Standards. VARA Market Conduct Rulebook Clause VIII.A.4 requires VA Standards to address, to the extent relevant to the Virtual Asset Activity, at least fourteen specified considerations for each Virtual Asset, including market capitalisation and liquidity trends, design, features and use cases, AML/CFT, sanctions, securities and intellectual property compliance impact, regulatory treatment and approvals, prohibitions by VARA or other authorities, distributed-ledger protocol security and immutability, development roadmap, price manipulation susceptibility and mitigations, conflicts of interest and mitigations, Issuer background and history of fraud or investigation claims, enforceability of represented rights, sufficiency of assets to satisfy obligations, and correlation of Virtual Asset terms with any underlying physical market.

VIII.B.1

Ongoing assessment against VA Standards. VARA Market Conduct Rulebook Clause VIII.B.1 requires a VASP to regularly, and on an ongoing basis, assess relevant information to ensure a Virtual Asset continues to meet the VA Standards. This continuing-assessment obligation operationalises the ongoing compliance duty set out in Clause VIII.A.2 through an active, recurring monitoring process, rather than a one-off check performed only when the Virtual Asset is first supported.

VIII.B.2

Eight-year retention of VA Standards assessment records. VARA Market Conduct Rulebook Clause VIII.B.2 requires a VASP to maintain all records relevant to VA Standards assessments for eight years and to provide them to VARA upon request. This retention period mirrors the eight-year Insider List retention standard under Clause VI.A.2, applied here to VA Standards assessment documentation and evidence supporting the ongoing monitoring duty under Clause VIII.B.1.

VIII.B.3

Suspension conditions and controls for non-conforming Virtual Assets. VARA Market Conduct Rulebook Clause VIII.B.3 requires a VASP to set conditions under which Virtual Asset Activities in relation to a Virtual Asset may be suspended, including where it no longer meets the VA Standards, and to have and implement the necessary operational procedures and controls for when such conditions are met.

VIII.B.4

Notification of a Virtual Asset failing VA Standards. VARA Market Conduct Rulebook Clause VIII.B.4 requires a VASP to notify VARA as soon as possible after becoming aware that a Virtual Asset no longer meets its VA Standards, and to take such steps as VARA directs to minimise adverse client impact. This closes the VA Standards regime with a mandatory regulatory notification and remediation-direction duty.