VARA Technology and Information Rulebookchapter by chapter

I.A.1

Technology Governance and Risk Assessment Framework. VARA Technology and Information Rulebook Clause I.A.1 requires a Virtual Asset Service Provider to implement a Technology Governance and Risk Assessment Framework capable of determining defined policies underpinned by the necessary processes, procedures and controls to adequately mitigate identified risks. This is the foundational requirement opening Part I, underpinning every specific technology governance, cybersecurity and key-management obligation set out in the remainder of the Chapter.

I.A.2

Implementation of risk-mitigating policies and controls. VARA Technology and Information Rulebook Clause I.A.2 requires a VASP to implement all policies, processes, procedures and controls necessary to address risks to its business and Virtual Asset Activities covered by the Framework, using appropriate methods including defence-in-depth approaches for cybersecurity risks. This translates the Framework required under Clause I.A.1 from a governance concept into operative controls.

I.A.3

Framework must be comprehensive and risk-proportionate. VARA Technology and Information Rulebook Clause I.A.3 requires the Technology Governance and Risk Assessment Framework to be comprehensive and proportionate to the VASP's business and Virtual Asset Activity risk profile, to apply to all relevant technologies, and to clearly set out cybersecurity objectives, including Staff, end-user and client competency requirements, and clearly defined policies, processes, procedures and controls for managing risk, considering international standards and industry best practice.

I.A.4

Governance and system development controls. VARA Technology and Information Rulebook Clause I.A.4 requires the Framework to address governance policies and system development controls, including a development, maintenance and testing process for technology systems, operations controls, back-up controls, capacity and performance planning, and availability testing. This gives specific technical content to the general Framework requirement under Clause I.A.1, covering the full technology lifecycle from build through ongoing operation.

I.A.5

Ongoing monitoring and periodic testing of the Framework. VARA Technology and Information Rulebook Clause I.A.5 requires a VASP to monitor, assess and maintain the effectiveness of the Framework, including reviewing, updating and arranging testing of its policies, processes, procedures and controls on a periodic basis, having regard to the macroeconomic environment and emerging technology risks. This makes the Framework a living document rather than a static, one-time deliverable.

I.B.1

Cybersecurity Policy creation and submission to VARA. VARA Technology and Information Rulebook Clause I.B.1 requires a VASP to create and implement a Cybersecurity Policy outlining procedures for protecting electronic systems and client or counterparty data, and to submit it to VARA for assessment as part of licensing and at any subsequent time upon VARA's request. This gives VARA direct visibility of, and approval leverage over, the VASP's cybersecurity policy content.

I.B.2

Annual CISO review of the Cybersecurity Policy. VARA Technology and Information Rulebook Clause I.B.2 requires a VASP to ensure the Cybersecurity Policy is reviewed and updated at least annually by the Chief Information Security Officer. This ties ownership of the Cybersecurity Policy's currency directly to the CISO role established under Clause I.I.1, distinct from the initial policy submission required under Clause I.B.1.

I.B.3

Minimum content of the Cybersecurity Policy. VARA Technology and Information Rulebook Clause I.B.3 requires the Cybersecurity Policy to enable compliance with applicable information security, data protection and privacy laws, including Part II of the Rulebook and the Personal Data Protection Law, and to address at least nineteen minimum criteria spanning information security, data governance and classification, access controls, capacity and performance planning, systems operations and availability, network security and smart contract audit processes, application development and quality assurance, physical security, client transaction and session authentication including multi-factor authentication triggers, account-change authentication, client data privacy, vendor and third-party management, core protocol change monitoring, incident response, supplier and Staff vetting, governance and escalation procedures, hardware and infrastructure standards, and threat information sharing.

I.C.1

Compliance with other cybersecurity and data laws. VARA Technology and Information Rulebook Clause I.C.1 requires a VASP to ensure the Framework complies, to the extent applicable, with other cybersecurity laws and regulatory requirements, including Dubai Electronic Security Center standards, the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, and UAE Data Office requirements, and Central Bank of the UAE Consumer Protection Regulation requirements. This layers external UAE cybersecurity and data-protection standards on top of the VARA-specific Framework.

I.D.1

Cryptographic key and Virtual Asset Wallet management scope. VARA Technology and Information Rulebook Clause I.D.1 requires the Framework to address, to the extent necessary, the generation of cryptographic keys and Virtual Asset Wallets, the signing and approval of transactions, the storage of cryptographic keys and seed phrases, and Virtual Asset Wallet creation and management. This opens the key-management-specific requirements elaborated in the remainder of Section I.D.

I.D.2(a)

No single point of failure in Virtual Asset access. VARA Technology and Information Rulebook Clause I.D.2(a) requires a VASP to safeguard access to Virtual Assets per industry best practice, ensuring no single point of failure exists in the VASP's access to, or knowledge of, Virtual Assets held. This foundational resilience principle underpins the more detailed key-storage and access-control requirements in the remainder of Clause I.D.2.

I.D.2(b)

Private key storage and backup separation. VARA Technology and Information Rulebook Clause I.D.2(b) requires a VASP to adopt industry best practice for storing clients' private keys, ensuring keys stored online or in one physical location alone are insufficient to conduct a transaction absent adequate controls, and to store backups of keys and seed phrases in a location separate from the primary key or phrase. This prevents a single compromised location from exposing both a client's primary and backup key material.

I.D.2(c)

Strict access management controls for keys. VARA Technology and Information Rulebook Clause I.D.2(c) requires a VASP to adopt strict access management controls for keys, including an audit log of each access change, and to assess whether a new key must be generated whenever Staff with access to a key, including multi-signature keys, leaves the VASP's employment. This ties key security directly to Staff employment status changes.

I.D.2(d)(i,iii,iv)

Immediate revocation and documented on/offboarding procedures. VARA Technology and Information Rulebook Clause I.D.2(d)(i,iii,iv) requires a VASP to adopt procedures to immediately revoke a key signatory's access, ensuring revoked signatories cannot access the backup seed phrase or knowledge used in key creation, and to implement and maintain documented procedures for Staff onboarding and offboarding and for granting or revoking role-based access to the key management system.

I.D.2(d)(ii)

Quarterly internal audit of access removal. VARA Technology and Information Rulebook Clause I.D.2(d)(ii) requires a VASP to perform internal audits on a quarterly basis concerning the removal of user access, by reviewing access logs and verifying access as appropriate. This recurring audit obligation checks that the immediate-revocation and offboarding procedures required under Clause I.D.2(d)(i,iii,iv) are actually being followed in practice.

I.D.2(e)

Assessing security of IT systems and external integrations. VARA Technology and Information Rulebook Clause I.D.2(e) requires a VASP to regularly assess the security of its IT systems or software integrations with external parties and to ensure appropriate safeguards are implemented to mitigate all relevant risks. This extends the key-management security regime in Section I.D to the VASP's broader IT and third-party integration landscape.

I.D.4

Access restricted to demonstrable business need. VARA Technology and Information Rulebook Clause I.D.4 requires a VASP to ensure access to its systems and data is only granted to individuals with a demonstrable business need, and to implement safeguards for proper identification of all individuals, including maintenance of an access log. This is a general least-privilege access principle applying across the VASP's systems and data, not only cryptographic key material.

I.E.1

Annual independent vulnerability assessment and penetration testing. VARA Technology and Information Rulebook Clause I.E.1 requires a VASP to engage a qualified, independent third-party auditor to conduct vulnerability assessments and penetration testing, including smart contract audits where relevant, at least annually and prior to introducing any new systems, applications or products, and to provide results to VARA upon request. This is the baseline VAPT obligation underpinning the more intensive Threat-Led Penetration Testing regime in Clauses I.E.6 through I.E.10.

I.E.2

Regular security testing on VARA's request. VARA Technology and Information Rulebook Clause I.E.2 requires a VASP, on a regular basis and on VARA's request, to perform security testing on infrastructure and applications, and internal and external system vulnerability audits. This supplements the annual independent VAPT cycle under Clause I.E.1 with testing VARA can require at any other time it considers necessary.

I.E.3

Documentation of test and audit evidence. VARA Technology and Information Rulebook Clause I.E.3 requires evidence of tests and audits to be documented and made immediately available for inspection by VARA upon request. This ensures the vulnerability assessment, penetration testing and security testing conducted under Clauses I.E.1 and I.E.2 leaves a verifiable, inspectable audit trail rather than an informal or undocumented record.

I.E.4

Independent audit of management processes. VARA Technology and Information Rulebook Clause I.E.4 requires a VASP to ensure it is regularly audited by independent auditors examining management processes for the effectiveness of processes, procedures and controls and regulatory compliance, and to provide audit results to VARA upon request. This is a broader management-process audit, distinct from the technical VAPT testing required under Clause I.E.1.

I.E.6(a-d)

Threat-Led Penetration Testing scope and execution. VARA Technology and Information Rulebook Clause I.E.6(a-d) provides that, where VARA requires a Threat-Led Penetration Test, it must be carried out by an external tester, may be required to cover Critical or Important Functions on live production systems, must include participation of relevant third-party service providers where necessary, and the VASP must mitigate testing risks to data, assets, and Critical or Important Functions.

I.E.6(e)

TLPT findings summary and remediation plans. VARA Technology and Information Rulebook Clause I.E.6(e) requires that, at the end of a Threat-Led Penetration Test, the VASP, together with the external tester, must produce a summary of findings, remediation plans, and documentation demonstrating the TLPT was conducted per all applicable requirements. This is the mandatory output deliverable closing out each TLPT exercise required under Clause I.E.6(a-d).

I.E.6(f)

Prompt submission of TLPT documentation to VARA. VARA Technology and Information Rulebook Clause I.E.6(f) requires a VASP to promptly provide all Threat-Led Penetration Test documentation to VARA, including the findings summary, remediation plans, and compliance documentation produced under Clause I.E.6(e). This gives VARA direct, timely visibility of TLPT outcomes without a separate information request being necessary each time a test is completed.

I.E.7

Suitability standards for external TLPT testers. VARA Technology and Information Rulebook Clause I.E.7 requires a VASP to ensure external Threat-Led Penetration Test testers are suitable and of good repute, possess necessary technical and organisational capability and threat intelligence and penetration testing expertise, are certified by an accreditation body or adhere to formal codes of conduct, provide independent assurance and audit reporting on TLPT risk management, and are covered by relevant professional indemnity insurance.

I.E.8

Contract terms with external testers over TLPT results. VARA Technology and Information Rulebook Clause I.E.8 requires a VASP to ensure contracts with external testers require sound management of Threat-Led Penetration Test results and any related data processing, and do not create additional risks for the VASP or its systems. This governs the contractual relationship underpinning the testing regime set out in Clauses I.E.6 and I.E.7.

I.E.9-10

Third-party contracted testers remain under VASP direction. VARA Technology and Information Rulebook Clause I.E.9-10 provides that, where a third-party technology service provider directly contracts with the external tester for a Threat-Led Penetration Test, the VASP must ensure the third party remains under the VASP's direction, that results cover the relevant scope of Critical or Important Functions, and that all results provided are a fair and specific representation of the VASP.

I.F.1

Preventing manipulation of automated systems. VARA Technology and Information Rulebook Clause I.F.1 requires a VASP to implement controls that prevent the manipulation or coordinated collusion or attacks of automated systems. This opens the Virtual Asset transaction integrity controls in Section I.F, addressing threats to the automated systems underlying a VASP's Virtual Asset Activities and market functions, whether the threat originates internally or externally.

I.F.2

Distributed ledger tracing for transaction screening. VARA Technology and Information Rulebook Clause I.F.2 requires a VASP to implement and maintain distributed ledger tracing software to screen incoming and outgoing Virtual Asset transactions and Virtual Asset Wallet addresses, with the response to Suspicious Transactions set out in the VASP's AML/CFT policies per the Compliance and Risk Management Rulebook. This links the technology infrastructure requirement to the substantive AML/CFT response obligations found in another Rulebook.

I.G.1

Board and Senior Management oversight of algorithms. VARA Technology and Information Rulebook Clause I.G.1 requires that, where a VASP conducts Virtual Asset Activities using algorithms, it must establish policies and procedures enabling the Board and Senior Management to have robust oversight and control over algorithm design, testing, performance, deployment and ongoing maintenance. This applies the Company Rulebook's governance-oversight principles specifically to algorithmic activity.

I.G.2

Algorithm documentation and record-keeping. VARA Technology and Information Rulebook Clause I.G.2 requires a VASP to maintain documentation and records of algorithm design, testing, performance, deployment and ongoing maintenance, including logic, data and assumptions used, potential or actual biases, and results produced. This record-keeping obligation supports the Board and Senior Management oversight required under Clause I.G.1 and the Staff competency standard in Clause I.G.3.

I.G.3

Qualified Staff for algorithm supervision. VARA Technology and Information Rulebook Clause I.G.3 requires a VASP to ensure it has qualified and competent Staff to ensure the proper functioning and supervision of algorithms on an ongoing basis. This staffing requirement complements the governance and documentation obligations in Clauses I.G.1 and I.G.2 with a competence standard for the individuals actually supervising algorithmic systems.

I.H.1

Business Continuity and Disaster Recovery Plan. VARA Technology and Information Rulebook Clause I.H.1 requires a VASP to implement, maintain, test and update annually an adequate Business Continuity and Disaster Recovery Plan, addressing trigger events, resource requirements, recovery priorities, communication arrangements, data-integrity validation, impact mitigation and escalation procedures, alternative site arrangements, and post-event remediation across the VASP's critical technology systems and third-party dependencies.

I.I.1

Appointment of a Chief Information Security Officer. VARA Technology and Information Rulebook Clause I.I.1 requires a VASP to appoint a Chief Information Security Officer responsible for ensuring the VASP complies with Part I and Part III of the Rulebook, with the CISO required to be a separate individual from the Compliance Officer but permitted also to serve as the Data Protection Officer. This fixes personal accountability for technology governance and confidential information compliance in a named role.

I.I.2

CISO standing and experience requirements. VARA Technology and Information Rulebook Clause I.I.2 requires the Chief Information Security Officer to be of sufficiently good standing and appropriately experienced. This eligibility standard for the CISO role mirrors the Fit and Proper expectations the Company Rulebook applies to other key control functions such as the MLRO and Data Protection Officer, reflecting the seniority of the role within the VASP.

I.I.3

Senior Management review and conflict-avoiding role allocation. VARA Technology and Information Rulebook Clause I.I.3 requires Senior Management to regularly assess and review the effectiveness of the VASP's processes, procedures and controls relevant to the Rulebook and applicable laws, and to allocate duties and apportion roles and responsibilities to prevent conflicts of interest. This gives Senior Management an active, ongoing supervisory role over the Part I control framework.

I.J.1

Staff cybersecurity risk awareness. VARA Technology and Information Rulebook Clause I.J.1 requires a VASP to ensure all Staff are aware of the latest cybersecurity risks and developments, including those specific to Virtual Assets and distributed ledger technology, taking into account the type and level of cyber risk relevant to their roles. This role-calibrated awareness obligation supports the human element of the wider Technology Governance and Risk Assessment Framework.

I.K.1

72-hour notification of material cybersecurity events. VARA Technology and Information Rulebook Clause I.K.1 requires that, upon detecting a material cybersecurity event or a Business Continuity and Disaster Recovery Plan-triggering event that materially impacts business operations, a VASP must report it to VARA as soon as reasonably practicable and no later than 72 hours from detection, with details of the nature, scope and impact and mitigation steps taken or planned, including whether other authorities have been notified.

II.A.1

Compliance with applicable data protection laws. VARA Technology and Information Rulebook Clause II.A.1 requires a VASP to comply with all applicable data protection and data privacy requirements in all relevant jurisdictions, including the UAE Personal Data Protection Law and any applicable sectoral or free zone laws, and any applicable non-UAE data protection laws. This is the general compliance obligation opening Part II, Personal Data Protection.

II.B.1

Written Personal Data protection compliance programme. VARA Technology and Information Rulebook Clause II.B.1 requires a VASP to produce and implement a written compliance programme to protect the privacy of Personal Data in accordance with all applicable data protection laws. This operationalises the general compliance duty under Clause II.A.1 into a documented, implemented programme rather than an informal or unwritten set of practices.

II.B.2(a)

Appointment of a Data Protection Officer. VARA Technology and Information Rulebook Clause II.B.2(a) requires a VASP to appoint a Data Protection Officer with appropriate competencies and experience to perform statutory duties under applicable data protection laws, including Article 11 of the Personal Data Protection Law, and permits the Data Protection Officer to be the same individual as the Chief Information Security Officer appointed under Clause I.I.1.

II.B.2(b)

Dedicated Personal Data management and protection function. VARA Technology and Information Rulebook Clause II.B.2(b) requires a VASP to establish a function responsible for the management and protection of Personal Data, appropriate to the level of risk involved, including implementing and maintaining appropriate processes, procedures and controls. This gives the Data Protection Officer role required under Clause II.B.2(a) an operational function to lead.

II.C.1

VARA access to Part II compliance information. VARA Technology and Information Rulebook Clause II.C.1 requires that, notwithstanding any other requirement, a VASP must take all steps, including notifications, contractual provisions, and consents, necessary to enable VARA access to any information relating to the VASP's Part II compliance, wherever stored, in the manner and timelines VARA communicates. This overrides other confidentiality constraints to preserve VARA's supervisory access.

II.C.2

24-hour VARA notification of Personal Data incidents. VARA Technology and Information Rulebook Clause II.C.2 requires a VASP to notify VARA within 24 hours of notifying a data regulator or a Data Subject of any incident affecting or potentially affecting Personal Data, providing VARA a summary, and a copy if the regulator is in the UAE, unless prohibited by law. This creates a VARA-specific notification timeline running alongside any statutory data-breach notification obligation.

III.A.1

Protecting confidentiality of client-related information. VARA Technology and Information Rulebook Clause III.A.1 requires a VASP to take all reasonable steps to protect the ongoing confidentiality of all client-related information and related properties or records, including implementing and enforcing appropriate policies, procedures and mechanisms. This is the foundational confidentiality obligation opening Part III of the Rulebook, underpinning the remaining Section III.A requirements.

III.A.2

Purpose limitation on use of client information. VARA Technology and Information Rulebook Clause III.A.2 requires confidentiality policies and procedures to ensure that client-related information is used only for the purposes for which it was provided, in compliance with confidentiality agreements consistent with applicable laws, including agreement acceptance requirements. This restricts client information use strictly to its originally disclosed and agreed purpose.

III.A.3

Staff familiarisation and periodic certification. VARA Technology and Information Rulebook Clause III.A.3 requires a VASP to familiarise Staff with internal confidential-information policies and applicable Part III requirements, and to periodically certify Staff compliance with such internal policies. This training-and-attestation obligation ensures confidentiality duties are actively reinforced among Staff on a recurring basis, not merely documented once in policy and then left unrevisited.

III.A.4

Restriction on internal sharing of confidential information. VARA Technology and Information Rulebook Clause III.A.4 provides that Staff must not share confidential information within the VASP or with other Entities unless absolutely necessary for conducting Virtual Asset Activities related to such information. This need-to-know standard limits internal dissemination of client-related confidential information to only what is strictly required for the task at hand.

III.A.5

Prohibition on trading-related use of confidential information. VARA Technology and Information Rulebook Clause III.A.5 provides that neither a VASP nor its Staff may use or share confidential information for the purpose of trading Virtual Assets by any Entity. This closes Part III with an absolute prohibition preventing confidential client information from being exploited for personal or institutional trading advantage by anyone connected with the VASP.