Table of Contents
Dubai’s Virtual Assets Regulatory Authority (VARA) made two moves on crypto oversight in two days. On 5 October it signed a memorandum of understanding with the UAE Financial Intelligence Unit (FIU) to share intelligence on virtual-asset financial crime, and on 6 October it issued a circular setting out what an independent proof-of-reserve audit has to cover.
Key Takeaways
VARA’s circular, dated 6 October, sets seven minimum checks for the independent audits licensed crypto firms must commission on client reserves, after a thematic review of every proof-of-reserve report filed in 2025.
The circular clarifies expectations under rules that already require reserves equal to 100% of client liabilities, held in the same asset and reconciled daily. VARA didn’t publish what its review found.
On 5 October, the day before, VARA and the UAE Financial Intelligence Unit signed an MoU to share financial intelligence on virtual-asset crime.
What the circular requires
VARA issued the circular after what it calls a thematic review of all Proof of Reserve Assets reports submitted in 2025. Its stated aim is to promote “a consistent, robust, and sufficiently detailed approach” to verifying how firms safeguard client virtual assets.
The rules behind it already exist. A VARA licensed firm must hold reserve assets equal to 100% of what it owes clients, one-to-one in the same virtual asset, reconciled daily and audited by an independent third party. Client assets must sit in wallets separate from the firm’s own and can’t be rehypothecated unless client consent and licensing requirements are met.
What the circular adds is a minimum audit scope. At a minimum, the auditor must:
- Confirm reserves stayed at 100% or more of client liabilities throughout the review period.
- Confirm each liability was matched in the same type of asset, without substitution.
- Cover every wallet holding client assets, including hot, warm and cold wallets, wallet infrastructure providers and third-party custodians.
- Assess whether client assets were kept separate from the firm’s own, and identify any commingling.
- Confirm the firm controlled every client wallet, and describe the custody arrangement for each.
- Confirm daily reconciliation took place, with evidence that it worked.
- Confirm whether any client assets were lent, pledged or otherwise used, and give details if so.
Audit reports must describe the procedures performed, evidence obtained, sampling and any reliance on third parties for each item, and separate compliant outcomes from exceptions, scope limits and anything that couldn’t be verified. The circular adds: “Where independent evidence is reasonably available, management representations alone should not be relied upon as sufficient audit evidence.” It also says that appointing an external auditor “does not transfer or reduce the responsibility” of the firm, its board and senior executives.
The intelligence-sharing MoU
The MoU, signed by UAE FIU chief Ali Faisal Ba’Alawi and VARA chief executive Matthew White, sets a framework for exchanging financial intelligence and expertise on financial-crime risks in the virtual assets sector, within applicable law and confidentiality requirements.
Ba’Alawi said,
“The collaboration strengthens our collective ability to detect and analyse suspicious activity and understand emerging typologies and risks associated with virtual assets.”
White said: “Effective regulation depends on the ability to connect supervisory insight with high-quality financial intelligence. The MoU consolidates and strengthens the collaboration already in place” between the two bodies.”
The UAE FIU is the independent unit within the Central Bank of the UAE that receives suspicious transaction reports, including from virtual asset service providers. VARA, set up in March 2022, regulates virtual assets across Dubai outside the Dubai International Financial Centre.
What’s next
VARA hasn’t said what its review of the 2025 reports found, how many firms fell short, or whether any faces action. The circular applies to the audits firms commission from here, and the next set of reports will show how firms respond. The MoU doesn’t say what intelligence will be shared or how often.
FAQs
What is a proof-of-reserve audit?
An independent check that a crypto firm holds enough of each asset to cover what it owes its clients. Under VARA’s rules the firm must hold 100% of client liabilities, in the same asset, reconciled daily.
Does VARA’s circular create new rules?
No. It clarifies how existing reserve, segregation and reconciliation requirements must be audited, by setting a minimum scope and expectations for the audit report.
What is the UAE Financial Intelligence Unit?
The independent unit within the Central Bank of the UAE that receives and analyses suspicious transaction reports and shares findings with competent authorities on money laundering, terrorist financing and proliferation financing.
Which crypto firms does VARA regulate?
Virtual asset service providers operating in Dubai, including its free zones, but not the Dubai International Financial Centre, which has its own regulator.
Editor’s Take: The circular doesn’t add a new requirement. The 100%, same-asset and daily-reconciliation rules were already in the rulebooks, and what VARA has fixed is the checklist auditors work from. The strongest parts are specific: coverage of hot, warm and cold wallets and third-party custodians, a required statement on whether client assets were lent or pledged, and the line that management representations alone aren’t enough evidence. The FIU MoU is the lighter of the two moves, since White describes it as consolidating collaboration that already existed and no details of what will be shared have been given.