Our summary
VARA regulates virtual asset activities in Dubai (outside the DIFC). Its Compliance and Risk Management Rulebook applies to every licensed virtual asset service provider (VASP).
It requires a compliance function and a compliance officer, a money laundering reporting officer, an AML/CFT programme in line with UAE law and the FATF standards, sanctions screening, the Travel Rule, risk management, internal audit, record keeping and reporting to VARA.
How auditors use it: Use it as the checklist when auditing a Dubai-licensed crypto business, or when assessing a client or counterparty that is one.