Dubai VASPs and the VARA technology rulebook: ready for licensing and review

The rulebook has three parts: technology governance, controls and security; personal data protection; and confidential information. Schedule 1 is VARA guidance on the risk categories your technology governance and risk assessment framework should cover: organisational, technical, detection and response, customer virtual assets, and digital operational resilience.

It applies alongside the Company Rulebook, the Compliance and Risk Management Rulebook, the Market Conduct Rulebook and the activity-specific rulebooks. Our UAE VASP licensing team handles the application and those parts.

Required topics include information security, data classification, access control, systems and network security with code and smart contract validation and audit, development and quality assurance, physical security, vendor management, incident response with root cause analysis, escalation for ransomware attacks, and sharing threat intelligence.

Client transaction controls

The policy sets out how the firm applies multi-factor authentication, or a stronger standard, to transactions above client limits and to transactions after a change of client details such as a wallet address, plus session controls: failed password attempts, time-outs and password validity.

We write the policy from your architecture so every clause can be shown in a configuration.

The CISO must be of good standing and appropriately experienced. Senior management regularly reviews the effectiveness of processes and controls and allocates roles to prevent conflicts of interest. All staff must stay aware of current cyber risks, including those specific to virtual assets.

Keys and seed phrases

• backups of keys and seed phrases are stored apart from the primary ones;
• every change of access to keys is logged;
• when staff with key access leave, the firm assesses whether a new key must be generated;
• internal audits of access removal run quarterly (rule I.D.2(d)(ii)).

We review how this works in your firm today and document onboarding, offboarding and the granting and revoking of roles in the key management system.

Where relevant to the business, the scope includes smart contract audits. Evidence of tests and audits is documented and made immediately available to VARA on request (rule I.E.3). Independent auditors also review management processes and regulatory compliance on a regular basis (I.E.4), and VARA can require advanced testing in the form of TLPT (I.E.5).

Our role

An independent party runs the test and the audit, and one can be arranged on request. We prepare the firm: system descriptions and scope, fixes to known weaknesses before testing, taking the findings into the plan, and a re-check of what was closed.

For an incident affecting personal data, the VASP notifies VARA within 24 hours of notifying a data regulator or a data subject (rule II.C.2). The BCDR plan addresses issues specific to virtual assets: network malfunction, loss or corruption of data, key storage.

How we work

1. A paid 30-minute consultation and a scope letter: systems, dates, fixed price.
2. Review against Parts I to III of the rulebook; a person checks every finding.
3. Policy, procedures and BCDR plan built on your systems.
4. Remediation by us or with your team, then a re-check.
5. An evidence folder for VARA mapped to the rules.