VARA Guide
VARA Supervision After Licensing: What VASPs Need to Be Ready For
Getting a Virtual Assets Regulatory Authority (“VARA”) licence is a major milestone for any virtual asset business in Dubai. But it is not the end of the regulatory process. Once a VASP is licensed, the relationship with the VARA continues through ongoing supervision, regulatory reporting, requests for information, compliance monitoring and, where necessary, formal examinations.
VARA has broad powers to examine licensed entities when it considers an examination necessary or appropriate. A VASP must cooperate and provide access to the books, records, accounts, documents, data and other information relevant to the examination.
VARA has broad powers to examine licensed entities when it considers an examination necessary or appropriate. A VASP must cooperate and provide access to the books, records, accounts, documents, data and other information relevant to the examination.
What Is a VARA Supervisory Examination?
A supervisory examination is a regulatory review of how a licensed VASP actually operates and complies with its obligations. It is not a repeat of the initial application process but neither is it an isolated audit. It is a comprehensive assessment of your live operational environment. It tests whether your governance, risk controls, custody setup, and market conduct hold up in daily practice.
The exact scope depends on the business, its licensed activities, its risk profile and the matters VARA considers relevant. VARA does not assess compliance independently of the business model.
When Can VARA Conduct an Examination?
There is no rule that limits VARA examinations to a fixed annual schedule. The structure of VARA enables it to conduct examinations on an entity whenever it finds them necessary. This means that a VASP should distinguish between two different concepts:
Routine supervision: This can involve ongoing interaction, information requests, regulatory submissions, notifications, reviews and other supervisory activity. It does not necessarily mean that VARA has identified a serious problem.
Formal examination or investigation: This is a deeper review of the business, controls, records or a particular issue. It can be broader and may involve requests for large volumes of documentation, interviews with management and compliance staff, testing of controls and detailed follow-up questions.
The Four Compulsory Rulebooks
Every licensed VASP stays subject to four compulsory rulebooks for as long as the licence is held, plus whichever activity-specific rulebook covers what the licence actually permits:
What Examination Actually Tests?
An examination doesn't test one of these. It tests whether the business actually operates in full alignment with all four rulebooks combined. In practice, this means:
This deserves particular attention. A business can change significantly after obtaining its licence. The regulatory question is whether that change falls within VARA's requirements for a Material Change or involves a change to the VASP's authorised activities, both of which may require VARA's prior written approval.
This requirement is triggered when a VASP alters its:
Business Model & Services: Adding/modifying VA activities, launching material new products, or entering new business lines.
Corporate & Governance: Changing ownership, control structures, or key organisational setups.
Operations & Controls: Updating risk management, internal controls, or contingency plans.
Not every operational change will be classed as a Material Change. For example, replacing an existing service provider with another provider offering equivalent services is generally not a Material Change.
The key point is that management needs a process for identifying changes that may trigger a regulatory requirement before the change is implemented. A VASP should not rely on the assumption that a change is "operational" simply because it appears minor from a commercial perspective.
Supervisory Timelines: When Should You Expect VARA?
In practice, a newly licensed VASP should expect regulatory engagement relatively early after starting operations. However, there is no fixed VARA rule requiring a first supervisory examination within six or twelve months, and there is no mandatory annual examination cycle. Instead, VARA's framework provides for continuous, risk-based supervision.
This does not mean that a licensed VASP can expect long periods without regulatory interaction. The timing can therefore depend on the nature and scale of the business, its licensed activities, risk profile, compliance history and other supervisory considerations. VARA requires regular regulatory reporting, including:
What Happens If VARA Finds a Problem?
An examination does not automatically mean that a licence will be suspended or revoked. The outcome depends on the nature and seriousness of the findings. A supervisory review may result in:
The practical objective for a VASP should therefore not be to "pass an inspection". It should be to identify weaknesses early and remediate them before they become regulatory issues.
A VARA licence is not the end of the regulatory process. Your compliance framework needs to work long after the licence is issued. If you are preparing for a VARA supervisory review or want to understand whether your current framework would withstand regulatory scrutiny, contact AML Zone to discuss your situation.
A supervisory examination is a regulatory review of how a licensed VASP actually operates and complies with its obligations. It is not a repeat of the initial application process but neither is it an isolated audit. It is a comprehensive assessment of your live operational environment. It tests whether your governance, risk controls, custody setup, and market conduct hold up in daily practice.
The exact scope depends on the business, its licensed activities, its risk profile and the matters VARA considers relevant. VARA does not assess compliance independently of the business model.
When Can VARA Conduct an Examination?
There is no rule that limits VARA examinations to a fixed annual schedule. The structure of VARA enables it to conduct examinations on an entity whenever it finds them necessary. This means that a VASP should distinguish between two different concepts:
Routine supervision: This can involve ongoing interaction, information requests, regulatory submissions, notifications, reviews and other supervisory activity. It does not necessarily mean that VARA has identified a serious problem.
Formal examination or investigation: This is a deeper review of the business, controls, records or a particular issue. It can be broader and may involve requests for large volumes of documentation, interviews with management and compliance staff, testing of controls and detailed follow-up questions.
The Four Compulsory Rulebooks
Every licensed VASP stays subject to four compulsory rulebooks for as long as the licence is held, plus whichever activity-specific rulebook covers what the licence actually permits:
- Company Rulebook - Board oversight, ongoing Fit & Proper status of key individuals, capital adequacy, and wind-down planning.
- Compliance and Risk Management Rulebook - AML/CFT controls, transaction monitoring, client asset protection and segregation, and Travel Rule compliance.
- Technology and Information Rulebook - Cybersecurity, wallet management (hot/cold storage protocols), penetration testing, and disaster recovery.
- Market Conduct Rulebook - Transparent client disclosures, execution fairness, market manipulation controls, and complaints handling.
What Examination Actually Tests?
An examination doesn't test one of these. It tests whether the business actually operates in full alignment with all four rulebooks combined. In practice, this means:
- Whether board members and Responsible Individuals still meet the standard assessed at licensing.
- Whether monitoring rules match current business volume, and whether flagged accounts are being watched.
- Whether STRs are filed through goAML, not logged internally.
- Whether daily reconciliation records exist and discrepancies were escalated on time.
- Whether the tech environment on file matches what is actually running.
- Whether records are retained for the required period and can be produced on request.
- Whether material changes were notified to VARA before implementation.
This deserves particular attention. A business can change significantly after obtaining its licence. The regulatory question is whether that change falls within VARA's requirements for a Material Change or involves a change to the VASP's authorised activities, both of which may require VARA's prior written approval.
This requirement is triggered when a VASP alters its:
Business Model & Services: Adding/modifying VA activities, launching material new products, or entering new business lines.
Corporate & Governance: Changing ownership, control structures, or key organisational setups.
Operations & Controls: Updating risk management, internal controls, or contingency plans.
Not every operational change will be classed as a Material Change. For example, replacing an existing service provider with another provider offering equivalent services is generally not a Material Change.
The key point is that management needs a process for identifying changes that may trigger a regulatory requirement before the change is implemented. A VASP should not rely on the assumption that a change is "operational" simply because it appears minor from a commercial perspective.
Supervisory Timelines: When Should You Expect VARA?
In practice, a newly licensed VASP should expect regulatory engagement relatively early after starting operations. However, there is no fixed VARA rule requiring a first supervisory examination within six or twelve months, and there is no mandatory annual examination cycle. Instead, VARA's framework provides for continuous, risk-based supervision.
This does not mean that a licensed VASP can expect long periods without regulatory interaction. The timing can therefore depend on the nature and scale of the business, its licensed activities, risk profile, compliance history and other supervisory considerations. VARA requires regular regulatory reporting, including:
- Monthly reporting: financial information, VA wallet addresses and certain group and related-party transaction information;
- Quarterly reporting: Board and committee minutes, financial compliance information, financial projections and strategic plans, and risk exposure reporting;
- Annual reporting: audited financial statements, independent auditor reporting on internal controls, senior management's compliance assessment and other required information.
What Happens If VARA Finds a Problem?
An examination does not automatically mean that a licence will be suspended or revoked. The outcome depends on the nature and seriousness of the findings. A supervisory review may result in:
- Requests for clarification or additional documentation;
- Mandatory remediation requirements and enhanced supervisory monitoring;
- Directives to strengthen internal controls and perform follow-up testing;
- Formal enforcement actions, fines, or operational restrictions where appropriate.
The practical objective for a VASP should therefore not be to "pass an inspection". It should be to identify weaknesses early and remediate them before they become regulatory issues.
A VARA licence is not the end of the regulatory process. Your compliance framework needs to work long after the licence is issued. If you are preparing for a VARA supervisory review or want to understand whether your current framework would withstand regulatory scrutiny, contact AML Zone to discuss your situation.
