Fit & Proper Requirements Under VARA: A Practical Guide for VASPs
Every individual who sits on the Board, occupies a Senior Management position, or acts as a Responsible Individual within a Virtual Asset Service Provider ("VASP") licensed by Dubai's Virtual Assets Regulatory Authority ("VARA") must be assessed as a "Fit and Proper Person." This isn't just a formal checklist. It is one of the areas where VARA's Licensing and Supervision teams apply the closest scrutiny, and - based on our firm's experience supporting applicants through the process - it is also where avoidable delays most commonly occur.
This guide walks through the Fit and Proper (F&P) framework set out in Part III of VARA's Company Rulebook, the documentation Virtual Assets Regulatory Authority [VARA] expects, and the practical mistakes we see repeatedly in real applications.
1. The Five Pillars of a "Fit and Proper" Person
Rule III.A.1 of the Company Rulebook sets out the core test. A Fit and Proper Person must:
(a) Hold the necessary academic qualifications and relevant professional or industry knowledge appropriate to the role;
(b) Be honest, reputable, and demonstrate integrity, upholding the ethical standards expected of the position;
(c) Possess adequate relevant experience in the virtual asset sector or a comparable sector, including management experience where relevant;
(d) Understand the regulatory framework governing the role and the market; and
(e) Be financially sound.
Two details in this rule are easy to overlook. First, Rule III.A.4 shows that Virtual Assets Regulatory Authority [VARA] doesn’t just check boxes. Instead, it evaluates a person's full background-including any other businesses they run-alongside the company's license conditions and business model. Second, Rule III.G confirms that being "fit and proper" is an ongoing requirement, not a one-time test. VARA can demand a status review at any time and has the power to order extra oversight or remove someone from their role.
2. The Most Common Mistakes in the F&P Assessment Process
The Fit and Proper assessment isn't just about filling out a form. It is a thorough evaluation where VARA scrutinizes every key individual in your firm. The documentation you provide serves as the direct evidence VARA uses to make its decision.
In our experience, most delays have nothing to do with whether the individual is truly fit for the role. They are the result of easily preventable errors in how the application is prepared and submitted.
2.1 Incomplete Document Uploads
One of the most frequent - and most easily avoided - failures is an incomplete document package. Within the F&P assessment workflow, an applicant must upload, for each individual, a complete set: the Fit and Proper form, a passport copy, a full CV, and an Emirates ID (where applicable) - and all of these must be in PDF format. Too often, teams focus intensively on the content of the F&P form itself and forget that VARA treats this as a single, integrated document package per person. Missing one element causes the entire submission for that person to be sent back for resubmission.
All supporting documents for an individual should be uploaded together in a single folder through VARA's portal. Reviewers evaluate applications folder by folder, so uploading documents separately in different places often triggers "please resubmit" requests that delay the process by weeks.
2.2 Undisclosed Roles at Other VARA-Regulated Entities
When completing the employment history section of the F&P form, applicants frequently overlook consulting engagements, advisory positions, or directorships at other VARA-licensed entities. Rule III.A.4.a.vi explicitly directs VARA to consider "the state of affairs of any other business" with which the individual is involved, and any position - whether as employee, consultant, director, or otherwise - must be disclosed. This is not a discretionary judgment call.
Where a form states that a role began on a certain date while the CV skips the position entirely, or where an organisational chart lists a different job title than the one declared, VARA will issue a direct query. Even where the underlying facts are entirely legitimate, these inconsistencies read as incomplete disclosure and trigger a clarification cycle.
2.3 Internal Inconsistencies
Your 10-year employment history-including full-time jobs, part-time work, consultancy roles, and directorships-must match perfectly across every document you submit. That means your Fit and Proper form, CV, org chart, and service agreements must align down to the details. In our experience, simple contradictions between these files cause far more VARA follow-up queries than the actual work history itself.
Simple clerical errors-a wrong birthdate, a blank field instead of "N/A," or an unclear address-cause unnecessary delays. While minor mistakes won't disqualify an applicant, each one forces another review cycle and drags out the entire approval process.
3. Consequences of Non-Disclosure vs. Full Disclosure
Rule III.F sets out how VARA assesses honesty, integrity and reputation. Among the factors considered is whether the individual "has been candid and truthful in all dealings with any regulatory body" and demonstrates a genuine willingness to comply with regulatory standards (Rule III.F.1(j)). This is precisely why voluntary disclosure matters more than the underlying issue itself in most cases.
Our consistent recommendation to clients: disclose everything completely, even if a detail seems minor or unfavorable. VARA evaluates candid applicants far differently than those who try to hide past issues. Being open leads to a fair review on the facts; hiding information turns a minor issue into a question about your honesty-a much harder problem to fix. If you have past regulatory findings, disciplinary history, or overlapping roles, address them upfront rather than waiting for VARA to discover them.
4. Criminal Records and Financial Status: Not Mere Checkboxes
Treat the criminal record and financial status sections with extreme care. Rushing through them with a quick "No" is a major mistake. VARA runs independent background checks to verify your answers. If they spot a discrepancy-even an honest mistake caused by misunderstanding a question-it can derail your entire application.
A past criminal record or financial issue does not mean automatic rejection. Under Rule III.F.2, VARA evaluates criminal offences based on severity, relevance to the role, time passed, and evidence of rehabilitation. The same applies to financial history under Rules III.E and III.F.1(g): past bankruptcies, unpaid court judgments, or debt settlements over AED 50,000 are evaluated in context rather than treated as instant dealbreakers.
Beyond these individual-level checks, VARA also sets structural requirements for specific roles - minimum experience, residency, and which functions the business is permitted to outsource.
5. Role-Specific Requirements, Outsourcing and Role Combination
Beyond the general Fit and Proper test, specific roles carry distinct structural requirements.
Even if outsourcing is allowed, VARA can still require you to bring key functions in-house if they feel your business complexity or risk profile demands it.
A frequent source of uncertainty for applicants is understanding which roles can be combined in one individual and which require a dedicated person. Combining functions is common in earlier-stage VASPs, and VARA's framework permits this within limits. The Compliance Officer may hold other non-client-facing responsibilities provided no conflict of interest arises, and combining the CO and MLRO roles in a single person is well-established practice. Head of Risk can similarly be combined with other functions, subject to the same conflict assessment.
What is not permitted is combining roles that create genuinely conflicting duties. For example, functions with inherent oversight tension over one another - and VARA may require separation as a VASP's business grows in complexity. Where an individual holds roles across more than one VASP, expect VARA to scrutinise the arrangement and potentially require formal information barriers between the entities.
Pulling the framework, documentation, disclosure, and structural rules together, here is what consistently separates a smooth application from a delayed one.
6. Practical Tips for a Smoother Application
Final Thought
Most Fit and Proper delays we see are not caused by genuine fitness issues - they are caused by documentation that does not tell a single, consistent story about who someone is and what they have done. Getting the narrative straight across every document, and disclosing fully rather than selectively, remains the most effective way to move an application through VARA's review without unnecessary friction.
This guide walks through the Fit and Proper (F&P) framework set out in Part III of VARA's Company Rulebook, the documentation Virtual Assets Regulatory Authority [VARA] expects, and the practical mistakes we see repeatedly in real applications.
1. The Five Pillars of a "Fit and Proper" Person
Rule III.A.1 of the Company Rulebook sets out the core test. A Fit and Proper Person must:
(a) Hold the necessary academic qualifications and relevant professional or industry knowledge appropriate to the role;
(b) Be honest, reputable, and demonstrate integrity, upholding the ethical standards expected of the position;
(c) Possess adequate relevant experience in the virtual asset sector or a comparable sector, including management experience where relevant;
(d) Understand the regulatory framework governing the role and the market; and
(e) Be financially sound.
Two details in this rule are easy to overlook. First, Rule III.A.4 shows that Virtual Assets Regulatory Authority [VARA] doesn’t just check boxes. Instead, it evaluates a person's full background-including any other businesses they run-alongside the company's license conditions and business model. Second, Rule III.G confirms that being "fit and proper" is an ongoing requirement, not a one-time test. VARA can demand a status review at any time and has the power to order extra oversight or remove someone from their role.
2. The Most Common Mistakes in the F&P Assessment Process
The Fit and Proper assessment isn't just about filling out a form. It is a thorough evaluation where VARA scrutinizes every key individual in your firm. The documentation you provide serves as the direct evidence VARA uses to make its decision.
In our experience, most delays have nothing to do with whether the individual is truly fit for the role. They are the result of easily preventable errors in how the application is prepared and submitted.
2.1 Incomplete Document Uploads
One of the most frequent - and most easily avoided - failures is an incomplete document package. Within the F&P assessment workflow, an applicant must upload, for each individual, a complete set: the Fit and Proper form, a passport copy, a full CV, and an Emirates ID (where applicable) - and all of these must be in PDF format. Too often, teams focus intensively on the content of the F&P form itself and forget that VARA treats this as a single, integrated document package per person. Missing one element causes the entire submission for that person to be sent back for resubmission.
All supporting documents for an individual should be uploaded together in a single folder through VARA's portal. Reviewers evaluate applications folder by folder, so uploading documents separately in different places often triggers "please resubmit" requests that delay the process by weeks.
2.2 Undisclosed Roles at Other VARA-Regulated Entities
When completing the employment history section of the F&P form, applicants frequently overlook consulting engagements, advisory positions, or directorships at other VARA-licensed entities. Rule III.A.4.a.vi explicitly directs VARA to consider "the state of affairs of any other business" with which the individual is involved, and any position - whether as employee, consultant, director, or otherwise - must be disclosed. This is not a discretionary judgment call.
Where a form states that a role began on a certain date while the CV skips the position entirely, or where an organisational chart lists a different job title than the one declared, VARA will issue a direct query. Even where the underlying facts are entirely legitimate, these inconsistencies read as incomplete disclosure and trigger a clarification cycle.
2.3 Internal Inconsistencies
Your 10-year employment history-including full-time jobs, part-time work, consultancy roles, and directorships-must match perfectly across every document you submit. That means your Fit and Proper form, CV, org chart, and service agreements must align down to the details. In our experience, simple contradictions between these files cause far more VARA follow-up queries than the actual work history itself.
Simple clerical errors-a wrong birthdate, a blank field instead of "N/A," or an unclear address-cause unnecessary delays. While minor mistakes won't disqualify an applicant, each one forces another review cycle and drags out the entire approval process.
3. Consequences of Non-Disclosure vs. Full Disclosure
Rule III.F sets out how VARA assesses honesty, integrity and reputation. Among the factors considered is whether the individual "has been candid and truthful in all dealings with any regulatory body" and demonstrates a genuine willingness to comply with regulatory standards (Rule III.F.1(j)). This is precisely why voluntary disclosure matters more than the underlying issue itself in most cases.
Our consistent recommendation to clients: disclose everything completely, even if a detail seems minor or unfavorable. VARA evaluates candid applicants far differently than those who try to hide past issues. Being open leads to a fair review on the facts; hiding information turns a minor issue into a question about your honesty-a much harder problem to fix. If you have past regulatory findings, disciplinary history, or overlapping roles, address them upfront rather than waiting for VARA to discover them.
4. Criminal Records and Financial Status: Not Mere Checkboxes
Treat the criminal record and financial status sections with extreme care. Rushing through them with a quick "No" is a major mistake. VARA runs independent background checks to verify your answers. If they spot a discrepancy-even an honest mistake caused by misunderstanding a question-it can derail your entire application.
A past criminal record or financial issue does not mean automatic rejection. Under Rule III.F.2, VARA evaluates criminal offences based on severity, relevance to the role, time passed, and evidence of rehabilitation. The same applies to financial history under Rules III.E and III.F.1(g): past bankruptcies, unpaid court judgments, or debt settlements over AED 50,000 are evaluated in context rather than treated as instant dealbreakers.
Beyond these individual-level checks, VARA also sets structural requirements for specific roles - minimum experience, residency, and which functions the business is permitted to outsource.
5. Role-Specific Requirements, Outsourcing and Role Combination
Beyond the general Fit and Proper test, specific roles carry distinct structural requirements.
- The Compliance Officer (CO) must have a minimum of five years of relevant compliance experience, ideally directly related to virtual asset activities. The CO must be a full-time employee and a UAE resident. This function cannot be outsourced.
- The MLRO must have at least two years of AML/CFT-specific experience and must be a UAE resident. While outsourcing is technically permitted under Part IV of the Company Rulebook, VARA strongly encourages an in-house arrangement and may require it depending on the VASP's risk profile.
- Responsible Individuals (RIs) are assessed under the general Fit and Proper test with no fixed experience threshold. They must be full-time employees and UAE residents, and their status must be revalidated annually. This function cannot be outsourced.
- The CEO / CCO is assessed under the general Fit and Proper test and must be a full-time employee and UAE resident. This function cannot be outsourced.
- The CISO / Data Protection Officer is assessed under the general Fit and Proper test. This function may be outsourced, subject to Part IV due diligence, governance, and agreement requirements.
Even if outsourcing is allowed, VARA can still require you to bring key functions in-house if they feel your business complexity or risk profile demands it.
A frequent source of uncertainty for applicants is understanding which roles can be combined in one individual and which require a dedicated person. Combining functions is common in earlier-stage VASPs, and VARA's framework permits this within limits. The Compliance Officer may hold other non-client-facing responsibilities provided no conflict of interest arises, and combining the CO and MLRO roles in a single person is well-established practice. Head of Risk can similarly be combined with other functions, subject to the same conflict assessment.
What is not permitted is combining roles that create genuinely conflicting duties. For example, functions with inherent oversight tension over one another - and VARA may require separation as a VASP's business grows in complexity. Where an individual holds roles across more than one VASP, expect VARA to scrutinise the arrangement and potentially require formal information barriers between the entities.
Pulling the framework, documentation, disclosure, and structural rules together, here is what consistently separates a smooth application from a delayed one.
6. Practical Tips for a Smoother Application
- Prepare early and organise by individual. Put each individual's complete set of documents into a single folder before uploading, rather than submitting them piece by piece.
- Cross-check every document against every other document. Dates, titles, and employment history should match exactly across the Fit and Proper form, CV, organisational chart, and any underlying agreements - this is the single most common source of avoidable queries.
- Treat "n/a" as mandatory, not optional, for any field that genuinely does not apply - an unanswered field reads as an incomplete submission.
- Verify that candidates meet the experience requirements before submitting their profiles. Be ready to prove how their past work directly applies to crypto and virtual assets.
- Document your conflict-of-interest analysis in writing wherever roles are combined, so it is available if VARA asks.
- Disclose concurrent or prior roles at other VARA-regulated entities as a matter of course - err on the side of over-disclosure.
- Build in ongoing compliance, not just a one-time push: annual Fit and Proper revalidation, and notify VARA immediately if any change in an individual's background could affect their status.
Final Thought
Most Fit and Proper delays we see are not caused by genuine fitness issues - they are caused by documentation that does not tell a single, consistent story about who someone is and what they have done. Getting the narrative straight across every document, and disclosing fully rather than selectively, remains the most effective way to move an application through VARA's review without unnecessary friction.