UAE compliance guide
VARA KYC and AML requirements for virtual asset firms
What Dubai's Virtual Assets Regulatory Authority expects from licensed VASPs on customer due diligence, transaction monitoring, the Travel Rule and record keeping.
Short answer
VARA, Dubai's Virtual Assets Regulatory Authority, requires licensed virtual asset service providers to perform customer due diligence before onboarding, monitor transactions and wallet exposure, apply the Travel Rule to transfers, and keep auditable records. Its rulebooks set the detailed obligations.
Last reviewed by the ITSEC compliance team. General information, not legal advice.
Who does VARA regulate?
Virtual asset service providers operating in or from Dubai, excluding the DIFC, which is supervised by the DFSA.
What does VARA expect for KYC?
Identity verification, sanctions and PEP screening, a customer risk assessment and enhanced due diligence where risk is higher, all documented and available for inspection.
Does VARA require transaction monitoring?
Yes. VASPs are expected to monitor transactions and blockchain exposure after onboarding, so onboarding checks are paired with ongoing KYT.
Frequently asked questions
- Does the Travel Rule apply to VARA-licensed firms?
- Yes. Originator and beneficiary information must accompany qualifying virtual asset transfers. In the UAE the threshold is AED 3,500.
- Is VARA the same as the DFSA?
- No. VARA covers Dubai outside the DIFC. Virtual asset firms inside the DIFC are regulated by the DFSA.
Official sources
See VerifiX on your own onboarding flow
A 30-minute walkthrough with a compliance engineer, or a request for sandbox access.