Dubai’s VARA finds gaps in virtual assets firms' public disclosures

The findings were published as part of a circular (6 pages / 219KB PDF) issued by the VARA following a thematic review of VASPs’ public disclosure practices.

The review examined VASPs’ compliance with the public disclosure requirements set out in VARA’s regulations and rulebooks and found disclosures that were "incomplete, insufficiently specific, difficult to locate, inconsistent with the VASP's operating model, or not updated".

VARA also identified cases where information required for each virtual asset offered by the VASP was absent, provided only for selected virtual assets, was difficult to locate, or was presented through generic asset information that did not clearly address each prescribed metric. In some cases, VASPs relied on links to third-party sources, including data provider such as CoinMarketCap, instead of directly disclosing the required information in an accessible and complete manner.

There were also cases where pricing disclosures were found to be “high-level” or “generic” and failed to provide sufficient information to help clients understand the rationale behind quoted prices. The regulator added that statements that prices are based on “market conditions”, “market prices” or “liquidity providers”, without additional context or explanation “may provide limited meaningful information regarding the VASP's pricing methodology.”

VARA also identified instances where VASPs described their execution arrangements only in general terms, without clearly explaining their order-routing practices or demonstrating that they had assessed whether any single liquidity source accounted for 20% or more of client orders routed by the VASP.

VARA also highlighted instances where disclosures failed to clearly identify all relevant third parties, solely focused on arrangements involving client assets, or where they listed service providers “without providing sufficient context to understand the capacity in which the third party was engaged.”

The review concluded that some firms treated disclosure as a "licensing deliverable, rather than as a continuing regulatory obligation requiring governance, monitoring and periodic testing".

Drawing on these findings, the circular outlines examples of good practice on governance, pricing methodology, order routing, asset information, client asset protection and third-party arrangements. 

Although the circular does not change any rules or impose any additional obligations on VASPs, Marie Chowdhry, UAE-based expert in financial regulation and fintech at Pinsent Masons, said these examples of good practice should act as an important wake-up call for VARA-licensed VASPs and their compliance functions. “Public disclosures sit on the VASP's own website, meaning VARA can review them directly without first requesting information from the firm,” she said. “These findings provide a useful checklist for VASPs. Describing pricing simply by reference to ‘market conditions’ or ‘liquidity providers’ is not enough. Where no single liquidity source accounts for 20% or more of routed client orders, the VASP should say so expressly. Similarly, linking to third-party sources such as CoinMarketCap does not satisfy the asset information requirements.”

Although Part V of the Market Conduct Rulebook and the activity-specific rulebooks already require public disclosure information to be published and kept accurate at all times, Abhay Raj of Pinsent Masons said there were several proactive steps that providers could take to ensure and maintain compliance. “Test the live website against Part V of the Market Conduct Rulebook and then against each activity-specific rulebook”. “Build a register mapping every requirement to the page that satisfies it, with an owner, the source rule and a last-tested date. Bring disclosures into compliance monitoring and testing”, he added.