Dubai’s VARA tightens expectations for crypto reserve audits

The Virtual Assets Regulatory Authority (VARA) has issued a circular (3 pages/209 KB PDF) setting out minimum expectations for reserve asset audit reports following a thematic review of all proof-of-reserve reports submitted during 2025. The regulator said the circular is intended to support a “consistent, robust, and sufficiently detailed approach” to assessing and verifying client asset safeguarding arrangements.

Existing VARA rulebooks already require VASPs to maintain at all times reserve assets equal to 100% of liabilities owed to clients, held on a one-to-one basis in the same virtual asset as the corresponding client liability, reconciled daily. The rules require an audit by an independent third-party auditor.

The circular sets out the minimum requirements for this audit. Auditors should confirm that reserve assets remained at or above 100% of aggregate client liabilities throughout the review period and were held in the same type of virtual asset as the underlying liability, without substitution by another asset or equivalent value.

VARA has also clarified that audits should extend beyond a firm’s directly controlled wallets. Audit scope should cover all wallets used to hold client virtual assets, including hot, warm and cold wallets, assets held through wallet infrastructure providers, and assets held with third-party custodians.

Marie Chowdhry, UAE-based expert in financial regulation and fintech at Pinsent Masons, said: “The practical question for VASPs is whether the audit they have already commissioned meets what VARA now expects. Audit scope has to extend to every wallet holding client assets, and for each one, the auditor has to describe the custody arrangement and say whether the firm maintained control over such wallets.”

“Firms are better off resolving these requirements with their auditor before the next engagement rather than discovering scope gaps when the report arrives,” she said.

Auditors are also expected to assess whether client assets have been segregated from the VASP’s proprietary or operational assets and identify any instances of commingling. They should also confirm whether the VASP maintained control over all wallets used to hold client assets and describe the custody arrangements applicable to each wallet.

The circular further expects auditors to confirm that reserve assets were reconciled against client liabilities on a daily basis and that appropriate evidence was obtained and reviewed to verify the effectiveness of reconciliation processes. Reports should also disclose any rehypothecation, lending, pledging or other use of client assets during the review period, including details of the arrangements and assets affected.

VARA has set out detailed expectations for the reporting of audit findings. In line with international market practice, for each area reviewed, auditors are expected to explain the procedures performed, evidence obtained, sampling methodology used, reliance placed on third parties and any scope limitations encountered.

Audit reports should reach a clear conclusion on each element of the minimum scope and clearly distinguish between compliant outcomes, identified exceptions, limitations in scope and matters that could not be independently verified. The regulator also said management representations alone will not be regarded as sufficient audit evidence where independent evidence is reasonably available.

Jessa White, UAE-based financial regulation and digital asset specialist at Pinsent Masons, said: “VARA has also said expressly that appointing an external auditor does not transfer or reduce the responsibility of the VASP, its board, its senior executive officer or its control functions.”