Dubai, UAE: Dubai’s Virtual Assets Regulatory Authority (VARA) has introduced clearer requirements for cryptocurrency reserve audits, reinforcing its commitment to protecting client assets and improving transparency across the emirate’s growing digital asset industry.
The regulatory update outlines the minimum standards independent auditors must follow when reviewing how virtual asset service providers (VASPs) manage, secure and account for customer holdings.
The guidance follows VARA’s review of proof-of-reserve audit reports submitted throughout 2025, which highlighted the need for greater consistency and more detailed verification procedures.
VARA Reinforces 100% Reserve Requirement for Crypto Firms
Under Dubai’s existing virtual asset regulations, licensed service providers must maintain reserve assets equivalent to at least 100% of their financial obligations to clients.
These reserves must be held on a one-to-one basis in the same cryptocurrency as the corresponding customer liability. Firms are also required to reconcile their reserve holdings against client balances every day.
VARA’s latest circular provides additional clarity on how independent third-party auditors should verify compliance with these obligations.
Auditors must establish whether firms maintained sufficient reserves throughout the entire assessment period, rather than confirming their financial position at a single point in time.
The regulator has also made clear that companies cannot substitute one cryptocurrency for another or use assets of equivalent monetary value to satisfy their reserve obligations.
Crypto Audits Must Cover All Wallets and Custody Arrangements
A major focus of the updated guidance is the requirement for comprehensive oversight of wallets used to store customer assets.
Independent audits must examine all relevant storage arrangements, including hot wallets, warm wallets and cold wallets.
The review must also include digital assets maintained through wallet infrastructure providers and external custodians, ensuring that customer funds remain within the scope of regulatory scrutiny regardless of where they are stored.
Marie Chowdhry, a UAE-based financial regulation and fintech expert at Pinsent Masons, highlighted the importance of ensuring that existing audit arrangements meet VARA’s expectations.
She explained that firms must work closely with their auditors to identify every wallet holding customer assets, document the applicable custody arrangements and establish whether the service provider retains control over those holdings.
Chowdhry also advised companies to address potential gaps in audit coverage before their next engagement rather than identifying deficiencies after the final report has been prepared.
Stronger Controls on Client Asset Segregation
VARA has placed additional emphasis on separating customer-owned cryptocurrencies from assets belonging to virtual asset service providers.
Auditors must determine whether client holdings have been kept distinct from funds used for a company’s business operations or proprietary activities.
Any instances of commingling, where customer assets are mixed with company-owned holdings, must be identified and documented.
The audit must also evaluate the degree of control maintained by the service provider over wallets containing customer assets, including those managed through third-party custody services.
These requirements are intended to strengthen accountability and help establish whether client assets are being safeguarded in accordance with Dubai’s regulatory framework.
Daily Reconciliation and Use of Customer Assets Face Greater Scrutiny
The updated guidance requires auditors to examine whether virtual asset service providers have consistently reconciled their reserves with customer liabilities on a daily basis.
Auditors must obtain appropriate supporting evidence and evaluate whether the reconciliation procedures operated effectively during the review period.
VARA has also strengthened disclosure expectations concerning the use of customer assets.
Audit reports must identify any arrangements involving the lending, pledging, rehypothecation or other use of client holdings.
Where such activities have occurred, auditors are expected to provide details of the relevant arrangements and specify which assets were affected.
This additional transparency is designed to provide a clearer picture of how customer holdings are managed and whether firms are meeting their safeguarding obligations.
Independent Audit Reports Must Provide Clear Evidence
Beyond verifying reserve balances, VARA is requiring greater detail in how auditors document their findings.
For every area examined, audit reports should explain the procedures performed, evidence reviewed and sampling methods used.
Auditors must also disclose any reliance on third-party information and highlight limitations that may have affected their ability to independently verify particular arrangements.
Reports are expected to distinguish clearly between areas where firms have demonstrated compliance, instances of non-compliance or exceptions, restrictions affecting the audit scope and matters that could not be independently confirmed.
Importantly, VARA has clarified that statements provided by company management cannot serve as sufficient audit evidence when independent supporting documentation is reasonably available.
The approach is intended to improve the reliability and comparability of reserve audits across Dubai’s regulated digital asset market.
Crypto Company Executives Remain Responsible for Compliance
VARA has further emphasized that appointing an independent auditor does not release cryptocurrency businesses or their leadership teams from regulatory responsibilities.
Jessa White, a UAE-based financial regulation and digital asset specialist at Pinsent Masons, explained that accountability continues to rest with the licensed service provider, its board of directors, senior executive officer and internal control functions.
External auditors are responsible for independently assessing and reporting on reserve arrangements, but the obligation to maintain appropriate safeguards remains with the regulated company.
The clarification reinforces the importance of effective corporate governance, internal oversight and ongoing compliance within Dubai’s virtual asset sector.
What VARA’s Updated Crypto Audit Rules Mean for Dubai
The latest guidance signals greater regulatory scrutiny of how cryptocurrency businesses safeguard customer funds and demonstrate financial accountability.
For licensed virtual asset service providers, the circular means reviewing existing audit arrangements, verifying wallet coverage, strengthening documentation and ensuring that independent auditors can access sufficient evidence.
For customers and investors, the regulatory clarification is intended to support greater transparency around the reserves backing digital asset holdings.
As Dubai continues developing its position as an international virtual asset hub, VARA’s strengthened audit expectations reflect a broader focus on investor protection, responsible market practices and regulatory oversight.
