Dubai’s 2026 VARA changes: what they mean for AML
VARA spent 2026 turning AML expectations into evidence requirements. For Dubai VASPs, the question is no longer whether a control exists. It is whether you can prove why it fired.
The short version
In under twelve months, Dubai's Virtual Assets Regulatory Authority (VARA) issued a run of circulars, a new exchange rulebook and fresh AML guidance. Read one at a time, each looks incremental. Read together, they say one thing: supervisors want controls that are risk-based, data-driven and documented end to end.
Here is what changed, and what it means for the MLRO who has to answer for it.
1. The federal baseline moved, and VARA made firms close the gap
The UAE's Federal Decree-Law No. (10) of 2025 put VASPs on the same AML footing as banks. VARA followed in November 2025 with a mandatory, clause-by-clause gap assessment: a board-approved remediation plan within 60 days, and all gaps closed within 120.
The practical consequences for VASPs:
- Due diligence starts low. Occasional transactions of AED 3,500 or more, single or linked, trigger CDD. That is far below the AED 55,000 line for traditional financial institutions.
- Reporting is immediate. Suspicious transactions go to the FIU through goAML without delay, whatever the value. VARA expects FIU and VARA requests answered within 48 hours.
- Sanctions are measured in hours. A confirmed match is frozen within 24 hours of a listing and reported to the EOCN as a Confirmed Name Match Report within five business days.
- Records last eight years in Dubai, against five under federal law.
Avus view: a 120-day remediation window does not leave room for stitching evidence together by hand. If your screening, case notes and filings live in different tools, the gap assessment will surface that first.
2. The Travel Rule circular: counterparties are now your risk
VARA's 24 February 2026 circular told VASPs to update their transfer and counterparty controls under the UAE Virtual Assets Travel Rule, and to expect inspections and thematic reviews.
The national rule is stricter than many firms assume:
- Originator and beneficiary data must travel with every transfer.
- From a daily aggregate of AED 3,500, the beneficiary's VASP must verify the beneficiary's identity. Aggregation is the detail that breaks simple per-transaction thresholds.
- A VASP must not send to a counterparty VASP that is not appropriately regulated where it is incorporated and located.
- Transfers to or from unhosted wallets require enhanced due diligence first, including source-of-funds checks.
- Privacy tokens cannot be transferred at all.
What this means in AML terms: counterparty due diligence is now a transaction-time control, not an onboarding formality. Every inbound transfer that arrives without complete data needs a documented decision: reject, permit, delay or return. And the reason for that decision needs to be on file when the inspector asks.
3. Business risk assessments: quarterly, quantitative, board-owned
VARA had already warned in 2024 and 2025 that it found major weaknesses in VASPs' business risk assessments (BRAs). After a 2026 thematic review, it published AML/CFT Business Risk Assessment Guidance on 12 June 2026.
The guidance sets a higher bar:
- Board ownership. Formal approval, documented challenge of the conclusions, and independent validation of the methodology.
- Quantitative methods. Risk scoring built on operational data, not narrative.
- Data integration. Strong BRAs pull in cross-border transfer data, including Travel Rule data fed into sanctions screening and counterparty exposure to high-risk jurisdictions.
- Proliferation financing as its own risk. PF must be assessed separately from money laundering and terrorist financing.
- Cadence. Reviews at least every three months, and whenever something material changes.
The PF point is not academic. The UAE's 2026 Proliferation Financing National Risk Assessment, circulated by VARA on 1 June 2026, identifies VASPs as the sector with the highest PF exposure in the country, citing the speed and pseudo-anonymity of transfers and state-sponsored hacking.
Avus view: a quarterly, data-driven BRA is only practical if the data is already structured. When monitoring rules, alert volumes, counterparty exposure and Travel Rule gaps all sit in one workflow, the BRA becomes a report you run, not a project you staff.
4. Derivatives arrive, and bring new typologies
On 31 March 2026, VARA published Version 2.1 of its Exchange Services Rulebook, effective immediately. It introduced a dedicated framework for exchange-traded virtual asset derivatives: futures, options and perpetuals.
The headline items are prudential. Retail leverage is capped at 5:1 through a 20% minimum initial margin, ETD providers must hold an insurance fund, retail access depends on a suitability assessment, and VARA can intervene without prior notice during market stress.
The AML angle is easy to miss:
- New products, new risk assessment. Federal law requires firms to assess new products and technologies before launch. A derivatives book changes your BRA.
- Market abuse and layering. Margin movements, rapid position cycling and offsetting trades between related accounts are classic vehicles for value transfer. Monitoring scenarios built for spot trading will not catch them.
- Better client data. Mandatory client classification and suitability assessments give you richer CDD inputs. Use them in risk scoring rather than leaving them in a separate onboarding system.
5. Enforcement is now about AML programmes, not just licences
VARA's early enforcement focused on unlicensed activity and marketing. That is changing. In 2026, VARA fined CoinMENA for failures in its AML programme, and fined MEXC and KuCoin for serving Dubai customers without a licence, with MEXC also cited for onboarding users without required KYC.
VARA can also act directly against directors, responsible individuals, senior management and the MLRO.
What this means in AML terms: personal accountability is real. An MLRO needs to show not only that a decision was made, but who made it, on what evidence, and under which rule.
6. The direction of travel: evidence over assertion
VARA's autumn circulars point the same way. On 6 October 2026, it set minimum expectations for independent audits of reserve assets after reviewing every 2025 Proof of Reserve report. On 28 October 2026, it published good-practice observations on VASPs' public disclosures. Neither is an AML circular, but both reflect a supervisor that now reviews the evidence, thematically, across the whole market.
What Dubai VASPs should do now
- Re-run your federal-law gap assessment against what you actually do day to day, not what your policy says.
- Test Travel Rule aggregation. Confirm that verification triggers at AED 3,500 per day, not per transfer, and that missing-data decisions are logged with a reason.
- Make counterparty checks transaction-time. Screen counterparty VASPs for regulatory status and high-risk jurisdiction exposure before funds move.
- Split out proliferation financing in your BRA, with its own indicators and its own score.
- Extend monitoring to derivatives if you offer or plan to offer them.
- Put the trail first. Make sure every alert, escalation and goAML filing links back to the rule, the data and the person behind it.
How Avus helps
Avus is built for CASPs in the EU and the Emirate of Dubai. It screens every transfer with a deterministic engine, so every score names the rule that produced it. Case AI traces funds across hops and bridges and proposes a finding; a person confirms it. Escalations carry their trail from analyst to MLRO, and suspicious transaction reports draft from that trail and export to goAML with the evidence attached.
When VARA asks why, your answer is already assembled.
Book a demo and bring a real case.
This article is for general information and is not legal advice. VARA's rulebooks, circulars and the UAE federal texts are the authoritative sources.