Dubai’s Digital Property Regulatory Authority has issued new anti-money laundering steerage that pushes licensed crypto companies towards extra data-driven and ceaselessly up to date danger assessments.
The steerage, launched on June 12, requires digital asset service suppliers to combine FATF high-risk and increased-monitoring jurisdictions into their compliance processes. It additionally raises expectations round danger monitoring, senior administration oversight, AI-related dangers, anonymity-enhancing transactions, and proliferation financing.
The replace raises the compliance bar for one of many world’s most energetic crypto licensing hubs. NeosLegal estimates that greater than 100 VASPs maintain permits or approvals throughout UAE regulators, together with VARA, ADGM, DFSA, CBUAE, and CMA.
For international exchanges and custodians working in Dubai, the message is evident: entry to the market now comes with heavier operational obligations.
VARA pushes crypto companies towards data-driven danger checks
VARA’s up to date framework requires licensed companies to maneuver past static compliance checklists and keep danger assessments that replicate present enterprise exercise.
Corporations should assess dangers tied to buyer profiles, transaction varieties, merchandise, companies, supply channels, and geographic publicity. Nations recognized by the Monetary Motion Activity Power as high-risk or topic to elevated monitoring have to be factored into these assessments promptly.
Threat assessments have to be reviewed no less than each three months, or sooner if a agency modifications its merchandise, companies, enterprise mannequin, possession, or company construction. That makes compliance an ongoing course of moderately than a periodic licensing train.
The steerage additionally requires companies to tell apart between cash laundering, terrorist financing, proliferation financing, and focused monetary sanctions dangers. They can’t deal with all monetary crime dangers as one broad class.
Senior managers, board members, and compliance officers are anticipated to know the agency’s residual danger score and the way it’s being managed. VARA additionally expects corporations to account for rising dangers linked to AI and machine studying, anonymity-enhancing transactions, and crowdfunding exercise.
Dubai’s crypto hub standing now comes with increased compliance prices
Dubai has positioned itself as a regulatory hub for international crypto companies, however the brand new steerage reveals that the regime is changing into extra demanding.
The VARA framework is carefully aligned with FATF requirements. Its rulebooks incorporate FATF suggestions as enforceable necessities, together with Journey Rule obligations, sanctions screening, buyer due diligence, and risk-based monitoring.
That provides international companies some benefit in the event that they already function below sturdy compliance regimes in jurisdictions such because the EU, Singapore, Switzerland, or the US. Lots of the core controls overlap.
Nonetheless, Dubai’s expectations go additional in some areas. Corporations are anticipated to keep up up to date sanctions monitoring, automated screening, wallet-address evaluation, distributed ledger analytics, and extra detailed geographic-risk controls.
This implies an organization with a primary compliance guide will battle. VARA expects companies to indicate that their danger fashions are supported by actual operational knowledge and may adapt because the enterprise modifications.
UAE enforcement makes the message tougher to disregard
The steerage comes as UAE regulators proceed tightening monetary crime supervision throughout the broader monetary sector.
Since early 2025, the UAE Central Financial institution has imposed greater than AED 370 million, or over $100 million, in AML and counter-terrorist financing penalties on monetary establishments, together with banks, change homes, insurers, and finance corporations.
Dubai regulators have additionally taken a stricter method to anonymity-related dangers, with privacy-enhancing belongings and transactions receiving nearer scrutiny due to their AML implications.
For crypto companies, the course of journey is evident. Dubai stays open to digital asset companies, however it’s not sufficient to acquire a licence and function with static controls. Corporations should hold proving that their danger programs match the dimensions, complexity, and publicity of their enterprise.