Dubai's Virtual Assets Regulatory Authority (VARA) sets its technology and information security requirements in the Technology and Information Rulebook, which "applies to all VASPs Licensed by VARA to carry out any VA Activity in the Emirate" (Introduction). "Emirate" is defined as all zones of Dubai "excluding the Dubai International Financial Centre" (Schedule 2).
This guide for IT and security teams at virtual asset service providers (VASPs) and applicants summarises the rulebook by theme, with references, practical steps and related Company and Custody Services Rulebook rules.
The key documents
- Technology and Information Rulebook. Current version dated 19 May 2025; VARA's rulebook site shows "Effective From: 19 June 2025" (earlier version: V.1, 7 February 2023). Covers technology governance and security (Part I), personal data (Part II), confidential information (Part III) and guidance (Schedule 1). Rulebook page.
- Company Rulebook. 19 May 2025, effective 19 June 2025. Part IV (Outsourcing Management) applies to outsourcing arrangements, including IT services. Rulebook page.
- Custody Services Rulebook. 19 May 2025, effective 19 June 2025. Part III.C (VA Wallet management) applies to VASPs licensed for Custody Services. Rulebook page.
Unless otherwise stated, the rulebook's requirements "are Rules and have binding effect" (Introduction). Schedule 1 is "provided by VARA as Guidance to VASPs" and says what VASPs "are expected to" do; this page labels it as guidance.
Governance and the information security function
What VARA says. VASPs must implement a "Technology Governance and Risk Assessment Framework" (Rule I.A.1) and review and test their controls "on a periodic basis" (Rule I.A.5). They must create a "Cybersecurity Policy" and "submit their Cybersecurity Policy to VARA for assessment as part of the licensing process" (Rule I.B.1); it must be "reviewed and updated at least annually by their CISO" (Rule I.B.2).
VASPs must appoint a Chief Information Security Officer (CISO). "The CISO must be a separate individual from the CO" (Compliance Officer), but may also act as Data Protection Officer (Rule I.I.1), and must be "of sufficiently good standing and appropriately experienced" (Rule I.I.2). All Staff must be "aware of the latest cybersecurity risks and developments" (Rule I.J.1).
What this means for your IT
- Map your Cybersecurity Policy against each item in Rule I.B.3, and record the annual CISO review.
- Keep the CISO and Compliance Officer roles with different people.
- Keep records of role-based security awareness training.
Risk assessment
What VARA says. The framework must be "comprehensive and proportionate to the nature, scale, and complexity of the risks" (Rule I.A.3) and use "defence-in-depth approaches for cybersecurity-related risks" (Rule I.A.2). It must address governance policies and system development controls, including back-up controls and availability testing (Rule I.A.4), and comply, where applicable, with Dubai Electronic Security Center standards, the UAE personal data law (Federal Decree-Law No. (45) of 2021) and the CBUAE Consumer Protection Regulation (Rule I.C.1).
Schedule 1 guidance expects a "formal risk assessment methodology" (A.1.b), "comprehensive asset inventories across all environments" and "network diagrams and data flow mappings" (A.4).
What this means for your IT
- Keep a current asset inventory, network diagram and data flow map.
- Use one documented risk methodology that links each risk to a control.
- Check which of the external laws in Rule I.C.1 apply to you, with your compliance team.
Access control and identity
What VARA says. Access to systems and data may only be granted to "individuals with a demonstrable business need", with safeguards for identification "including the maintenance of an access log" (Rule I.D.4). For clients, the Cybersecurity Policy must cover "the maximum incorrect attempts for entering a password, appropriate time-out controls and password validity periods" (Rule I.B.3.j). For client transactions above limits or after a change of details such as a wallet address, it must cover "considering multi-factor authentication or any better standard" (Rule I.B.3.i).
Schedule 1 guidance expects "multi-factor authentication for all access to systems with cryptographic keys" (B.9.a), "prohibition of instant messaging verification for high-risk operations" (D.1.b), and for developer workstations "prohibition of direct production access" (B.10.c). It also expects "minimum security requirements for personal devices used for work purposes" (A.3.e).
What this means for your IT
- Use MFA for staff and client access, and hardware-based authentication for key and signing systems.
- Review access regularly, keep the evidence and remove leavers promptly.
- Remove direct production access from developer machines.
Data protection, cryptography and key management
What VARA says. VASPs must comply with the UAE personal data law (PDPL) and any foreign data protection laws that apply (Rule II.A.1), including "where data may be stored or located and how such data is transferred" (Rule II.A.2). They need a written privacy compliance programme (Rule II.B.1) and a Data Protection Officer; "The Data Protection Officer can be the same individual as the CISO of the VASP" (Rule II.B.2.a).
The framework must address key generation, transaction signing and the "storage of cryptographic keys and seed phrases" (Rule I.D.1). Schedule 1 guidance expects "HSMs for critical key storage" (B.3.a), key generation with "separation of duties" (B.1.d), and "cryptographic erasure or physical destruction of media containing cryptographic keys" at disposal (B.12.b).
What this means for your IT
- Record where personal data is stored and which cross-border transfers occur.
- Use HSMs for key generation and storage where possible, and document media disposal.
Wallet and custody technology
What VARA says. VASPs must ensure there is "no single point of failure" in access to Virtual Assets (Rule I.D.2.a). Keys stored online or in one physical location must be insufficient to conduct a transaction unless appropriate controls are in place, and "backups of the key and seed phrases are stored in a separate location from the primary key and/or seed phrase" (Rule I.D.2.b). Access to keys needs "an audit log detailing each change of access to keys". When Staff with key access leave, the VASP must "conduct an assessment to determine whether a new key must be generated" (Rule I.D.2.c). VASPs must "perform internal audits on a quarterly basis concerning the removal of user access" (Rule I.D.2.d.ii). They must also run "distributed ledger tracing software" to screen transactions and wallet addresses (Rule I.F.2).
Schedule 1 guidance expects multi-signature for high-value operations where "M > N/2" (B.5.a) and a key compromise response plan (B.7).
For custodians, the Custody Services Rulebook says VASPs "should conduct a risk-based analysis to determine the method of Virtual Asset storage" (Rule III.C.1.b) and that a mnemonic backup seed phrase should be "broken into at least two (2) parts" (Rule III.C.2.c).
What this means for your IT
- Document wallet types, signing quorums and backup locations.
- Run quarterly leaver access audits for key systems and keep the results.
- Rehearse the key compromise plan, including key rotation.
Secure development and change
What VARA says. The framework must cover "a development, maintenance and testing process for technology systems" (Rule I.A.4.a). Schedule 1 guidance expects a secure development lifecycle with "mandatory security review gates before deployment" and "threat modelling for new features and secure coding standards" (A.2), plus "centralised configuration management and formal change control processes" (A.4.c). Security tests are expected "prior to any update to a production system" (B.11). Smart contracts are expected to have "independent third-party audits before deployment" (B.4.b).
What this means for your IT
- Make security sign-off a required release step, and keep test evidence for each production change.
Monitoring, incident response and notification
What VARA says. The Cybersecurity Policy must cover incident response, "including but not limited to root cause analysis and rectification activities to prevent reoccurrence" (Rule I.B.3.o), and escalation including "responses to ransomware and other forms of cyberattacks" (Rule I.B.3.q). Schedule 1 guidance expects logs stored "securely with tamper-evidence, maintaining logs for a minimum of one year" (B.13), "dedicated forensic resources (internal or contracted)" (C.5.a), and after incidents "complete rotation of all secret components" (C.7.a).
Notification deadlines are Rules:
- A material cybersecurity event, or an event triggering the BCDR Plan that materially impacts operations, must be reported to VARA "as soon as reasonably practicable, and in any event no later than seventy-two (72) hours from detection" (Rule I.K.1).
- For incidents affecting, or potentially affecting, Personal Data, VASPs must notify VARA "within twenty-four (24) hours following notification by them" to a data regulator or a Data Subject (Rule II.C.2).
What this means for your IT
- Retain security logs for at least a year in tamper-evident storage.
- Put both VARA deadlines in your incident runbook, with named owners.
- Arrange forensic support in advance.
Business continuity and recovery
What VARA says. VASPs must "implement, maintain, test and update on an annual basis" a Business Continuity and Disaster Recovery Plan (Rule I.H.1). It must cover, among other things, "an alternative site sufficient to recover and continue operations for a reasonable period" (Rule I.H.1.g). It should address "network malfunction, loss of data or compromise in data integrity, and key storage and maintenance of authorisation layers" (Rule I.H.2). Schedule 1 guidance expects "regular testing of key backup and recovery procedures" (B.3.d) and resilience testing "at least yearly on all systems and applications supporting Critical or Important Functions" (E.1.f).
What this means for your IT
- Test failover each year, including key recovery, and record the results.
Third parties and outsourcing
What VARA says. The Cybersecurity Policy must cover "vendor and third-party service provider management" and "supplier probity and Staff vetting procedures" (Rules I.B.3.m and I.B.3.p). Schedule 1 guidance expects due diligence, written contracts and "adopting multi-vendor strategies where possible and/or practicable" (A.5).
Under the Company Rulebook, Part IV, VASPs stay accountable for outsourced Functions "to the same extent as if the Function was performed in-house by the VASP" (Rule IV.A.5). They must keep a register of all outsourcing arrangements (Rule IV.C.2.b), and should assess risk before starting and "at least annually for the duration of such relationship" (Rule IV.B.2.a). Every outsourcing contract must include information security requirements, data access "at any time by the VASP or a competent authority", and obligations to "securely destroy data relating to the VASP or its clients" on termination (Rule IV.D.3). A Material Outsourcing is one "that includes a Function that is a Critical or Important Function" (Company Rulebook, Schedule 1 - Definitions). VASPs should notify VARA in advance of a new one (Rule IV.H.3), and must "notify VARA prior to undertaking any cross-border Outsourcing" (Rule IV.F.6).
What this means for your IT
- Add every IT provider (cloud, managed services, wallet technology) to the outsourcing register and mark which are material.
- Check contracts for the Rule IV.D.3 clauses, and whether any provider outside the UAE needs a cross-border notice.
Testing and audit
What VARA says. VASPs must engage a "qualified and independent third-party auditor" for vulnerability assessments and penetration testing "at least on an annual basis and prior to the introduction of any new systems, applications and products" (Rule I.E.1). Evidence of tests and audits must be "made immediately available by them for inspection by VARA" on request (Rule I.E.3). VARA may also require threat-led penetration testing (TLPT) "where VARA considers it necessary and proportionate to do so" (Rule I.E.5). Schedule 1 guidance expects "quarterly vulnerability assessments" and "continuous automated security scanning" (B.11).
What this means for your IT
- Schedule the annual independent test, plus a test before each new system goes live.
- Keep reports and remediation tracking ready to share with VARA.
How Dual Layer IT can help
Dual Layer IT is ISO/IEC 27001:2022 certified, and our engineers hold CISSP, CISM and CISA certifications.
- IT compliance audits: a gap review of your controls and evidence against the requirements above.
- Cybersecurity: monitoring, incident response planning and vulnerability management.
- Managed IT: day-to-day access control, backups, endpoint security and change records.
Frequently asked questions
Does the Technology and Information Rulebook apply to every VARA-licensed firm?
Yes, to all VASPs licensed by VARA in the Emirate (Introduction). The defined Emirate excludes the Dubai International Financial Centre.
Are the Schedule 1 standards mandatory?
Schedule 1 is Guidance: it says what VASPs "are expected to" do, and states that it does not limit or reduce any Rules. The Rules in Parts I to III are binding.
How quickly must a cyber incident be reported to VARA?
For a material cybersecurity event, no later than 72 hours from detection (Rule I.K.1). For a personal data incident, within 24 hours of notifying a data regulator or Data Subject (Rule II.C.2).
Can the CISO role be outsourced?
The Company Rulebook allows outsourcing of the CISO role under conditions in Rule IV.A.3. VASPs are "encouraged to resource them in-house", and VARA may require a full-time employee. The CISO must be a different person from the Compliance Officer (Rule I.I.1).
Sources
- VARA, Technology and Information Rulebook, 19 May 2025 (effective 19 June 2025): https://rulebooks.vara.ae/rulebook/technology-and-information-rulebook (PDF: https://rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_169_VER20250519.pdf)
- VARA, Company Rulebook, 19 May 2025 (effective 19 June 2025), Part IV Outsourcing Management: https://rulebooks.vara.ae/rulebook/company-rulebook (PDF: https://rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_36_VER20250519.pdf)
- VARA, Custody Services Rulebook, 19 May 2025 (effective 19 June 2025), Part III.C VA Wallet management: https://rulebooks.vara.ae/rulebook/custody-services-rulebook (PDF: https://rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_243_VER20250519.pdf)
This page summarises VARA publications for information. It is not legal or regulatory advice; read the rulebooks in full and take advice from your compliance team.