Why did Dubai Virtual Assets Regulatory Authority (VARA) introduce new anti-money laundering guidance for crypto firms?

Dubai Virtual Assets Regulatory Authority (VARA) introduced the guidance to require crypto firms to use data-driven risk assessments instead of relying on static compliance reviews. The framework follows findings from VARA's 2026 Business Risk Assessment review.

What are the new risk assessment requirements from Dubai Virtual Assets Regulatory Authority (VARA)?

Dubai Virtual Assets Regulatory Authority (VARA) now requires virtual asset service providers to update risk assessments at least every three months. Firms must also refresh assessments immediately after significant changes to their business operations or products.

How is Dubai Virtual Assets Regulatory Authority (VARA) requiring firms to use FATF blacklist data?

Dubai Virtual Assets Regulatory Authority (VARA) requires crypto firms to incorporate Financial Action Task Force (FATF) high-risk and blacklisted jurisdictions into their risk controls. Companies must continuously assess geographic exposure as part of their compliance programmes.

What does the Dubai Virtual Assets Regulatory Authority (VARA) framework mean for compliance officers?

Dubai Virtual Assets Regulatory Authority (VARA) said compliance officers, senior managers and board members are expected to be accountable for their firm's risk management processes. Firms must demonstrate that risk assessment findings directly influence compliance resources and enforcement actions.

Image for illustrative purposes only. Not a real photo.

VARA mandates quarterly crypto risk reviews

Q: What does Dubai Virtual Assets Regulatory Authority (VARA) guidance mean for artificial intelligence risks?

Dubai Virtual Assets Regulatory Authority (VARA) requires firms to formally identify and document risks linked to artificial intelligence and anonymity-enhanced transactions. Companies must show how those risks are monitored and addressed through compliance controls.

Written by Isaac FrancisPublished Jun 15, 2026, 11:33 PM

Dubai's Virtual Assets Regulatory Authority issued new anti-money laundering guidance requiring crypto firms to adopt data-driven risk assessment frameworks.
Virtual asset service providers must update risk assessments at least every three months and integrate FATF high-risk and blacklisted country data.
The regulator said firms must strengthen oversight of AI-related and anonymity-enhanced transaction risks as part of ongoing compliance efforts.

Dubai Virtual Assets Regulatory Authority (VARA) introduced new anti-money laundering guidance requiring crypto firms to use quantitative data in risk models and refresh risk assessments at least every three months.

The updated framework follows VARA's 2026 Business Risk Assessment review and replaces static compliance monitoring with continuous risk evaluation based on operational and customer data.

Crypto businesses must assess customer profiles, geographic exposures and transaction activity, including the immediate incorporation of Financial Action Task Force blacklists and high-risk jurisdictions into risk controls.

The guidance also requires firms to separately evaluate proliferation financing and targeted financial sanctions risks, while documenting risks linked to artificial intelligence and anonymity-enhanced transactions.

VARA said compliance findings must directly influence resource allocation and enforcement measures within firms, increasing accountability for compliance officers and senior management.

The framework aligns with broader regulatory changes in the United Arab Emirates, including recently published National Risk Assessments aimed at strengthening financial crime controls.

Dubai has positioned itself as a regulated hub for digital asset businesses, with VARA continuing to expand oversight requirements as crypto adoption and virtual asset activity grow across the region.