Virtual Asset Service Providers and ATS Regulation — full text, CMA Decision 4/Chairman/2026

94 articles · 51,247 words · text from the official publicationOfficial source ↗ · · Print

§PreambleThe Chairman of the Authority’s Board of Directors’ Resolution No. (04/ Chairman) of 2026
ShareEmailWhatsApp
| No.(04/Chairman)/2026 | Issued Date13/2/2026Effective Date28/2/2026Official Gazette Date27/2/2026 | Status: In-Force
The Chairman of the Capital Market Authority’ Board of Directors, Having reviewed:
- Federal Decree-Law No. (32) of 2025 Concerning the Capital Market Authority;
- Federal Decree-Law No. (33) of 2025 Concerning the Regulation of the Capital Market;
- Cabinet Resolution No. (111) of 2022 Concerning Regulating Virtual Assets and their Service Providers;
- Cabinet Resolution No. (99) of 2024 Concerning the List of Violations and Administrative Penalties for Acts Violating the Provisions of Cabinet Resolution No. (111) of 2022 Concerning Regulating Virtual Assets and their Service Providers;
- Cabinet Resolution No. (51-2 C) of 2025 Concerning the Restructuring of the Board of Directors of the Securities and Commodities Authority;
- Cabinet Resolution No. (83) of 2025 Concerning the Fees for Services Provided to Virtual Assets Service Providers;
- The Chairman of the Authority’s Board of Directors’ Resolution No. (13/Chairman) of 2021 on the Regulations Manual of the Financial Activities and Status Regularization Mechanisms Rule Book;
- The Chairman of the Authority’s Board of Directors’ Resolution No. (26/Chairman) of 2023 on the Regulation of the Virtual Assets Platform Operator;
- Based on the approval of the Authority's Board of Directors at its sixth meeting of the ninth round held on 26/12/2025, And as required by the interest of work, Has decided as follows:

§Article 1

The Regulation concerning Virtual Assets Service Providers and the Alternative Trading System Operator attached hereto shall be approved, and shall comprise the following modules:

1. General Framework Module.

2. Business Regulation Module.

3. Alternative Trading System Module.

§Article 2

Without prejudice to the provisions of Clause (1) of Article (3) of this Resolution, the Licensed Entity and all its employees shall comply with all obligations set out in the Regulation concerning Virtual Assets Service Providers and the Alternative Trading System Operator as of the effective date of this Resolution.

§Article 3

The licensed entity and the accredited person by the Authority shall comply with the following:

| | 1. Fulfill the requirements set out in the “Business Regulation Module” and the “Alternative Trading System Module” of the Regulation of Virtual Assets Service Providers and the Alternative Trading System Operator within a period not exceeding one year from the effective date of this Resolution | | 2. Continue to comply with the obligations related to licensing conditions and conditions for the accreditation of its employees set out in the previous resolutions and applicable prior to the effective date of this Resolution, until status regularization is completed.

§Article 4

The Authority may impose any of the penalties set out in Cabinet Resolution No. (99) of 2024 Concerning the List of Violations and Administrative Penalties for Acts Violating the Provisions of Cabinet Resolution No. (111) of 2022 Concerning the Regulation of Virtual Assets and their Service Providers in the following cases: | | 1. Loss of, or non-compliance by, the licensed entity or its employees with any of the licensing or accreditation conditions applicable prior to the effective date of this Resolution and during the status regularization period.

| | 2. Failure of the licensed entity or its employees to comply with the status regularization period specified in this Resolution.

§Article 5

| 1. Without prejudice to the provisions of Article (3) of this Resolution, an applicant who has obtained an initial approval from the Authority may continue with its application to obtain a license to carry out any of the activities of Virtual Assets Service Providers in accordance with the provisions of the Rule Book of the Financial Activities referred to above, or may withdraw its application if it wishes to abandon it. | 2. Applications submitted to the Authority that have not obtained initial approval prior to the effective date of this Resolution shall be deemed null. The applicant shall amend its application in accordance with the new provisions and requirements without payment of a new application fee, or withdraw its application if it wishes to abandon it.

§Article 6

| 1. | The following resolutions shall be repealed as of the effective date of this Resolution, except for the conditions contained therein relating to licensing, approval, or jobs accreditation: | | a. | The provisions relating to Virtual Assets Service Providers and their employees in Chapter One, Two, Three, and the Glossary of Terms of the Rule Book of the Financial Activities referred to above. | | b. | The Chairman of the Authority’s Board of Directors’ Decision No. (26/Chairman) of 2023 Concerning the Regulation of the Virtual Assets Platform Operator. | 2. | The conditions referred to in Clause (1) of this Article shall be repealed upon the expiry of the status regularization period.

§Article 7This Resolution shall be published in the Official Gazette and shall enter into force on the day following the date of its publication.
The Regulation Concerning Virtual Assets Service Providers and the Alternative Trading System Operator
ShareEmailWhatsApp
| No.(04/Chairman)/2026 | Issued Date13/2/2026Effective Date28/2/2026Official Gazette Date27/2/2026 | Status: In-Force
General Module
Part One: Preliminary Provisions
Chapter One: Introduction
Article (1) Definitions The following words and phrases shall have the meanings assigned to them below in this Decision or its Annexes, unless the context indicates otherwise:
| State: | United Arab Emirates.
| Authority:
| The Capital Market Authority.
| Virtual Assets: | A digital representation of value that can be digitally traded or transferred and used for investment purposes. It does not include digital representations of fiat currencies, securities, or other financial instruments.
| Algorithmic Token: | A virtual asset that is claimed to maintain a stable value by reference to a virtual asset or any other asset as a result of interventions (whether automatic or manual) carried out by its issuer or another party from time to time to alter the supply of or demand for the virtual asset.
| Virtual Private Network (VPN): | A virtual private network that enables users to establish secure and encrypted connections over the internet.
| Distributed ledger: | A technology that enables the operation and use of distributed ledgers, made electronically available through a network of participants from multiple locations, who can update it based on consensus approval, or pursuant to an agreed-upon protocol or procedures.
| Privacy Devices: | Any technology, digital wallet, mechanism, or device (excluding VPNs) containing features used or intended to be used to obscure, anonymize, obfuscate, or prevent the tracking of any of the following information:
1. A transaction involving the virtual asset.
2. The identity of the virtual asset holder.
3. The identity of parties involved in the virtual asset transaction.
4. The value of the virtual asset transaction.
5. The beneficial owner of the virtual asset.
| Privacy Token: | A virtual asset in which the characteristics of the asset, the distributed ledger, or other similar technologies used therein contains features used or intended to be used to anonymize, obscure, or prevent the tracking of any of the information listed in (1) through (5) above.
| Utility Token: | A type of virtual asset designed to provide access to specific services, features, or products within a particular ecosystem (e.g., a platform or application). Its primary purpose is to offer functional utility within that system rather than serve as an investment or store of value.
| Non-Fungible Token (NFT): | A type of digital asset that represents unique ownership or a unique digital item on blockchain or distributed ledger technology. It is non-interchangeable, meaning each token is unique and cannot be replaced with another of equal value or specifications.
| Green List: | A list that includes virtual assets recognized by the Authority.
| Licensed Entity: | An entity that has obtained a license for any of the activities listed in Article (12) of this module.
| Cybersecurity Incident: | A Cybersecurity event resulting from malicious or non-malicious use of information or communication technologies that negatively impacts the information technology assets of a licensed entity.
| Cybersecurity Risk: | The risk of (1) financial loss, operational disruption, or damage; or (2) loss of confidentiality or integrity, or availability of ICT assets due to a cyber-incident.
| Information and Communication Technology (ICT) Assets: | Any data, devices, or other components of IT infrastructure, such as software applications, hardware, databases, or end-user computing tools.
| Multi-Factor Authentication (MFA): | A security system requiring users to provide two or more independent verification factors to access digital systems or accounts.
| Information Technology System: | A collection of ICT assets and the related procedures and methodologies organized to perform information processing functions.
| Network: | A group of interconnected ICT assets used to exchange data, including communication channels between such assets.
| Third-Party Cybersecurity Risks: | Cybersecurity risks arising from the use of ICT services provided by third parties or subcontractors of such third parties.
| Controller: | A person who, personally or with related parties:
| | a. | Owns 10% or more of the shares in the licensed entity or its holding company.
| | b. | Has the right to exercise or control 10% or more of the voting rights in the licensed entity or its holding company.
| | c. | Has the ability to exercise significant influence over the management of the licensed entity due to share ownership, ability to exercise voting rights in the licensed entity or its holding company, or a currently enforceable right to acquire such shares or voting rights.
| For the purpose of defining “shares” in the context of a controller: | a. | In the licensed entity or its holding company with equities.
| | b. | In the licensed entity or its holding company with share capital.
| | c. | In the licensed entity or its holding company without share capital, it means any interest that grants the right to share in profits or losses or bear part of liabilities or expenses upon liquidation.
| For the purpose of defining “holding” in the context of a controller: | Ownership of or right to own shares or voting rights in a licensed entity or its holding company, either personally or jointly with others.
| Financial Activities Rulebook: | Chairman of the Authority’s Board of Directors' Decision No. (13/Chairman) of 2021 on Financial Activities Rulebook and Status Regularization Mechanisms.
| 1. | The provisions of this module apply to any person who conducts or wishes to conduct any Virtual Asset Service Provider (VASP) activities in accordance with Article (12) of this module in or from within the State.
| 2. | The provisions of this module apply to virtual assets used for investment purposes.
Article (3) Overview | 1. | Part Two: | Regulates activities related to virtual assets, enforcing a strict prohibition on unlicensed practices and emphasizing compliance with regulatory standards and integrity. It includes the registration and recognition of virtual assets under specific standards and governs related activities through In principle approvals subject to strict requirements ensuring market and investor protection.
| 2. | Part Three: | Requires licensed entities to adhere to comprehensive requirements covering governance, systems and controls, risk management (including cybersecurity), and enhancement of professional competence. It emphasizes clear assignment of responsibilities, compliance with regulations, and a balance between regulatory performance and client protection.
| 3. | Part Four: | Outlines the core principles for licensed entities and persons, emphasizing integrity, competence, and compliance. It establishes a regulatory framework for emergency provisions, communication, supervision, and interaction with the Authority to ensure regulatory goals and protection of client interests.
| 4. | Part Five: | Provides a clear regulatory framework for licensing and approvals for both entities and persons, ensuring transparency, compliance and thorough review.
| 5. | Part Six: | Addresses the full scope of obligations on licensed entities to ensure compliance with regulatory rules. It includes temporary coverage for key persons, mandates Authority approval for amendments to Memorandum of Association or mergers, and requires submission of interim and annual financial reports in line with international standards. Entities must clearly define their financial year, maintain accounting records electronically, and appoint an external auditor to ensure compliance with auditing standards. The chapter also covers mandatory notifications to the Authority regarding significant changes such as relocation, branch closures, or organizational restructuring. The Authority may appoint an independent expert. It also governs annual license renewals and sets clear conditions for revocation of licenses or financial activities, protecting clients' rights and ensuring orderly settlement of obligations. For controllers, prior approval from the Authority is required to acquire or increase control thresholds. Controllers must notify the Authority of any changes affecting their control. The Authority retains the right to object to unqualified controllers and take appropriate measures to ensure compliance. Bankruptcy and voluntary liquidation procedures are regulated to protect clients’ rights and ensure obligations are settled in an orderly manner.
Part Two
Chapter One: General Provisions
Article (4) Virtual Asset Activities It is prohibited for any person, unless licensed by the Authority pursuant to Article (12) of this module, to carry out from within or inside the State any of the following virtual asset activities:
a. Providing operation and management services for virtual asset platforms.
b. Providing exchange services between one or more forms of virtual assets.
c. Providing virtual asset transfer services.
d. Providing brokerage services for trading in virtual assets.
e. Providing custody and management services for virtual assets and enabling control over them.
f. Providing financial services related to the offering and/or sale of virtual assets or participating in providing such services.
Article (5) Privacy Tokens and Prohibited Devices No person may, from within or inside the State, do the following:
a. Provide a financial service related to a Privacy Token or involving the use of a Privacy Device.
b. Issue or approve the promotion of a virtual asset related to a Privacy Token or Privacy Device.
c. Engage in any activities related to a Privacy Token.
d. Offer a Privacy Token to the public.
Article (6) Algorithmic Tokens No person may, from within or inside the State, do the following:
a. Provide a financial service related to an Algorithmic Token.
b. Engage in any activities related to an Algorithmic Token.
c. Issue or approve any financial promotion related to an Algorithmic Token.
d. Offer an Algorithmic Token to the public.
Article (7) Utility Tokens and Non-Fungible Tokens (NFTs)
1. A licensed entity shall not provide any service or engage in any activity related to Utility Tokens or Non-Fungible Tokens (NFTs).
2. The prohibition mentioned in clause (1) herein does not apply to a licensed entity to conduct custody services or to operate a multilateral trading facility for virtual assets, provided prior approval is obtained from the Authority.
Chapter Two: Registration and Recognition of Virtual Assets

§Article 8 — Submission of Notice for Virtual Asset Registration| 1. | The licensed entity operating a multilateral trading facility for virtual assets shall register a virtual asset with the Authority, by submitting a notice in accordance with Annex (1) before enlisting the virtual asset and making it available for trading.
| 2. | The Authority may, when appropriate and as it deems necessary, evaluate the registration notice and take the following actions:
| | a. | Request the licensed entity to clarify how it ensures compliance with the standards set out in Annex (1).
| | b. | Conduct any independent inquiries.
| | c. | Request the licensed entity to provide additional information.
| | d. | Verify any information submitted by the licensed entity.
| | e. | Obtain any relevant information when and during the evaluation of the registration notice’s compliance with the standards referred to in Annex (1).
| 3. | In assessing the standards in Annex (1), the Authority will take into account:
| | a. | The cumulative impact of factors that may, when considered personally, be insufficient to raise reasonable doubt about meeting the standards in Annex (1).
| | b. | The equivalence of anti-money laundering requirements in the other jurisdictions, and whether reports from reliable sources-such as mutual evaluations, detailed assessment reports, or follow-up reports issued by the Financial Action Task Force (FATF), the International Monetary Fund (IMF), the Organization for Economic Co-operation and Development (OECD), and other relevant international bodies-indicate that the jurisdiction:
i. Has AML requirements aligned with FATF recommendations.
ii. Effectively implements those recommendations.
| 4. | The Authority may delist a virtual asset from the register of virtual assets maintained by the Authority if it ceases to meet any of the requirements outlined in this Article.

§Article 9 — Recognition of Virtual Assets

1. The Authority may publish a "Green List" that includes recognized virtual assets.

2. The Authority may amend the Green List as it deems appropriate.

3. The Authority may add or remove a virtual asset from the Green List either immediately or on a specified future date.

§Article 10 — Publication1. The Authority shall publish a notice upon recognizing a virtual asset or upon deciding to revoke its recognition.
2. The Authority may publish a notice indicating receipt of an application for recognition of a virtual asset, as well as the rejection of such an application.
3. The Authority shall publish a notice upon deciding to cancel the registration of a virtual asset.
Chapter Three: Financial Activities and Licensing Categories
The provisions of this Chapter apply to any person conducting or intending to conduct any financial activity related to virtual asset service providers within or from the State.

§Article 12 — Financial ActivitiesThe virtual asset service provider activities referred to in Article (4) of this Module are deemed financial activities and are regulated as follows:
1. Dealing in virtual assets as principal.
2. Dealing in virtual assets as an agent.
3. Providing custody.
4. Arranging custody.
5. Operating a multilateral trading facility.
6. Providing investment advice.
7. Portfolio management.
8. Arranging investment deals.
Article (13) Dealing in Virtual Assets as Principal
1. "Dealing in virtual assets as principal" means buying, selling, subscribing to, or underwriting any virtual asset in a principal capacity.
2. A person is not considered to be dealing in virtual assets as principal if:
a. They are issuing or redeeming virtual assets that they have issued.
b. They enter into a transaction involving a virtual asset with or through a licensed entity.
3. The exception in clause (2) herein does not apply if the person presents themselves as:
a. Willing to enter into transactions involving the virtual asset, including through promotion, advertisement, or marketing.
b. Engaged in the activity described in clause (1) of this Article.

§Article 14 — Dealing in Virtual Assets as An agent1. "Dealing in virtual assets as an agent" means buying, selling, subscribing to, or underwriting any virtual asset on behalf of others.
2. A person is not considered to be dealing in virtual assets as an agent if they:
a. Merely receive, pass on, or transmit a client’s order without executing it or otherwise intervening in the process.
b. Do not execute the client’s order as described in clause (1) of this Article.
3. A licensed entity engaged in virtual asset as an agent shall be considered a matched principal in virtual assets if:
(a) It enters into transactions as a principal solely for the purpose of executing its clients’ orders;
(b) It holds positions for its own account (“positions”) only as a result of failing to match clients' orders;
(c) The total market value of the positions it holds does not exceed 15% of its Tier 1 Capital Resources, and such positions are incidental in nature and strictly limited to the period reasonably necessary to complete a transaction of this kind.

§Article 15 — Providing Custody1. “Providing custody” means safeguarding, protecting and administering virtual assets that belong to another person.
2. In the context of virtual assets, “safeguarding”, “protecting”, and “administering” mean the following:
a. A person provides custody of a client’s virtual asset if they hold the legal right to the asset or have the means to access it, which may occur if the person is recorded in the distributed ledger as the asset holder, holds the cryptographic key or digital wallet, or otherwise has the legal right or beneficial interest in the asset or control over the cryptographic keys or tools that allow access to the client’s digital wallet.
b. A person manages a virtual asset if, as the legal rights holder or access enabler, they perform activities such as exchange, transfer, participation in consensus mechanisms, reinvestment of rewards/income generated by the asset, or exercise other rights including early access or discounts on products/services provided via the original distributed ledger.
3. If the entity providing custody appoints a “third party” to perform any of its functions, it shall remain responsible to the client for the secure custody, and such responsibility shall not be transferred to the third party.
In such a case, the entity shall conduct due diligence on the appointed third party in accordance with the requirements set out in Articles (6) and (7) of Annex (6) of the Business Regulation Module.
4. For the purposes of clause (3) of this Article, the appointment of a “third party” shall not be considered the conduct of a safeguard arrangement activity.
For the purposes of this Article, “third party” means an entity licensed by the Authority to provide safeguarding, or by an equivalent regulatory authority accepted by the Authority, operating under a regulatory framework equivalent to that of the Authority, and acting as an agent of the licensed entity to provide custody.

§Article 16 — Arranging Custody1. "Arranging custody" refers to facilitating and organizing the process that allows the licensed entities under Article (15) to provide custody services, without themselves providing those services.
2. Activities considered as arranging custody include:
a. Negotiating and determining contractual terms between the custody provider and the service recipient (client).
b. Assisting the client with application forms and procedures necessary to obtain custody services.
c. Collecting and processing client payments related to custody services.
d. Transmitting information (including client instructions and confirmations from the custody provider) between the client and the custody provider.
3. A person is not deemed to be arranging custody if they merely introduce a person to a licensed custody provider. However, this exception does not apply if:
a. The custody provider is part of the same group as the introducer.
b. The introducer receives monetary compensation for introducing the person to the licensed custody provider.

§Article 17 — Operating a Multilateral Trading Facility

1. "Operating a multilateral trading facility" refers to managing a system that matches buy and sell orders for virtual assets from multiple third parties based on non-discretionary rules, resulting in a transaction with regard to such virtual assets.

2. A person is not considered to be carrying out the activity specified in clause (1) if they operate a facility that is merely an orders-routing system, where buy and sell orders are transmitted without those orders being matched with each other.

3. Subject to Article (12) of this module, the provisions of this module shall not apply to a multilateral trading facility except to the extent provided for in the Alternative Trading System Module.

§Article 18 — Providing Investment Advice1. “Providing investment advice” means giving recommendations to a person as an investor or potential investor, or their agent, about the suitability of buying, selling, holding, subscribing to, or underwriting a specific virtual asset, as a principal or as an agent.
2. The advice included in clause (1) herein includes delivering a statement, opinion, or report intended to:
a. Influence someone to make an investment decision.
b. Be reasonably understood as intended to influence someone to make an investment decision.
3. A person is not considered to provide investment advice with regard to virtual assets if they provide an advice in a newspaper, magazine, broadcast, or similar media, provided the main purpose of the publication or service, when viewed as a whole, is not to:
a. Offer the advice described above in clause (1) herein.
b. Direct or enable people to buy, sell, subscribe to, or underwrite virtual assets.

§Article 19 — Portfolio Management1. "Portfolio management" means providing specialized investment services to manage clients’ virtual assets in discretionary or non-discretionary portfolios, based on their investment goals and risk tolerance.
2. Services specified in clause (1) above of the present article include:
a. Identifying the client’s investment goals e.g., long-term growth, income generation, capital preservation, and understanding the client needs such as the required liquidity/timing of achieving these goals.
b. Allocating investments across various virtual asset classes based on goals and risk tolerance.
c. Selecting suitable virtual assets and developing a management strategy.
d. Monitoring and mitigating investment risks, including diversification and hedging tools.
e. Periodically reviewing portfolio performance to ensure that the objectives are being met, and adjusting as needed if circumstances change.
3. A person is not considered to provide discretionary portfolio management if they:
a. Act solely on specific instructions from the client for each investment within the portfolio, without any involvement in making investment decisions.
b. Offer general advice or investment plans without being directly responsible for managing assets within specific portfolio.
c. Only execute buy/sell orders for virtual assets as instructed by the client.

§Article 20 — Arranging Investment Deals1. “Arranging investment deals” means making arrangements that enable another person to buy, sell, subscribe to, or underwrite a virtual asset, whether acting as principal or as an agent.
2. These arrangements include:
a. Arrangements that do not result in transaction execution.
b. Receiving and transmitting client orders related to virtual assets as a coordinator without the authority to execute or commit the client to the transaction.
3. A person is not considered as engaging in the activity of arranging investment deals if:
a. They become a party to the transaction (regardless of whether the transaction has been executed). This exception does not apply to a branch arranging transactions for its head office or any other branch of the same legal entity to enter into the transaction as outlined in Clauses (1) and (2) of this Article.
b. They only provide the means for one party to communicate with others, without engaging in the arrangements described in clause (1).

§Article 21 — Licensing Categories and Capital1. The licensing categories consist of the following categories:
| # | Category | Activity | Capital Requirement | Capital in the Case of Holding Clients' Assets
| 1.
| Category One | Dealing in virtual assets as principal.
| Minimum capital of AED (4) million, or the minimum capital based on expected or audited annual expenses of not less than 25%, whichever is higher.
| A minimum capital of AED 4 million, or the minimum capital based on the expected or audited annual expenses of not less than 35%, or the risk-based capital requirement, whichever is higher.
| 2.
| Category Two | Dealing in virtual assets as an agent or as a matched principal.
| Minimum capital of AED (1) million, or the minimum capital based on expected or audited annual expenses of not less than 25%, whichever is higher.
| A minimum capital of AED (1) one million, or the minimum capital based on the expected or audited annual expenses of not less than 35%, or the risk-based capital requirement, whichever is higher.
| 3.
| Category Three | Providing custody | Minimum capital of AED (3) million, or the minimum capital based on expected or audited annual expenses of not less than 25%, whichever is higher.
| -
| 4.
| Category Four | 1. Arranging custody.
2. Arranging deals in investments.
3. Providing investment advice.
| Minimum capital of AED (1) million, or the minimum capital based on expected or audited annual expenses of not less than 25%, whichever is higher.
| -
| 5.
| Category Five | Managing portfolios | Minimum capital of AED (1) million, or the minimum capital based on expected or audited annual expenses of not less than 25%, whichever is higher.
| A minimum capital of AED (1) one million, or the minimum capital based on the expected or audited annual expenses of not less than 35%, or the risk-based capital requirement, whichever is higher.
| 6.
| Category Six | Operating multilateral trading facility | Minimum capital of AED (500) thousand, or the minimum capital based on expected or audited annual expenses of not less than 35%, whichever is higher.
| Capital based on the expected or audited annual expenses of not less than 35%, or the risk-based capital requirement, whichever is higher.
2. Subject to Chapter Four of Part Three of the Business Regulation Module, a licensed entity may combine one or more activities within the same category, and it may also obtain a license for more than one category.
3. Clients' assets may not be held except after complying with the provisions of Chapters Ten to Twelve of Title Four of the Business Regulation Module and obtaining prior approval within the license from the Authority.
4. In the case of combining one or more activities or categories, the higher capital requirement shall suffice.
5. Without prejudice to the minimum capital requirement, the entity, after obtaining a license, shall continuously maintain all the requirements of the Capital Adequacy Module.
Chapter Four: In principle Approval
1. The provisions of this chapter do not apply to licensed entities practicing any of the activities stipulated in Article (12) of this module when adding any activity.
2. The provisions of this chapter do not apply to operating a multilateral trading facility.

§Article 23 — Conditions for Obtaining In principle Approval1. Financial Eligibility: No default on commercial debts even if not accompanied by bankruptcy declaration, reinstatement in case of bankruptcy, proof of commitment to repay bank loans for commercial purposes and financial obligations arising from judicial decisions or rulings, absence of repeatedly returned checks due to commercial activities, and demonstrating financial capacity to meet urgent and future obligations.
Experience and Competence: Availability of required experience, proof of previous experience and its relevance to the required expertise in the same field, and demonstration of the ability to carry out financial activity and manage risks effectively.
Honesty and Integrity: Submission of accurate and complete information and documents to the authority; absence of any matter in relevant records that may harm or damage the authority’s or state’s integrity or reputation; no lawsuits, reports, or investigations before prosecution inside or outside the state related to honesty and integrity; and no court or prosecution rulings related to breach of trust, fraud, or deception.
Compliance: Compliance with legislation related to practicing financial activities or relevant applicable laws; absence of administrative sanctions in professional records issued by the authority or other regulatory bodies inside or outside the state; exclusion from sanctions lists issued by the United Nations and other foreign organizations especially related to Anti-Money Laundering (AML), Counter-Terrorism Financing (CTF), and illegal organizations; no criminal or misdemeanor offenses committed by the entity, its partners, or board members related to the authority’s activities inside or outside the state; and no ongoing administrative or criminal investigations inside or outside the state during the application or evaluation period.
No rejection or cancellation of license penalties imposed by other regulatory or governmental entities, local or foreign, which shall be verified by obtaining a copy of the professional record or direct communication with those entities.
Business Plan: Submission of a realistic and logical business plan for conducting financial activities, showing expected revenues and expenses for the first three years of operation, with the basis and assumptions relied upon and a comparison with the same sector.
Legal Form: The authority may, via notice, specify the legal form that the applicant must adopt to obtain the license.

§Article 24 — Submission of In principle Approval Request

1. Submission of Request: When submitting a request for in principle approval, the applicant shall specify the financial activity they wish to conduct according to the authority’s prescribed form, accompanied by supporting documents and information confirming compliance with the in principle approval conditions stated in Article (23) of this Module.

2. Payment of Fee: The applicant shall pay a non-refundable fee for the in principle approval application review.

§Article 25 — Evaluation of In principle Approval RequestWhen evaluating the in principle approval request, the authority may:
1. Verify the availability of sufficient resources, including but not limited to:
a. Ability to meet financial solvency standards.
B. Ability to fulfill obligations without exposing clients or concerned parties to unjustified risks.
c. Compliance with regulatory capital or liquidity requirements.
2. Verify competence and suitability, including but not limited to:
a. Competence and suitability of board members or equivalents.
B. Suitability of controllers or any other persons.
c. The potential impact of controllers on the applicant’s ability to comply with applicable requirements.
d. Applicant’s activities and any associated risks that may threaten achieving the authority’s objectives.
e. Any matter that may harm or has harmed the integrity or reputation of the authority or the state.
3. Ensure the ability to comply with requirements, including but not limited to:
a. Clarify how the requirements specified in Part Two and any other applicable requirements will be met. B. Conduct any inquiries deemed appropriate, including independent inquiries from the applicant.
c. Request the applicant to provide additional information.
d. Request clarifications from the applicant or approval on how compliance with certain requirements is guaranteed.
e. Request the applicant or approval to verify any information provided by any method determined by the authority.
f. Consider any other information the authority deems relevant.

§Article 26 — Approval or Rejection1. The authority shall issue its decision to approve or reject the in principle approval request within no more than forty-five (45) working days from the date of submission if the application is complete, stating reasons in case of rejection.
2. The authority’s approval of the in principle approval request does not constitute a license or approval to conduct the financial activity; the financial activity may only be conducted after obtaining the license, and any act or procedure conducted based on in principle approval is null and void.
3. The applicant shall fulfill the licensing requirements specified in Part Three of this Module to obtain the license within no more than six (6) months from the date of in principle approval issuance. The authority may extend this period once for an equal duration only.
4. If the ongoing requirements are not met within the specified periods mentioned in clause (3), the applicant shall reapply for in principle approval.
Part Three: Licensing Requirements
Chapter One: General Provisions
1. This part applies continuously to any person wishing to obtain a license or a licensed entity wishing to obtain approval to add one or more of the financial activities specified in Article (12) of this Module.
2. The provisions of this chapter do not apply to operating a multilateral trading facility.

§Article 28 — Allocation of Significant Responsibilities1. The licensed entity shall allocate significant responsibilities among the members of its administrative structure and senior management and maintain this allocation in a manner that:
a. Meets the governance requirements stipulated in Article (43) of this Module and is appropriate considering:
i. The nature, size, and complexity of the licensed entity’s business.
ii. The capabilities and qualifications of the responsible persons.
b. Clearly identifies who is responsible for each matter.
c. Enables adequate monitoring and control of the licensed entity’s operations by the administrative structure and senior management.
2. The licensed entity shall assign the following tasks to the Senior Manager or equivalent for managing the entity’s operations or to the board of directors:
a. Managing the distribution of responsibilities.
b. Supervising the development, review, and updating of systems and controls.
3. The licensed entity shall document the allocation of responsibilities as follows:
a. Create and maintain an updated record showing arrangements made to comply with clauses (1) and (2) of this article.
b. The record shall demonstrate that board members or equivalents and senior management are aware of and accept the allocated responsibilities under clause (1).
c. If one responsibility is assigned to more than one person, the record shall precisely clarify how this responsibility is distributed among those persons.
d. The record shall be retained for (6) six years from the date of its creation or replacement by a more recent record.
Chapter Two: Systems and Controls
The licensed entity shall:
1. Establish, review, and update systems and controls, including but not limited to financial systems and controls and risk management systems, to ensure effective and responsible management by its senior management.
2. Comply with requirements and controls of Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF), as set forth in the Authority’s financial activity rulebook.

§Article 30 — Organization1. The licensed entity shall, considering the nature, size, complexity of its business, and organizational structure, implement appropriate measures to ensure:
a. Clear definition of roles and responsibilities assigned to the Board of Directors and its members, senior management, and persons performing key control functions.
b. Existence of clear reporting lines applicable to persons performing these functions.
c. Documentation of roles, responsibilities, and reporting lines referred to in (a) and (b), and communication of these to all relevant employees.
2. The licensed entity shall ensure clear identification of any employee providing financial services to its clients, along with their accountability and supervision channels.
3. The licensed entity shall make details of any employee providing financial services to clients publicly available in a dedicated register or on its website, including:
a. The date the employee began providing services to clients.
b. The financial services the employee is authorized to provide to clients.
4. The licensed entity shall ensure segregation of duties and key functions. This segregation shall ensure that duties performed by the same person do not conflict with each other in a manner that would impede the effective performance of those functions (e.g., undetected errors or misuse of position).

§Article 31 — Risk Management

1. The licensed entity shall develop and implement policies and procedures to manage the risks it faces, and where applicable, those faced by its clients or users.

2. The licensed entity shall establish, review, and update risk management systems and controls that enable it to identify, assess, mitigate, control, and monitor the risks it faces.

3. The licensed entity shall appoint a person to advise the Board of Directors and senior management on risk matters.

4. If the licensed entity is part of a group, it shall be aware of the implications of any group-level risk policies and associated systems and controls.

§Article 32 — Compliance1. The licensed entity shall establish, review, and update compliance arrangements, including processes and procedures that ensure and reasonably demonstrate compliance with all applicable laws and regulations in the state.
The licensed entity shall document the organization of the compliance function’s responsibilities and procedures.
The licensed entity shall ensure the compliance officer has sufficient resources, including an adequate number of qualified staff, to perform duties objectively and independently from operational and commercial functions.
The licensed entity shall ensure the compliance officer has unrestricted access to relevant records and to the Board of Directors and senior management.
The licensed entity shall establish, review, and update monitoring and reporting procedures to ensure that any compliance breaches are identified, reported, and appropriate action is taken promptly.
The licensed entity shall document monitoring and reporting procedures and maintain records of breaches of any applicable laws in the state.

§Article 33 — Internal Audit

1. The licensed entity shall establish, review, and update internal audit arrangements to monitor the adequacy and effectiveness of its systems and controls.

2. The licensed entity shall ensure that the internal audit function is independent from operational and commercial functions.

3. The licensed entity shall ensure the internal audit function has unrestricted access to all relevant records and the right to escalate issues to the Board or a designated committee established for this purpose by the Board.

4. The licensed entity shall document the organization of internal audit responsibilities and procedures.

§Article 34 — Business Plan and Strategy

1. The licensed entity shall prepare a business plan that enables it, among other things, to manage the risks it and its clients may face.

2. The business plan must consider the licensed entity’s current activities and anticipated business during the next twelve months.

3. The business plan shall be documented and updated as necessary to reflect changes in the business environment and changes in the licensed entity’s operations.

§Article 35 — Management Information

The licensed entity shall establish, review, and update arrangements to provide the Authority, its Board of Directors, and senior management with the necessary information to regulate, monitor, control its activities, and ensure compliance with applicable legislation in the state for risk management. This information must be relevant, accurate, comprehensive, reliable, and timely.

§Article 36 — Employees and Agents1. The licensed entity shall establish, review, and update systems and controls that enable it to ensure the suitability of any person acting on its behalf.
2. The licensed entity shall ensure, as reasonably practicable, that its employees:
a. Possess appropriate qualifications and conduct.
b. Are qualified and capable of performing the tasks assigned to them.
c. Are trained to comply with applicable legislation in the state.
3. The licensed entity shall establish, review, and update systems and controls to comply with clause (1) of this article.
4. The licensed entity shall document the procedures taken to demonstrate its compliance with these requirements by retaining related records for no less than (6) six years from the date of the records.

§Article 37 — Continuing Professional Development (CPD)1. The licensed entity shall ensure that employees in the categories specified in clause (2) of this article remain qualified by completing a minimum of 15 hours of continuing professional development annually.
2. The specified categories for the said purpose in clause (1) herein are:
a. Senior Executive Officer.
b. Compliance Officer.
c. Money Laundering Reporting Officer.
3. The licensed entity shall ensure:
a. The CPD referenced in clause (1) is relevant to:
i. The employee’s current role and any anticipated changes to that role.
ii. The employee’s professional skills and knowledge.
B. The CPD consists of organized activities such as courses, seminars, lectures, conferences, workshops, webinars, or e-learning requiring a minimum of 30 minutes commitment.
c. The licensed entity and its employees keep sufficient records of CPD activities to demonstrate compliance with these requirements.

§Article 38 — Conduct

The licensed entity shall establish, review, and update systems and controls to ensure, as reasonably practicable, that neither the licensed entity nor its employees engage in or facilitate others to engage in conduct that may:

1. Damage the market’s reputation, inside or outside the state.

2. Constitute a financial crime under the laws applicable in the state.

§Article 39 — Outsourcing1. The licensed entity that outsources any of its functions or activities (including within its group) is not exempt from its regulatory obligations and remains responsible for compliance with applicable legislation in the state.
2. An outsourced function under this article shall be considered as if performed by the licensed entity itself.
3. The licensed entity outsourcing services shall ensure:
a. Due diligence in selecting appropriate service providers.
b. Effective supervision of outsourced functions or activities.
c. Effective handling of any action or omission by the service provider that leads or may lead to a violation of any applicable legislation in the state.
4. The licensed entity shall notify the Authority of any material outsourcing arrangements.
5. The licensed entity with material outsourcing arrangements shall:
a. Establish, review, and update comprehensive outsourcing policies, contingency plans, and risk management programs.
b. Conclude an appropriate written outsourcing agreement.
c. Ensure outsourcing arrangements do not diminish its ability to meet obligations to clients and the Authority, nor impede Authority supervision.
6. The outsourcing contract shall include provisions for:
a. Providing information to the Authority about the licensed entity and allowing access to business premises per Article (67) of this Module.
b. Cooperation with the Authority and responding to its requests.

§Article 40 — Business Continuity and Disaster Recovery

1. The licensed entity shall have adequate arrangements to ensure business continuity and compliance with obligations under applicable legislation in the state in the event of an unexpected interruption.

2. The licensed entity shall regularly update and periodically test these arrangements to ensure their effectiveness.

§Article 41 — Records

1. The licensed entity shall prepare and retain records covering all transactions, including accounting records and corporate governance practices, meeting the requirements and standards of applicable legislation in the state.

2. Regardless of the storage method, records must be reproducible on paper within a reasonable period not exceeding 3 working days.

3. The licensed entity shall have systems and controls to fulfill legal and regulatory obligations related to record adequacy, accessibility, retention periods, and security.

4. Records shall be retained for no less than six years from the date of receipt.

§Article 42 — Fraud

The licensed entity shall establish, review, and update effective systems and controls to:

a. Deter and prevent fraud, forgery, or deception against the licensed entity.

b. Report fraud, forgery, deception, and other financial crimes to competent authorities in the state.

§Article 43 — Corporate Governance1. The licensed entity shall have a Board of Directors and senior management meeting the requirements specified in clauses (2) and (3) of this article, respectively.
2. The Board of Directors shall:
a. Have clear responsibility for setting the company’s business objectives and strategies to achieve those objectives, and provide effective oversight of management.
b. Consist of a sufficient number and suitable composition of persons with the collective knowledge, skills, experience, and time commitment necessary to effectively perform the board’s duties and functions.
c. Have sufficient authority and resources, including governance practices and procedures, to enable it to perform its duties effectively.
3. Senior management shall have clear responsibility for the day-to-day management of the company’s business in line with the objectives and business strategies set by the Board.

§Article 44 — Remuneration Structure and Strategies1.The Board of Directors (or equivalent) shall ensure that the remuneration structure and company strategy:
a. Are aligned with business objectives and strategies and the risk standards under which the company operates.
b. Provide effective alignment between risk outcomes and employees’ roles and functions, taking into account:
i. The nature of roles and functions performed by the relevant employees.
ii. Whether employees’ actions may expose the company to financial, reputational, or other unacceptable risks.
c. Include, at minimum, board members or equivalents, senior management, key control function holders, and any employees making key risk-related decisions materially affecting the licensed entity’s risk exposure.
d. Are implemented and monitored to ensure ongoing effective operation.
2. The Board shall provide the Authority and relevant stakeholders with sufficient information on the remuneration structure and strategy to demonstrate ongoing compliance with clause (1) herein.

§Article 45 — Reporting of Violations

1. The licensed entity shall establish, review, and update appropriate and effective policies and procedures to:

a. Facilitate reporting of violations and regulatory concerns.

b. Assess reported regulatory concerns and report them as appropriate.

2. The licensed entity shall keep a written record of reported regulatory concerns, including the outcomes of assessments.

§Article 46 — Complaints and Their Handling1. The licensed entity shall establish, review, and update adequate and effective policies and procedures to investigate and consider complaints made against it, including compensation methods (such as for acts and errors it committed).
2. Upon receipt of a complaint, the licensed entity shall:
a. Document the receipt of the complaint immediately and in writing.
b. Provide the complainant with:
i. Contact details of the person responsible for handling the complaint.
ii. Key points regarding complaint handling procedures.
iii. A statement that a copy of the complaint handling procedures is available free of charge upon request.
c. Consider the substance of the complaint.
d. Where appropriate, keep the complainant informed about the progress of the complaint handling.
3. Upon completion of the complaint investigation, the licensed entity shall promptly:
a. Inform the complainant of the outcome of the complaint consideration.
b. Specify the compensation method, if applicable.
c. Comply with compensation terms if accepted by the complainant.
4. If the complainant is not satisfied with the compensation terms offered, the licensed entity shall inform the complainant of other available means to resolve the complaint, if any, and provide appropriate contact details upon request.
5. The licensed entity shall ensure that a copy of its complaint handling procedures is publicly available free of charge upon request.
6. The licensed entity shall retain a record of all complaints received for no less than (6) six years from the date of receipt.
Chapter Three: Cybersecurity Risk Management

§Article 47 — Cybersecurity Risk Management Framework1. Subject to the relevant licenses applicable in the State, the licensed entity shall establish, review, and update a cybersecurity risk management framework to effectively, integrally, and comprehensively identify, assess, and manage cybersecurity risks.
2. The licensed entity shall ensure that the framework is approved by its Board of Directors.
3. The cybersecurity risk management framework shall include the following:
a. Systems and controls commensurate with the nature, size, and complexity of the licensed entity’s activities.
b. Clear roles and responsibilities, including accountability for decision-making during normal operations as well as emergency conditions.
4. The systems and controls referred to in clause (3)(a) herein shall include:
a. A system for identifying and assessing cybersecurity risks that enables the licensed entity to fulfill the requirements set forth in Article (50) of this Module.
b. A system for protecting Information and Communications Technology (ICT) assets in accordance with Articles (51) and (52) of this Module.
c. A system for managing and controlling cybersecurity incidents that enables compliance with the requirements in Article (52) of this Module.
5. The licensed entity shall review its cybersecurity risk management framework periodically, at least annually, to ensure it remains appropriate, effective, and up to date.
6. The licensed entity shall integrate the cybersecurity risk management framework within its overall risk management framework established under Article (31) of this module.

§Article 48 — Third-Party Cybersecurity Risk Management1. The licensed entity shall manage third-party cybersecurity risks as an integral part of its cybersecurity risk management framework defined under Article (47) of this Module by:
a. Conducting due diligence to ensure appropriate third parties who comply with applicable cybersecurity standards are selected.
b. Ensuring that contractual terms with third parties require:
i. Compliance with the licensed entity’s cybersecurity requirements.
ii. Notification to the licensed entity of any cybersecurity incident that may affect it.
iii. Cooperation with the licensed entity in addressing the impact of any cybersecurity incident.
c. Allowing the licensed entity to verify that the third party continues to comply with its cybersecurity requirements.
2. A licensed entity that relies on services provided by a third party shall remain fully responsible for complying with and implementing all obligations under this Article.

§Article 49 — Responsibilities of the Board of Directors and Senior Management in Cybersecurity Risk Management1. The licensed entity shall ensure that its Board of Directors and Senior Management are responsible for ensuring the entity’s compliance with the cybersecurity risk management framework and that cybersecurity risks are effectively managed.
2. Without prejudice to clause (1) of this Article, the responsibilities of the licensed entity’s Board of Directors and Senior Management regarding cybersecurity risks include:
a. Ensuring that cybersecurity risks are adequately identified, assessed, and managed in accordance with the entity’s cybersecurity risk management framework.
b. Establishing and maintaining a senior management organizational structure aimed at managing cybersecurity risks and ensuring compliance with the entity’s cybersecurity risk management framework.
c. Defining the licensed entity’s cybersecurity risk appetite consistent with its business objectives, strategy, and overall risk tolerance level.
d. Ensuring that relevant employees possess the necessary expertise to manage cybersecurity risks.

§Article 50 — Identification and Assessment of Cybersecurity Risks1. The licensed entity shall identify and maintain an up-to-date inventory of its ICT assets, classified based on their confidentiality level and importance to supporting its business functions and operations.
2. The licensed entity shall regularly assess cybersecurity risks associated with the assets identified in clause (1) herein.
3. When conducting the assessment referred to in clause (2) herein, the licensed entity shall:
a. Identify threats arising from cybersecurity incidents.
b. Assess the cybersecurity risks resulting from those threats and the effectiveness of related controls to determine residual cybersecurity risk.
c. Analyze and measure the potential impact and consequences of residual cybersecurity risks on its business and operations overall.

§Article 51 — Protection of ICT Assets from Cybersecurity Incidents1. The licensed entity shall use and maintain up-to-date anti-malware software and ensure periodic updates of malware definitions to provide continuous protection against Cybersecurity threats.
2. The licensed entity shall implement network security controls, including appropriate network architectures, protocols, and network security devices, to protect its network perimeter.
3. The licensed entity shall apply network security monitoring procedures to facilitate rapid detection of unauthorized or malicious activities.
4. The licensed entity shall ensure proper management of access rights and privileges to its IT systems and networks by:
a. Establishing user access management procedures that include:
i. Ensuring users are granted only the minimum necessary permissions or access rights required to perform their duties (principle of least privilege).
ii. Immediately revoking access rights when the conditions under which approval was granted are no longer met.
b. Conducting periodic reviews of user access rights and privileges to verify their continued appropriateness.
5. The licensed entity shall secure access to its IT systems and networks through the implementation of:
a. Strong authentication requirements using robust passwords.
b. Multi-factor authentication (MFA) or equivalent protection for IT systems and networks accessible via the internet.
c. Multi-factor authentication (MFA) or equivalent protection for access to privileged rights or access permissions.
d. Encryption techniques to secure communication between users and the licensed entity’s IT systems and networks.
6. The licensed entity shall have comprehensive change management procedures that consider cybersecurity risks before and during any changes to IT systems and networks, including any new cybersecurity risks that may arise after the change.
7. The process referred to in clause (6) shall include systems and controls to ensure that changes to IT systems and networks are:
a. Adequately tested.
b. Approved before implementation.
c. Implemented promptly if needed to resolve major cybersecurity incidents or address security vulnerabilities.
8. The licensed entity shall establish software update management procedures to address security vulnerabilities in any of its ICT assets.
9. The process referred to in clause (8) shall ensure:
a. Identification and classification of software updates based on their importance in mitigating cybersecurity risks.
b. Timely application of software updates.
c. Prioritization of critical software updates implementation.
10. The licensed entity shall implement software updates following the required processes in clauses (8) and (9).
11. The licensed entity shall implement appropriate encryption technologies to protect the confidentiality and integrity of information.
12. The encryption technologies applied shall be commensurate with the sensitivity of the information.
13. The licensed entity shall restrict physical access to data centers and server rooms, if any, to persons with a legitimate business need through procedures that include:
a. Limiting access approvals to persons with legitimate business needs.
b. Immediate revocation of access approval if conditions for approval are no longer met.
14. The licensed entity shall implement appropriate physical security measures to prevent unauthorized physical access to data centers and server rooms.
15. The licensed entity shall provide training programs for all relevant employees in cybersecurity, along with sufficient awareness measures, including:
a. Relevant employees shall receive training on the licensed entity’s cybersecurity policies and standards at least once annually.
b. Maintaining an adequate level of employee awareness and competence to help detect and report cybersecurity incidents.
c. Assisting employees in understanding their person responsibilities related to cybersecurity.
16. The licensed entity shall ensure:
a. The existence of a comprehensive resilience testing program for its IT systems and networks, as well as testing of processes and controls implemented to comply with the provisions of this Article.
b. Conducting regular tests for the comprehensive program, at least once annually for internet-connected systems.
c. Having procedures to prioritize and address negative test results.

§Article 52 — Detection, Response, and Recovery1. The licensed entity shall continuously monitor its IT systems and networks to detect:
a. Cybersecurity incidents.
b. Deviations or events indicating the possibility of a cyber-incident.
2. The licensed entity shall have a procedure to escalate actual or potential Cybersecurity incidents.
3. The licensed entity shall develop, review, and update a robust Cybersecurity incident response plan that includes measures to respond to Cybersecurity incidents and mitigate their consequences, regularly ensuring its effectiveness.
4. The Cybersecurity incident response plan shall include appropriate conditions and procedures to ensure the immediate implementation of response and recovery actions, including those required under clauses (5), (6), and (7) of this Article.
5. If a potential or actual Cybersecurity incident is detected, the licensed entity shall conduct an investigation to determine the nature and extent of the incident’s impact.
6. During the investigation referred to in clause (5), the licensed entity shall, as appropriate:
a. Take immediate actions to contain the situation and prevent further damage.
b. Begin recovery operations based on its Cybersecurity incident response plan.
7. The licensed entity shall exercise due diligence to responsibly resume its operations, including taking the following steps as appropriate:
a. Eliminate residual harmful effects of the Cybersecurity incident.
b. Restore affected IT systems and networks.
c. Recover corrupted data.
d. Identify and address all vulnerabilities exploited in the Cybersecurity incident.
e. Correct vulnerabilities to prevent recurrence of similar Cybersecurity incidents in the future.
f. Communicate appropriately internally and externally with relevant stakeholders.

§Article 53 — Reporting Cybersecurity Incidents1. The licensed entity shall notify the Authority as soon as practically possible and within no more than (72) hours from becoming aware of a material Cybersecurity incident.
2. For the purposes of this Article and to determine whether the Cybersecurity incident is material, the licensed entity shall consider whether the Cybersecurity incident:
a. Affects client information or poses a risk to client assets;
b. Leads to the leakage or damage of sensitive or confidential information;
c. Causes disruption to critical operational functions or information systems; and
d. Results in significant financial losses for the licensed entity or impacts external stakeholders.
Chapter Four: Functions and Personnel

§Article 54 — Positions Required at the Licensed Entity1. To properly perform regulatory functions, the licensed entity shall have at all times designated persons to perform the following positions:
a. Members of the Board of Directors or equivalent.
b. Senior Manager
c. Chief Executive Officer.
d. Chief Financial Officer.
e. Compliance Officer.
f. Anti-Money Laundering Reporting Officer.
g. Internal Auditor.
2. The following key positions shall be performed by a person residing in the State:
a. Senior Manager.
b. Chief Executive Officer.
c. Compliance Officer.
d. Anti-Money Laundering Reporting Officer.
3. Notwithstanding clause (2) of this Article, the Senior Manager position may be performed without the requirement of permanent residence in the State, provided that:
a. There is an effective internal control framework that ensures daily monitoring and direct oversight of operational activities and compliance with relevant regulations and instructions;
b. There are direct and stable communication channels between the Senior Manager and the Authority, as well as regulatory bodies, allowing for immediate interaction and exchange of information upon request or in the event of any material incident.
c. It is ensured that this exception does not conflict with governance requirements or the integrity of the regulatory system.
4. The licensed entity may combine the positions referred to in clause (1) of this Article, provided that:
a. It is appropriate to the nature, size, and complexity of the licensed entity's business, and the duties can be effectively performed by one person;
b. The person possesses the competence and suitability to perform each of those positions; and
c. There is no conflict of interest, or any actual or potential conflict of interest is managed appropriately.
5. For the purposes of clause (4) of this Article, it is permissible to combine more than one position as per the following table:
| Licensed position | Member of the Board/ Partner | Senior Manager | Senior Executive Officer | Financial Manager | Compliance Officer | Anti-Money Laundering Reporting Officer
| Member of the Board/ Partner
| Senior Manager
| Senior Executive Officer
| Financial Manager
| Compliance Officer
| Anti-Money Laundering Reporting Officer
| ✓ | The positions may be combined if the conditions specified in clause (4) of this Article are met.
| ✖ | The positions may not be combined.

§Article 55 — Persons Occupying Positions Subject to Approval1. The position of Senior Manager shall be held by a person who bears ultimate responsibility—either solely or jointly with other key persons-for the day-to-day management, supervision, oversight, and control of the licensed entity. Such person shall be an employee of the licensed entity and shall not be a member of its Board of Directors or a partner therein.
The position of Senior Executive Officer shall be held by a person who is a member of the Board of Directors, a partner, or a Senior Executive Officer of the licensed entity. This person shall bear ultimate responsibility-either solely or jointly with other key persons-for the day-to-day management, supervision, oversight, and control of the licensed entity.
The position of Chief Financial Officer shall be held by a person, board member, partner or senior manager at the licensed entity, who bears full responsibility for the licensed entity’s compliance with relevant financial requirements.
The position of Compliance Officer shall be held by a person, board member, partner or senior manager at the licensed entity, who bears full responsibility for the licensed entity’s compliance with applicable laws and regulations in the state.
The position of Anti-Money Laundering and Counter-Terrorist Financing Reporting Officer shall be held by a person, a member of the Board of Directors, or a Senior Manager of the licensed entity. This person shall bear full responsibility for the licensed entity’s compliance with Anti-Money Laundering and Counter-Terrorist Financing legislation, including the implementation of the licensed entity’s AML policies, procedures, systems, and controls, as well as the day-to-day oversight of compliance with the relevant rules and other AML/CFT legislation.

§Article 56 — Technical Positions Required at the Licensed Entity1. To properly perform technical functions, the licensed entity shall have at all times designated persons to perform the following positions: Broker Representative.
a. Financial Analyst.
b. Portfolio Manager.
2. Clause (1) of this Article shall apply - within the scope of its activity - to the following licensed entities:
a. Dealing in virtual assets as an agent.
b. Providing investment advice.
c. Portfolio management.
3. The licensed entity shall be exempt from clause (1) of this Article if its business model does not require providing any of these positions.

§Article 57 — Persons Occupying Technical Positions Subject to Approval1. The position of Financial Analyst shall be held by a qualified person who analyzes financial data of companies or markets with the aim of providing recommendations based on financial and economic fundamentals to support investment decision-making by clients.
2. The position of Portfolio Manager shall be held by a qualified person responsible for making investment decisions within a financial portfolio to achieve the investment objectives set by clients based on their financial goals, financial status, and risk appetite, whether on a discretionary or non-discretionary basis.
3. The position of Broker Representative shall be held by a person acting on behalf of a financial brokerage firm, responsible for executing clients’ transactions (buying and selling) in financial markets and alternative trading systems.
4. The provisions of Annex (2) shall apply to technical positions and personnel.
Part Four: Key Principles and General Provisions
Chapter One: Key Principles
The provisions of this chapter apply to any person who practices or intends to practice any of the financial activities related to Virtual Asset Service Providers or the main and technical positions in and/or from within the State.

§Article 59 — Principles Applicable to the Licensed Entity1. Principle One – Integrity: The licensed entity shall adhere to high standards of integrity and fair dealing.
Principle Two – Skill, Care, and Diligence: When conducting its business activities, the licensed entity shall act with skill, care, and diligence.
Principle Three – Management, Systems, and Controls: The licensed entity shall ensure its affairs are effectively and responsibly managed by senior management and must maintain adequate systems and controls to ensure, as far as reasonably practicable, compliance with applicable laws and regulations in the State.
Principle Four – Resources: The licensed entity shall maintain sufficient resources and the ability to demonstrate their existence to manage and conduct its business, including financial resources, qualified human resources, and adequate operational systems.
Principle Five – Conduct: The licensed entity shall adhere to appropriate standards of conduct equivalent to those applied in licensed financial markets.
Principle Six – Client Interests: The licensed entity shall give due regard to the interests of its clients and communicate with them in a clear, fair, and non-misleading manner.
Principle Seven – Conflict of Interest: The licensed entity shall take all reasonable steps to identify, prevent or manage, or disclose conflicts of interest between the firm and its clients, or between its employees and clients, or among clients themselves, in a manner that does not adversely affect the clients’ interests.
Principle Eight – Suitability: The licensed entity shall exercise due diligence to ensure that its advice and discretionary decisions are suitable for clients who are entitled to rely on its judgment when permitted.
Principle Nine – Client Assets and Funds: When controlling or responsible for client assets or funds that shall be protected, the licensed entity shall arrange appropriate safeguards in accordance with the accepted responsibilities.
Principle Ten – Relations with Regulatory Authorities: The licensed entity shall deal with regulatory authorities openly and cooperatively, and immediately notify the Authority of any material events or other matters relating to the licensed entity that the Authority would reasonably expect to be informed of.
Principle Eleven – Governance: The licensed entity shall maintain a governance framework proportionate to the nature, size, complexity, and structure of its business, sufficient to promote sound and prudent management and supervision of its affairs and to protect the interests of its clients and stakeholders.
Principle Twelve – Remuneration: The licensed entity shall have remuneration structures and policies that are well aligned with the long-term interests of the firm and appropriate to the nature, size, and complexity of its business.

§Article 60 — Principles Applicable to Persons1. Principle One – Integrity: The accredited person shall adhere to high standards of integrity and fair dealing when performing their duties.
2. Principle Two – Professional Skill, Care, and Diligence: The accredited person shall act with skill, care, and diligence when performing their duties.
3. Principle Three – Conduct: The accredited person shall adhere to appropriate standards of conduct applicable when performing their duties.
4. Principle Four – Dealing with the Authority: The Accredited person shall deal with the Authority openly and cooperatively and disclose appropriately any information reasonably expected to be required by the Authority.
5. Principle Five – Management: The accredited person who holds significant responsibilities shall exercise the necessary professional care to ensure that the licensed entity’s affairs under their responsibility are organized and managed effectively and controlled adequately.
6. Principle Six – Compliance: The accredited person who holds significant responsibilities shall exercise the necessary professional care to ensure that the licensed entity’s affairs under their responsibility comply with any applicable laws and regulations in the State.
Chapter Two: General Provisions
The provisions of this chapter apply to any person who practices or intends to practice any of the financial activities related to Virtual Asset Service Providers in and/or from within the State.

§Article 62 — Interpretation

1. Each provision in the Virtual Asset Provider Part shall be interpreted in light of its purpose, which is primarily determined by the text of the relevant provision and its context among related provisions.

2. References to any specific provision include all types of provisions, including relevant controls and guidelines.

§Article 63 — Emergencies

1. If the licensed entity is unable to comply with a specific provision due to an emergency beyond its or its employees' control, and such non-compliance could not be avoided after taking all reasonable steps, the licensed entity shall not be considered in violation of that provision to the extent that compliance is rendered impossible by the emergency.

2. This provision applies only for the duration of the emergency’s effects, and the licensed entity must be able to demonstrate that it is taking all practical steps to address those effects, comply with the provision, and minimize losses or potential losses to its clients or users.

3. The licensed entity shall notify the Authority as soon as possible about the emergency and the steps taken and/or intended to address its effects.

§Article 64 — Disclosure of Regulatory Status1. The licensed entity shall not misuse its regulatory status, whether explicitly or implicitly.
2. The licensed entity shall ensure that every major business document contains one of the following disclosures:
a. "Licensed by the Capital Market Authority."
b. "Licensed by CMA."
3. Major business documents include—whether issued by mail, fax, or electronic means—official papers, business terms, client agreements, promotional materials, business cards, brochures, or websites.

§Article 65 — Head Office1. The licensed entity’s main office shall be located within the State’s geographical boundaries under the Authority’s jurisdiction, except when approval is obtained from the Authority and relevant bodies to conduct financial activity within other geographical boundaries pursuant to applicable legislation.
The licensed entity may establish one or more branches inside or outside the State or in a financial free zone within the State for conducting financial activity after obtaining the Authority’s approval.
The “head office” means the place where the licensed entity exercises oversight, management, control, and daily decision-making over all its operations and staff conducting financial activity within the State.
The head office shall be the licensed entity’s address within the State for communication with the Authority or others; however, communication may also be with a branch if the matter concerns financial activity conducted by that branch.
The Authority has the right to inspect the head office or any branch and verify its readiness to conduct financial activity.
The head office and any branch of the licensed entity shall have a physical, real location.

§Article 66 — Close Links

1. Upon submitting a licensing application, the applicant shall notify the Authority of any close links, ensuring these links do not impede the Authority’s supervision or oversight of the licensed entity and that the linked person meets the competence and suitability criteria set by the Authority.

2. The licensed entity shall provide the Authority—upon request—with the necessary documents and information related to those links.

3. Under competency and suitability procedures, and licensing requirements, the Authority may request termination or modification of such close links if it deems them inconsistent with required conditions or obstructive to the Authority’s supervision and oversight. The Authority may take appropriate measures and sanctions, including license revocation if the licensed entity does not comply.

§Article 67 — Supervision and Investigation1. The Authority shall supervise and inspect the licensed entity to verify compliance with the Authority’s legislation and any other applicable related laws, and may investigate any violations found during inspections or contained in complaints or reports received by the Authority.
The licensed entity shall respond to the Authority’s inquiries within the specified time, with full honesty, and enable its employees to attend investigations or meetings requested by the Authority.
The Authority may request any information, documents, or records from the licensed entity or its employees for supervision and inspection purposes, including electronic and non-electronic records, data, computer systems, and other technical or electronic means as related to virtual assets or the practice of financial activity. The licensed entity shall provide what is requested within the specified time, enabling the Authority to access, review, and obtain copies on the licensed entity’s premises at its expense.
The Authority may require the licensed entity to establish any electronic connection with the Authority.
The Authority may investigate the licensed entity and/or its board members and/or partners and/or senior management and/or employees or any investors or third parties regarding any violations of laws applicable to the Authority and request any relevant information or documents related to the investigation.

§Article 68 — Communication with the Authority

1. Communication with the Authority may be in Arabic or English.

2. Communication with the Authority shall be through authorized channels and mechanisms, and by persons with the appropriate status and authority or duly authorized representatives of the licensed entity. Requests, complaints, or appeals made by unauthorized or non-designated persons shall not be considered. The licensed entity is responsible for any communication with the Authority made using its documents, electronic mail, or other communication means by persons without proper authority or authorization.

§Article 69 — Public RegisterThe Authority may, at its discretion, make information contained in the licensed entity’s register available to the public via its website or by any other means it deems appropriate.
Part Five: Licensing, Approval, and Accreditation
Chapter One: Procedures for Issuing a License or Approval
1. The provisions of this Chapter apply to anyone who submits an application for a license or approval to conduct one or more financial activities of Virtual Asset Service Providers in and/or from within the State.
2. The provisions of this Chapter do not apply to the operation of a Multilateral Trading Facility.

§Article 71 — Submission of License Application

The applicant is obligated to:

1. Submit evidence demonstrating compliance with the licensing requirements specified in Part three of this Module.

2. Follow the legal form specified by the Authority, if any.

§Article 72 — Submission of Approval Application

Only entities licensed by the Authority may submit an application for approval to add one or more activities of Virtual Asset Service Providers, provided they are able to meet the ongoing conditions specified in Part Two of this Module to the necessary extent.

§Article 73 — Application EvaluationWhen evaluating a license or approval application, the Authority has the right to:
1. Ensure the applicant has sufficient resources, including financial resources, such as but not limited to:
a. Ability to comply with financial adequacy standards.
b. Ability to meet obligations without exposing clients or related parties to undue risks.
c. Compliance with regulatory capital or liquidity requirements.
2. Verify competence and suitability, including but not limited to:
a. Competence and suitability of board members.
b. Suitability of the controller or any other person.
c. The potential impact of the controller on the applicant’s ability to comply with applicable requirements.
d. The applicant’s activities and any risks related to these activities that may threaten the Authority’s objectives.
e. Any matter that may harm or has harmed the integrity or reputation of the Authority or the State.
3. Ensure the ability to comply with regulatory requirements, including but not limited to:
a. Conducting any inquiries deemed appropriate, including independent inquiries from the applicant.
b. Requiring the applicant to provide additional information.
c. Requesting clarifications from the applicant on how compliance with certain requirements is ensured.
d. Requiring the applicant to verify any information provided in any manner determined by the Authority.
e. Requesting any other information considered relevant to the application by the Authority.

§Article 74 — Approval or Rejection Decision

1. The Authority may condition its approval of a license or approval application on any terms or restrictions it decides, or may reject the application despite fulfillment of the conditions mentioned in this part based on its discretion regarding the public interest, and the Authority must state the reasons for rejection.

2. The Authority shall issue its decision to approve or reject the application within no more than sixty (60) working days from the date of its complete submission, and in case of rejection, the Authority shall specify the reasons for that.

§Article 75 — Fees

Payment of the approval fee for the license application or approval request as determined by the Authority.

Chapter Two: Procedures for Person Accreditation

1. The provisions of this chapter apply to any person applying for the status of an accredited person.

2. The licensed entity shall not permit any person to perform a position subject to accreditation in accordance with Article (55 & 56) of this Module, unless that person is accredited as an accredited person, except as permitted under Article (81) of this Module.

§Article 77 — Application for Accredited Person Status1. The applicant shall complete the form specified by the Authority.
2. The licensed entity shall ensure that the person for whom the application is submitted:
a. Is qualified to perform the intended role.
b. Is aware of developments related to the market, products, technology, and legislation.
c. Is capable of effectively applying their knowledge.
3. The applicant shall demonstrate to the Authority their suitability and competence for the intended role, and the Authority will consider the following:
a. The person’s integrity.
b. The person’s competence and capabilities.
c. The person’s financial soundness and non-insolvency.
d. The role to be performed.
e. Any other matters deemed relevant by the Authority.
f. That the person has not been convicted of a serious criminal offense.
g. That the person is mentally and physically sound and able to manage their affairs.
4. The application shall be submitted meeting the above-mentioned conditions.

§Article 78 — Evaluation of the Application for Accredited Person StatusWhen evaluating the application, the Authority may:
Conduct any inquiries deemed appropriate, including independent inquiries from the applicant.
Request additional information from the person or the licensed entity
Request verification of any information submitted by the person or the licensee by any means determined by the Authority.
Take into account any other information deemed appropriate.

§Article 79 — Approval or Rejection Decision

1. The Authority may condition its approval of the application for accredited person status on terms or restrictions it deems fit, or reject the application despite meeting the conditions stipulated in this Part based on its discretion of the public interest, provided that the Authority states the reasons for rejection.

2. The Authority shall issue its decision to approve or reject the application within no more than sixty (60) working days from the date of its complete submission, and if rejected, the Authority shall specify the reasons.

§Article 80 — Fees

Payment of the approval fee for obtaining the status of an accredited person, as determined by the Authority.

Part Six: General Obligations and Controllers

Chapter One: General Obligations

§Article 81 — Temporary Coverage, Termination of Service, or Resignation of an Accredited Persons1. A licensed entity may appoint a non-accredited person to perform the role of an accredited person, provided the following conditions are met:
a. The absence of the accredited person is temporary or reasonably unexpected.
b. The temporary coverage period for the authorized person shall not exceed six (6) months within a single year.
c. The licensed entity has assessed that the person possesses the relevant skills and experience to perform the role.
2. The licensed entity may not appoint a board member or equivalent as a temporary accredited person under paragraph (1) of this article.
3. The licensed entity shall take reasonable steps to ensure the person complies with all applicable rules for accredited persons.
4. If a person is appointed under this article, the licensed entity must notify the Authority of the name and contact details of the appointed person.
5. The licensed entity shall take reasonable steps to ensure an accredited person is appointed to perform the role after the expiration of the permitted temporary coverage period under this article.
6. If a person is appointed under this article, the Authority may exercise any powers it has as if the person were accredited.
7. The licensed entity shall request the withdrawal of an Accredited person status within a period not exceeding ten (10) days from the date on which the Accredited person ceases to be employed by the licensed entity to perform a role, subject to approval.
8. When requesting the withdrawal of the Accredited person status, the licensed entity shall submit a notice including details of any circumstances that the licensed entity considers may lead to the person being regarded as not meeting the fitness and propriety requirements.
9. If the Accredited person is dismissed or requested to resign, the licensed entity shall provide the Authority with a statement explaining the reason or reasons for the dismissal or resignation.

§Article 82 — Memorandum of Association and Ownership

The licensed entity shall:

1. Obtain the Authority’s approval before making any amendments to the memorandum of association and/or bylaws, except for public joint-stock companies and branches of foreign companies.

2. Comply with Part Five, Chapter Two of this Module regarding controllers.

3. Obtain the Authority’s approval before undertaking any merger transaction.

§Article 83 — Financial ReportingThe licensed entity is obligated to prepare and submit the following financial reports to the Authority:
Interim quarterly financial reports, except for the last quarter of the year, audited by an external auditor, submitted within forty-five (45) days of the end of the quarterly period, and signed by the authorized signatory.
Annual audited financial reports by an external auditor, submitted within three (3) months of the end of the financial year, and signed by the authorized signatory.
Interim (quarterly) reports within forty-five (45) days of the end of the quarterly period, and an annual report within three (3) months of the end of the financial year on the company’s activities related to conducting financial activities, including profits and losses, according to the form prepared by the Authority, and these reports must be signed by the responsible manager if the company is licensed for more than one financial activity or if the licensed entity is a local bank or a foreign bank branch.
Any other financial statements or reports requested by the Authority.
Every company established in the State and licensed by the Authority must specify a financial year in its bylaws, provided that the first financial year does not exceed eighteen (18) months and is not less than six (6) months, starting from the date of registration in the commercial registry at the competent authority, with notification to the Authority of the specified end date of the first financial year.
Subsequent financial years shall be consecutive periods, each lasting twelve (12) months, starting immediately after the end of the preceding financial year.

§Article 84 — Accounting Records1. The licensed entity shall:
a. Comply with International Financial Reporting Standards (IFESs).
b. Ensure that records are sufficient to disclose and explain transactions, including but not limited to:
i. Continuously presenting the financial position of the licensed entity.
ii. Displaying and recording the financial position at year-end.
iii. Clarifying the financial position of clients and details of their transactions.
2. Maintain accounting records electronically in a manner that enables the Board of Directors to ensure the preparation of financial statements and reports in accordance with the approved International Accounting Standards.

§Article 85 — External AuditThe licensed entity shall:
Appoint an external auditor who is certified and licensed by the relevant authorities, possessing the necessary skills, resources, and sufficient experience, unless the licensed entity is exempted from submitting financial reports.
Enter into a written agreement with the external auditor regarding the audit terms, the form of the required report, and the audit principles and standards according to international accounting and auditing standards.
Ensure that the external auditor is able to perform their duties throughout the appointment period.
Notify the Authority immediately upon appointment or change of the external auditor.

§Article 86 — NotificationsThe licensed entity shall notify the Authority immediately in the following cases:
Any change in the group structure, head office or any branch office related to conducting financial activity, or changes in addresses or contact numbers (phone, email, or others).
Closure of any branch related to conducting financial activity.
Any significant changes in governance system or remuneration strategy.
Calling a meeting to consider a resolution for dissolution or liquidation.
Any decision by another regulatory authority to accept or reject any licensing application, or to suspend, modify, or cancel a license.
Any decision by another regulatory authority to accept or reject any application for accredited person status, or to suspend, modify, or cancel such accreditation.
Investigation by another regulatory authority into its affairs or those of any of its employees, or appointment of inspectors to investigate matters related to financial activity.
Imposition of any disciplinary measures or sanctions by another regulatory authority against it or any of its employees.
Imposition of any administrative penalty by it against any of its employees regarding the performance of their duties.
Initiation of civil or criminal lawsuits against it or any of its accredited employees concerning claims related to financial activity or tasks, or involving fraud, breach of trust, or tax evasion.
Any events that have occurred or are expected to occur that negatively affect or may affect its reputation or cause serious financial consequences to it or its clients.
Any material change in the adequacy of capital or financial solvency.
Upon knowledge or reasonable grounds of fraud or misconduct related to financial activity, including:
a. Realization that a serious fraud or misconduct may have been committed against one of its clients.
b. Reason to believe that a person is acting with intent to commit serious fraud against it.
c. Detection of material discrepancies in its accounting or other records.
Suspicion that any board member, accredited person, or employee has committed serious misconduct relating to their honesty or integrity.
Any change in the fitness and competence of accredited persons.
Any other notifications the licensed entity considers important or that the Authority requests, specifying the timing of the notification.

§Article 87 — Appointment of an Independent Expert

The Authority may appoint an independent expert at the expense of the licensed entity, whether inside or outside the State, in cases the Authority deems necessary, such as cases of manipulation, fraud, or misconduct. The expert shall prepare a report according to the conditions, form, and timeframe determined by the Authority.

§Article 88 — License Duration and Renewal1. The license duration for the activity shall be one year, starting from the date of issuance of the license and ending at the end of the calendar year. It shall be renewed annually, at the latest within one month from the license expiration date.
Exceptionally, for the initial license or for a license to add a financial activity at any time during the year, the license duration shall extend until the end of the year following the first license year or the year the financial activity was added. The applicable fee shall be prorated accordingly.
The Authority shall collect a license fee for each financial activity the licensed entity wishes to conduct within the category.
The license for the financial activity shall be renewed upon renewal of the category license and payment of the renewal fee related to each licensed financial activity within the category.
No financial activity within a given category may be conducted unless both the category license and the financial activity license are valid.

§Article 89 — License or Financial Activity Cancellation1. If the licensed entity wishes to cancel a license or financial activity, it shall submit a written request to the Authority including the following:
a. Reasons for the request.
b. A statement indicating whether the license or financial activity has ceased or will cease, with clarification of the cessation date.
c. Publication of the request in two daily newspapers issued in the State, one in Arabic and the other in English, within three (3) working days of submitting the request to enable clients to regularize their positions.
d. A report signed by the external auditor detailing the settlement of clients’ accounts, whether cash or virtual assets, and confirming there are no outstanding obligations towards them.
e. A report signed by the legal advisor accompanied by a certificate from judicial authorities clarifying the status of the head office and its branches (if any) regarding lawsuits filed by or against clients.
f. A commitment letter from the licensed entity to continue fulfilling any subsequent obligations after the cancellation of the category license or financial activity, according to the form prepared by the Authority.
2. Payment of the cancellation fee for each financial activity according to the fee determined by the Authority.
3. Publication of the Authority’s decision to cancel the license or financial activity immediately upon issuance in two daily newspapers issued in the State, one in Arabic and the other in English.
4. Before approving the cancellation of the license or financial activity, the Authority may require the licensed entity to:
a. Notify contracted parties of the cancellation request at least three (3) months prior to the specified date, and continue performing the required services until contracting with a licensed replacement entity.
b. Prove the settlement of its obligations with contracted parties.
c. Transfer records and data related to contracted parties or clients, their accounts, and assets to another licensed entity.
5.The licensed entity shall fulfill the cancellation requirements within a period not exceeding six (6) months from the date of submitting the request to the Authority. The Authority may extend this period once for a similar duration

§Article 90 — Voluntary Liquidation1.The Authority supervises the voluntary liquidation of the licensed entity and has the authority to take any appropriate steps to ensure adequate protection of the rights of the licensed entity’s clients.
2. If the licensed entity intends to undergo voluntary liquidation, it shall:
a. Notify the Authority of the liquidation and specify the proposed date for the Board of Directors, General Assembly, or creditors’ meeting regarding the liquidation procedures.
b. Provide the Authority with any documents requested relating to the liquidation procedures.
c. Cooperate with the Authority before initiating liquidation procedures to ensure all client-related obligations are settled, their funds and assets returned, accounts cleared, and all transactions, accounts, and obligations related to conducting the financial activity with the Authority are finalized.

§Article 91 — Protective Composition (Arrangement) Against Bankruptcy

1. When requesting a protective composition against bankruptcy, the licensed entity shall notify the Authority in writing at least ten (10) working days prior to submitting the request. The Authority has the right to submit its documents and defenses to the court.

2. The Authority may request the court to appoint a supervisor to oversee the implementation of the protective composition procedures.

§Article 92 — Bankruptcy Procedures

1. The licensed entity shall notify the Authority of its intention to file for bankruptcy proceedings at least fifteen (15) working days prior to submitting the request to the court. The Authority has the right to submit its documents and defenses to the court.

2. The Authority may submit a bankruptcy petition for the licensed entity to the court, accompanied by the required documents and proof that the licensed entity is financially indebted.

3. The Authority may request the court to appoint a supervisor to oversee the bankruptcy procedures.

Chapter Two: The Controller

§Article 93 — Excluded HoldingsFor the purpose of determining excluded holdings and whether a person is considered a controller, any shares, voting rights, or rights to acquire shares or voting rights held by the person, alone or jointly with others, in a licensed entity or its holding company shall be disregarded in the following cases:
1. Shares held solely for clearing and settlement purposes within a short settlement cycle.
2. Shares held by a custodian or as registered owner, where voting rights attached to these shares are exercised solely based on written instructions from the beneficial owner.
3. If the person is a licensed entity or a licensed financial institution and the following conditions are met:
a. The shares were acquired as part of an underwriting commitment for a share issuance or offering on a firm commitment basis.
b. The person has not exercised the voting rights attached to the shares nor interfered in the management of the issuing entity
c. The shares were held for less than one year.

§Article 94 — Prior Approval for Control PurposesIf the entity is locally licensed, no person shall, without prior approval from the Authority, do any of the following:
1. Become a controller.
2. Increase their level of control to the following thresholds:
a. From less than 30% to 30% or more.
b. From less than 50% to 50% or more.

§Article 95 — Requirements for Prior Approval1. Any person required to obtain prior written approval from the Authority under Article (94) of this Module shall submit an application to the Authority using the form prepared for this purpose.
2. Upon receipt of a complete application under paragraph (1) herein, the Authority may:
a. Approve the proposed acquisition or increase in control level.
b. Approve the proposed acquisition or increase in control level subject to conditions deemed appropriate.
c. Reject the application for the proposed acquisition or increase in control level.
3. The Authority shall review the application within 90 days of receiving a correctly completed request unless it decides to extend the period as deemed appropriate, in which case the applicant will be notified.

§Article 96 — Approval or Rejection

1. In exercising its regulatory authority, the Authority may:

a. Notify the applicant, and where appropriate, the licensed entity as soon as possible of its approval, conditional approval, or rejection, including conditions or reasons for rejection.

2. The person whose application is approved must comply with the related conditions of the approval.

3. The person whose application is rejected must not proceed with the acquisition or increase in control.

§Article 97 — Notification of Decrease in Control Level in the Licensed Entity

The controller in the licensed entity shall notify the Authority in the following cases:

1. When intending to cease being a controller.

2. When intending to reduce their share from more than 50% to 50% or less.

§Article 98 — Notification Requirements Regarding Control Changes in BranchesIf the licensed entity is a branch, the controller or any person intending to become a controller shall notify the Authority before taking any action regarding any of the following:
1. Becoming a controller.
2. The current controller intending to cease being a controller.
3. When the current controller’s share has:
a. Increased from less than 30% to 30% or more.
b. Increased from less than 50% to 50% or more.
c. Decreased from more than 50% to 50% or less.

§Article 99 — Obligations of the Licensed Entity Regarding the Controller1. The licensed entity shall establish adequate systems and controls to monitor:
a. Any changes related to its controllers.
b. Any significant changes in the behavior or circumstances of current controllers that could reasonably be seen as affecting the fitness, propriety, or ability of the licensed entity to manage its business in a sound and effective manner.
2. The licensed entity shall notify the Authority of any event specified in paragraph (1) herein as soon as possible after becoming aware of its occurrence, in accordance with paragraph (3) of this Article.
3. The licensed entity is not required to comply with the notification requirement in paragraph (2) herein if it has reasonable grounds to believe that the proposed or current controller has already obtained prior approval from the Authority or has notified the Authority of the event in accordance with the provisions of this chapter.
4. The licensed entity shall include the following in its annual report:
a. The name of each controller.
b. The current holding of each controller, expressed as a percentage.

§Article 100 — Powers of the Authority1. The Authority may, subject to paragraph (2) of this Article, reject a person as a controller in a licensed entity if that person:
a. Acquired or increased their level of control in the licensed entity without obtaining the Authority’s prior written approval as required under Article (94) of this Module.
b. Violated the provisions of Article (99) of this Module.
c. Is no longer acceptable to the Authority as a controller.
2. Where the Authority rejects a person as a controller in a licensed entity under paragraph (1), it shall provide the person with:
a. A notice outlining:
i. The reasons for the Authority's rejection.
ii. Any proposed conditions under which the Authority might approve the person’s control of the licensed entity.
b. A grace period to submit an appeal within 14 days of receiving the rejection notice or any longer period as agreed by the Authority.
3. As soon as reasonably possible after deciding on the appeal—or if no appeal is submitted after the expiration of the period for appeal, specified in paragraph (2)(b)—the Authority shall issue a final notice stating:
a. The withdrawal of the rejection and any conditions, or confirming that the person is an accredited controller.
b. Approval of the person as a controller subject to conditions specified in the notice.
c. Confirmation that the person is not accepted as a controller and shall dispose of the relevant holding.
4. If the Authority issues a final notice approving a person as a controller, the person shall comply with the conditions imposed by the Authority.
5. If the Authority issues a final notice declaring a person to be an unacceptable controller, the person shall dispose of their relevant holding within the period specified in the final notice.
6. The Authority shall also notify the licensed entity of any decision made under paragraph (3) of this Article.
7. If the Authority exercises its regulatory power under this Article to reject a person as a controller, impose conditions on approval, or require a person to dispose of their holding, the concerned person may refer the matter to the Appeals Committee.

Annex 1 — Virtual Asset Registration Notification Form

| Part One: Basic Information
| 1. Name / Type of Virtual Asset | | 2. Brief Description of the Asset | | 3. Dates (if any) | | Listing Date | | Project Launch Date | | Mining Date | | Token Issuance Date |
| 4. Issuing Entity or Organization (if any) | | 5. Trading Symbol | | 6. Primary Jurisdiction of the Virtual Asset – location of the main issuer. This does not refer to the developer's location, but rather where the main issuer is located or regulated (if any). | | Part Two: Regulatory Standards
| 1. Regulatory Status in Other Jurisdictions | | a. Has the virtual asset been assessed or approved for use by a recognized regulatory authority (e.g., a Financial Services or Securities Authority that is a member of international bodies such as the Financial Action Task Force (FATF), the International Organization of Securities Commissions (IOSCO), or a regulatory authority equivalent to the Authority and accepted by the Authority. | | b. Names of jurisdictions that recognize the virtual asset.
If yes, please provide details.
A recognized virtual asset refers to one that is listed on a trading platform, approved, or exempted.
| c. Details of regulatory assessments.
If yes, please provide details.
| d. Regulatory authorities that conducted the assessment. | | e. Date and outcome of the assessment (if any). | | 2. Virtual Asset Transparency | | a. Structure and purpose of the virtual asset | | b. Information on token distribution and sale (please provide details such as token economics, distribution method, and whether there is a concentration of tokens among a specific group or company) | | c. Protocols and consensus mechanisms used | | d. Independent audit reports | | e. Governance arrangements | | f. Names of founders and key persons | | g. Details of initial investors/shareholders (both minor and major) | | h. Availability of documentation and information to the public | | i. This information should include at a minimum: website, whitepaper, and token economics details. | | 3. Market Size, Liquidity, and Volatility | | a. Global market size of the virtual asset. This should include both the market capitalization at launch and the fully diluted value (FDV). | | b. Number of trading platforms where the virtual asset is listed (including both centralized exchanges (CEX) and decentralized exchanges (DEX)). | | c. Volatility analysis | | d. Price range over the past 12 months | | 4. Technology Used | | a. Description of the technology used and the underlying infrastructure | | b. Transaction fees, speed, and scalability | | c. Security measures in place. Please state whether there are mechanisms to protect holders of virtual asset from security breaches | | 5. Risk Management | | a. Governance risks | | b. Are the governance arrangements effective? | | Please include details of the governance structure. The listing entity shall have minimum standards for governance assessment. | | c. Legal and regulatory risks | | d. Past or potential legal challenges | | 6. Cybersecurity Risks | | Security measures to protect the virtual asset ecosystem. For example: is there a mechanism to deal with price collapse or if virtual assets are sent to a sanctioned entity? | | 7. Anti-Money Laundering and Market Manipulation Risks | | Policies and procedures of the virtual asset related to regulatory compliance | | 8. Other Financial Crime Risks | | Additional details | | Part Three: Legal Declaration
| We, the undersigned, hereby certify that the Virtual Asset complies with all of the above criteria, and we bear full responsibility for this cert, including the accuracy and truthfulness of all information and data provided in this form.

Annex 2 — Qualifications and Automatic Eligibility

The provisions of this annex apply to technical positions.
Article (2) Details Table | | Job Title | Academic Qualifications (Minimum Bachelor's Degree)
| Professional Qualifications | Grandfathering for Technical Roles to Obtain Accredited Person Status
| 1. | Financial Analyst |
• Finance
• Economics
• Accounting
• Business Administration
• Mathematics or Statistics (for quantitative analysis fields)
•CFA (Chartered Financial Analyst) •FRM (Financial Risk Manager) •CPA (Certified Public Accountant) •CMA (Certified Management Accountant) •CISI (Chartered Institute for Securities & Investment) •CFP (Certified Financial Planner)
| • Possess 5-10 years of professional experience.
• Held approved positions and/or roles in licensed financial institutions
• Have a proven track record of performing the required tasks for the job.
• Proof of professional experience through work certificates and/or recommendation letters or any other method.
| 2. | Investment Portfolio Manager | • Possess at least 7 years of professional experience in portfolio management.
• Have a proven track record of achieving agreed-upon performance objectives.
• Performance reports demonstrating continuous portfolio growth.
• Documentation proving compliance with risk management and fiduciary responsibilities.
• Proof of professional experience through work certificates and/or recommendation letters or any other method.
| 3. | Broker Representative | • Possess at least 5 years of professional experience in trading or executing client orders.
• Proof of professional experience through work certificates and/or recommendation letters or any other method.
Business Regulation Module
Part One: Introduction
Article (1) Definitions The following words and phrases shall have the meanings assigned to them below in this Decision or its Annexes, unless the context indicates otherwise:
| Multilateral Trading Facility: | A multilateral trading facility designated to virtual assets, in accordance with the Alternative Trading System Module.
| Soft Dollar Agreement: | An agreement between two licensed entities, such as a portfolio management entity and an operator of a multilateral trading facility, under which the first party receives research, tools, or related investment services; in return for routing transactions to the second party; instead of receiving direct monetary compensation.
| Execution Only Transaction: | A transaction executed by the licensed entity on behalf of the client without providing any advice or personal recommendations regarding the suitability of the transaction.
| Non-Market Price Transaction: | A transaction where the dealing rate or price paid by the licensed entity or its client materially differs from the prevailing market rate, or where either party provides value that materially exceeds or falls below the value received in return.
| Contingent Liability Investment: | An investment involving a potential future financial liability contingent upon the occurrence of a specific event, such as market fluctuations or the activation of contractual conditions- for example, margin trading, options, and futures contracts.
| Client Assets: | This includes: Client funds and virtual assets.
| Isolated Margin Trading: | A margin trading mechanism where the margin is allocated to a specific position separately from other positions.
| (Staking): | The process of locking virtual assets on a distributed ledger network to support its security, operations, and consensus mechanism in return for rewards.
| Digital Wallet: | As defined in Article (1) of the Alternative Trading System Module.
| Digital Wallet Service Provider (Third Party): | As defined in Article (1) of the Alternative Trading System Module.
| Self-Custody (Non-Custodial Wallet): | As defined in Article (1) of the Alternative Trading System Module.
| Financial Activities Rulebook: | Chairman of the Authority’s Board of Directors’ Decision No. (13/Chairman) of 2021 on Financial Activities Rulebook and Status Regularization Mechanisms
The provisions of this Module apply to every person conducting a financial activity specified in Article (12) of the General Framework Module within or from within the State.
Article (3) Overview
1. Part 2: outlines the conditions for providing financial services and Client agreements. Chapter One requires compliance with Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) laws. It classifies clients as retail, professional, or counterparty, with specific standards for each classification. Licensed entities shall document and periodically update client classifications. A professional investor is classified based on the nature of the activity, service provided, or personal evaluation, subject to conditions related to assets and expertise. Chapter Two covers Client agreements, mandating that licensed entities enter into an agreement with the client containing key information to enable informed decision-making. It also regulates Clients agreements amendments, requiring prior notice for retail clients. Entities may rely on agreements made by other entities within the financial group or from main branches. Agreements shall be available to the Authority upon request, with immediate notification if this becomes impossible.
2. Part 3: sets out the core rules for providing financial services, emphasizing the need for clear, fair, and non-misleading information, and appropriate marketing based on client classification. Licensed entities shall assess the suitability and appropriateness of investment services for retail clients and maintain documented results with periodic reviews. It governs conflict-of-interest management and disclosure of potential incentives to ensure transparency. Additionally, it requires recordkeeping of services and activities for a period of not (6) six years to ensure regulatory compliance.
3. Part 4: addresses additional controls related to financial services. This includes regulation of personal employee transactions to prevent conflicts of interest, with documentation of all related actions. It regulates the preparation and publication of investment research, ensuring objectivity and required disclosures. It enforces best execution pricing practices and prohibits non-market price trading, with records retained. It governs the handling and safeguarding of client assets and funds, requiring secure protection, and imposes strict margin trading standards like negative balance protection and prominent risk disclosures. Digital wallet services are also regulated, requiring compliance with security and technology standards and client asset segregation. Finally, the part obligates licensed entities to provide comprehensive and updated information on virtual assets, including risks, with transparency ensured through white papers and digital platform warnings.
Part Two: Service Conditions and Client Agreement
Chapter One: Financial Service Conditions
Article (4) Compliance with AML and CTF Requirements The licensed entity shall comply with the provisions of the Part on Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), and Countering Unlawful Organization Financing, the Regulations Rulebook, and any other applicable legislation in force within the State.
Article (5) Client Classification
1. Prior to providing a financial service to a person, the licensed entity shall classify the person as follows:
a. Retail Investor/ Client.
b. Professional Investor/ Client.
c. Counterparty.
2. The licensed entity shall classify any person as a retail client unless otherwise classified as a professional investor or counterparty.
3. A professional client may request reclassification as a retail client.
4. If the licensed entity knows that the person it intends to provide a service to or enter into a transaction with is acting as an agent for another party (the "principal"), the licensed entity shall treat the principal as the client unless the agent is another licensed entity or a regulated financial institution.
5. If the licensed entity intends to provide a financial service to a trust, the trustee – not the beneficiaries – shall be treated as the client, unless otherwise stated.
6. If a professional client no longer meets the requirements for such classification, the licensed entity shall notify them as soon as possible and explain available remedies.
7. The licensed entity shall obtain an annual declaration from the client confirming no change in classification data and update any such data at any time if changed. Classification shall be updated every (3) three years, with records maintained.
8. The licensed entity shall document and archive classification procedures and prepare a classification record for each client, including sufficient information and supporting documents.
Article (6) Retail Investor Any natural or legal person who does not qualify as a professional investor or counterparty.
Article (7) Professional Investor First: Professional by Nature:
| 1. International organizations whose members are countries, central banks, or national monetary authorities.
| 2. Governments and their entities, and authorities, whether investment or non-investment in nature, or companies wholly owned by any of them.
| 3. Central banks or other national monetary authorities in any country, jurisdiction, or legal authority.
| 4. Capital market institutions licensed by the Authority or an equivalent regulator.
| 5. Financial institutions.
| 6. Regulated financial institutions, a domestic or foreign investment fund, a regulated pension fund management company, or a regulated pension fund.
| 7. Any entity whose principal activity is investing in financial instruments, asset securitization, or financial transactions.
| 8. Any company whose shares are listed or admitted to trading on any market of a jurisdiction that is a member of IOSCO.
| 9. Trustees with assets of at least AED (35) million in the past 12 months.
| 10. Single-family office license holders, solely in relation to carrying out its activities in performing its duties as a single family office, and having assets of no less than AED 15 million.
| 11. Partnerships or unincorporated entities that have, or have had at any time during the previous two years, net assets of no less than AED 25 million; and in the case of a partnership, such net assets shall be calculated without deducting loans due to any of the partners.
| 12. Large undertakings that, as of the date of its most recent financial statements, satisfies at least two of the following requirements:
| | a. Total assets of not less than AED 75 million, before deducting short-term and long-term liabilities.
| | b. Net annual revenues of not less than AED 150 million.
| | c. The total of cash and investments in the statement of financial position, or the total authorized capital less the paid-up capital, is not less than AED 7 million.
Second: Professional by Service:
| 1. Engages in activities involving the provision of credit facilities for commercial purposes to any of the following:
| | a. The undertaking party.
| | b. The controller of the undertaking party.
| | c. Any member of the group to which the undertaking party belongs.
| | d. Any joint investment project in which the undertaking party participates.
| 2. A person who provides services for arranging credit facilities and investment transactions related to structuring and financing companies.
Third: Professional Investor (Assessed):
| 1. A natural person who owns net assets - excluding the value of their primary residence - of no less than AED 4 million.
| 2. A natural person who is certified by the Authority or by a similar supervisory authority, or employed by a licensed entity or a regulated financial institution, or who has been employed by either of them within the past two years, or possesses sufficient knowledge and experience in the investment at hand and its risks according to suitability standards. Whereas, represented by an entity licensed by the Authority in a manner that does not conflict with its licensing conditions.
| 3. A natural person who holds a joint account with a natural person who qualifies as an assessed professional investor under clause (1) of this Article (the primary account holder), if the following conditions are met:
| | a. The joint account holder shall be a family member of the primary account holder up to the second degree of kinship.
| | b. The account shall be used to manage the investments of the primary account holder and the joint holders.
| | c. A written confirmation from the joint account holder that investment decisions related to the joint account are made on their behalf by the primary account holder.
| 4. Any special purpose entity or special legal form, such as a trust or foundation, established solely to facilitate the management of the investment portfolio of a natural person who qualifies as an assessed professional investor under clause (1) of this Article.
| 5. The Undertakings meeting the following conditions:
| | a. The total of cash and investments in the statement of financial position, or the total authorized capital less the paid-up capital, is not less than AED 4 million.
| | b. Possesses sufficient experience and understanding of the markets, financial products, relevant financial transactions, and the associated risks according to suitability standards.
| 6. The undertaking that has:
| | a. A natural person controller who owns the majority of shares in a company or is able to control the majority of voting rights therein, or has the ability to appoint or remove the majority of its board members.
| | b. A holding or subsidiary company.
| | c. A joint investment project (a joint venture partner).
Article (8) Counterparty A licensed entity (by the Authority or an equivalent regulator) shall be considered a counterparty client if it is:
1. A Professional Investor (by Nature) as per Article 7/First
2. A Professional Investor (assessed) owned by a holding company deemed a Professional Investor (by Nature) as per Article 7/First/Clauses 8 or 12
Article (9) Reliance on External Classification
1. Subject to clause (2) of this Article, a licensed entity that is a head office, branch or a member of a financial group may rely on a client classification done by another group entity, provided it has reasonable grounds to believe the classification is substantially equivalent to the classification required in this chapter.
2. If there are gaps between the regulatory requirements applied on the licensed entity pursuant to this Chapter and the requirements based on which the client has been classified by other entity referred in clause (1) of this article, such reliance is not allowed unless those gaps are effectively addressed.
Chapter Two: Client Agreement
Article (10) Restrictions A licensed entity may not provide a financial service to or on behalf of any person unless:
1. A client agreement has been executed that includes the key information specified in Annex (1), and is signed between the licensed entity and that person; or in accordance with the requirements set out in Article (11) of this Chapter.
2. Prior to executing the client agreement with the person, the licensed entity shall have provided that person with the key information referred to in Clause (1) sufficiently in advance to enable them to make an informed decision regarding the relevant financial service.
Article (11) Amendments to the Client Agreement If the client agreement provided to a Retail Client allows the licensed entity to amend the agreement without the client’s prior written consent, the licensed entity shall notify the client at least 14 days in advance prior to providing any financial service to that client based on the amended terms.
Article (12) Reliance on a Client Agreement Executed by Another Entity
1. The licensed entity may rely on a client agreement executed in accordance with the requirements set out in Clauses (2) or (3) of this Article, without prejudice to the minimum key information specified in Annex (1).
2. For the purposes of Clause (1) of this Article, if the licensed entity is a branch, it may rely on a client agreement entered into by the head office or any other branch within the financial group, provided that:
a. The client agreement clearly and adequately applies to the financial services provided by the branch; and
b. The licensed entity ensures that the client agreement is available to the Authority upon request.
3. For the purposes of Clause (1), the licensed entity may rely on a client agreement entered into by another member of its financial group if:
a. That member is providing a financial service; and
b. The client agreement clearly states:
i. The financial service provided by the licensed entity; and
ii. That the client’s rights in relation to clause (i) are enforceable against the licensed entity; and
c. The licensed entity ensures that the client agreement is available to the Authority upon request.
4. The licensed entity shall immediately notify the Authority if, for any reason, it can no longer provide unrestricted access to the client agreement as required under Clauses (2) or (3) of this Article.
Part Three: Key Controls
Chapter One: Communication Regarding Information and Marketing Materials
1. The Licensed Entity shall, when providing information to any person concerning a Virtual Asset or Financial Service, take reasonable steps to ensure that the information provided is clear, fair, and not misleading.
2. The Licensed Entity shall not, in any form of communication with any person, including in the conclusion of agreements, seek to exclude or restrict any duty or liability it may owe to that person or any other person under the applicable laws in the State.
3. Where any provision under the Business Regulations requires information to be provided to a Client, the Licensed Entity shall ensure that such information is delivered directly to the Client and not to any other person, unless otherwise instructed in writing by the Client.
Article (14) Marketing Materials
1. The Licensed Entity shall ensure that any Marketing Material provided to a person contains the following information:
a. The name of the Authorized Firm providing the Marketing Material or on whose behalf it is being provided.
b. The regulatory status of the Licensed Entity, as required under Article (64) of the General Framework Module.
c. If the Marketing Material is directed exclusively to a Professional Investor or Counterparty, it shall include a clear statement to that effect and that no person other than those identified should act on it.
2. The Marketing Material referred to in clause (1) of this Article includes any invitation or incentive to enter into an agreement that:
a. Relates to a Virtual Asset or the provision of a Financial Service by the Licensed Entity.
b. Relates to a Virtual Asset or Financial Service offered by another entity.
3. A Licensed Entity providing Marketing Material under subparagraph (b) of clause (2) of this Article shall:
a. Ensure that the Marketing Material complies with the applicable laws of the State and the Regulations of the Authority.
b. Not distribute the Marketing Material if it becomes aware that the entity providing the relevant Virtual Asset or Financial Service has breached applicable regulatory requirements in relation to that asset or service.
4. The Licensed Entity shall take reasonable steps to ensure the following:
a. That any Marketing Material directed to Professional Investors is not sent or directed to Retail Investors.
b. That no person communicates or uses the Marketing Material on behalf of the Licensed Entity in a manner that breaches the requirements of this Chapter.
Article (15) Past Performance and Projections
1. The Licensed Entity shall ensure that any information or statements relating to past performance, or future expectations based on past performance or other assumptions, provided to targeted Retail Clients:
a. Present a fair and balanced view of the Virtual Assets or Financial Services to which the information or statements relate.
b. Clearly and understandably indicate the source of the past performance information and any key facts or assumptions used in this context.
c. Include a prominent warning that past performance is not necessarily a reliable indicator of future results.
Chapter Two: Suitability
1. The provisions of this Section shall not apply to a Licensed Entity that:
a. Provides a Financial Service to a Professional Investor or Counterparty.
b. Carries out Execution-Only Transactions.
c. Operates a Multilateral Trading Facility.
2. The client suitability assessment requirements shall be applied at the commencement of the client relationship and thereafter upon any material change in the client’s investment status or available information, or upon the offering of new products or services. In all cases, such assessment shall be updated every three (3) years, while retaining all declarations and updates.
Article (17) Suitability Standards
1. The licensed entity that provides a recommendation or investment advice to the client regarding investment in a virtual asset or a financial service, or that performs (Execution Transaction) on a discretionary basis on behalf of the client in relation to a virtual asset, shall comply with the client suitability standards as follows:
a. The client’s experience, which shall be assessed through the following:
i. The types of financial services, activities, investments, or virtual assets with which the client is familiar and knowledgeable.
ii. The nature, volume, and frequency of the client’s transactions in financial services, activities, investments, or virtual assets.
iii. The client’s educational background, as well as current and previous occupations.
b. The client’s financial position and capacity, which shall be assessed through the following:
i. The source and amount of the client’s regular income and expenses.
ii. The client’s assets, property, and investments.
iii. The client’s regular financial obligations.
iv. The client’s ability to bear losses and risks, including the types and maximum levels of such risks.
c. The client’s investment objectives, which shall be assessed through the following:
i. The client’s preferred investment options relating to virtual assets.
ii. The investment goals or purposes relating to virtual assets in terms of duration and value.
Article (18) Suitability Report The Licensed Entity shall prepare a Suitability Report for the Client that includes the following:
1. Acknowledgment of the Client’s awareness of the need to provide current, accurate, and truthful information to the Licensed Entity, and understanding the questions directed to them.
2. Confirmation that a proper and reliable assessment was made of the Client’s knowledge, experience, and ability to bear risk and loss.
3. Statement of the evaluation tools and mechanisms used and their appropriateness.
4. A detailed statement of the recommendation provided or the standards used by the Licensed Entity to consider the Virtual Asset to be complex, along with its nature, characteristics, and risks.
5. A statement explaining the reasons for the suitability or unsuitability or the Virtual Asset for the Client, and how it meets the client’s objectives, including the client’s risk attitude and their ability to bear such risks and losses.
6. Evidence of the periodic review and update of the Client’s Suitability Standards, the recommendation, and the Virtual Asset’s features and risks provided to the client based on those standards, and the manner in which such updates and reviews are conducted.
Article (19) Suitability Assessment
1. The licensed entity shall comply with the following when assessing the suitability of the client:
a. Take the necessary actions and measures to ensure that the information provided by the client is accurate, complete, and up-to-date, and that the recommendation or investment in the virtual asset is suitable for the client and does not contradict the result of the suitability assessment.
b. Refrain from providing any recommendation or executing any transaction in the virtual asset for the client where sufficient information is not obtained that would enable the licensed entity to assess the client's suitability. The client shall be notified accordingly.
2. Following the suitability assessment, the licensed entity shall:
a. Provide the client with sufficient information to assess the benefits, costs, and risks of investing in the virtual asset, including a disclosure of any potential risks the client may be exposed to.
b. Inform the client as to whether the investment in the virtual asset is suitable or unsuitable for them, and whether it meets the suitability standards, while retaining a record of such notification.
c. In the event the client insists on proceeding with the execution after being informed that the investment in the virtual asset or the financial service is unsuitable, retain evidence of the client's insistence and the warning issued by the entity disclaiming liability.
3. Retain suitability assessment reports for clients and provide them to the Authority upon request.
4. Update internal procedures to ensure compliance with the suitability standards requirements.
Article (20) Documentation and Archiving of Suitability Procedures The Licensed Entity shall document and archive all Suitability procedures in accordance with record-keeping regulations and updates for a period of six (6) years.
Chapter Three: Appropriateness
1. This Chapter applies to a Licensed Entity that provides Execution-Only Transactions to Retail Clients in relation to a Virtual Asset or Financial Service.
2. The client appropriateness assessment requirements shall be applied at the commencement of the client relationship and thereafter upon any material change in the client’s investment status or available information, or upon the offering of new products or services. In all cases, such assessment shall be updated every three (3) years, while retaining all declarations and updates.
Article (22) Appropriateness Standards A Licensed Entity conducting Execution-Only Transactions shall meet the following Appropriateness Standards for the Client:
1. The Client’s knowledge and understanding of the relevant Financial Services, activities, investments, or Virtual Assets.
2. The nature, volume, and frequency of the Client’s relevant transactions.
3. The Client’s educational background and current and previous occupation.
4. The appropriateness of the Virtual Asset or Financial Service to the Client based on collected data.
5. The appropriateness of the target Trading Facility for the Client based on collected data.
Article (23) Appropriateness Report The Licensed Entity shall prepare an Appropriateness Report for the Client containing the following:
1. The Virtual Assets or Financial Services intended for execution.
2. The result of the appropriateness assessment.
3. Justification of the appropriateness or inappropriateness of the execution.
Article (24) Appropriateness Assessment When assessing appropriateness, the Licensed Entity shall:
1. Exercise due diligence to enhance the Client’s understanding of Virtual Assets and Financial Services by providing necessary information.
2. Notify the Client of the inappropriateness of the execution and maintain a record of such notification.
3. Refrain from executing transactions in the absence of sufficient information from the Client to conduct an appropriateness assessment and notify the Client.
4. If the Client insists on execution despite being informed of its inappropriateness, retain evidence of the Client’s insistence and the warning with a disclaimer of liability.
5. Retain Appropriateness Reports for Clients and provide them to the Authority upon request.
6. Update internal procedures to ensure compliance with Appropriateness Standards.
Article (25) Documentation and Archiving of Appropriateness Procedures The Licensed Entity shall document and archive all Appropriateness procedures in accordance with record-keeping regulations and updates for a period of six (6) years.
Chapter Four: Conflict of Interest
Article (26) Fair Treatment
1. The licensed entity shall take reasonable steps to ensure the identification, prevention, or management of actual and potential conflicts of interest between the licensed entity and its clients, and between one client and another. This shall be done in a manner that ensures that the interests of clients are not adversely affected, and that all clients are treated fairly and without bias due to such conflicts.
2. When the licensed entity becomes aware of an actual or potential conflict of interest, it shall prevent or manage such conflict using one or more of the following arrangements, as appropriate:
a. Establishing and maintaining an effective "Chinese Wall" to limit the flow of relevant information.
b. Disclosing the conflict of interest to the client in writing, either generally or in relation to a specific transaction.
c. Relying on a written independence policy that requires the employee to disregard any conflict of interest when advising the client or exercising discretion.
3. If the licensed entity is unable to prevent or manage an actual or potential conflict of interest as described in clause (2) of this article, it shall refrain from providing services to that client.
Article (27) Attribution of Knowledge If a provision of this Module "the Business Regulation Module" requires a licensed entity to act on the basis of certain knowledge, the entity will not be considered to have such knowledge if the individuals acting on its behalf do not possess it due to a "Chinese Wall" established under clause (2/a) of Article (26) of this Module.
Article (28) Incentives
1. The licensed entity shall establish systems and controls, including policies and procedures, to ensure that it or any of its employees or affiliates do not offer or accept incentives such as commissions or other direct or indirect benefits, if it is reasonably likely that such incentives would conflict with the provisions of Article (26) of this Module.
2. Subject to clause (3) of this article, before recommending a virtual asset or executing a transaction on behalf of a retail client, the licensed entity shall disclose to that client any commission or direct or indirect benefit it or any employee or affiliate has received or will receive as a result of the recommendation or transaction.
3. The licensed entity is not required to disclose details of incentives to the retail client under clause (2) of this article if:
a. It has reasonable grounds to believe that the retail client is already aware of the relevant incentives.
b. The transaction is an execution-only transaction.
c. The transaction is executed under a discretionary portfolio management agreement on behalf of the client.
4. The licensed entity may provide the information required under clause (2) of this article in summary form, provided that the client is informed that further details are available upon request and the entity responds to such request.
Article (29) Acceptance of Goods and Services Under a Soft Dollar Agreement
1. A licensed entity may accept goods and services under a soft dollar agreement only if the goods and services are reasonably expected to contribute to the provision of virtual asset services to its clients. This includes, but is not limited to, providing specific advice, research, analysis, financial analysis tools, portfolio valuation, or performance measurement services.
2. Under a soft dollar agreement, the licensed entity may not deal in virtual assets as an agent on behalf of a client, directly, indirectly, or through any intermediary, unless:
a. The agreement is in writing and pertains to the provision of goods or services, provided such goods or services are not in the form of cash or any other direct financial benefit.
b. The intermediary’s execution of transactions complies with best execution obligations.
c. The licensed entity has taken reasonable steps to ensure the services provided by the intermediary are competitive and do not result in price disadvantages compared to other options, taking into account the client’s interest.
d. The licensed entity has taken reasonable steps to ensure the commission paid under the agreement is sufficient to cover the value of the goods or services to be received and execution costs, in cases where the intermediary acts as principal.
e. The licensed entity has provided adequate disclosure in accordance with clauses (4) and (5) of this article.
3. Before entering into a transaction on behalf of a retail or professional investor, directly or indirectly, with or through another person under a soft dollar agreement the licensed entity holds or knows another group member holds with that person, it shall disclose to its client:
a. The existence of the soft dollar agreement.
b. The licensed entity’s or its group’s policy regarding soft dollar agreements.
4. Where the licensed entity or a group member has a soft dollar agreement under which the licensed entity or group member deals on behalf of a client, it shall provide the client with the following information:
a. The percentage paid under the soft dollar agreement out of total commissions paid by the licensed entity or another group member involved in the agreement.
b. The value of goods and services, based on cost price, received under the soft dollar agreements, expressed as a percentage of the total commissions paid by the licensed entity or other group members.
c. A summary of the nature of the goods and services received under the soft dollar agreements.
d. The total commissions paid from that client’s portfolio.
5. The licensed entity shall provide the information mentioned in clause (4) of this article to the client at least once annually.
Chapter Five: Records
Article (30) Requirements The licensed entity shall maintain adequate records related to each activity and function it performs for a period of no less than six (6) years. These records shall include, where applicable:
1. Any marketing materials issued by or on behalf of the licensed entity.
2. Any virtual assets or financial services provided to the client, and all advice or recommendations given to the client.
3. The client agreement, including any subsequent amendments agreed upon with the client.
4. Suitability and appropriateness assessment reports carried out by the licensed entity to demonstrate compliance with the provisions of Chapters Two and Three of this section.
5. Records to demonstrate compliance with the requirements related to incentives under Chapter Four, including any disclosures provided to clients under that chapter, and, where any goods or services have been received by the Licensed Entity under a “Soft Dollar Agreement", and details regarding any goods or services received under a soft dollar agreement.
6. Any other disclosures provided to clients.
Article (31) Retention Period For the purpose of applying Article (30) of this Module, the six (6) year retention period for records shall begin as follows:
1. For the requirement in clause (1) of Article (30) of this Module, from the date the last marketing material was provided to the person.
2. For the requirements in clauses (2–4) of Article (30) of this Module, from the date the client ceases to be a client of the licensed entity.
3. For the requirement in clause (5) of Article (30) of this Module, from the date the relevant incentives were last received.
Part Four: Additional Controls
Chapter One: Personal Transactions by Employees of the Licensed Entity
Article (32) Conditions for Employee Personal Transactions
1. The licensed entity shall establish, update, and maintain adequate policies and procedures to ensure the following:
a. An employee does not engage in a personal transaction for their own account unless:
i. The licensed entity, through written notice, informs the employee of the conditions under which personal transactions may be carried out, and such notice forms part of the employee’s employment or service agreement.
ii. The licensed entity has given written authorization to the employee for that transaction or for transactions in general.
iii. The transaction does not conflict with the licensed entity’s duties to its clients.
b. The licensed entity receives immediate notice of, or becomes aware of, any personal transactions carried out by the employee.
c. Where personal transactions are carried out with the licensed entity, each employee’s account shall be clearly identified and distinguished from other client accounts.
2. The written notice mentioned in clause (1/a) of this article shall clearly state that if an employee is prohibited from conducting a personal transaction, they shall refrain from the following, except for what is required in the course of their official duties:
a. Assigning another person to enter into such a transaction.
b. Communicating any information or opinion to another person if the employee knows, or should know, that the person will enter into such a transaction or instruct another to do so as a result.
3. If the licensed entity takes reasonable steps to ensure that the employee is not materially involved in or does not have access to information about the licensed entity's investment activities, the entity is not required to comply with clause (1) of this article in relation to that employee.
4. The licensed entity shall establish, update, and maintain procedures and controls to ensure that a financial analyst does not conduct personal transactions in an investment if the analyst is preparing an investment research report on:
a. That virtual asset or its issuer.
b. An investment related to that virtual asset or its issuer.
This prohibition remains until the research report is published or made available to the licensed entity's clients.
Article (33) Record Keeping
1. The licensed entity shall keep a record including the following:
a. The written notice specifying the conditions for personal transactions under clause (1/a/i) of Article (32) of this Module.
b. All authorizations granted or denied by the licensed entity under clause (1/a/i) of Article (32) of this Module.
c. All notifications submitted to the licensed entity under clause (1/b) of Article (32) of this Module.
d. The basis on which the licensed entity confirmed that the employee is not materially involved in or does not have access to investment information under clause (3) of Article (32) of this Module.
2. These records shall be retained for at least six (6) years from the date of:
a. For clauses (1/a) and (1/d) of this article, termination of the employee’s employment contract.
b. For clause (1/b) of this article, each authorization granted or denied by the licensed entity.
c. For clause (1/c), each notification submitted to the licensed entity.
Chapter Two: Investment Research
The provisions of this chapter apply to licensed entity that prepare or publish investment research.
Article (35) Requirements A licensed entity that prepares and publishes investment research shall establish adequate procedures and controls to ensure the following:
1. Effective supervision and management of financial analysts.
2. Proactive management of actual or potential conflicts of interest in accordance with Chapter Four of this Module.
3. That investment research issued to clients is objective and unbiased.
4. That investment research includes the disclosures stipulated under Articles (36) and (37) of this Module.
Article (36) Disclosures Related to Investment Research When publishing investment research, a licensed entity shall take reasonable steps to ensure that the research includes:
1. A clear identification of the types of clients the research is primarily intended for.
2. A distinction between facts and opinions or estimates, including references to data sources and any assumptions used.
3. The initial publication date of the research.
4. The time period covered by evaluations or recommendations.
5. A clear and unambiguous explanation of the rating or recommendation system used.
6. A breakdown of the proportions of different ratings or recommendations, as follows:
a. For all virtual assets.
b. For virtual assets, where the licensed entity has conducted corporate finance activities with or on behalf of the issuer in the past 12 months.
7. A clear warning, when the research is intended only for professional clients or eligible counterparties, that it should not be relied upon or distributed to retail clients.
Article (37) Publication A licensed entity shall take reasonable steps to ensure that, when publishing investment research or when a representative of the entity appears publicly, the following are disclosed:
1. Any financial interest or material interest held by the financial analyst or any of their second-degree relatives related to the virtual asset.
2. The reporting structure for financial analysts and their compensation arrangements if such could reasonably give rise to a conflict of interest affecting the objectivity of the investment research.
3. Any holding of 1% or more of the total issued share capital of the issuer by the licensed entity or any of its partners.
4. Any holding of 1% or more of the total number of virtual assets of the same type issued.
5. Whether the licensed entity or its partner acts as a broker for the issuer.
6. Any material holding the issuer has in the licensed entity.
7. Any corporate finance activities carried out by the licensed entity with or on behalf of the issuer in the past 12 months and any related future initiatives.
8. Whether the licensed entity acts as a market maker for the virtual asset.
Article (38) Restrictions on Licensed Entity Transactions
1. A licensed Entity is prohibited from executing a proprietary transaction in a virtual asset or related investment that is the subject of an investment research report prepared by the licensed entity, until the clients for whom the investment research was primarily prepared have been given a reasonable opportunity to act upon it.
2. The restriction under clause (1) of this Article shall not apply if:
a. The licensed Entity is acting as a market maker in the relevant virtual asset; or
b. The licensed Entity is executing an execution-only transaction.
Chapter Three: Best Execution
1. The provisions of this chapter do not apply to a licensed entity in relation to any transaction:
a. Executed with a counterparty.
b. Executed for non-discretionary portfolio management purposes.
c. That is execution-only transaction.
d. Executed on a Multilateral Trading Facility (MTF) operated by the entity.
2. When executing an execution-only transaction with or on behalf of a client, the licensed entity is not exempt from providing best execution for any aspect of the transaction outside the client's specific instructions.
Article (40) Best Execution
1. When a licensed entity agrees or decides, in its discretion, to execute a transaction with or on behalf of a client in a virtual asset, it shall provide best execution.
2. A licensed entity is considered to have provided best execution if it takes reasonable care to determine the best overall available price for that virtual asset under prevailing market conditions and transacts at no less advantageous a price for the client.
Article (41) Requirements
1. In determining whether the Licensed Entity has exercised reasonable care to provide the client with the best overall execution price in accordance with Article (40) of this Chapter, the Authority shall consider whether the Licensed Entity has:
a. Deducted any fees or charges that were previously disclosed to the client;
b. Not applied any mark-up or mark-down to the price at which the transaction was executed, unless such adjustment was disclosed to the client;
c. Taken into account price competition or the availability of multiple pricing sources for the execution of client transactions. In cases where the licensed entity has access to prices from regulated financial markets or alternative trading systems, the licensed entity shall execute the transaction at the best overall available execution price after considering all relevant factors.
2. Where another person is responsible for executing the transaction, the licensed entity may rely on that person to provide best execution, provided that such person has undertaken to provide best execution in accordance with this Chapter.
Chapter Four: Off-Market Transactions
1. Subject to clause (2) of this Article, the provisions of this chapter apply to the licensed entity regardless of the client classification.
2. The provisions of this chapter do not apply to a client receiving services from a Multilateral Trading Facility (MTF).
Article (43) Prohibitions The licensed entity shall not enter into an off-market transaction, in any capacity and with or on behalf of a client, unless it has taken reasonable steps to ensure that the client is not entering into the transaction for an unlawful purpose.
Article (44) Recordkeeping The licensed entity shall prepare and maintain, for a period of no less than six (6) years, a record of the steps taken in relation to each transaction under this chapter.
Chapter Five: Order Aggregation and Allocation
The provisions of this chapter do not apply to a licensed entity in relation to any transaction executed with a counterparty.
Article (46) Order Aggregation A licensed entity may aggregate a client’s order with orders of other clients or with an order for its own account only in the following cases:
1. It is unlikely that the aggregation will disadvantage any of the clients whose orders are aggregated.
2. The licensed entity has disclosed in writing to the client that their order may be aggregated and that the effect of aggregation may sometimes be disadvantageous.
3. The licensed entity has recorded the intended basis for allocation and the identity of each client prior to order execution.
4. The licensed entity has written policies and standards regarding aggregation and allocation that are applied consistently, and these policies shall include the approach to be taken if only part of the aggregated order is executed.
Article (47) Allocation When a licensed entity aggregates a client’s order with orders of other clients or with an order for its own account and the aggregated order is executed in whole or in part, it shall:
1. Allocate the relevant virtual assets immediately.
2. Allocate the virtual assets in accordance with the client agreement.
3. Ensure that the allocation is carried out fairly and consistently without giving undue preference to itself or any of the parties it acted on behalf of it.
4. Prepare and maintain a record that includes:
a. The date and time of the allocation.
b. The relevant virtual assets.
c. The identity of each concerned client.
d. The amount allocated to each client and to the licensed entity, with the allocation properly documented.
Article (48) Recordkeeping The licensed entity shall retain the records required under Articles (46) and (47) of this chapter for six (6) years from the date of allocation.
Chapter Six: Voice and Electronic Communications
1. Subject to clause (2) of this Article, the licensed entity shall take reasonable steps to ensure the creation and retention of recordings of its voice and electronic communications when such communications are with a client or with another person in connection with a commercial transaction, including the receipt or transmission of related instructions.
2. Clause (1) of this Article does not apply to voice or electronic communications that are not intended to result in a specific transaction but are general discussions or communications about market conditions.
Article (50) Requirements for Retaining Voice and Electronic Communications
1. The licensed entity shall be able to demonstrate immediate accessibility to all records.
2. The licensed entity shall retain records in an intelligible format or be able to promptly reproduce them in an intelligible format.
3. The licensed entity shall establish and implement appropriate procedures to prevent unauthorized alteration of its records.
Article (51) Order and Transaction Records
1. When the licensed entity receives an order from a client or decides to execute a transaction on a discretionary basis, it shall immediately create a record containing the information outlined in Annex (2).
2. When the licensed entity executes a transaction, it shall immediately create a record containing the information outlined in Annex (2)
3. When the licensed entity transmits a client order to another person for execution, it shall immediately create a record containing the information outlined in Annex (2).
Article (52) Recordkeeping The licensed entity shall retain the records referred to in Articles (50) and (51) for no less than six (6) years.
Chapter Seven: Other Conduct Requirements
1. The provisions of this chapter, except for Article (59), do not apply to the licensed entity in relation to any transaction with a counterparty.
2. The provisions of this chapter do not apply to the licensed entity in relation to any transactions it conducts on a Multilateral Trading Facility (MTF) that it operates.
Article (54) Excessive Trading (Churning)
1. The licensed entity shall not, at its discretion, execute a transaction on behalf of a client or advise any client to enter into transactions with such frequency or volume that may be considered excessive trading (churning).
2. It is the responsibility of the licensed entity to ensure that such transactions were fair and reasonable at the time they were entered into.
Article (55) Timely Execution 1.Once the licensed entity agrees to or decides to enter into a transaction on behalf of a client, it shall do so as soon as reasonably practicable.
2.The licensed entity may delay the execution of the transaction mentioned in clause (1) if it has taken reasonable steps to ensure that the delay serves the client's best interest.
Article (56) Fair and Priority-Based Treatment The licensed entity shall treat its own transactions and client transactions fairly and in accordance with the priority of order receipt.
Article (57) Volume-Weighted Average Price (VWAP)
1. The licensed entity may execute a group of transactions on behalf of a client during a single trading day or another agreed-upon period, to achieve a specific investment decision or objective, or to fulfill aggregated orders.
2. If the licensed entity does so, it may determine a uniform price for the transactions executed during that period, calculated as the volume-weighted average price of the different prices within that group of transactions.
Article (58) Timely Allocation 1.The licensed entity shall ensure the immediate allocation of any transaction it executes.
2.The allocation shall be:
a. To the client’s account based on their instruction upon which the transaction was executed.
b. For discretionary transactions, to the account of the client(s) for whom the licensed entity made and recorded a prior decision to execute the transaction.
c. In all other cases, to the licensed entity’s own account.
Article (59) Direct Electronic Access Where the licensed entity provides a client (including a counterparty) with direct electronic access to a licensed multilateral trading facility, it shall continuously establish, update, and maintain appropriate and effective policies, procedures, systems, and controls to prevent the client from submitting an order that would cause the licensed entity to exceed its current position or credit limits.
Chapter Eight: Trade Confirmations
The provisions of this chapter do not apply to the licensed entity in relation to any transaction with a counterparty.
Article (61) Sending Trade Confirmations
1. When the licensed entity executes a transaction in a virtual asset on behalf of a client, it shall send a trade confirmation notice to the client as soon as possible, in all cases, no later than two (2) business days of the date of the execution of the transaction.
2. If the licensed entity executes a transaction or series of transactions in accordance with Article (57) of this Module, it shall send a trade confirmation notice relating to those transactions as soon as possible and, in all cases, no later than two business days from the execution of the last transaction.
3. The confirmation notice shall include transaction details as outlined in Annex (3).
4. The licensed entity is not required to send a confirmation notice if a professional client has provided written notice of their preference not to receive such confirmations.
Article (62) Recordkeeping The licensed entity shall retain a copy of each trade confirmation sent to a client for a period of no less than six (6) years from the date of dispatch.
Chapter Nine: Periodic Statements
The provisions of this chapter do not apply to the licensed entity in relation to any transaction with a counterparty.
Article (64) Investment Management and Contingent Liability Investments
1. When the licensed entity does any of the following:
a. Acts as a portfolio manager for a client.
b. Holds uncovered open positions in a contingent liability investment.
2. For the purposes of clause (1), the licensed entity shall provide the client with a periodic statement containing the matters set out in Annex (4), within the following timeframes:
a. Every six (6) months.
b. Monthly, if the client's portfolio contains an uncovered open position in a contingent liability investment.
c. Any alternative frequency agreed with the client, provided it is at least once a year.
Article (65) Recordkeeping The licensed entity shall retain a copy of each periodic statement provided to a client for period not less than six (6) years from the date of delivery.
Chapter Ten: Client Assets
This chapter applies to a licensed entity that:
1. Holds or controls client virtual assets.
2. Provides custody services.
Article (67) General Requirements
1. A licensed entity that holds or controls client assets shall comply with Chapter Eleven of this Part.
2. A licensed entity that holds or controls virtual assets of clients or provides custody services for virtual assets shall comply with Chapter Twelve.
3. The licensed entity shall establish systems and controls to ensure client assets are identifiable and secure at all times.
4. Where the licensed entity holds authorization or discretionary authority over an account in the client’s name with a third party, its systems and controls shall include:
a. An updated list of all such authorities and any conditions set by the client or the licensed entity.
b. Details of procedures and authorizations related to giving and receiving instructions under such authority.
c. Assurance that all transactions carried out using the authority are recorded and within the scope of responsibilities of the licensed entity and its relevant employees.
Article (68) Holding or Controlling Client Assets Client assets are deemed to be held or controlled by the licensed entity if they are:
1. Held directly by the licensed entity.
2. Held in an account in the name of the licensed entity.
3. Held by a person, or in an account in the name of a person, controlled by the licensed entity.
4. Held in the client’s name, but the licensed entity holds authorization or has discretionary authority to manage those assets.
Article (69) Recordkeeping
1. The licensed entity shall maintain:
a. Records that demonstrate compliance with Article (67) of this chapter.
b. Records that demonstrate and explain all entries related to assets held or controlled.
2. The licensed entity shall maintain records referred to in clause (1) for a period of not less than six (6) years.
Chapter Eleven: Client Funds
The provisions of this chapter apply to all funds held or controlled by the licensed entity on behalf of clients in the course of, or in connection with, conducting virtual asset investment business.
Article (71) Client Funds Holding Requirements
1. A licensed entity that holds or controls Client Funds on their behalf shall comply with the provisions set out in Annex (5).
2. If the client is a counterparty, the licensed entity may be exempt from complying with the Client Funds Holding rules, provided it obtains prior written consent from the client.
Article (72) Recordkeeping 1.The licensed entity shall maintain records as follows:
a. Records that demonstrate compliance with Article (71) of this chapter.
b. Records that demonstrate and explain all entries related to the funds held or controlled under this chapter.
2. The licensed entity shall retain the records mentioned in Clause (1) of this Article for period not less than six (6) years.
Chapter Twelve: Client Assets in Virtual Assets
Article (73) General Requirements
1. The Licensed Entity shall treat all virtual assets held or controlled on behalf of the client, during or in connection with the conduct of virtual asset business, as client virtual assets.
2. The Licensed Entity that holds or controls client virtual assets shall have systems and controls in place to ensure the appropriate protection of such assets.
3. Subject to paragraph (1) of this Article, the Licensed Entity that holds or controls client virtual assets and/or provides custody services shall do so in accordance with the safe custody provisions set out in Annex (6).
4. The safe custody provisions in Annex (6) do not apply to client virtual assets held as Collateral, unless otherwise stated.
Article (74) Holding of Collateral
1. Before holding collateral provided by the client, the Licensed Entity shall disclose to the client the basis and any terms governing how such collateral will be held, including any rights the Licensed Entity may have to liquidate the collateral.
2. Before depositing client collateral with a third party, the Licensed Entity shall notify the third party of the following:
a. The collateral does not belong to the Licensed Entity and shall therefore be held in a segregated client account clearly labeled as belonging to the clients of the Licensed Entity.
b. The third party has no right to assert any lien, retention, or sale of the collateral except to cover obligations owed to the third party resulting from the deposit, pledge, other arrangement, or any related administrative or custodial fees.
3. The Licensed Entity may permit a third party to hold client collateral only if it has reasonable grounds to believe the third party is and will remain qualified to hold such collateral.
4. The Licensed Entity shall be able to demonstrate to the Authority the basis on which it considered the third party qualified to hold client collateral.
5. The Licensed Entity shall take reasonable steps to ensure the proper protection of the collateral.
6. The Licensed Entity shall withdraw the collateral from the third party if it is not properly protected unless the client provides written instructions otherwise.
7. The Licensed Entity holding client collateral shall send a statement every six months to the client in accordance with Article (9) of Annex (6).
8. The Licensed Entity shall conduct a reconciliation of client collateral in accordance with Article (10) of Annex (6).
Article (75) Record Keeping
1. The Licensed Entity shall maintain records as follows:
| | a. Records demonstrating compliance with this Chapter of this Part.
| | b. Records that prove and detail all entries related to client virtual assets and collateral held or controlled in accordance with this Chapter.
2. The Licensed Entity shall retain the records referred to in clause (1) for a period of not less than six (6) years.
Chapter Thirteen: Margin Trading
The provisions of this Chapter apply to the Licensed Entity when dealing in virtual assets as an agent and when operating a multilateral trading facility (MTF).
Article (77) Marketing Materials The Licensed Entity shall prominently and clearly display links to the risk disclosure statement regarding margin trading and the use of leverage on the homepage of its website and in all marketing, educational materials, and other communication channels, as well as part of every warning or disclaimer presented clearly on its website.
Article (78) Risk Disclosure Statement | 1. Before opening a margin trading account for a Retail Client, the Licensed Entity shall:
| | a. Provide a separate risk disclosure statement, as specified in clause (3) of this Article, to the Retail Client as part of the account opening process and before any trading occurs on the Retail Client's behalf.
| | b. Obtain a documented acknowledgment from the Retail Client confirming receipt, review, understanding, and acceptance of the risks associated with margin trading, and provide the client with a copy of the acknowledgment.
| | c. Maintain a record of these acknowledgments as part of its recordkeeping obligations.
| 2. The Licensed Entity shall ensure the risk disclosure statement is always published and accessible on its website.
| 3. The risk disclosure statement provided to the Retail Client, according to clause (1) of this article, shall include the following:
| | a. A statement that the risk disclosure may not cover or identify all risks associated with margin trading.
| | b. A warning that the Retail Client is at risk of losing all funds held in the account and all unrealized profits from open positions.
| | c. A statement that margin trading, especially when leverage is used, magnifies losses.
| | d. A clarification that margin limits, stop-loss limits, or other mechanisms intended to limit losses may not be effective or may fail. Where appropriate, it shall explain stop-loss orders, clearly indicating whether the stop-loss is guaranteed or not. For example, a guaranteed stop-loss operates regardless of market conditions, while a non-guaranteed stop-loss may not prevent loss during volatile trading conditions in the asset, the underlying asset, or the reference price.
| | e. The risk of price slippage, representing the difference between the price at the time of placing the order and the price at which it was executed.
| | f. A warning that most retail clients lose money when trading on margin, and losses accelerate with higher leverage.
| 4. The risk disclosure shall include a prominent presentation of performance data for each margin product, clearly stating the percentage of profitable active retail client accounts, including the following:
| | a. Active accounts include all retail client accounts that have traded or been held during the relevant period.
| | b. Profitable accounts are those in which net trading activity on a specific product was profitable, excluding bonuses or promotional amounts.
| | c. Performance statements shall separately indicate the most recent four quarterly results for each completed calendar quarter. If the licensed entity has not completed four full quarters of providing margin services to retail clients, it shall present the performance data for the completed calendar quarter or quarters.
| 5.The statement shall clarify that the Retail Client is responsible for:
| | a. Assessing whether the margin multiples are appropriate for them and whether they have the ability to bear the risk of losing all funds in this account maintained for that purpose.
| | b. Consulting professional advisers before entering any legally binding margin trading arrangements.
| 6.The statement shall disclose any actual or potential conflict of interest with Retail Clients and affirm the duty to prioritize the Retail Client’s interests, particularly by:
| | a. Identifying what the conflict of interest is or may be.
| | b. Disclosing any potential benefits of the Licensed Entity.
| | c. Informing the client of their right to object to the conflict of interest.
| | d. The licensed entity shall obtain written confirmation from the retail client as to whether the client accepts any actual or potential conflict of interest.
Article (79) Margin Requirements for Retail Clients The Licensed Entity shall require the Retail Client to deposit margin before opening a margin trading position.
Article (80) Margin Close-Out Requirements for Retail Clients
1. The Licensed Entity shall ensure that the Net Equity does not fall below 20% in the Retail Client's margin trading account (Cross Margin) for open positions.
2. If the Net Equity (sum of deposited margin and unrealized P&L) falls below 50% of the required margin, the Licensed Entity shall close the Retail Client’s open position(s) as soon as market conditions allow.
3. In Isolated Margin Trading, the Licensed Entity shall limit losses to the amount allocated for that specific position only, without risking the entire margin account balance.
Article (81) Negative Balance Protection The Retail Client’s liability for all margin trading investments linked to their account is limited to the funds held in that account for this purpose.
Article (82) Introduction by Third Party
1. If relying on a third party to introduce margin trading, the Licensed Entity shall have adequate systems and controls to ensure that the introducer does not actively market margin trading or provide investment advice or conduct any other financial activity on behalf of the Licensed Entity.
2. The Licensed Entity shall not accept referrals of Retail Clients from an entity not licensed for this purpose.
Article (83) Additional Margin Product Restrictions
1. The Licensed Entity shall not offer or sell the following to Retail Clients:
a. Embedded products that are not virtual assets.
b. Products without a transparent pricing mechanism to determine reference price movements used to calculate profit or loss.
2. The Licensed Entity shall not provide or arrange copy trading or similar services to Retail Clients unless licensed to manage portfolios or licensed to operate multilateral trading facility.
Article (84) Record Keeping
1. The Licensed Entity shall maintain records demonstrating compliance with the requirements in this Chapter.
2. Such records shall be retained for no less than six (6) years.
Chapter Fourteen: Lending and Borrowing
1. Lending and borrowing operations may only be conducted through a custodian or a Multilateral Trading Facility (MTF) operator providing custody services.
2. The licensed authority shall determine the virtual assets permitted for lending and borrowing.
3. Without prejudice to Clause (1) of this Article, it is prohibited to lend virtual assets that are subject to a lien or seizure.
Article (86) Lending and Borrowing Agreement The licensed entity shall sign a virtual asset lending agreement with both the lender and borrower, which shall include at a minimum the following:
1. Name of the lender and their agent, if any.
2. Name of the borrower and their agent, if any.
3. Name and symbol of the virtual asset being lent.
4. Value of the virtual asset(s) subject to the lending.
5. Duration of the lending period, the lender’s right to recall the assets within that period, and the process for doing so.
6. Type and amount of collateral as per the provisions of this chapter.
7. Applicable commissions and fees.
8. Procedures for replacing or increasing collateral and clarification of the parties' related rights.
9. Procedures for returning the virtual assets.
10. Definition of default events and the rights and obligations of the other party in such cases.
11. Procedures for delivery or liquidation of collateral and maintaining margin when daily revaluation shows a material change in value.
12. Method for distributing entitlements related to virtual assets and collateral.
13. Authorization from the client allowing the licensed entity to lend the virtual assets.
Article (87) Collateral and Risk Management 1.The licensed entity shall obtain collateral from the borrower and determine the Loan-to-Value (LTV) ratio.
2. The licensed entity shall set liquidation thresholds to prevent borrower default.
3. The licensed entity shall:
a. Recalculate the collateral value daily based on market value.
b. Request additional collateral if it falls below the agreed percentage.
c. Liquidate collateral if the borrower fails to provide additional collateral within the specified time.
d. Notify the client when the collateral is liquidated.
Article (88) Marketing Materials The licensed entity shall prominently and clearly display links to risk disclosure statements regarding lending and borrowing on its homepage and in all marketing, educational materials, and communication channels, and as part of any warning or disclaimer on its website.
Article (89) Risk Disclosure Statement
1. Before entering into a lending and borrowing agreement, the licensed entity shall:
a. Provide a separate risk disclosure statement, as outlined in Clause (3) of this Article, to retail clients as part of the lending agreement and before conducting any activity on their behalf.
b. Obtain a documented acknowledgment from the retail client confirming receipt, review, understanding, and acceptance of the risks involved in lending and borrowing, and provide the client with a copy of the acknowledgment.
c. Maintain a record of the documented acknowledgments as part of recordkeeping requirements.
2. The risk disclosure statement provided to the retail client shall include a prominent warning that lending and borrowing involve the risk of loss and inform the client that the disclosure may not include or identify all associated risks.
3. The risk disclosure statement shall clarify whether the licensed entity has an actual or potential conflict of interest with retail clients, and emphasize prioritizing the client’s interests, particularly regarding:
a. The nature of the conflict of interest or potential conflict.
b. Any potential benefits to the licensed entity.
c. The client’s right to object to the conflict of interest.
d. The licensed entity’s obligation to obtain written confirmation from the client on whether they accept the actual or potential conflict.
Article (90) Recordkeeping
1. The licensed entity shall retain records proving its compliance with the provisions of this chapter.
2. The licensed entity shall retain the records referred to in Clause (1) of this Article for a minimum of six (6) years.
Chapter Fifteen: Staking
Staking operations may only be conducted through a custodian or an MTF operator providing custody services.
Article (92) Agreement The licensed entity shall include the terms and conditions of staking in the client agreement.
Article (93) Disclosures
1. The licensed entity shall disclose staking risks as follows:
a. Price volatility risks, as the value of the staked virtual asset may change significantly, leading to losses.
b. Slashing penalties if the validator makes errors in verifying transactions.
c. Inability to withdraw staked assets during the lock-up period.
2.The licensed entity shall disclose rewards as follows:
a. Clarify how rewards are calculated, their frequency, and whether they are fixed or variable.
b. Any fees deducted from the rewards.
c. Explain how validators are selected and how this affects reward opportunities.
d. Possibility of early withdrawal of assets and rewards, and applicable penalties.
Article (94) Recordkeeping
1. The licensed entity shall retain records proving its compliance with this chapter.
2. The licensed entity shall retain records mentioned in Clause (1) of this Article shall for no less than six (6) years.
Chapter Sixteen: Digital Wallet
1.This chapter applies to:
a. Third-party digital wallet service providers.
b. Self-custody (non-custodial wallets) is excluded from the provisions of this chapter.
Article (96) Requirements | 1. The third-party digital wallet provider shall ensure:
| | a. The distributed ledger used for custodial services is flexible, reliable, and compatible with related facilities used for trading, clearing, or settlement of virtual assets.
| | b. Ability to identify and segregate client assets.
| | c. Appropriate procedures to confirm client instructions and transactions, maintain related records and data, and match transactions at appropriate intervals.
| 2. When developing or using distributed ledger technologies or similar tools to provide custody of virtual assets, the third-party digital wallet provider:
| | a. Ensure digital wallet architecture adequately addresses compatibility and risk concerns.
| | b. Incorporate adequate security measures (including cybersecurity) to store and transmit virtual assets data securely.
| | c. Secure encryption keys through appropriate technologies, considering password protection and encryption protocols.
| | d. Address risks related to the use and storage of encryption keys (or their equivalents) within the distributed ledger.
| | e. Ensure the technology complies with operational protocols or equivalent standards at the relevant trading/clearing/settlement facility.
| 3.The licensed entity shall include its compliance with these requirements in the annual audit report referenced in Article (99) of this Module.
Article (97) Transfers and Movement | 1. If transferring client virtual assets, the licensed entity shall immediately confirm:
| | a. The successful completion of the transfer.
| | b. The transfer date.
| | c. Final fees payable by the client for the transfer.
| 2. If an unauthorized or erroneous transfer is made by the licensed entity, the licensed entity shall immediately rectify the issue and return the client to their previous position within (3) three business days.
| 3. To implement Clause (2) of this Article, the licensed entity shall:
| | a. Have policies and procedures to identify and correct unauthorized or incorrect transfers.
| | b. Have appropriate compensation arrangements for potential losses in the event that treatment and correction are not possible.
| | c. Review the measures taken by it for compliance with its obligations under this Clause at least once a year to ensure their adequacy.
| 4. Upon request, the licensed entity that provides services of custody of virtual assets shall provide the Authority with the following information:
| | a. Number of unauthorized or incorrect transfers per client.
| | b. Total value of such transfers referred to in Paragraph (a) of this Clause.
| | c. Number and value of total transfers referred to in Paragraph (a) of this Clause that have been successfully processed.
| | d. Total compensation paid to clients for unauthorized or incorrect transfers per client.
Article (98) Service Suspension or Restriction
1. The licensed entity may restrict or suspend client access in the following cases:
a. As specified in the signed client agreement.
b. In cases of unauthorized or fraudulent use or based on reasonable security concerns.
2. The licensed entity shall restore access to services or provide alternative services as soon as possible after the issue is resolved.
3. If the licensed entity becomes aware of a significant operational or security incident, it shall promptly notify clients and disclose measures to mitigate harm.
Article (99) Technology Audit Report
1. The licensed entity shall appoint a qualified, independent external auditor to:
a. Conduct an annual audit on compliance with technology and governance requirements applicable under this chapter
b. Prepare a written report that outlines the audit methodology, results of the annual audit, confirms whether the requirements mentioned in paragraph (1/a) of this Article have been met, and provides any recommendations or reservations in this regard.
2. The licensed entity shall submit a copy of the audit report referred to in paragraph (1/b) of this Article to the Authority within four months of the end of the fiscal year.
Chapter Seventeen: Information Disclosure
1. This chapter applies to all financial activities of Virtual Asset Service Providers (VASPs).
2. This chapter does not apply to the licensed operator of a Multilateral Trading Facility.

§Article 101 — Key Characteristics Document1. No licensed entity may provide financial services related to a virtual asset unless it provides the client with a document containing key characteristics, including:
a. Issuer information (if any).
b. Basic features of the virtual asset, associated rights, and any related projects or venture capital funding.
c. Regulatory status of the virtual asset in other jurisdictions.
d. Information on individuals/entities responsible for obligations and exercise of rights related to the asset.
e. Information on the distributed ledger technology used, including issuance, storage, transfer methods, and interoperability.
f. Underlying technology used by the licensed entity, including technical protocols and standards.
g. How virtual asset ownership is proven.
h. Valuation methodology and any benchmarks or third parties involved.
i. Details of any markets/facilities where the asset is traded.
j. Risks related to price volatility and unpredictability.
k. For stablecoins: details on reserves, stabilization, and redemption mechanisms.
l. Cybersecurity risks associated with the virtual asset or its underlying technology, including the risks of losing the virtual asset in the event of a cyberattack, and details of the steps that have been taken or could be taken to mitigate those risks.
m. Risks of fraud, hacking, and financial crimes.
n. Any other relevant information to help clients understand the asset and make informed investment decisions.
2. The licensed entity shall ensure that the information contained in the Key Features Document for the virtual asset is up to date. Additionally, the Key Features Document must be provided to the client in a timely manner before providing the relevant financial service, enabling the client to make an informed decision regarding the use of the service.
3. The document may be omitted if it was previously provided and no material changes occurred.
4. A document prepared by another party may be used if the licensed entity ensures its completeness and accuracy, and remains legally liable for its content.

§Article 102 — White Paper PublicationIf the licensed entity publishes a white paper related to a virtual asset or makes it available to its members or other participants in the facility, it shall:
1. Ensure the version is the most up-to-date.
2. Identify the authors (if known) and include the publication date.
3. Clearly disclose:
a. That the entity did not prepare or verify the information in the white paper.
b. That investors should exercise caution when relying on its contents, as it may be inaccurate or outdated.

§Article 103 — Risk Warnings1. The licensed entity shall display prominent risk warnings on its website, including that:
a. Virtual assets are highly volatile and may rapidly lose value.
b. Investors may lose all or part of their investment.
c. Virtual assets may not always be liquid or transferable.
d. Virtual asset investments are complex and risky to understand, buy, sell, or lend.
e. Virtual assets are susceptible to theft from cyberattacks.
f. Virtual asset investments differ significantly from traditional investments like securities.
2. When a Licensed Entity provides any marketing, educational, or communication materials related to a virtual asset on its website, through public media, or as part of distributions made to existing, new, or prospective members or participants, it shall include the warnings referred to in Clause (1) of this Article prominently at the top of every page of such materials or nearby.
3. If the materials mentioned in Clause (1) of this Article are provided via a website or mobile app, the warning shall be visible and fixed at the top of the screen, even during scrolling, and shown within every link.

Annex 1 — Key Information and Contents of the Client Agreement

§Annex 1, para 1 — General ContentThe basic information that shall be provided by the Licensed Entity to the client and included in the client agreement shall include the following:
1. The basic information specified in:
a. Clause (1) of Article (2) of this annex if the client is a Retail Client.
b. Clause (2) of Article (2) of this annex if the client is a Professional Client.
2. The additional information required under Article (3) of this annex for portfolio management, where applicable.
3. If the client agreement involves the provision of custody services, the terms and additional information specified in Clause (3) of Article (3) of this annex.

§Annex 1, para 2 — Basic Information1. For a Retail Client, the basic information includes:
a. The name and address of the Licensed Entity, and if it is a subsidiary, the name and address of the holding or parent company.
b. The regulatory status of the Licensed Entity.
c. The effective date of the client agreement and how it may be amended or terminated.
d. Sufficient details about the service to be provided by the Licensed Entity, including, where relevant, information about any product or other restrictions that apply to the Licensed Entity in providing its services, how these restrictions affect the service being provided, or a statement that no such restrictions exist.
e. Details of fees, charges, commissions, and the basis on which they will be charged.
f. Details of any conflicts of interest for disclosure purposes under Clause (b) of Article (28).
g. Details of any Soft Dollar Agreement required to be disclosed under Clauses (3) and (4) of Article (29) of this Module.
h. Key information related to the complaints handling procedures of the Licensed Entity, and a statement that a copy of these procedures is available free of charge upon request in accordance with Article (46) of the General Framework Module.
2. For a Professional Client, the basic information includes sub-clauses (a), (b), (c), and (e) of Clause (1) of this Article.

§Annex 1, para 3 — Additional Information| 1. The additional information for financial activities includes:
| | a. Arrangements for giving instructions to the Licensed Entity and confirming their receipt.
| | b. Information on any agreed-upon standards.
| | c. Arrangements for notifying the client of any transaction executed on their behalf.
| | d. Whether the Licensed Entity may act as a principal in any transaction.
| | e. The frequency of periodic statement issuance and whether the statement will include performance measurement, along with the basis for such measurement.
| | f. Cases where the obligation to provide best execution can be waived, a statement that the Licensed Entity is not obligated to provide best execution or the circumstances under which this obligation does not apply. | | g. The basis on which assets in the portfolio will be valued.
| 2. In the case of portfolio management, the client agreement shall include the following additional information:
| | a. The initial value of the managed portfolio.
| | b. The initial composition of the managed portfolio.
| | c. The account period during which periodic portfolio statements will be provided in accordance with Chapter 8 (Periodic Statements) of Part Four.
| 3. In addition to the information in Clause (2) of this Article, in the case of discretionary portfolio management, the client agreement shall also include:
| | a. The discretionary powers exercised by the Licensed Entity, including any restrictions on the value of a specific asset or the proportion of the portfolio that the asset may constitute, or a statement that no such restrictions exist. | | b. Whether the Licensed Entity may require the client to increase funds in the portfolio, and whether this may include borrowing on the client’s behalf:
| | | i. Circumstances under which the Licensed Entity may do so.
| | | ii. Any limits on the extent to which the Licensed Entity may do so, if any, and any circumstances under which those limits may be exceeded.
| | | iii. Any margin lending arrangements and their terms.
| 4. A Licensed Entity providing custody services shall include the following in the client agreement:
| | a. Details of all fees, commissions, and costs associated with the transfer of virtual assets (referred to as “the transfer”), specifying when such charges apply.
| | b. The information required to complete the transfer process.
| | c. The form and procedures necessary for granting consent to the transfer.
| | d. An indicator of the usual time frame for completing the transfer process.
| | e. Details of when the transfer is deemed complete.
| | f. How and in what form information and communications regarding transfer services will be provided to the client, including timing, frequency, and language used, as well as the technical requirements for the client’s devices and software to receive such communications. | | g. Clear policies and procedures regarding unauthorized or incorrectly executed transfers, including when the client is or is not entitled to compensation.
| | h. Clear policies and procedures for situations in which virtual assets may be compromised or exposed to risk, such as breaches, theft, or fraud.
| | i. Details of the procedures followed by the Licensed Entity to communicate with the client in case of suspected or actual breaches, theft, or fraud.

Annex 2 — Minimum Contents of Transaction Records

Article (1) Transaction Records A Licensed Entity shall maintain a record upon receiving a client order or making a discretionary investment decision that includes the following:
1. Client identity and account number.
2. Date and time the instruction was received or the decision was made by the Licensed Entity.
3. Identity of the employee who received the instruction or made the decision.
4. The virtual asset, including quantity or value and any price limits.
5. Whether the instruction was to buy or sell.
Article (2) Transaction Execution The Licensed Entity shall maintain a record when executing a transaction that includes:
1. Client identity and account number if the transaction was executed for them, or an indication that the transaction was for the Licensed Entity’s own account.
2. Date and time of transaction execution.
3. Identity of the employee who executed the transaction.
4. The virtual asset, including quantity, price, and value.
5. Whether the transaction was a purchase or sale.
Article (3) Client Order Passing
1. The licensed entity, when transmitting a client order to another person for execution, shall maintain a record that includes the following:
a. The identity of the person assigned to execute the instructions;
b. The terms of the instructions and the date and time the instructions were issued.

Annex 3 — Transaction Confirmation Notices

§Annex 3, para 1 — General ContentFor the purpose of applying Article (61) of this Module, the licensed entity shall include the following general information in the confirmation notice upon completion of a transaction:
Name and address of the Licensed Entity.
Clarification on whether the Licensed Entity acted as principal or agent.
Client’s name, account number, or other identifier.
Description of the virtual asset, including quantity, price, and value.
Whether the transaction was a sale or purchase.
Statement indicating that the transaction was an execution-only transaction, if applicable.
Date and time of transaction execution.
Total amount due and the due date.
Amount of fees charged by the Licensed Entity, including commissions, any mark-up or mark-down in price, taxes, and other costs.
Shared fees charged by the Licensed Entity with another party or a statement that such information is available upon request.

§Annex 3, para 2 — Additional Information

1. For the purpose of applying Article (61) of this Module, the licensed entity shall include the following additional information in the confirmation notice:

a. Contract maturity, delivery, or expiration date.

b. Whether exercising the right leads to a purchase or sale of the underlying asset.

c. If the transaction closes an open futures position, all key details of each contract involved in the open position and each closed contract shall be provided, along with the client’s profit or loss resulting from the position closure (difference calculation).

Annex 4 — Portfolio Management Activity Statements and Periodic Reports

Article (1) General Information Periodic statements, as of the end of the covered period, shall contain the following general information:
1. Number, description, and value of each virtual asset.
2. Amount of cash held.
3. Total portfolio value.
4. Statement of the basis used to determine the value of each virtual asset.
Article (2) Additional Information
1. In addition to the information in Article (1), when investment decisions are made on a discretionary basis, the Licensed Entity shall include the following in the periodic reports:
a. Statement of virtual assets lent to third parties or pledged as collateral for loans on behalf of the portfolio as of the closing date.
b. Details of each transaction executed for the portfolio during the period.
c. Total cash and details of all virtual assets transferred into or out of the portfolio during the period.
d. Total interest payments, applicable dates, and other profits or interest earned by the Licensed Entity for the benefit of the portfolio.
2. Statement of cumulative total fees received by the Licensed Entity and/or its partners.
3. Statement of the value of any compensation received from third parties on behalf of the Licensed Entity and/or its partners.
Article (3) Content of Additional Information in the Presence of Contingent Liability Investments In addition to the information required in Articles (1) and (2) of this annex, if the portfolio includes investments involving contingent liabilities, the periodic reports shall also include:
1. Total cash transferred to and from the portfolio during the evaluation period.
2. The client’s unrealized profit or loss (before deducting or adding any closing commission) for each open position in the account at the end of the period.
3. Profit or loss resulting after deducting or adding commission for each closed transaction during the period.
4. The total of the following items related to the client’s portfolio at the close of business on the evaluation date:
a. Cash.
b. Value of collateral.
c. Management fees.
d. Commissions.

Annex 5 — Client Asset Protection Rules

§Annex 5, para 1 — General Requirements

The licensed entity that holds or controls client funds shall implement systems and controls that enable it to demonstrate compliance with the provisions of this Annex.

§Annex 5, para 2 — Bank Accounts

1. The licensed entity shall open a bank account in its name dedicated solely to client funds.

2. The licensed entity may open more than one bank account with local or foreign banks.

3. The licensed entity shall assess the risks of the local or foreign bank and the appropriateness of depositing client funds therein.

§Annex 5, para 3 — Receipt and Allocation

Upon receiving client funds, the licensed entity shall:

1. Record any amount received, deposited, transferred, or withdrawn by the client in any manner, directly or indirectly, in the client's accounting records, with full details of those funds.

2. Segregate each client’s funds from those of other clients and from the licensed entity’s own funds.

§Annex 5, para 4 — Prohibitions

1. Not to deposit any funds owned by the licensed entity into the client's bank account.

2. The licensed entity shall not earn interest or returns on the funds held in client accounts unless explicitly agreed in writing with the client.

3. The licensed entity shall not obtain credit facilities or loans secured by funds held in client accounts.

4. Funds deposited in the client account are held in trust and are not owned by the licensed entity. They are not subject to lien, seizure, liquidation, bankruptcy, or any other legal proceedings related to the licensed entity’s obligations.

§Annex 5, para 5 — ExceptionsFunds in the client account may only be withdrawn, deposited, transferred, or otherwise acted upon in the following cases:
Based on the client’s clear written and dated instructions.
Pursuant to a written agreement with the client concerning investments and any resulting returns or obligations, documented in accounting records.
Payment of commissions and service fees due to the licensed entity under the agreement with the client.
Payment of fees, expenses, and commissions due to the Authority and other regulatory bodies.
In execution of a decision issued by the Authority.

§Annex 5, para 6 — Obligations

The licensed entity shall provide the Authority, upon request and immediately upon any changes, with information on its bank accounts, including:

1. Client account numbers, bank names, account types, and currencies.

2. Licensed entity’s account numbers, bank names, account types, and currencies.

3. Authorized individuals permitted to open, close, or manage bank accounts of the licensed entity and/or clients, and the scope of their authorities.

§Annex 5, para 7 — Reconciliation

The licensed entity shall:

1. Perform daily reconciliation between total client credit balances and total balances in client bank accounts as of the previous business day, ensuring the total client account balances are not less than the clients’ credit balances, and submit a monthly report to the Authority signed by the Operations Manager and Compliance Officer.

2. Rectify any client account shortfall by no later than the end of the next business day after reconciliation.

3. Notify the Authority if reconciliation or settlement cannot be performed the following day after discovery.

Annex 6 — Safe Custody Rules

§Annex 6, para 1 — General Requirements

A licensed entity that holds or controls client assets shall implement systems and controls that allow it to demonstrate compliance with the provisions of this Annex.

§Annex 6, para 2 — Client Asset Segregation

1. The licensed entity shall:

a. Segregate client assets from its own assets.

b. Maintain separate and clearly designated accounts labeled “Client Accounts” to distinguish them from its own accounts.

§Annex 6, para 3 — Registration and Custody Requirements

A licensed entity that provides custody services or holds/controls virtual assets of clients shall:

1. Ensure proper registration and safekeeping of virtual assets to protect and control them.

2. Subject to Clause (3) of this Article, register and hold virtual assets separately from its own.

3. Record all virtual assets in an account in the client’s name. Where this is not possible due to applicable laws or market practice, the assets shall be held in a pooled client account in the name of the licensed entity.

§Annex 6, para 4 — Client Account

The licensed entity shall record all virtual assets:

1. In the name of the client account.

2. In the name of the licensed entity, if registration under the client’s name is not possible, with the account clearly labeled as a “Client Account.”

§Annex 6, para 5 — Master Register1. The licensed entity shall maintain a master register of all client accounts.
2. The master register shall include:
a. Account name
b. Account number
c. Account location
d. Whether the account is open or closed
e. Date of opening or closing the account
3. The master register shall be documented and retained for at least (6) six years after account closure.

§Annex 6, para 6 — Custody with a Third Party

1. Before holding virtual assets with a third party, the licensed entity shall assess and reasonably conclude the third party is suitable for safekeeping such assets.

2. The licensed entity shall implement control systems and procedures to ensure ongoing suitability of the third party.

3. When evaluating the third party, the licensed entity shall ensure the level of protection provided is equivalent to that outlined in this Annex.

4. The licensed entity shall be able to demonstrate the rationale behind its decision to deem the third party suitable.

§Annex 6, para 7 — Safe Custody Agreements with Third Parties1. Before transferring or allowing the transfer of virtual assets to a third party, the licensed entity shall obtain a written acknowledgment from the third party that includes:
a. Clear distinction of the client account from any other account containing virtual assets of the licensed entity.
b. Virtual assets of the client will only be credited or withdrawn per the licensed entity’s instructions.
c. Client virtual assets will be held separately from the third party’s own assets.
d. Arrangements for registration, entitlement distributions, receipt of returns, and giving/receiving instructions.
e. The third party shall provide a statement to the licensed entity (specifying the frequency of this statement), including details of the client's virtual assets registered in the account.
f. All virtual assets added to the account balance shall be held by the third party on behalf of the licensed entity as an agent, and the third party shall not have the right to merge the account with any other account, nor to exercise any lien, pledge, set-off, or claim on the virtual assets in that account with respect to any amount owed to it on any other account of the licensed entity.
g. The third party’s responsibility in case of breach or failure.
2. The licensed entity shall retain records of all safe custody agreements and instructions issued to the third party under such agreements.
3. These records shall be retained for no less than (6) six years.

§Annex 6, para 8 — Client Disclosure1. Before arranging custody for the client, the licensed entity shall disclose to the client that virtual assets may be held outside the country, and that laws, market practices, and insolvency regulations applicable outside the country may differ from those applicable in the country.
2. Before providing custody services, the licensed entity shall disclose the following to the client:
a. A statement confirming the client is subject to the protection provided under these safe custody rules.
b. Arrangements for registration, entitlement distributions, returns, and giving/receiving instructions.
c. Methods of storing virtual assets, including types of digital wallets and transfer mechanisms, as well as associated risks.
d. Indemnity arrangements in case of unauthorized or incorrect transfers.
e. Obligations of the licensed entity in exercising rights on behalf of the client.
f. Conditions governing how assets are held, including any rights of the licensed entity to liquidate assets on the client’s behalf in case of default.
g. Frequency and method of communicating with the client about held assets.
h. Disclosure of any intention to pool client assets with those of other clients and the related risks.
i. Disclosure of whether virtual assets will be held with a third party within the same group as the licensed entity, if applicable.
j. The liability of the licensed entity in case of third-party failure.

§Annex 6, para 9 — Client Reports1. A licensed entity that provides custody or holds/controls client virtual assets shall send a report to retail clients at least every (6) six months. For professional clients, a different reporting frequency may be agreed upon in writing.
2. The report shall include:
a. A list of the client’s virtual assets as of the report date.
b. A list of the client’s collateral and its market value as of the report date.
c. Details of any client funds held by the licensed entity as of the report date.

§Annex 6, para 10 — Reconciliation1. The licensed entity shall:
a. Reconcile its records of client virtual asset accounts held with third parties against the statements received from those third parties daily.
b. Reconcile individual client ledger balances with its own records of client virtual asset holdings daily.
2. The licensed entity shall ensure reconciliation processes do not involve conflicts of interest.
3. Reconciliations shall be reviewed by a person of suitable seniority, who shall issue a written statement confirming that reconciliation was performed as required.
4. The licensed entity shall notify the Authority of any material discrepancies in reconciliation that are not corrected.

§Annex 6, para 11 — AuditThe licensed entity shall include in its annual audit report an assessment of its compliance with the provisions of this Annex.
Alternative Trading System Module
Part One: Preliminary Provisions
Article (1) Definitions | Facility: | Refers to the alternative trading system, unless the context indicates otherwise.
| Operating of Alternative Trading Systems: | The operating of a Multilateral Trading Facility (MTF) or an Organized Trading Facility (OTF).
| Multilateral Trading Facility (MTF): | A system that matches the buy and sell orders of multiple third parties in financial products, based on non-discretionary rules, resulting in the conclusion of a transaction in such financial products.
| Organized Trading Facility (OTF): | A system that matches the buy and sell orders of multiple third parties in securities, commodity contracts, tokenized securities, or tokenized commodity contracts, on a discretionary basis, resulting in the conclusion of a transaction in such securities or contracts.
| Licensed Entity: | An entity that has obtained a license to operate one or more alternative trading systems in accordance with the provisions of this module, unless otherwise stated in the context.
| Negotiated Transactions: | The transactions in which the purchaser and seller directly agree on the number of financial products, their price, and all other details outside of the order book, provided that they are executed through the facility.
| Distributed ledger: | A technology that enables the operation and use of distributed ledgers, made electronically available through a network of participants from multiple locations, who can update it based on consensus approval, or pursuant to an agreed-upon protocol or procedures.
| Official List of Securities: | A list that includes the securities registered with the Authority for the purpose of listing in the market.
| Financial Products: | Local and foreign securities, local and foreign tokenized securities, commodity contracts, tokenized commodity contracts, virtual assets, derivatives contracts, and virtual assets derivatives contracts and any other financial instruments accepted by the Authority. References to securities or commodity contracts shall include tokenized securities and tokenized commodity contracts, unless the context indicates otherwise.
| Illiquid or Non-Equity Financial Products:
| The financial products permitted to be traded through an Organized Trading Facility (OTF), and include, but are not limited to:
| | 1. | Debt instruments (Government Bonds), (Corporate Bonds), (Covered Bonds).
| | 2. | Structured finance products (Asset-backed Securities (ABS) or Mortgage-backed Securities (MBS)).
| | 3. | Derivatives (Interest Rate Derivatives, Credit Derivatives, Foreign Exchange Derivatives (FX derivatives)).
| | 4. | Carbon balances.
| | 5. | Any other financial instruments approved by the Authority.
| Direct Electronic Access: | Any arrangement, such as the use of a member's trading code, that enables the member or that member’s clients to submit orders related to financial products directly to the licensed entity’s facility.
| Short Selling: | The sale of securities, tokenized securities, or virtual assets by a person who does not own such securities, tokenized securities, or virtual assets at the time of entering into the sale contract.
| Liquidity Incentive Program: | An arrangement designed to provide liquidity in the facility or in relation to a specific financial product or category of financial products.
| Digital Wallet: | A software application or other tool used to control, protect, or manage public and private cryptographic keys (or their equivalents).
| Digital Wallet Service Provider: | The licensed entity operating the alternative trading system that provides custody services for tokenized securities or tokenized commodity contracts or virtual assets by controlling public and private cryptographic keys.
| Third-Party Digital Wallet Service Provider:
| | 1. | An entity licensed by the Authority — other than the entity licensed to operate alternative trading systems — to provide custody services for tokenized securities, tokenized commodity contracts, or virtual assets through control of public and private cryptographic keys.
| | 2. | An entity licensed by a regulatory authority equivalent to the Authority to provide custody services for tokenized securities, tokenized commodity contracts, or virtual assets through control of public and private cryptographic keys.
| Self-Custody (Non-Custodial Wallet): | The holding and control of a tokenized security or tokenized commodity contract or virtual asset by its owner through possession of public and private cryptographic keys.
| Direct Participant: | A natural or legal person, other than a licensed entity, who may access the facility directly for the purpose of trading financial products.
| White Paper: | A document (Concept Paper) prepared by virtual asset developers that outlines the general concept and proposed value of the virtual asset. It typically includes a roadmap for the development of the virtual asset and the main objectives that developers aim to achieve.
| Controller: | As defined in Article (1) of the General Framework Module.
| Price Information Provider: | An entity that regularly and systematically creates, aggregates, evaluates, or reports on the prices of investments, indices, commodities, or figures, and makes them available to users.
| The provisions of this module shall apply to:
| 1. | A person who engages or intends to engage in the activity of operating an alternative trading system in and/or from within the State.
| 2. | An approved key person or any person who intends to become an approved key person in a licensed entity.
| 3. | A Controller or a person who intends to become a controller of the licensed entity.
| 1. | A person who intends to obtain a license to operate an alternative trading system in and/or from within the State shall be a legal entity.
| 2. | An Organized Trading Facility (OTF) shall not be used for the purpose of trading and settling virtual assets in and/or from within the State.
| 3. | Notwithstanding Clause (2) of this Article, a Multilateral Trading Facility dedicated to virtual assets may conduct negotiated transactions.
Article (4) Overview | 1. | Part 2: This Part addresses the conditions and procedures for obtaining In Principle approval to operate an alternative trading system or/and within the State. It defines the scope of application and the requirements for such In Principle approval, including financial eligibility, experience and competence, honesty and integrity, compliance with legislation, and a clean professional record with no sanctions or penalties. It also requires the submission of a clear business plan and adherence to the legal form prescribed by the Authority. Applications shall be submitted using an approved form and accompanied by the applicable fees. The Authority evaluates financial resources, competence, and compliance before issuing a decision within 45 working days. In-Principle approval does not constitute final licensing; the applicant shall meet the final conditions within six months, with a possible one-time extension.
| 2. | Part 3: This Part outlines the general and ongoing licensing requirements for operating an alternative trading system and for key persons. It includes organizational structure, human resources, the need for competence and fitness, and the implementation of effective corporate governance. It addresses the appointment of key persons to specific roles, the requirement for them to reside in the State, and the prohibition and systematic management of conflicts of interest. The Part also includes operational competency, financial resources, technology, asset protection, and regulatory rules related to market organization, such as member admission standards, transaction integrity, compliance monitoring, and risk management. Strict controls are imposed on trading operations, especially in virtual assets, requiring risk disclosure and continuous information reporting, with clear rules for dispute resolution and regulatory updates. Operators shall adhere to specific requirements when operating systems for virtual assets, tokenized securities, or tokenized commodity contracts, including the use of distributed ledgers, key protection, and the integrity of technological operations. Periodic reports to the Authority are required, along with compliance with disclosure and governance standards, and the implementation of effective systems to prevent abuse or money laundering, ensuring transparency and market integrity.
| 3. | Part 4: This chapter specifies the procedures and requirements for obtaining a license to operate an alternative trading system in and/or from within the State or to obtain "approved key person" status. It includes the submission of a complete application meeting ongoing requirements and compliance with the legal form prescribed. Licensed capital market institutions may apply for approval instead of a license to operate an alternative trading system if they meet the criteria. The Authority evaluates applications by reviewing financial resources, competence, fitness, and the ability to meet regulatory requirements, with additional inquiries and assurances. The Authority shall decide on the application within 60 working days and may impose conditions or restrictions or reject the application for public interest considerations. The Part also outlines requirements for key persons, including submission of a specific form demonstrating their integrity, competence, and financial soundness. Applications are assessed against defined criteria, with the possibility of inquiries or requests for additional information. The specified fees shall be paid upon submission of applications, whether for licensing or for approved key person status.
| 4. | Part 5: This Part addresses the general obligations of the licensed entity and the framework for dealings with controllers. The first Chapter provides for temporary coverage of key persons functions under certain conditions, such as competence and duration. It also includes the requirement to report changes in the memorandum of association, financial reports, and accounting records in accordance with international standards. The licensed entity shall appoint an approved external auditor, report material changes, and follow procedures related to license revocation, liquidation, and bankruptcy. Regarding controllers, the Part outlines procedures for obtaining prior approval from the Authority before acquiring or increasing control. It explains the evaluation criteria for controllers, such as fitness and competence, and the procedures for notifications and periodic reporting. The Authority has the power to reject controllers in cases of non-compliance or if they are no longer fit, while giving them an opportunity to appeal. The Part also includes requirements for submitting annual reports on controllers and documenting control changes.
Part Two: In Principle Approval
Scope of Application and Request for Approval
| 1. | The provisions of this Chapter apply to the person who engages or intends to engage in the activity of operating an alternative trading system in and/or from within the State.
| 2. | The provisions of this Chapter do not apply to capital market institutions licensed by the Authority that wish to operate an alternative trading system in and/or from within the State.
Article (6) Conditions for Obtaining In Principle Approval | 1. | Financial Eligibility: The applicant must not have defaulted on commercial debts, regardless of whether this resulted in bankruptcy proceedings; shall have been rehabilitated if previously declared bankrupt; shall demonstrate a commitment to repaying commercial bank loans and financial obligations resulting from court judgments or decisions; shall not have a pattern of issuing dishonored cheques in the course of business; and shall demonstrate the financial capacity to meet unexpected and future obligations.
| 2. | Experience and Competence: The applicant shall have the required experience, demonstrate prior relevant experience, and show how it relates to the specific financial activity in question. The applicant shall also demonstrate the ability to conduct financial activities and manage risks effectively.
| 3. | Honesty and Integrity: The applicant shall provide accurate and complete information and documentation to the Authority. The applicant’s records shall be free from any issues that may damage the integrity or reputation of the Authority or the State. There shall be no ongoing or past legal claims, complaints, or investigations—domestically or internationally—relating to honesty or integrity, and no criminal or prosecutorial judgments or decisions related to breach of trust, fraud, or deception.
| 4. | Compliance: Compliance with applicable financial legislations and related laws, with no administrative penalties in the professional record issued by the Authority or any other regulatory body within or outside the State. The applicant shall not be listed on sanctions lists issued by the United Nations or other foreign entities, particularly those related to anti-money laundering, combating the financing of terrorism, or illicit organizations. Neither the applicant, its partners, nor its board members should have committed any felonies, misdemeanors, or violations related to the Authority’s activities, and they shall not be subject to any administrative or criminal investigations—domestically or internationally—at the time of application.
| 5. | No Prior Rejection or Sanction: The applicant shall not have previously been denied or had a license revoked by any other regulatory authority or government body, whether local or foreign. Verification shall be conducted by obtaining a copy of the applicant's professional record or through direct communication with the relevant authority.
| 6. | Business Plan: The applicant shall submit a realistic and logical business plan for carrying out the financial activity, including projected revenues and expenses for the first three years of operations, the underlying assumptions and methodologies used, and a comparison with industry benchmarks.
| 7. | Legal Form: The compliance with the legal form specified by the authority.
Article (7) Submission of the In Principle Approval Request | 1. | Submission of the Request: The applicant shall specify the financial activity intended to be carried out using the application form prepared by the Authority, along with all supporting documents and information proving compliance with the conditions set out in Article (6) of this module.
| 2. | Payment of the Fee: The applicant shall pay a non-refundable fee for the review of the In Principle approval request.
Article (8) Evaluation of the In Principle Approval Application | When evaluating the In Principle approval application, the Authority may do the following:
| 1. | Verify the sufficiency of resources, including, financial resources, but not limited to:
| | a. | The ability to meet financial solvency standards.
| | b. | The ability to fulfill obligations without exposing clients or stakeholders to undue risks.
| | c. | Compliance with regulatory capital or liquidity requirements.
| 2. | Assess Fitness and Propriety, including but not limited to:
| | a. | The fitness and propriety of board members or their equivalents.
| | b. | The propriety of the controller or any other relevant person.
| | c. | The potential impact of the controller on the applicant’s ability to comply with applicable requirements.
| | d. | The applicant’s activities and any associated risks that may hinder the achievement of the Authority’s objectives.
| | e. | Any matter that may have harmed or may harm the integrity or reputation of the Authority or the State.
| 3. | Verify the ability to comply with applicable requirements, including but not limited to:
| | a. | Clarifying how the applicant will meet the requirements specified in Part Two and any other applicable requirements.
| | b. | Conducting any inquiries deemed appropriate, including independent inquiries regarding the applicant.
| | c. | Requesting additional information from the applicant.
| | d. | Requesting clarifications or confirmations from the applicant on how compliance with specific requirements will be ensured.
| | e. | Requiring the applicant to verify any provided information in any manner specified by the Authority.
| | f. | Taking into consideration any other information the Authority deems relevant.
Article (9) Approval or Rejection | 1. | The Authority shall issue its decision to approve or reject the In Principle approval application within no more than 45 business days from the date of submission of a complete application. In the event of rejection, the Authority shall state the reasons.
| 2. | The Authority’s In Principle approval does not constitute a license or permission to engage in financial activities. Financial activities may not be conducted unless a formal license is obtained. Any actions based solely on the in principle approval shall be considered invalid.
| 3. | The applicant shall fulfill the ongoing requirements outlined in Part Three of this module in order to obtain the license within a maximum period of 6 months from the date of the In Principle approval. The Authority may extend this period only once for an equivalent duration.
| 4. | If the ongoing requirements are not met within the specified timeframes stated in Clause (3) of this Article, the applicant shall reapply for In Principle approval.
Part Three: General and Ongoing Licensing Requirements
Chapter One: Introduction
The provisions of this Part apply to the activity of operating an alternative trading system and to key persons.
Chapter Two: Organizational Structure Requirements
Article (11) Organizational Structure | The licensed entity shall establish an organizational structure that meets the following criteria:
| 1. | Suitability and ability to meet licensing requirements and carry out regulatory functions.
| 2. | Adequate human resources and expertise that enable it to effectively operate and monitor its business.

§Annex 6, para 12 — Human Resources

| 1. | The licensed entity shall:

| | a. | Provide adequate human resources to operate, supervise, and maintain its facilities.

| | b. | Ensure, to the extent possible, that its employees are competent and suitable, receive proper training to perform their duties, and are familiar with applicable laws and regulations in the State, including the rules and decisions of the Authority and the licensed entity itself.

| 2. | The licensed entity shall implement appropriate arrangements to ensure that employees maintain their competence and suitability on an ongoing basis and shall retain performance assessment records for each employee for at least six (6) years from the date their employment ends.

§Annex 6, para 13 — Corporate Governance| 1. | The licensed entity shall ensure the following:
| | a. | A governance framework appropriate to the nature, size, complexity of its operations, and structure, adequate to promote sound management, effective oversight, and protection of stakeholders’ interests.
| | b. | A compensation structure aligned with the licensed entity’s long-term plans and interests, and proportionate to the size and complexity of its business and structure.
| 2. | The licensed entity shall ensure that a sufficient number of independent members are present on its Board of Directors at all times.
Chapter Three: Functions and Key Persons

§Annex 6, para 14 — Regulatory Functions and Key Persons| 1. | To perform regulatory functions appropriately, the licensed entity shall at all times have persons appointed to perform the following roles:
| | a. | Members of the Board of Directors or their equivalents.
| | b. | Senior Manager.
| | c. | Senior Executive Officer.
| | d. | Chief Financial Officer.
| | e. | Compliance Officer.
| | f. | Money Laundering Reporting Officer g. Risk Officer.
| | g. | Risk Officer.
| | h. | Internal Auditor.
| 2. | Any member of the licensed entity’s Board of Directors shall be considered a key person if they perform any of the key persons functions.

§Annex 6, para 15 — Persons Holding Key Positions| 1. | The position of Senior Manager shall be held by a person who bears ultimate responsibility—either individually or jointly with other key persons —for the day-to-day management, oversight, and control of the licensed entity, provided that such person shall be an employee of the Licensed Entity and not a member of the Board of Directors of the Licensed Entity nor a partner therein.
| 2. | The position of the Senior Executive Officer shall be held by a person who is a member of the Board of Directors, a partner, or a senior manager in the Licensed Entity, and who shall bear the ultimate responsibility—whether individually or jointly with the other Key persons—for the day-to-day management, supervision, oversight, and control of the Licensed Entity.
| 3. | The position of Chief Financial Officer (CFO) shall be held by a person who is either a board member, partner or a senior manager of the licensed entity. These person holds full responsibility for ensuring the licensed entity’s compliance with related financial requirements.
| 4. | The position of Compliance Officer shall be held by a person who is either a board member or a senior manager of the licensed entity. This person bears full responsibility for ensuring the licensed entity’s compliance with the applicable laws and regulations in the State.
| 5. | The position of Risk Officer shall be held by a person who is either a board member or a senior manager of the licensed entity. This person holds full responsibility for risk management.
| 6. | The position of Anti-Money Laundering and Counter-Terrorism Financing Reporting Officer shall be held by a person who is either a board member, partner or a senior manager of the licensed entity. This person bears full responsibility for the implementation of the Licensed Entity’s Anti-Money Laundering policies, procedures, systems, and controls, as well as for the day-to-day supervision of its compliance with the relevant rules and other AML/CFT regulations.
| 7. | The position of Internal Auditor shall be held by a person who bears full responsibility for audit-related matters concerning the licensed entity.
| 8. | The provisions of Clause (4) of Article (54) and the provisions of Articles (76-80) of the General Framework Module shall apply to persons holding key positions, with the exception of the internal auditor.

§Annex 6, para 16 — Residency of Key Persons| 1. | The following key functions Chapter shall be performed by person residing in the State:
| | a. | Senior Manager.
| | b. | Key Chief Executive Officer.
| | c. | Compliance Officer.
| | d. | Anti-Money Laundering Reporting Officer.
| 2. | Notwithstanding paragraph (1/a) of this Article, the Senior Manager function may be performed without the requirement of permanent residency in the State, provided that:
| | a. | There is an effective internal control framework that ensures daily monitoring and direct oversight of operational activities and compliance with relevant regulations and instructions.
| | b. | There are direct and stable communication channels between the Senior Manager and the Authority, as well as regulatory bodies, allowing for immediate interaction and exchange of information upon request or in the event of any material incident.
| | c. | It is ensured that this exception does not conflict with governance requirements or the integrity of the regulatory system.

§Annex 6, para 17 — Combining Roles| 1. | To the extent practically possible, the licensed entity shall ensure that no key person is assigned commercial functions that conflict with their key function responsibilities or could affect their ability to effectively perform those functions.
| 2. | Before assigning a key person any commercial responsibilities, the licensed entity shall:
| | a. | Form a reasonably-based view that the commercial duties assigned do not, as far as practically possible, conflict with their responsibilities as a key person and do not hinder their effectiveness.
| | b. | Where there is an inherent conflict between the roles, the entity shall implement adequate procedures and controls to mitigate such conflict.
| 3. | The licensed entity shall retain records of its decisions and procedures as specified in Clause (2) of this Article.
Chapter Four: Conflict of Interest

§Annex 6, para 18 — Managing Conflicts of Interest and Obligations of the Licensed Entity

| 1. | Without prejudice to the obligations set out in Chapter Four of Part Three of the Business Regulation Module, the licensed entity shall take all reasonable steps to ensure the absence of any conflicts of interest, including but not limited to:

| | a. | Conflicts between the entity and its shareholders, members, or users of its services and other facilities.

| | b. | Conflicts between its members, between users of its facilities, or between members and users of its facilities.

| 2. | If any conflict of interest is identified pursuant to Clause (1), the licensed entity shall take the necessary measures to prevent, manage, or disclose such conflict in a way that does not negatively impact the performance and proper operation of its facilities.

§Annex 6, para 19 — Policies and Procedures to Prevent Conflicts in Employees' Personal Transactions

Without prejudice to Article (18) of this Chapter, the licensed entity shall establish and maintain adequate policies and procedures to ensure that its employees do not conduct personal transactions in securities, virtual assets, or derivatives in a way that creates or may create a conflict of interest.

§Annex 6, para 20 — Code of Conduct and Conflict of Interest Standards

| Without prejudice to Article (18) of this Chapter, the licensed entity shall establish a Code of Conduct that outlines the professional behavior standards for its employees, including clear procedures for managing conflicts of interest. This Code shall:

| 1. | Be binding on all employees.

| 2. | Be made publicly available to the extent appropriate and practically feasible.

§Annex 6, para 21 — Performance of Regulatory Functions

| 1. | The licensed entity shall take all necessary steps to ensure that the performance of its regulatory functions is not adversely affected by its commercial interests.

| 2. | For the purposes of Clause (1), the licensed entity shall implement adequate systems and controls—including policies and procedures—to ensure that the pursuit of commercial interests (including profitability) does not negatively impact the performance of its regulatory functions.

Chapter Five: Operational Efficiency and Resilience

§Annex 6, para 22 — Systems and Controls| 1. | Without prejudice to Chapter Two of Part Two of the General Framework Module, the licensed entity shall take all necessary steps to ensure that its systems and controls are:
| | a. | Adequate to ensure that operations are conducted at all times in accordance with applicable laws and regulations.
| | b. | Flexible and robust enough to ensure continuity and consistency in performing its functions related to facility operations.
| | c. | Proportionate to the nature, size, and complexity of its operations.
| 2. | For the purposes of Clause (1), the licensed entity’s systems and controls shall be sufficient to enable it to continuously meet licensing requirements. In particular, the systems and controls shall include adequate arrangements concerning:
| | a. | Risk assessment and management.
| | b. | Financial and technological resources.
| | c. | Staff competence and suitability.
| | d. | Operational functioning of its activities.
| | e. | Outsourcing.
| | f. | Safeguarding and managing assets of its members and other participants.
| | g. | Information sharing with members and other facility participants.
| | h. | Monitoring and tracking transactions within its facilities.
| 3. | The licensed entity shall periodically review its systems and controls to ensure their continued adequacy and effectiveness.

§Annex 6, para 23 — Risk Management| Without prejudice to the provisions of Article (31) of the General Framework Module, the licensed entity shall maintain a comprehensive risk assessment and management system that clearly assigns responsibilities for risk management, identifies types of risks, outlines measurement mechanisms, and details how they will be addressed. This includes, but is not limited to:
| 1. | Identifying all general, operational, and legal risks across all its activities.
| 2. | Accurately measuring and monitoring the various types of risks.
| 3. | Assigning risk management responsibilities to persons with appropriate knowledge and experience.
| 4. | Providing sufficient and reliable information to key persons and, where appropriate, to the board of directors.

§Annex 6, para 24 — Outsourcing| Without prejudice to the provisions of Article (39) of the General Framework Module, the licensed entity shall, before entering into any outsourcing arrangements with a service provider, specifically ensure the following:
| 1. | Perform due diligence in selecting service providers and monitoring the performance of the outsourced functions.
| 2. | Establish legally binding contracts with service providers.
| 3. | Provide for business continuity arrangements and disaster recovery plans.
| 4. | Ensure the security and confidentiality of information provided to the service provider in accordance with applicable legislation.
| 5. | Avoid concentration of outsourced functions with a single service provider.
| 6. | Clearly define agreed-upon procedures for terminating outsourcing arrangements.
| 7. | Ensure it has rights of access to the books and records of the service providers.
| 8. | Ensure that the Authority has rights of access to the books and records of the service providers and may conduct inspections.

§Annex 6, para 25 — Financial Resources| 1. | The licensed entity shall, at all times, maintain financial resources commensurate with the nature, size, and complexity of its business, in accordance with Article (21) of the General Framework Module, and in a manner proportionate to its own nature, size, and complexity, without posing a risk to meeting its due obligations.
| 2. | The assets held to meet the financial obligations referred to in Clause (1) shall be:
| | a. | Of high quality and sufficient liquidity, enabling the entity to meet current and anticipated operating expenses under a range of adverse scenarios, including unfavorable market conditions.
| | b. | If the assets are cash, they shall be held in a licensed bank within the State.
| 3. | The licensed entity shall implement systems and controls that enable it to identify and monitor the adequacy of its financial resources to meet the requirements under Clause (1). These systems and controls shall address relevant and appropriate factors related to its business model, including:
| | a. | The nature, size, and complexity of its activities and associated risks.
| | b. | Operational risk, counterparty risk, market risk, and settlement risk exposures.
| | c. | The size, composition, and condition of its available financial resources.
| | d. | Its ability to access additional financial resources if necessary.
| 4. | The licensed entity shall monitor and manage its concentration of credit and liquidity exposures to commercial banks and clearing members.

§Annex 6, para 26 — Technological Resources and Cyber Risk Management| 1. | The licensed entity shall provide sufficient technological resources to operate, maintain, and supervise its facilities.
| 2. | The licensed entity shall ensure that its members and other participants in its facilities possess adequate and compatible technological resources.
| 3. | To meet the requirement in Clause (1), the licensed entity shall establish adequate procedures and arrangements to continuously assess, select, and monitor its IT systems. These procedures and arrangements shall include, at a minimum:
| | a. | Issue management and system change management.
| | b. | Pre-operational testing of IT systems in accordance with Clauses (5) and (6) of this Article.
| | c. | Monitoring system performance, availability, and integrity, and reporting thereon.
| | d. | Adequate measures to ensure:
| | | i. | Resilience of IT systems and protection against failure.
| | | ii. | اBusiness continuity in the event of IT system failure.
| | | iii. | Integrity of data forming part of or processed through the IT system.
| 4. | The licensed entity shall comply with the applicable requirements in Annex (1) of this Module for the purposes of:
| | a. | Testing the adequacy and effectiveness of its IT systems.
| | b. | Evaluating the adequacy and effectiveness of its members’ IT systems.
| 5. | The licensed entity shall conduct periodic reviews and continuous updates of its IT systems and controls in line with the nature, size, and complexity of its operations.
| 6. | For the purposes of Clause (5), the licensed entity shall adopt clearly documented and defined development and testing methodologies that comply with internationally recognized testing standards.
| 7. | The licensed entity shall meet the applicable requirements regarding cyber risk management, in accordance with Chapter Three of Part Three of the General Framework Module.
Chapter Six: Business Rules

§Annex 6, para 27 — Content of the Rules| 1. | The licensed entity shall establish and maintain business rules that include:
| | a. | Rules and standards governing the acceptance of members and any other persons granted access to the facility.
| | b. | Rules and standards governing the acceptance of financial products for trading, clearing, and settlement, as appropriate for the facility.
| | c. | Rules governing cases of failure or default in transactions.
| | d. | Any other matters contributing to the proper operation and smooth functioning of the facility.
| 2. | The business rules shall meet the following criteria:
| | a. | Be objective.
| | b. | Be clear, fair, and unbiased.
| | c. | Define the obligations of members and other participants, and the administrative arrangements when conducting transactions within the facility, or those related to the professional standards imposed on employees and representatives of the licensed entity and/or other participants.
| | d. | Be legally binding and enforceable on members and other participants.
| | e. | Include provisions for resolving disputes among members and other participants, as well as grievance procedures for decisions made in this regard.
| | f. | Include disciplinary procedures, including sanctions.
| | g. | Be publicly available free of charge.

§Annex 6, para 28 — Default Rules

The licensed entity shall establish default rules that enable appropriate actions to be taken regarding unsettled transactions involving any member or other participant in its facilities, in the event of proven or apparent inability of the member or participant to fulfill obligations related to one or more transactions.

§Annex 6, para 29 — Compliance Monitoring| The licensed entity shall establish adequate procedures for monitoring compliance with business rules to ensure:
| 1. | Monitoring and enforcement of its own business rules.
| 2. | Prompt investigation of any complaints regarding its operations or concerning members and other participants.
| 3. | Taking disciplinary actions, including financial and other penalties, when appropriate.
| 4. | Establishing grievance procedures.
| 5. | The ability to refer complaints to the Authority when necessary.

§Annex 6, para 30 — Amendments to the Rules

| 1. | When making necessary amendments to the business rules, the licensed entity shall comply with the requirements outlined in Articles (31), (32), and (33) of this Chapter.

| 2. | The reference to the word “amendment” in Articles (31), (32), and (33) includes the addition of a new provision, modification of an existing provision, or deletion of an existing provision.

§Annex 6, para 31 — Public Consultation| 1. | The licensed entity shall conduct a public consultation before making any amendments to the business rules.
| 2. | For the purposes of implementing paragraph (1) of this Article, the licensed entity shall:
| | a. | Publish a consultation paper that includes:
| | | i. | The proposed amendment text and the business rules to be amended.
| | | ii. | The reasons for proposing the amendment.
| | | iii. | A reasonable consultation period of no less than 30 days from the date of publication, during which members and other stakeholders are allowed to submit their comments.
| | b. | Submit the consultation paper mentioned in subparagraph (a) of this Article to the Authority before it is issued for public consultation.
| 3. | The Authority may, if it deems appropriate and on reasonable grounds, request the licensed entity to extend the consultation period specified in the consultation paper. The licensed entity shall comply with this request.
| 4. | The licensed entity shall:
| | a. | Facilitate informal discussions regarding the proposed amendment with members and other stakeholders.
| | b. | Consider the impact of the proposed amendment on the interests of members and other stakeholders.
| | c. | Give due consideration to any public comments received.
| 5. | After completing the public consultation and before the proposed amendment becomes effective, the licensed entity shall submit the following to the Authority:
| | a. | A summary of the public comments received and how the issues raised were addressed.
| | b. | Any changes made to the original proposal as a result of the public comments, or if no changes were made, a statement to that effect.

§Annex 6, para 32 — Exemption from Public Consultation| 1. | The Authority may, upon a written request from the licensed entity, exempt the licensed entity from the public consultation requirement set out in Article (31) of this Chapter in the following cases:
| | a. | If any delay resulting from the public consultation is likely to harm the interests of the licensed entity.
| | b. | If the proposed amendment:
| | | i. | Is purely administrative or non-material.
| | | ii. | The licensed entity is able to demonstrate to the Authority that it has appropriately considered the views and interests of its members and other stakeholders when developing the proposed amendment.
| | c. | The licensed entity complies with the requirements set out in either paragraph (2) or (3) of this Article, as applicable.
| 2. | A licensed entity seeking exemption from public consultation on the grounds stated in paragraph (1)(a) of this Article shall submit a statement to the Authority that includes:
| | a. | The text of the proposed amendment and the business rules to be amended.
| | b. | The reasons for proposing the amendment.
| | c. | The basis on which the licensed entity believes that the delay caused by public consultation may harm its interests.
| | d. | A statement indicating whether the rights or obligations of any of the licensed entity’s members or other participants in its facilities will be materially adversely affected by the proposed amendment, and if so, the proposed measures to address those concerns.
| 3. | A licensed entity seeking exemption from public consultation on the grounds stated in paragraph (1)(b) of this Article shall submit a statement to the Authority that includes:
| | a. | The text of the proposed amendment and the business rules to be amended.
| | b. | The reasons why the licensed entity believes that the proposed amendment is purely administrative or non-material; or evidence that it has taken into account the views and interests of its members and other stakeholders, as appropriate, when developing the proposed amendment.

§Annex 6, para 33 — Approval of the Authority| 1. | The licensed entity shall obtain the Authority’s approval for any proposed amendment to the business rules before such rules come into effect.
| 2. | The Authority shall approve the proposed amendment to the business rules unless it has reasonable grounds to believe that the proposed amendment is likely to harm the interests of the markets in the State.
| 3. | If the Authority has any concerns regarding the proposed amendment, it may:
| | a. | Reject the proposed amendment or request its withdrawal by the licensed entity.
| | b. | Require the licensed entity to make appropriate changes to the proposed amendment, with or without public consultation.
| 4. | The Authority shall provide the licensed entity with the reasons for its decisions under paragraph (3) of this Article, as applicable.
| 5. | Upon obtaining the Authority’s approval, the licensed entity shall notify its members and the public of the amendment to the business rules and the effective date of such amendment.
| 6. | If the Authority decides to exercise its powers under paragraph (3) of this Article, the licensed entity may appeal the decision to the Authority, in accordance with the regulations and decisions issued by the Authority in this regard.
Chapter Seven: Access to Facilities

§Annex 6, para 34 — Membership Admission Standards

| 1. | The licensed entity shall not grant access to its facilities to any person except in accordance with the requirements set out in this Chapter and its business rules.

| 2. | A person granted access to the facilities of the licensed entity in accordance with its business rules shall be considered a member of the licensed entity unless otherwise stated.

§Annex 6, para 35 — Conditions for Admission of Members to the Licensed Entity| 1. | Subject to paragraphs (2) and (3) of this Article, the licensed entity may admit the following as members:
| | a. | A licensed entity.
| | b. | A recognized member.
| | c. | A person classified as a professional client.
| | d. | A person not mentioned in subparagraphs (a) to (c) of paragraph (1) of this Article, if the following requirements were met:
| | | i. | The facility involves trading in tokenized securities, tokenized derivative contracts, and virtual assets.
| | | ii. | The person's access is limited exclusively to trading in tokenized securities, tokenized derivative contracts, and virtual assets.
| 2. | Prior to admitting any person referred to in subparagraphs (a)–(c) of paragraph (1) of this Article, the licensed entity shall perform due diligence to ensure that the person:
| | a. | Has a good reputation.
| | b. | Possesses an adequate level of competence and experience.
| | c. | Has regulatory arrangements, including financial and technological resources, no less than those of any licensed entity offering similar financial services.
| 3. | Before admitting any person referred to in subparagraph (d) of paragraph (1) of this Article, the licensed entity shall perform due diligence to ensure that the person:
| | a. | Meets the standards mentioned in subparagraphs (a) and (b) of paragraph (2) of this Article.
| | b. | Has sufficient financial and technological resources to comply with the business rules of the facility.
| | c. | Does not pose any operational risks that could affect the orderly and efficient functioning of the facility’s trading or clearing systems.

§Annex 6, para 36 — Direct Electronic Access| 1. | The licensed entity may allow only its members to grant their clients direct electronic access to trading facilities, under the following conditions:
| | a. | Clients meet the suitability criteria established by the member to satisfy the requirements outlined in paragraph (2) of this article.
| | b. | The member is responsible for the orders and trades executed by clients using direct electronic access.
| | c. | The member has adequate mechanisms to prevent clients from placing or executing orders via direct electronic access in a manner that would exceed the member’s position or margin limits.
| | d. | The member itself is not a direct access member.
| 2. | The licensed entity shall establish sufficient controls and procedures to ensure that the member does not provide clients with direct electronic access to the facility unless the following are in place:
| | a. | Appropriate standards for risk controls, including trading limits for direct electronic access.
| | b. | The ability to identify orders and trades carried out via direct electronic access.
| | c. | The ability to stop client-initiated orders or trades executed via direct electronic access if necessary, without affecting other orders or trades submitted or executed by the member.
| 3. | The licensed entity shall establish adequate and effective systems and controls, including policies and procedures, and ensure their review and update, to ensure compliance by its members and other persons granted direct access to its facilities through members with its operating rules.
| 4. | A person permitted to have direct electronic access to the facilities of the licensed entity through a member shall not, by virtue of such access, be considered a member of the licensed entity.
Chapter Eight: Acceptance of Financial Products

§Annex 6, para 37 — Standards| 1. | The licensed entity shall, within its business rules, establish clear and objective standards for the trading of financial products, in line with its operations, as per clause (2) of this Article.
| 2. | When accepting the financial products, the licensed entity shall ensure the following in its facilities:
| | a. | In the case of securities listed on the official list of securities, obtain approval from the market licensed by the Authority or other regulated exchanges accepted by the Authority, as appropriate.
| | b. | In the case of derivatives (excluding virtual asset derivatives), the contracts shall meet the specifications set out in Article (45) of this Module.
| | c. | If the security is a tokenized security and does not meet the standard stipulated in paragraph (a) of clause (2) of this article, the following requirements shall be met:
| | | i. | The existence of a document or offering document related to the tokenized security.
| | | ii. | The licensed entity shall have adequate systems and controls, at least equal to those applied in the market licensed by the Authority, to monitor and enforce the listed entities' compliance with listing requirements and ongoing obligations.
| | d. | In the case of illiquid or non-equity-linked financial products.
| | | i. | Adequate procedures shall be established for the fair and transparent pricing and valuation of illiquid products.
| | | ii. | An appropriate level of disclosure shall be provided to market participants regarding the liquidity, credit, and market risks associated with the product.
| | | iii. | The listing or trading of these instruments shall ensure that it does not compromise market integrity or the protection of investors.
| | e. | In the case of virtual assets:
| | | i. | Virtual assets shall be registered or recognized in accordance with Articles (8) and (9) of the General Framework Module.
| | f. | In the case of virtual asset derivative contracts:
| | | i. | They shall be linked to registered or recognized virtual assets.
| | | ii. | The contracts shall meet the specifications set out in Article (45) of this Module.
| 3. | The licensed entity shall ensure that sufficient information regarding the financial products listed in the facility is made available to members and other persons with access to the facility through those members, enabling them to make informed decisions about such products.
| 4. | If the licensed entity lists financial products in its facilities whose value is determined by reference to a benchmark or underlying index provided by a price information provider, this shall be done only in accordance with the requirements set out in Annex (2).
| 5. | Virtual asset derivatives shall be considered related to a virtual asset if their value is determined based on:
| | a. | The virtual asset itself; or
| | b. | An index that includes the virtual asset.
Chapter Nine: Integrity and Transparency

§Annex 6, para 38 — Integrity and Fair Dealing| The licensed entity shall:
| 1. | Be capable and willing to uphold and maintain high standards of integrity and fair dealing in conducting business through its facilities, and cooperate with the Authority or any other relevant regulatory bodies concerning regulatory matters upon request.
| 2. | Establish clear and comprehensive policies and procedures to provide sufficient information enabling members and other participants in its facilities to gain an accurate understanding of the risks, fees, and material costs associated with using those facilities.
| 3. | Make the policies and procedures referred to in paragraph (2) of this Article available to the public.
| 4. | Prepare and maintain records related to matters and transactions, including accounting records and corporate governance practices, in accordance with the requirements and standards set out in the relevant legislation.

§Annex 6, para 39 — Transaction Recording| Without prejudice to the provisions of Article (41) of the General Framework Module, the licensed entity shall ensure satisfactory arrangements for the following:
| 1. | Recording activities and transactions, including orders and order trail records, conducted on or through its facilities.
| 2. | Providing such records to the Authority in a timely manner and upon request.
| 3. | Exercising due care to protect data in accordance with relevant requirements.
| 4. | Retaining records of activities and transactions for a period of no less than six (6) years from the date of the transaction execution or order entry, as the case may be.
Chapter Ten: Asset Protection and Management

§Annex 6, para 40 — Safe Custody Arrangements| 1. | The licensed entity shall provide the necessary arrangements to protect and manage the assets of members and other participants in its facilities, including:
| | a. | Making satisfactory arrangements ("safe custody arrangements") for this purpose, in accordance with Clauses (2) and (3) of this Article.
| | b. | Providing such arrangements under a clear agreement with members and other participants in the facility.
| 2. | The licensed entity shall ensure that the "safe custody arrangements" include, at a minimum:
| | a. | Segregation of each member’s and participant’s assets from those of the licensed entity and from the assets of other members and participants in its facilities.
| | b. | Prompt access to the assets held under the "safe custody arrangements."
| | c. | Use or transfer of members’ and participants’ assets only in accordance with the instructions of the relevant asset owners or in accordance with the terms of the agreement referred to in Clause (1/b) of this Article and any applicable laws in the State.
| | d. | Periodic and regular reconciliation between the assets and the accounts held.
| | e. | Maintaining accurate records of the assets held, including the following:
| | | i. | The identity of the legal owners and beneficiaries of the relevant assets and, where appropriate, any persons with other rights or interests in those assets.
| | | ii. | Any additions, deductions, or transfers in each personal asset account.
| | | iii. | The identity of the asset owned by different persons or on their own behalf, including the assets owned by members and other participants in its facilities.

§Annex 6, para 41 — Appointment of a Third Party to Provide Custody

| The licensed entity shall:

| 1. | Not appoint a third party to provide custody unless such person is a Licensed by the Authority, or the custody provider is subject to regulation and supervision by an equivalent regulatory authority accepted by the Authority.

| 2. | A Sub-custody provider shall not be appointed unless such Sub-custody provider satisfies the requirements stipulated in Clause (1) of this Article.

Chapter Eleven: Ensuring Integrity and Compliance in Facilities

§Annex 6, para 42 — Orderly Conduct in Facilities

| The licensed entity shall ensure that work within its facilities is conducted in an orderly manner and that it maintains an effective surveillance program over trading, in order to:

| 1. | Ensure that activities conducted in or through its facilities are executed in an orderly manner and in accordance with business rules and other applicable requirements, thereby providing appropriate protection for investors.

| 2. | Monitor behavior that may constitute manipulation, financial crime, or money laundering.

§Annex 6, para 43 — Prevention of Manipulation and Financial Crimes| 1. | Without prejudice to the provisions of Article (42) of this Chapter, the licensed entity shall:
| | a. | Implement appropriate measures to prevent manipulation within the facility and to mitigate financial crimes and money laundering.
| | b. | Immediately notify the Authority of any cases referred to in paragraph (a) of this clause.
| 2. | For the purposes of complying with Clause (1/a), the licensed entity shall:
| | a. | Include in its business rules a system to prevent manipulation within the facility and to mitigate financial crimes and money laundering, in accordance with the requirements set out in Clause (1) of this Article.
| | b. | Implement adequate measures to ensure its members comply with the business rules referred to in paragraph (a) of this clause.
| 3. | The business rules referred to in Clause (2/a) shall include, at a minimum, the following:
| | a. | Compliance arrangements to prevent manipulation within the facility and to mitigate financial crimes and money laundering-related offenses.
| | b. | Transaction monitoring.
| | c. | Risk assessment.
| | d. | Training.
| 4. | The notification referred to in Clause (1/b) of this Article shall include details of the behavior and the reasons for the licensed entity’s suspicion that it may constitute manipulation within the facility, a financial crime, or money laundering, as applicable.
Chapter Twelve: Proper Market

§Annex 6, para 44 — Fair and Orderly Operation| 1. | The licensed entity shall establish rules and procedures to ensure the fair, efficient, and effective operation of financial product trading within its facilities, and ensure that the products traded within its facilities meet the requirements of a Proper Market.
| 2. | To achieve a Proper Market, the licensed entity shall meet the following requirements:
| | a. | If derivatives are traded within its facility, the traded derivatives shall meet the contract design specifications outlined in Clause (2) of Article (45) of this Module.
| | b. | Relevant market information shall be made available to trading participants on a fair basis, including the disclosure of orders before and after the trading session, in accordance with Article (46) of this Module.
| | c. | Appropriate mechanisms shall exist to halt, suspend, or cancel trading in facilities where Proper Market requirements are not met.
| | d. | Controls shall be established to prevent market volatility not arising from natural market forces, in accordance with the requirements of Article (47) of this Module.
| | e. | Trading errors shall be managed in accordance with Article (48) of this Module.
| | f. | Monitoring of short selling and managing concentration in positions.
| | g. | A fair and non-discretionary algorithm for order matching shall be in place.
| | h. | Adequate controls shall be implemented to monitor and manage any foreign ownership restrictions, as required under Article (50) of this Module.
| | i. | Liquidity incentive programs shall be offered in accordance with Article (51) of this Module.
| | j. | Sufficient rules and procedures shall be in place to address market manipulation and financial crimes, in accordance with Article (53) of this Module.

§Annex 6, para 45 — Derivatives Contract Design Specifications| 1. | If the licensed entity permits the trading of derivative contracts within its facilities, it shall ensure the following:
| | a. | Clear and transparent rules and procedures for trading derivatives contracts are in place and made publicly available.
| | b. | Trading of derivative contracts in its facilities occurs in a fair, orderly, and efficient manner.
| | c. | Rules and procedures shall enhance transparency by ensuring that sufficient market information is available regarding the terms and conditions of traded derivative contracts, which should include, where applicable, details on delivery and pricing.
| 2. | The licensed entity shall ensure that the specifications and design of derivative contracts:
| | a. | Allow for orderly pricing and efficient settlement of resulting obligations.
| | b. | For commodity derivatives requiring delivery, include terms and conditions that:
| | | i. | Enhance the transparency of the underlying commodity price.
| | | ii. | Provide, as far as possible, a link between the underlying commodity and physical market operations.
| | | iii. | Include contract delivery specifications that address the matters listed in Annex (3).
| | | iv. | Provide for legally enforceable settlement and delivery procedures.
| 3. | To meet the requirement under Clause (1/a) of this Article, the licensed entity shall include the following minimum design specifications for derivative contracts in its business rules:
| | | a. | Minimum price fluctuation (tick size).
| | | b. | Maximum price fluctuation (daily price limits), if applicable.
| | | c. | Last trading day.
| | | d. | Settlement or delivery procedures, as applicable.
| | | e. | Contract months.
| | | f. | Position limits, if applicable.
| | | g. | Reportable levels.
| | | h. | Trading hours.
| 4. | The licensed entity shall conduct ongoing reviews of derivative contracts by:
| | | a. | Establishing and implementing clear procedures for developing and reviewing the design of traded derivative contracts.
| | | b. | Maintaining an appropriate process for incorporating input from potential users during the development and review of contract design.
| | | c. | Having sufficient authority to amend or cancel contract terms that cause or may cause market manipulation, distort the Proper Market generally, or affect a specific class or type of derivatives.
| | | d. | Maintaining appropriate mechanisms for monitoring and evaluating whether the settlement and delivery procedures reflect the underlying physical market and enhance reliable price relationships between the two markets.

§Annex 6, para 46 — Disclosure and Transparency| 1. | The licensed entity shall provide appropriate arrangements to enhance disclosure and transparency regarding information on traded financial products and trading activities within its facilities, as follows:
| | a. | Pre-trade stage.
| | b. | Post-trade stage.
| 2. | The licensed entity shall disclose the following information related to the trading of financial products within its facilities:
| | a. | Bid and ask prices and quantities.
| | b. | Depth of prices and volumes displayed on electronic systems.
| | c. | Any other trading-related information that would enhance transparency.
| 3. | The information referred to in Clause (2) of this article shall be made continuously available to the public during normal trading hours.
| 4. | The licensed entity shall disclose post-trade information, including price, volume, and time of execution, as follows:
| | a. | It shall be available in real-time on reasonable commercial terms and on a non-discretionary basis.
| | b. | It shall be made available to the public as soon as possible thereafter.

§Annex 6, para 47 — Limiting Volatility| 1. | The licensed entity shall establish regulations, controls, and procedures to ensure that its trading systems:
| | a. | Are resilient.
| | b. | Have sufficient capacity to handle peak order and message volumes.
| | c. | Can operate in an orderly manner under conditions of market stress.
| 2. | Without prejudice to its obligations under Clause (1) of this Article or any other applicable rule, the licensed entity’s rules, systems, controls, and procedures shall enable it to:
| | a. | Reject orders that exceed pre-defined volume and price limits, or that are clearly erroneous.
| | b. | Cancel, modify, or correct any transaction where appropriate.
| | c. | Temporarily halt the trading of financial products if a large and unusual price movement occurs within a short period.
| | d. | Prevent exceeding capacity limits related to messaging.
| | e. | Ability to request from its members to apply pre-trade controls on their clients.
| | f. | Permit only its members to modify the parameters of Phase 52 pre-trade transaction controls.
| | g. | Pre-trade.
| 3. | The licensed entity shall make public the details of the arrangements referred to in Clause (2) of this Article.

§Annex 6, para 48 — Erroneous Trades| 1. | The licensed entity shall have the ability to cancel, modify, or correct any erroneous trades.
| 2. | A trade is considered erroneous if it results from:
| | a. | The entry of an incorrect order.
| | b. | A malfunction in the member’s system or the licensed entity’s system.
| | c. | A combination of (a) and (b).
| 3. | To meet the requirements of Clause (1) of this Article, the licensed entity shall include in its business rules a comprehensive erroneous trade policy, clearly specifying the scope under which the licensed entity may cancel erroneous trades at its own discretion, upon request by a member, or by mutual agreement of the involved members.
| 4. | The licensed entity shall provide adequate systems and controls to:
| | a. | Prevent or minimize erroneous trades.
| | b. | Immediately identify and rectify erroneous trades when they occur.
| | c. | Determine whether the erroneous trades were caused by market disruptions.

§Annex 6, para 49 — Short Selling and Position Management

| 1. | The licensed entity shall establish effective systems, controls, and procedures to monitor and manage:

| | a. | Short selling activities.

| | b. | Risks arising from concentrations in short positions.

| 2. | For the purpose of implementing Clause (1) of this Article, the licensed entity shall have sufficient powers over its members to address risks that may threaten the orderly functioning of its facilities arising from unstable conditions in financial products.

§Annex 6, para 50 — Foreign Ownership Restrictions| 1. | The licensed entity may allow trading of financial products subject to foreign ownership restrictions in its facilities, provided it has adequate and effective arrangements to:
| | a. | Monitor the restrictions imposed on foreign ownership.
| | b. | Detect any violations or potential violations of such restrictions and take appropriate action immediately when they occur or are expected to occur.
| 2. | For the purpose of implementing Clause (1) of this Article, the licensed entity’s arrangements shall include:
| | a. | Requirements on issuers and other responsible parties for the relevant financial products to:
| | | i. | Provide the licensed entity with information on any ownership restrictions related to those securities.
| | | ii. | Take appropriate action to address any violations as soon as possible.
| | b. | Mechanisms to access up-to-date information regarding ownership of the relevant securities, including identifying the ultimate beneficial owners.
| | c. | Disclosure of information in the event of a breach or expected breach of ownership restrictions.
| | d. | Mechanisms to suspend trading in the relevant financial products in the event of a breach or expected breach of ownership restrictions, and mechanisms to resume trading once the breach has been resolved.

§Annex 6, para 51 — Liquidity Incentive Programs| 1. | The licensed entity shall not implement a liquidity incentive program unless:
| | a. | Participation in the program is limited to its members;
| | b. | Any other person participating in the program has:
| | | i. | Undergone due diligence by the licensed entity confirming they are of good repute, have sufficient competence, and appropriate regulatory arrangements;
| | | ii. | Provided written agreement to comply with the licensed entity’s business rules.
| 2. | The licensed entity shall provide the Authority with at least ten (10) business days’ prior notice before implementing a liquidity incentive program referred to in clause of this article, which shall include:
| | a. | Details of the proposed program.
| | b. | The benefits of the program for the licensed entity, its members, and other participants.
| | c. | A certificate confirming that all requirements under Clause (1) of this Article have been fully met.
| | d. | The effective date of the program.
| 3. | The Authority may, for reasonable grounds, request the licensed entity not to implement or to cease the liquidity incentive program—for example, if it is detrimental to maintaining an orderly market.
| 4. | The licensed entity shall publicly announce the implementation of any liquidity incentive program and provide any other relevant information.

§Annex 6, para 52 — Clearing and Settlement Arrangements| The licensed entity shall:
| 1. | Ensure appropriate arrangements are in place to guarantee the timely fulfillment of rights and obligations of parties to transactions conducted on or through its facilities.
| 2. | Inform its members and other participants of the arrangements referred to in Clause (a) of this Article, as follows:
| | a. | In case of securities listed on the official list, settlement shall be conducted through market institutions licensed by the Authority (clearing and settlement entities or depository centers) or other licensed market institutions (clearing and settlement entities or other depository centers) from a regulatory authority similar to the Authority, which is accepted by the Authority, and operating under a system equivalent to the Authority's system.
| | b. | For virtual assets and their derivatives, tokenized securities, or tokenized commodity contracts, settlement shall be conducted through a digital wallet service provider or a third-party digital wallet service provider.
| | c. | For illiquid or non-equity-linked financial products, settlement may be conducted bilaterally between counterparties or through a licensed custody provider, provided that such arrangements meet the Authority's requirements for orderly settlement. The entity licensed to operate the regulated trading facility shall be responsible for monitoring and reporting settlement failures.

§Annex 6, para 53 — Fraud and Market Manipulation| 1. | The licensed entity shall:
| | a. | Implement and maintain appropriate measures to detect and prevent fraud and market manipulation within or through its facilities.
| | b. | Immediately notify the Authority if it has reasonable grounds to suspect that any behavior in its facilities may constitute fraud or market manipulation.
| 2. | To comply with Clause (1/a) of this Article, the licensed entity shall:
| | a. | Include in its business rules controls to prevent fraud and market manipulation, applicable to its members and their clients.
| | b. | Implement and maintain sufficient measures to ensure its members comply with these controls.
| 3. | The controls referred to in Clause (2/a) shall include, at a minimum, rules and procedures aligned with the requirements set out in Annex (4), including appropriate compliance arrangements for its members, their employees, and clients, recordkeeping, transaction monitoring, risk assessment, and appropriate training.
| 4. | When submitting the notification under Clause (1/b), the licensed entity shall provide details of the suspicious behavior and the reasons for suspecting it may constitute fraud or market manipulation.
| 5. | The licensed entity shall:
| | a. | Verify, before accepting a membership application, that the applicant has adequate arrangements, including systems and controls, to comply with fraud and market manipulation prevention controls.
| | b. | Regularly monitor and review its members’ compliance with such controls.
| | c. | Take appropriate measures to ensure its members correct any violations of the controls to the greatest extent possible and without delay.
| 6. | The licensed entity shall immediately notify the Authority of the following:
| | a. | Any violation of the fraud and market manipulation controls by a member, its employees, or clients.
| | b. | Any circumstances in which the member is unable to correct such violations.
Chapter Thirteen: Additional Requirements for Operating an Alternative Trading System (ATS) for Tokenized Securities and Tokenized Commodity Contracts
This Chapter applies to licensed entities operating an alternative trading system (ATS) dedicated to tokenized securities and tokenized commodity contracts.

§Annex 6, para 55 — Technology and Governance Requirements| Without prejudice to the technology resource requirements under Article (26) of this Module, the licensed entity shall:
| 1. | Ensure that any distributed ledger used by the facility operates on a permissioned basis, allowing the licensed entity to have and maintain sufficient control over the persons permitted to access and update records on the distributed ledger.
| 2. | Establish and update adequate measures to ensure that the distributed ledger used in the facility, and its associated rules and protocols, include:
| | a. | Clear standards governing who may access and update records for the purposes of trading, clearing, or settlement of tokenized securities and tokenized commodity contracts on the facility, including standards related to integrity, qualifications, and competence for the roles those persons perform.
| | b. | Measures to address risks—including network security and interoperability—that may arise through the systems used by authorized persons to update records on the distributed ledger.
| | c. | Procedures to ensure due diligence and ongoing compliance monitoring regarding the matters mentioned in (a) and (b).
| 3. | Ensure that any distributed ledger used by the facility is suitable for its intended purpose, including but not limited to:
| | a. | The ability to process transactions at the required speed and volume without undue delay or failure.
| | b. | Compliance with applicable legal and regulatory standards, including data protection, privacy, auditability, and transaction traceability as required by regulations.
| | c. | Interoperability with other systems and platforms as needed for trading, clearing, and settlement.
| | d. | Reliable scalability to accommodate future growth in the number of users, assets, or transaction volume.
| 4. | Follow industry best practices in developing the design and governance of technology related to the distributed ledger used by the facility.

§Annex 6, para 56 — Direct Participant| 1. | The licensed entity shall have adequate controls and procedures in place to ensure that granting direct access to a direct participant does not pose risks to the proper and efficient performance of the facility's trading system.
| 2. | If direct access to the facility is granted to a direct participant, the business rules shall include:
| | a. | The obligations of the licensed entity toward the direct participants in the facility, and how the entity assumes responsibility for any failure to meet those obligations.
| | b. | The obligations of the direct participants toward the licensed entity, and how they are held accountable for any failure to meet those obligations.
| 3. | The facility shall include a prominent disclosure of the risks associated with using a distributed ledger for trading, clearing, and settlement of tokenized securities and commodity contracts, particularly those related to digital wallets and the potential unauthorized access to private cryptographic keys.
| 4. | The licensed entity shall have sufficient systems and controls to address risks associated with market integrity, anti-money laundering and combating the financing of terrorism (AML/CFT), and investor protection when granting direct access to the facility, including the following measures:
| | a. | Identifying the beneficial owner in case the participant is a legal entity.
| | b. | Ensuring sufficient due diligence to address AML/CFT risks for each direct participant before permitting trading.
| | c. | Monitoring and addressing fraud and market manipulation.
| | d. | Verifying the adequacy of disclosures related to tokenized securities and commodity contracts traded on the facility, including via a prospectus and continuous disclosure rules.
| 5. | The licensed entity shall have adequate controls and procedures to ensure that trading in tokenized securities and commodity contracts by a direct participant does not pose any risk to the orderly and efficient functioning of the facility's trading system, including:
| | a. | Mitigating counterparty risk arising from a direct participant’s default through sufficient collateral management measures, such as margin requirements based on the settlement cycle.
| | b. | Identifying and distinguishing orders submitted by the direct participant.
| | c. | Preventing the direct participant from granting others access to trading on the facility.
| | d. | Ensuring the direct participant fully complies with the facility’s operational rules and promptly addressing any identified gaps or deficiencies.
| 6. | The licensed entity shall have sufficient resources and systems to monitor the trading activities of the direct participant.
| 7. | The licensed entity shall include any systems and controls implemented or operated through the distributed ledger in the annual audit report required under Article (59) of this chapter.

§Annex 6, para 57 — Client Funds

The licensed entity shall comply with Chapter Eleven of Part Four of the Business Regulation Module if it receives client funds intended for trading.

§Annex 6, para 58 — Digital Wallet Service Provider| 1. | A licensed entity acting as a digital wallet service provider shall ensure the following:
| | a. | That any distributed ledger it uses for custodial services is resilient, reliable, and interoperable with any related facility where such tokenized securities and commodity contracts are traded, cleared, or settled.
| | b. | The ability to identify and segregate tokenized securities and commodity contracts belonging to different clients.
| | c. | The implementation of appropriate procedures to confirm client instructions and transactions, maintain relevant records and data, and perform timely reconciliation of such transactions.
| 2. | When developing and using distributed ledger applications or other technologies for the custodianship of tokenized securities and commodity contracts, the licensed digital wallet provider shall ensure:
| | a. | That the structure of any digital wallet used appropriately addresses compatibility issues and associated risks.
| | b. | That the technology and related procedures include adequate security measures (including cybersecurity) to allow for the safe storage and transfer of data related to tokenized securities and commodity contracts.
| | c. | The safeguarding of cryptographic keys using secure technology, taking into consideration password protection and encryption methods.
| | d. | The existence of adequate measures to address any risks related to the use and storage of cryptographic keys (or equivalents) accessible via the distributed ledger.
| | e. | Verification of the technology’s compatibility with the procedures and protocols included in the facility’s operational rules, or equivalent procedures and protocols at any facility where the tokenized securities and commodity contracts are traded, cleared, or settled.
| 3. | A licensed entity that appoints a third-party digital wallet service provider to offer custodial services for tokenized securities and commodity contracts traded on its facility shall ensure that:
| | a. | The service provider is licensed by the Authority to provide custody services as digital wallet service provider.
| | b. | The provider shall be licensed by a regulatory authority equivalent to the Authority, accepted by the Authority, and operating under an equivalent regulatory framework to that of the Authority.
| 4. | The licensed entity shall include the extent to which it meets the requirements of this Article in the annual audit report required under Article (59) of this chapter.
| 5. | This Article does not apply to self-custody (non-custodial wallets).

§Annex 6, para 59 — Technology Audit Report| 1. | The licensed entity shall, after exercising due diligence, appoint an independent, qualified external auditor with relevant expertise to:
| | a. | Conduct an annual audit to assess the licensed entity’s compliance with applicable technology resources and governance requirements, including those set forth in this chapter.
| | b. | Prepare a written report outlining the methodology and results of the annual audit, confirming whether the requirements mentioned in paragraph (a) have been met, and providing any recommendations or reservations in this regard.
| 2. | The licensed entity shall submit a copy of the report referred to in paragraph (1)(b) to the Authority within four months of the end of the financial year.
Chapter Fourteen: Additional Requirements for Operating a Multilateral Trading Facility (MTF) Dedicated to Virtual Assets
This chapter applies to the licensed entity when operating a multilateral trading facility (MTF) dedicated to virtual assets and virtual assets derivatives.

§Annex 6, para 61 — Technology and Governance Requirements

The licensed entity shall comply with all technology and governance requirements set out in Article (55) of this Module. For the purpose of such compliance, references to tokenized securities and commodity contracts shall be understood as references to virtual assets.

§Annex 6, para 62 — Direct Participant

The licensed entity shall comply with the provisions of Article (56) of this Module. For the purpose of such compliance, references to tokenized securities and commodity contracts shall be understood as references to virtual assets.

§Annex 6, para 63 — Client Funds

The licensed entity shall comply with the provisions of Article (57) of this Module. For the purpose of such compliance, references to tokenized securities and commodity contracts shall be understood as references to virtual assets.

§Annex 6, para 64 — Digital Wallet Service Provider| 1. | The licensed entity acting as a digital wallet service provider shall comply with the provisions of Article (58) of this Module. For the purpose of such compliance, references to tokenized securities and commodity contracts shall be understood as references to virtual assets.
| 2. | A licensed entity providing custodial services for virtual assets shall immediately confirm the following to the client upon transferring the client’s virtual assets:
| | a. | That the transfer was successful.
| | b. | The date of the transfer.
| | c. | The final fees payable by the client for the transfer.
| 3. | If the licensed entity or a third party providing custodial services for virtual assets is responsible for an unauthorized or incorrectly executed transfer, the licensed entity shall promptly address the situation and restore the client's account to the state it was in prior to the transfer within three business days.
| 4. | To implement paragraph (3) of this Article, the licensed entity shall:
| | a. | Have appropriate policies and procedures in place to identify and rectify unauthorized or incorrectly executed transfers.
| | b. | Maintain adequate compensation arrangements to cover potential losses if resolution and rectification are not possible.
| | c. | Review the adequacy of the measures taken to comply with this paragraph at least once annually.
| 5. | The licensed entity providing custodial services for virtual assets shall, upon request, provide the Authority with the following information:
| | a. | The number of unauthorized or incorrectly executed transfers per client.
| | b. | The total value of the transfers referred to in paragraph (a).
| | c. | The number and value of those transfers that were successfully resolved.
| | d. | The total amount of compensation paid to clients for unauthorized or incorrectly executed transfers per client.
| 6. | The licensed entity providing custodial services for virtual assets may restrict or suspend a client's access to its services in the following cases:
| | a. | As explicitly stated in the agreement signed with the client.
| | b. | In cases of unauthorized or fraudulent use of the services or suspected misuse or for security reasons, based on reasonable grounds.
| 7. | The licensed entity shall restore access to the service or provide an alternative service as soon as possible once the reasons for the restriction or suspension have ceased.
| 8. | If the licensed entity providing custodial services for virtual assets becomes aware of a major operational or security incident, it shall promptly inform clients of the incident and the measures it is taking to mitigate its adverse effects.

§Annex 6, para 65 — Disclosure of Virtual Asset Information

| 1. | A licensed entity may not permit the trading of any virtual asset on its facility unless a document outlining the key characteristics of the virtual asset is published and disclosed on its website.

| 2. | The document shall include the information specified in Article (66) of this chapter.

§Annex 6, para 66 — Key Characteristics Document for the Virtual Asset| A licensed entity may not permit the trading of a virtual asset on its facility unless a document published on its website includes the following information:
| 1. | Information about the issuer, if any.
| 2. | The core features of the virtual asset, including the associated rights and any project or venture capital that will be funded, if applicable.
| 3. | The regulatory status of the virtual asset in other jurisdictions.
| 4. | Details of the persons responsible for fulfilling obligations related to the virtual asset, and where and against whom the rights granted by the virtual asset can be enforced.
| 5. | Essential information about the distributed ledger technology (DLT), including the technology used for issuance, storage, or transfer of the virtual asset and any interoperability with other DLTs.
| 6. | Information about the core technology used by the licensed entity, including the protocols and technical standards applied.
| 7. | Details on how ownership of the virtual asset is verified.
| 8. | Information on how the virtual asset is valued, including any benchmarks, indices, or third parties relied upon.
| 9. | Details of any other market or facility where the virtual asset is traded.
| 10. | Risks related to volatility and price unpredictability of the virtual asset.
| 11. | In the case of stablecoins, details about the reserves backing the asset in fiat currency, and stabilization and redemption mechanisms.
| 12. | Cybersecurity risks related to the virtual asset or its underlying technology, including the risk of loss due to cyberattacks, and steps taken or available to mitigate such risks.
| 13. | Risks related to fraud, hacking, and financial crimes.
| 14. | Any other relevant information that may reasonably assist clients in understanding the virtual asset and making an informed investment decision.

§Annex 6, para 67 — Publication of the White Paper| If a licensed entity publishes a white paper related to a virtual asset or makes it available to its members or other participants in the facility, it shall:
| 1. | Take reasonable steps to ensure that the published version of the white paper is the most recent.
| 2. | Identify the authors of the white paper, if known, and indicate its publication date.
| 3. | Clearly disclose the following:
| | a. | That the licensed entity did not prepare or verify the accuracy of the white paper.
| | b. | That investors should exercise caution when relying on the information in the white paper, as it may be inaccurate or outdated.

§Annex 6, para 68 — Ongoing Information| 1. | The licensed entity shall take necessary steps to ensure the availability of accurate and up-to-date information about any virtual asset traded on its facility, to enable investors to make informed trading decisions.
| 2. | Without prejudice to paragraph (1), the licensed entity shall at minimum ensure that the following information is readily available for each virtual asset:
| | a. | The total number and global market value of the virtual asset in circulation.
| | b. | Whether the supply of virtual assets is scheduled to increase or decrease according to a predetermined path.
| | c. | Details of any inflationary or deflationary mechanisms such as issuance or burning of virtual assets (other than standard mining).
| | d. | The total amount of virtual assets held by the developers or issuer, retained for rewards, promotional purposes, or locked from total circulating supply.
| | e. | Details of the major holders of the virtual asset, particularly those holding 10% or more of the total supply.
| | f. | Without prejudice to paragraph (e), the licensed entity is not required to disclose the identity of a holder if, after taking reasonable steps, it cannot determine the identity of a person holding 10% or more.
| | g. | In the case of stable coins, information about reserves backing the coin and the stabilization and redemption mechanisms.

§Annex 6, para 69 — Forum| If the licensed entity provides a communication tool (forum) for users to discuss virtual assets, it shall:
| 1. | Include a clear and prominent warning that the licensed entity does not perform due diligence on the information posted on the forum.
| 2. | Restrict posting privileges to members and participants only.
| 3. | Ensure all users of the forum have equal access to the information posted.
| 4. | Require any person posting a comment to disclose whether they are affiliated in any way with a virtual asset or are receiving direct or indirect compensation for promoting it.
| 5. | Take reasonable steps to monitor and prevent misleading, fraudulent, or market manipulation-related posts.
| 6. | Act promptly to remove, request removal, or amend any post if it becomes aware of a violation of paragraphs (4) or (5).
| 7. | Refrain from participating in discussions on the forum, except for modifying posts or taking actions outlined in paragraph (6).

§Annex 6, para 70 — Risk Warnings| 1. | The licensed entity shall prominently display risk warnings on its website related to virtual assets, including
| | a. | That virtual assets are subject to high volatility and can decrease in value as quickly as they can increase.
| | b. | That investors may lose all or part of their invested funds.
| | c. | That virtual assets may not always be liquid or transferable.
| | d. | That investments in virtual assets may be complex and difficult to understand in terms of buying, selling, holding, or lending.
| | e. | That virtual assets may be vulnerable to theft due to cyberattacks.
| | f. | That investing in and holding virtual assets is not comparable to traditional investments such as securities.
| 2. | When the licensed entity provides any marketing, educational, or other communication materials related to a virtual asset on its website, public media, or as part of outreach to existing or prospective participants, it shall include the risk warnings described in paragraph (1) in a prominent location at the top of each page or near it.
| 3. | If such materials are made available through a downloadable website or mobile app, the warning shall be fixed and visible at the top of the screen at all times, even when scrolling up or down, and included on every link.

§Annex 6, para 71 — Virtual Asset Registration

The licensed entity shall register the virtual asset with the Authority in accordance with Article (8) of the General Framework Module.

§Annex 6, para 72 — Prohibitions| 1. | The licensed entity may not provide services to a retail client—if they are direct participants—unless it conducts an appropriate assessment of that retail client and reasonably concludes that the person:
| | a. | Has sufficient skills and experience to understand the risks involved in trading virtual assets or virtual asset derivatives (as applicable).
| | b. | Has the financial capacity to bear significant potential losses from trading virtual assets or virtual asset derivatives (as applicable).
| 2. | Subject to Article (26) of the Business Regulation Module, the licensed entity may offer or provide to a retail client any incentive to trade in virtual assets or virtual asset derivatives.
| 3. | The licensed entity’s systems and controls shall include adequate measures to ensure compliance with paragraph (2) of this Article.

§Annex 6, para 73 — Technology Audit Report| 1. | The licensed entity shall, after exercising due diligence, appoint an independent and qualified external auditor with relevant expertise to do the following:
| | a. | Conduct an annual audit to assess the licensed entity’s compliance with the applicable technology resources and governance requirements, including those stipulated in this Chapter.
| | b. | Prepare a written report outlining the methodology and results of the annual audit, confirming whether the requirements mentioned in paragraph (a) have been met, and providing any recommendations or concerns.
| | c. | Preparing a written report that specifies the methodology and results of the annual audit, confirms whether the requirements referred to in paragraph (a) have been met, and lists any recommendations or areas of concern.
| 2. | The licensed entity shall submit a copy of the report referred to in paragraph (1)(b) to the Authority within four (4) months from the end of the financial year.
Chapter Fifteen: Miscellaneous Requirements

§Annex 6, para 74 — Reporting

Without prejudice to Article (45) of the General Framework Module, the licensed entity shall implement appropriate protection procedures that enable its employees to report any information to the Authority or to the competent authorities involved in preventing fraud, market manipulation, money laundering, other financial crimes, or violations of applicable regulations.

§Annex 6, para 75 — Complaint Handling| 1. | Without prejudice to Article (46) of the General Framework Module, the licensed entity shall:
| | a. | Provide effective arrangements for investigating and handling complaints lodged against it.
| | b. | Establish, maintain, and update a record that includes details of complaints and their resolution.
| 2. | The licensed entity shall retain complaint records for no less than six (6) years.
Part Four: Licensing and Approval
Chapter One: Introduction
The provisions of this Part apply to any person applying for a license to operate an Alternative Trading System (ATS) within and/or from inside the State.
Chapter Two: License Applicant

§Annex 6, para 77 — License Application Submission

| The applicant shall:

| 1. | Provide evidence of meeting the licensing requirements set out in Part Three of this Module.

| 2. | Follow the legal form specified by the Authority, if applicable.

§Annex 6, para 78 — Application for Approval

Only Capital Market Institutions licensed by the Authority or the entity licensed to operate the alternative trading system may apply for approval to add one or more of the activities of operating an Alternative Trading System, provided they are capable of meeting the ongoing requirements specified in Part Three of this Module to the necessary extent.

§Annex 6, para 79 — Application Assessment| When assessing a license or approval application, the Authority may:
| 1. | Verify that the applicant has adequate resources, including financial resources, such as:
| | a. | The ability to meet solvency standards.
| | b. | The ability to meet obligations without exposing clients or other stakeholders to undue risk.
| | c. | Compliance with regulatory capital or liquidity requirements.
| 2. | Verify the competence and suitability of the applicant, including but not limited to:
| | a. | The competence and suitability of board members or their equivalents.
| | b. | The suitability of controllers or any other person.
| | c. | The impact that a controller may have on the applicant’s ability to comply with applicable requirements.
| | d. | The activities of the applicant and any associated risks that may undermine the objectives of the Authority.
| | e. | Any matter that may harm or has harmed the integrity or reputation of the Authority or the State.
| 3. | Ensure the ability to comply with regulatory requirements, including but not limited to:
| | a. | Making any inquiries deemed appropriate, including independent inquiries about the applicant.
| | b. | Requesting additional information from the applicant.
| | c. | Requesting clarification from the applicant on how they intend to meet specific requirements.
| | d. | Requiring the applicant to verify any information provided in a manner determined by the Authority.
| | e. | Requesting any other information relevant to the application.

§Annex 6, para 80 — Approval or Rejection Decision

| 1. | The Authority may attach its conditions or restrictions to its approval of a license or application and may reject the application—even if requirements under this Part are fulfilled—at its sole discretion for the sake of public interest, provided that the Authority states the reasons for rejection.

| 2. | The Authority shall issue a decision to approve or reject the application within no more than sixty (60) working days from the date of submission of a complete application. In the case of rejection, the Authority shall provide the reasons.

§Annex 6, para 81 — Fees

The applicant shall pay the approval fee for the license or application as determined by the Authority.

Part Five: General Obligations and Controller

Chapter One: General Obligations

§Annex 6, para 82 — Temporary Coverage for an Approved Person| 1. | The licensed entity may appoint a person who is not an approved person to perform the function of an approved person, provided the following conditions are met:
| | a. | The absence of the approved person is reasonably temporary or unexpected.
| | b. | The period of temporary coverage for the approved person shall not exceed (6) six months during one year.
| | c. | The licensed entity has assessed that the person possesses the relevant skills and experience to perform the function.
| 2. | The licensed entity may not, under paragraph (1) of this Article, appoint a member of the Board of Directors or equivalent.
| 3. | The licensed entity shall take reasonable steps to ensure the person complies with all applicable rules governing approved persons.
| 4. | If a person is appointed under this Article, the licensed entity shall notify the Authority with the person’s name and contact details.
| 5. | The licensed entity shall take reasonable steps to ensure that an approved person is appointed to perform the relevant function upon the expiry of the permitted temporary coverage period.
| 6. | If a person is appointed under this Article, the Authority may exercise any powers available to it as if the person were an approved person.
| 7. | The Licensed Entity shall request the withdrawal of the Approved Person status within a period not exceeding ten (10) days from the date the Approved Person ceases to be employed by the Licensed Entity to perform a function subject to approval.
| 8. | When requesting the withdrawal of the Approved Person status, the Licensed Entity shall submit a notification including details of any circumstances that the Licensed Entity considers may result in the person being deemed not to satisfy the fitness and propriety requirements.
| 9. | If the Approved Person is dismissed or requested to resign, the Licensed Entity shall provide the Authority with a statement setting out the reason or reasons for the dismissal or resignation.

§Annex 6, para 83 — Memorandum of Association and Ownership

| The licensed entity shall:

| 1. | Obtain the Authority’s approval prior to making any amendment to its memorandum of association and/or bylaws, except in the case of public joint stock companies and branches of foreign companies.

| 2. | Comply with Chapter Two of this Part regarding the controller.

| 3. | Obtain the Authority’s approval before undertaking any merger.

§Annex 6, para 84 — Financial Reports| The licensed entity shall prepare the following financial reports and submit them to the Authority:
| 1. | Quarterly interim financial reports, except for the fourth quarter, reviewed by an external auditor, submitted within 45 days from the end of the quarter, and signed by the authorized signatory.
| 2. | An annual audited financial report submitted within three months from the end of the financial year, signed by the authorized signatory.
| 3. | Interim (quarterly) reports within 45 days from the end of the quarter, and an annual report within three months from the end of the financial year on the entity’s financial activities, including profits and losses, in the format prescribed by the Authority, signed by the responsible manager if the entity is licensed for more than one financial activity or is a local or foreign bank branch.
| 4. | Any additional financial data or reports requested by the Authority.
| 5. | Every company established in the State and licensed by the Authority shall specify its financial year in its bylaws, which shall not exceed 18 months or be less than 6 months. It starts from the date of its registration in the commercial registry of the relevant authority, with the Authority to be notified of the end date of the first financial year.
| 6. | Subsequent financial years shall be consecutive periods of twelve months each, starting immediately after the previous financial year ends.

§Annex 6, para 85 — Accounting Records| 1. | The licensed entity shall:
| | a. | Comply with International Financial Reporting Standards (IFESs).
| | b. | Ensure records are sufficient to show and explain transactions, including, but not limited to:
| | | i. | Continuously illustrating the financial position of the licensed entity.
| | | ii. | Showing and recording its financial standing at the end of the year.
| | | iii. | Demonstrating the financial position of clients and the details of their transactions.
| 2. | Maintain accounting records electronically in a way that allows the Board of Directors to ensure financial data and reports are prepared in accordance with international accounting standards.

§Annex 6, para 86 — External Audit| The licensed entity shall:
| 1. | Appoint an external auditor who is approved and licensed by the relevant authorities, possesses the necessary skills, resources, and sufficient experience, unless exempted from submitting financial reports.
| 2. | Agree in writing with the external auditor on the audit terms, the format of the report, and the auditing principles and standards in line with international accounting and auditing principles.
| 3. | Ensure the external auditor is able to perform their duties throughout their appointment.
| 4. | Notify the Authority immediately upon appointment or change of the external auditor.

§Annex 6, para 87 — Notifications| The licensed entity shall promptly notify the Authority, including but not limited to, the following cases:
| 1. | Any change in the main office or any branch related to financial activities, or changes in contact details (telephone, email, etc.).
| 2. | Closure of any branch related to financial activities.
| 3. | Significant changes to the governance framework or remuneration strategy.
| 4. | A call to convene a meeting to consider dissolution or liquidation.
| 5. | Any decision by another regulatory authority to accept or reject any license application, or to suspend, amend, or revoke the license.
| 6. | Any decision by another regulatory authority to accept or reject an approved person’s application, or to suspend, amend, or revoke the approval.
| 7. | An investigation by another regulatory authority into the licensed entity’s affairs or any of its employees, or appointment of inspectors to investigate matters related to the licensed financial activity.
| 8. | Any disciplinary measures or sanctions imposed by another regulatory authority against the entity or any of its employees.
| 9. | Any internal administrative penalties imposed against an employee in connection with their job.
| 10. | Civil or criminal lawsuits filed against the entity or any of its approved employees concerning financial activity, fraud, breach of trust, or tax evasion.
| 11. | Any actual or anticipated events that may adversely affect its reputation or cause serious financial consequences for it or its clients.
| 12. | Any material change in capital adequacy or financial solvency.
| 13. | If it becomes aware of or has reasonable grounds to believe any fraud or deception related to financial activity has occurred:
| | a. | If it suspects it has committed serious fraud or deception against a client.
| | b. | . If it believes someone is acting with the intent to commit serious fraud against it.
| | c. | If it detects significant irregularities in its accounting or other records.
| 14. | If it suspects any member of its board or approved persons or staff has engaged in serious misconduct affecting their honesty or integrity.
| 15. | Any changes in the fitness and propriety of approved persons.
| 16. | Any other notifications it deems important or that are requested by the Authority with specified timelines.

§Annex 6, para 88 — Appointment of Independent Expert

The Authority may appoint an independent expert, at the licensed entity’s expense and from within or outside the State, in cases it deems necessary—such as manipulation, fraud, or deception. The expert shall prepare a report according to the format, scope, and period specified by the Authority.

§Annex 6, para 89 — License Duration and Renewal| 1. | The license duration is one year, starting from the date of issuance and ending with the end of the calendar year. It shall be renewed annually, within a maximum of one month from its expiry.
| 2. | By exception, the initial license period or that of a newly added financial activity granted at any point during the year will last until the end of the following year. The applicable license fee will be prorated accordingly.
| 3. | The Authority charges a license fee for each financial activity the entity wishes to engage in within the category.
| 4. | The license for the financial activity shall be renewed upon category license renewal, subject to payment of the applicable renewal fees for each licensed financial activity.
| 5. | No financial activity may be conducted within a given category unless both the category and specific activity licenses are valid.

§Annex 6, para 90 — License or Financial Activity Cancellation| 1. | If the licensed entity wishes to cancel its license or a financial activity, it shall submit a written request to the Authority, including:
| | a. | Reasons for the request.
| | b. | Whether the license or activity has ceased or will cease, along with the cessation date.
| | c. | An announcement of the request in two daily newspapers issued in the State—one in Arabic and one in English—within 3 business days of submitting the request, to allow clients to settle their positions.
| | d. | A signed report from the external auditor confirming the settlement of client accounts, whether cash or virtual assets, and that no obligations remain.
| | e. | A signed report from the legal advisor, accompanied by a certificate from the judicial authorities, stating the legal status of the head office and any branches (if any) regarding lawsuits filed by or against clients.
| | f. | A commitment from the licensed entity to continue fulfilling any outstanding obligations after the category or financial activity license is canceled, using the form prescribed by the Authority.
| 2. | Payment of the license cancellation fee for each financial activity, as prescribed by the Authority.
| 3. | Publication of the Authority’s decision to cancel the license or activity in two daily newspapers issued in the State—one in Arabic and one in English—immediately upon issuance.
| 4. | Before approving the cancellation, the Authority may require the licensed entity to:
| | a. | Notify its contracting parties of the cancellation request at least three months in advance, and continue providing services until a replacement licensed entity is appointed.
| | b. | Provide proof of settling its obligations with contracting parties.
| | c. | Transfer records, data, and accounts related to contracting parties or clients and their assets to another licensed entity.
| 5. | The licensed entity shall fulfill all cancellation requirements within six months from the date the request is submitted to the Authority. The Authority may extend this period once for an equal duration.

§Annex 6, para 91 — Voluntary Liquidation| 1. | The Authority shall supervise the voluntary liquidation of the licensed entity and has the authority to take any appropriate steps to ensure adequate protection of the rights of the licensed entity’s clients.
| 2. | If the licensed entity wishes to proceed with voluntary liquidation, it shall:
| | a. | Notify the Authority of the liquidation and specify the proposed date of the board of directors’, general assembly’s, or creditors’ meeting concerning the liquidation procedures.
| | b. | Provide the Authority with any documents it requests relating to the liquidation procedures.
| | c. | Cooperate with the Authority prior to initiating the liquidation procedures to ensure the settlement of all client-related obligations, return of their funds and assets, closure of their accounts, and finalization of all transactions, accounts, and obligations related to the financial activity licensed by the Authority.

§Annex 6, para 92 — Preventive Composition in Bankruptcy

| 1. | The licensed entity shall notify the Authority in writing at least ten (10) business days prior to filing for preventive composition in bankruptcy. The Authority is entitled to submit its documents and arguments to the court regarding the matter.

| 2. | The Authority may request the court to appoint a supervisor to oversee the implementation of the preventive composition procedures.

§Annex 6, para 93 — Bankruptcy Procedures

| 1. | The licensed entity shall notify the Authority of its intention to file for the commencement of bankruptcy procedures at least fifteen (15) business days before submitting the request to the court. The Authority may submit its documents and arguments to the court.

| 2. | The Authority has the right to file a request to the court to initiate bankruptcy procedures against the licensed entity, accompanied by the required documents and proof that the entity is in financial distress.

| 3. | The Authority may request the court to appoint a supervisor to oversee the bankruptcy procedures.

Chapter Two: Controller

§Annex 6, para 94 — Excluded Holding| For the purposes of determining excluded holdings and whether a person is considered a controller, any shares, voting rights, or rights to acquire shares or voting rights held by a person (individually or jointly with others) in a licensed entity or its holding company shall be disregarded in the following cases:
| 1. | If the shares are held solely for clearing and settlement purposes within a short settlement cycle.
| 2. | If the shares are held by a custodian or as a registered nominee, and the voting rights are exercised only according to written instructions from the beneficial owner.
| 3. | If the person is a licensed entity or financial institution and the following conditions are met:
| | a. | The shares were acquired due to an underwriting commitment to subscribe in a share issuance or offering on a firm commitment basis.
| | b. | The voting rights were not exercised, and the person did not interfere in the management of the issuer in any way.
| | c. | The shares were held for less than one year.

§Annex 6, para 95 — Prior Approval for Control| If the licensed entity is local, no person may do the following without obtaining prior approval from the Authority:
| 1. | Become a controller.
| 2. | Increase their level of control to the following thresholds:
| | a. | From less than 30% to 30% or more.
| | b. | From less than 50% to 50% or more.

§Annex 6, para 96 — Requirements for Prior Approval| 1. | A person required to obtain prior written approval from the Authority under Article (95) of this Chapter shall submit a request using the prescribed form.
| 2. | Upon receiving the request under paragraph (1), the Authority may:
| | a. | Approve the proposed acquisition or increase in control.
| | b. | Approve the acquisition or increase in control subject to conditions it deems appropriate.
| | c. | Reject the request.
| 3. | The Authority shall assess the request within 90 days of receiving a complete and accurate application, unless it decides to extend the period as it deems necessary, in which case the applicant shall be notified.

§Annex 6, para 97 — Approval or Rejection

| 1. | When exercising its regulatory powers, the Authority may notify the applicant, and the licensed entity where appropriate, as soon as possible of its approval, conditional approval, or rejection, and provide the applicant with any conditions or reasons for the rejection.

| 2. | A person whose request is approved shall comply with the associated conditions.

| 3. | A person whose request is rejected shall not proceed with the acquisition or increase in control.

§Annex 6, para 98 — Notification of Reduction in Control Level in the Licensed Entity

| A controller in a licensed entity shall notify the Authority in the following cases:

| 1. | When intending to cease being a controller.

| 2. | When intending to reduce their shareholding from more than 50% to 50% or less.

§Annex 6, para 99 — Notification Requirements for Changes in Control of Branches| If the licensed entity is a branch, the controller or the person intending to become a controller shall notify the Authority before taking any of the following actions:
| 1. | Becoming a controller.
| 2. | The current controller intends to cease being a controller.
| 3. | The current controller's shareholding:
| | a. | Increases from less than 30% to 30% or more.
| | b. | Increases from less than 50% to 50% or more.
| | c. | Decreases from more than 50% to 50% or less.

§Annex 6, para 100 — Obligations of the Licensed Entity Regarding Controllers| 1. | The licensed entity shall establish adequate systems and controls to monitor:
| | a. | Any changes related to its controllers.
| | b. | Any significant changes in the behavior or circumstances of existing controllers that could reasonably affect the entity’s fitness, propriety, or ability to operate soundly and effectively.
| 2. | Subject to the provisions of Clause (3) of this article, the licensed entity shall notify the Authority as soon as possible after becoming aware of any event described in paragraph (1).
| 3. | The licensed entity is not required to comply with paragraph (2) if it reasonably believes that the proposed or current controller has already obtained the Authority’s prior approval or has notified the Authority of the event in accordance with this Chapter.
| 4. | The licensed entity shall include the following in its annual report:
| | a. | the name of each controller.
| | b. | The current holding of each controller, expressed as a percentage.

§Annex 6, para 101 — Authority’s Powers| 1. | The Authority may, subject to paragraph (2), reject a person as a controller of a licensed entity if that person:
| | a. | Acquired or increased control in the licensed entity without obtaining the prior written approval required under Article (95) of this Chapter.
| | b. | Violated the provisions of Article (99) of this Module.
| | c. | Is no longer deemed acceptable by the Authority as a controller.
| 2. | If the Authority rejects a person as a controller, it shall:
| | a. | Provide notice specifying:
| | | i. | The reasons for the rejection.
| | | ii.
| Any proposed conditions under which the Authority might approve the control.
| | b. | Give it time to file a grievance within 14 days of receiving the notice, or within a longer period approved by the Authority.
| 3. | As soon as reasonably possible after considering the grievance—or if no grievance is submitted after the grievance period under (2)(b) ends—the Authority shall issue a final notice stating:
| | a. | Withdrawal of the rejection and confirmation of the person as an approved controller (with or without conditions).
| | b. | Approval of the person as a controller subject to specified conditions.
| | c. | Declaration of the person as an unacceptable controller, requiring them to dispose of their relevant holding.
| 4. | If the Authority issues a final notice approving the person as a controller, the person shall comply with the stated conditions.
| 5. | If the Authority issues a final notice declaring the person as an unacceptable controller, the person shall dispose of the relevant holding within the period specified in the final notice.
| 6. | The Authority shall also notify the licensed entity of any decision it makes under paragraph (3).
| 7. | If the Authority exercises its regulatory power under this Article to reject a person as a controller, impose conditions on approval, or require divestiture, the person may refer the matter to the Appeals Committee.

Annex 1 — Technology Systems Testing

§Annex 1, para 1 — Application

For the purpose of meeting the requirements in Article (26) of this Module related to the testing of its IT systems, the licensed entity shall comply with the requirements set out in this Annex.

§Annex 1, para 2 — Technology Systems Testing

| Before going live with its IT systems or implementing any updates, the licensed entity shall use development and testing methodologies aligned with internationally accepted testing standards to verify the validity and effectiveness of such systems. For this purpose, testing shall be sufficient to reasonably ensure that, at a minimum, the systems are capable of:

| 1. | Enabling the licensed entity to continuously comply with all applicable regulatory requirements.

| 2. | Continuing to function effectively under stressed market conditions.

| 3. | Ensuring that any risk management controls embedded in the systems, such as automatically generated error reports, function as intended.

§Annex 1, para 3 — Testing Related to Members' Systems and Technology| 1. | The licensed entity shall implement a standardized conformance test to verify that systems used by members to access its facilities possess the minimum functionalities compatible with its own IT systems and do not pose a threat to fair and orderly conduct within its facilities.
| 2. | The licensed entity shall require its members, prior to the live deployment of any electronic trading system, user interface, or trading algorithm—including updates—to use appropriate development and testing methodologies to validate the effectiveness and integrity of their systems.
| 3. | For the purpose of implementing Clause (2) of this Article, the licensed entity shall require its members to:
| | a. | Conduct testing of trading algorithms, including in a simulated environment, appropriate to the risks these strategies may pose to the member itself or the fair and orderly operation of the facility.
| | b. | Deploy trading algorithms in a live environment only in a controlled and cautious manner to ensure operational safety and stability.

Annex 2 — Use of Price Information Providers

§Annex 2, para 1 — Application

A licensed entity may not operate an alternative trading system for securities that rely on a benchmark or index provided by a price information provider unless it has conducted due diligence to ensure that the provider continuously meets the requirements set out in Article (2) of this Annex.

§Annex 2, para 2 — Use of Price Information Providers| 1. | The licensed entity may permit trading of securities on its facilities that rely on a benchmark or index provided by a price information provider only after performing due diligence to verify that the provider consistently meets the requirements in Clause (2) of this Article.
| 2. | To meet the requirements of Clause (1), the price information provider shall:
| | a. | Use fair, non-discriminatory, and non-arbitrary procedures for determining reported securities prices.
| | b. | Provide sufficient transparency about the methodology, calculations, and inputs used to derive the benchmark or index, enabling users to understand the process and any potential limitations.
| | c. | Prioritize, where appropriate, actual transactions in the valuation process and implement measures to reduce selective reporting.
| | d. | Have a sound reputation as an independent and objective provider of price reports or indices.
| | e. | Maintain a robust governance framework to ensure integrity.
| | f. | Implement appropriate measures to avoid potential conflicts of interest among its employees, especially if such conflicts may materially impact the pricing process.
| | g. | Provide adequate mechanisms to address complaints related to the methodology, procedures, and valuation process.

Annex 3 — Contract Delivery Specifications

This Annex applies to the licensed entity when trading, clearing, and settling commodity derivatives contracts requiring physical delivery of the underlying commodity on its facilities.

§Annex 3, para 2 — Delivery of the Underlying Commodity

To meet the requirement of Article (45/2/b) of this Module, the licensed entity shall ensure that the terms and conditions of the commodity derivatives contracts traded, cleared, or settled on its facilities are designed to include the matters specified in Articles (3) and (10) of this Annex.

§Annex 3, para 3 — Quality or Grade of Delivery

Commodity derivatives contracts shall specify the characteristics of the commodities for bulk delivery, including grade, class, and weight. The defined quality or grade shall align with prevailing practices in the relevant physical commodity market.

§Annex 3, para 4 — Delivery Unit Size

The contract shall contain provisions on the size or composition of delivery units that align with prevailing market practices in the relevant physical market, ensuring they do not hinder delivery or the execution of the contract.

§Annex 3, para 5 — Delivery Instruments

The contract shall specify the acceptable form or type of delivery instruments, whether they are negotiable or transferable, and any specific conditions attached.

§Annex 3, para 6 — Delivery Process

| The contract shall specify:

| 1. | The delivery process, including timing, location, method, and format of delivery.

| 2. | Available delivery or storage facilities, consistent with prevailing physical market practices to allow effective monitoring and reduce the likelihood of failure.

§Annex 3, para 7 — Inspection and Certification Procedures

The contract shall outline applicable inspection or certification procedures to verify that the delivered commodity meets the quality or grade defined in the contract, in line with physical market standards.

§Annex 3, para 8 — Transportation and Storage Costs

| The contract shall specify:

| 1. | The parties’ responsibilities regarding costs related to transporting the commodity to and from the delivery point and any applicable storage costs.

| 2. | How title to the commodity is transferred, including from the short position holder to the long position holder.

§Annex 3, para 9 — Legal Enforceability

Where one or more of the trading, clearing, or settlement activities under the contract occur in different jurisdictions, the contract shall include adequate arrangements to mitigate risks arising from variations in applicable laws.

§Annex 3, para 10 — Default and Force Majeure Provisions

| The contract shall specify:

| 1. | The rights and obligations of the parties in case of default, force majeure, or any other specified event.

| 2. | Whether any clearing house or exchange guarantees the settlement of the transaction in such events, and if so, the manner in which settlement will occur.

Annex 4 — Market Abuse Prevention

§Annex 4, para 1 — Fraud and Market Manipulation

| It is prohibited for any person, by any means, to engage in any act or practice related to financial products if the person knows or should reasonably know that the act:

| 1. | Causes or is likely to cause a false or misleading impression of supply, demand, or price of financial products.

| 2. | Creates or is likely to create an artificial price for financial products.

| 3. | Constitutes fraud against anyone.

§Annex 4, para 2 — False or Misleading Statements

It is prohibited for any person to publish or disseminate any information that may give a false or misleading impression regarding one or more financial products, if the person knows or should reasonably know that the information is false or misleading.

§Annex 4, para 3 — Use of Deceptive Means and Other Forms of Fraud

Engaging in any activity or behavior related to financial products involving transactions or orders using fictitious means or any other form of deception or fraud is prohibited.

§Annex 4, para 4 — Insider Trading

It is prohibited for any person possessing inside information to trade or attempt to trade in financial products based on such information.

§Annex 4, para 5 — Disclosure of Inside Information

| 1. | Any person possessing inside information is prohibited from disclosing such information to another person unless such disclosure is part of their job duties.

| 2. | It is prohibited for any person to induce, urge, or encourage another person, directly or indirectly, to trade in financial products concerning which they possess inside information.

§Annex 4, para 6 — Inducing Others to Trade

| It is prohibited for any person to induce another person to trade in financial products by:

| 1. | Making or disseminating any statement, promise, or forecast, knowing that it is misleading, false, or deceptive.

| 2. | Concealing material facts.

← Record: Virtual Asset Service Providers and ATS Regulation

Text reproduced from the official publication for reference. Formatting, numbering and footnotes may differ from the original and the official text prevails. Arabic is the authoritative language of UAE federal and emirate legislation. Cross-reference links are generated automatically and cover only instruments held in this library.

Chairman of the Authority’s Board of Directors’ Resolution No. (04/Chairman) of 2026 Concerning the Regulation of Virtual Assets Service Providers and the Alternative Trading System Operator

§Preamble

§Article 1

§Article 2

§Article 3

§Article 4

§Article 5

§Article 6

§Article 7

§Article 8 — Submission of Notice for Virtual Asset Registration

§Article 9 — Recognition of Virtual Assets

§Article 10 — Publication

§Article 12 — Financial Activities

§Article 14 — Dealing in Virtual Assets as An agent

§Article 15 — Providing Custody

§Article 16 — Arranging Custody

§Article 17 — Operating a Multilateral Trading Facility

§Article 18 — Providing Investment Advice

§Article 19 — Portfolio Management

§Article 20 — Arranging Investment Deals

§Article 21 — Licensing Categories and Capital

§Article 23 — Conditions for Obtaining In principle Approval

§Article 24 — Submission of In principle Approval Request

§Article 25 — Evaluation of In principle Approval Request

§Article 26 — Approval or Rejection

§Article 28 — Allocation of Significant Responsibilities

§Article 30 — Organization

§Article 31 — Risk Management

§Article 32 — Compliance

§Article 33 — Internal Audit

§Article 34 — Business Plan and Strategy

§Article 35 — Management Information

§Article 36 — Employees and Agents

§Article 37 — Continuing Professional Development (CPD)

§Article 38 — Conduct

§Article 39 — Outsourcing

§Article 40 — Business Continuity and Disaster Recovery

§Article 41 — Records

§Article 42 — Fraud

§Article 43 — Corporate Governance

§Article 44 — Remuneration Structure and Strategies

§Article 45 — Reporting of Violations

§Article 46 — Complaints and Their Handling

§Article 47 — Cybersecurity Risk Management Framework

§Article 48 — Third-Party Cybersecurity Risk Management

§Article 49 — Responsibilities of the Board of Directors and Senior Management in Cybersecurity Risk Management

§Article 50 — Identification and Assessment of Cybersecurity Risks

§Article 51 — Protection of ICT Assets from Cybersecurity Incidents

§Article 52 — Detection, Response, and Recovery

§Article 53 — Reporting Cybersecurity Incidents

§Article 54 — Positions Required at the Licensed Entity

§Article 55 — Persons Occupying Positions Subject to Approval

§Article 56 — Technical Positions Required at the Licensed Entity

§Article 57 — Persons Occupying Technical Positions Subject to Approval

§Article 59 — Principles Applicable to the Licensed Entity

§Article 60 — Principles Applicable to Persons

§Article 62 — Interpretation

§Article 63 — Emergencies

§Article 64 — Disclosure of Regulatory Status

§Article 65 — Head Office

§Article 66 — Close Links

§Article 67 — Supervision and Investigation

§Article 68 — Communication with the Authority

§Article 69 — Public Register

§Article 71 — Submission of License Application

§Article 72 — Submission of Approval Application

§Article 73 — Application Evaluation

§Article 74 — Approval or Rejection Decision

§Article 75 — Fees

§Article 77 — Application for Accredited Person Status

§Article 78 — Evaluation of the Application for Accredited Person Status

§Article 79 — Approval or Rejection Decision

§Article 80 — Fees

§Article 81 — Temporary Coverage, Termination of Service, or Resignation of an Accredited Persons

§Article 82 — Memorandum of Association and Ownership

§Article 83 — Financial Reporting

§Article 84 — Accounting Records

§Article 85 — External Audit

§Article 86 — Notifications

§Article 87 — Appointment of an Independent Expert