VARA Custody Services Rulebook

Activity rulebook for Custody Services: additional Board requirements, policies and disclosures, VA storage and custody rules, staking from custody services and collateral wallet services. Current version effective 19 June 2025 (earlier versions February and August 2023).

Summary

The Custody Services Rulebook applies to every VASP licensed by VARA to provide Custody Services in Dubai outside the DIFC, in addition to the VARA Regulations and the four compulsory Rulebooks. Custody Services means safekeeping virtual assets for another Entity and acting only on its verified instructions, and the Regulations allow only VASPs that segregate each client's assets in separate wallets to hold this licence. The version in force took effect on 19 June 2025.

A custodian carries heavier governance than other VASPs. Its Board must include executive and non-executive directors with at least one independent director, meet at least quarterly and set term limits; independence is lost through links such as recent senior management roles, consultancy work, auditor ties, a 10% shareholding or more than seven years' service. Remuneration, nomination and audit committees are mandatory, minutes are kept for at least eight years, and Board pay is reported to VARA annually.

Part III sets the storage rules. Custodied assets are not the VASP's assets, rehypothecation is prohibited even with client consent, each client's assets sit in their own wallets and the custodian must keep control of them at all times. The custodian must be a separate legal entity from any group member providing other VA Activities, apart from a possible VA Transfer and Settlement licence. Hot and cold storage must follow a documented risk-based method; keys and seeds must be generated to industry standards, backed up separately with equal encryption, protected against collusion and covered by a lost-key procedure. Client Agreements must cover the custody framework, forks, return of assets, settlement finality and responsibility for loss, and monthly statements and an eight-year audit trail are required.

Part IV lets a custodian stake client assets only with express VARA authorisation in its Licence, on the client's specific opt-in instruction, with no pooling of clients on a node, published DLT standards and a separate risk disclosure the client accepts. Part V allows Collateral Wallet Services, also only with express authorisation, as an ancillary service with receipts and reporting. Both carry incremental VARA fees. Under the Company Rulebook, paid-up capital for Custody Services is the higher of AED 600,000 or 25% of fixed annual overheads, and Schedule 2 of the Regulations sets an AED 100,000 application fee and an AED 200,000 annual supervision fee.

Who it applies to

VASPs licensed by VARA for Custody Services in Dubai outside the DIFC, including those authorised for staking from custody or collateral wallet services, their Boards, independent directors and committees, outsourced custody providers, and the clients whose virtual assets they hold.

Contents

English official text in 82 rules. Open the full text or jump to a provision:

1. Rule I.A.1
2. Rule I.A.2
3. Rule I.A.3
4. Rule I.A.4
5. Rule I.B.1
6. Rule I.B.2
7. Rule I.B.3
8. Rule I.C.1
9. Rule I.C.2
10. Rule II.A.1
11. Rule II.A.2
12. Rule II.B.1
13. Rule II.B.2 — Other disclosable matters
14. Rule II.B.3
15. Rule III.A.1
16. Rule III.A.2
17. Rule III.A.3
18. Rule III.B.1
19. Rule III.B.2
20. Rule III.B.3
21. Rule III.B.4
22. Rule III.B.5
23. Rule III.B.6
24. Rule III.B.7
25. Rule III.C.1 — Hot and cold Virtual Asset storage
26. Rule III.C.2 — Seed or key generation, storage, and use
27. Rule III.C.3 — Lost or stolen keys
28. Rule III.D.1 — Written agreements with clients
29. Rule III.D.2 — Relationship between a VASP and client, for the provision of Custody Services
30. Rule III.D.3 — Outsourcing and third-party suppliers
31. Rule III.D.4 — Account statements
32. Rule III.D.5 — Audit
33. Rule IV.A.1
34. Rule IV.A.2
35. Rule IV.A.3
36. Rule IV.A.4
37. Rule IV.A.5
38. Rule IV.A.6
39. Rule IV.B.1
40. Rule IV.B.2
41. Rule IV.B.3
42. Rule IV.C.1 — Segregated client VA Wallets
43. Rule IV.C.2 — Single client per node
44. Rule IV.C.3 — Safekeeping of Virtual Assets
45. Rule IV.C.4 — Control of withdrawal keys
46. Rule IV.D.1
47. Rule IV.D.2 — VA Wallet management
48. Rule IV.D.3 — Outsourcing
49. Rule IV.E.1
50. Rule IV.E.2
51. Rule IV.E.3
52. Rule IV.E.4
53. Rule IV.E.5
54. Rule IV.E.6
55. Rule IV.E.7
56. Rule IV.F.1
57. Rule IV.F.2
58. Rule IV.G.1
59. Rule V.A.1
60. Rule V.A.2
61. Rule V.A.3
62. Rule V.A.4
63. Rule V.A.5
64. Rule V.A.6
65. Rule V.B.1
66. Rule V.B.2
67. Rule V.B.3
68. Rule V.B.4
69. Rule V.C.1
70. Rule V.C.2
71. Rule V.D.1
72. Rule V.D.2
73. Rule V.D.3
74. Rule V.E.1
75. Rule V.E.2
76. Rule V.E.3
77. Rule V.E.4
78. Rule V.F.1
79. Rule V.F.2
80. Rule V.G.1
81. Rule V.H.1 — Reporting
82. Rule V.H.2 — Notifications

Key provisions

Obligations and deadlines

• Keep at least one independent director on the Board and hold Board meetings at least quarterly.
• Establish remuneration, nomination and audit committees and keep their minutes for at least eight years.
• Report Board and committee remuneration to VARA every year.
• Hold each client's virtual assets in separate wallets and never rehypothecate them.
• Keep the custodian in a legal entity separate from group companies providing other VA Activities.
• Provide each client with a statement of transactions and balances at least monthly.
• Obtain express VARA authorisation before offering staking or collateral wallet services.

Penalties

The Rulebook sets no fines of its own; breaches are enforced under Part IX and Schedule 3 of the VARA Regulations, which allow fines, licence restrictions, suspension or revocation and action against Responsible Individuals. VARA may also suspend or revoke a staking authorisation for a specific DLT or entirely, and limit, suspend or revoke a collateral wallet authorisation at any time on reasonable grounds.

History and citations

“Cites” and “Cited by” are built automatically from references in the full texts held in this library; they cover only instruments in the library.

Related instruments

Related Polaris services

• Corporate Structuring & Group Design
• Holding Structures UAE Cyprus Switzerland
• Corporate Secretary Services