VARA Technology and Information Rulebook

Compulsory rulebook setting technology governance, cybersecurity, cryptographic key and wallet management, testing, audit, algorithm governance, business continuity and cybersecurity-event requirements for VASPs, plus personal data protection and confidential information rules. Current version effective 19 June 2025 (first version February 2023).

Summary

The Technology and Information Rulebook is the third compulsory VARA Rulebook and applies to every VASP licensed by VARA in Dubai outside the DIFC. It sets the technology governance, cybersecurity, key-management, data protection and confidentiality standards a VASP must evidence at licensing and maintain afterwards. The version in force took effect on 19 June 2025.

The technology Part requires a Technology Governance and Risk Assessment Framework proportionate to the business, covering development, operations, back-up, capacity and availability controls. It must comply with the Dubai Electronic Security Center standards under Dubai Law No. 9 of 2022, Federal Decree-Law No. 45 of 2021 on personal data, and the Central Bank's consumer protection cybersecurity rules where they apply. A written Cybersecurity Policy must be submitted to VARA during licensing and reviewed at least annually by the Chief Information Security Officer. Key and wallet management must avoid any single point of failure, log every change of key access, revoke departing signatories immediately and audit access removal quarterly.

An independent auditor must run vulnerability assessments and penetration tests, including smart-contract audits where relevant, at least annually and before any new system or product goes live; VARA may also require threat-led penetration testing by an external tester. VASPs must run distributed-ledger tracing software on incoming and outgoing transactions and wallet addresses, govern any algorithms they use, and keep a Business Continuity and Disaster Recovery Plan that is tested and updated annually. The CISO must be a different person from the Compliance Officer but may also be the Data Protection Officer. Material cybersecurity events, or events triggering the continuity plan, must be reported to VARA no later than 72 hours after detection.

The data protection Part requires compliance with the PDPL and any free zone or foreign data protection law that applies, a written privacy compliance programme, a Data Protection Officer, and notice to VARA within 24 hours after a personal data incident is reported to a data regulator or data subject. The confidentiality Part limits use of client information to the purpose for which it was given and prohibits using confidential information for trading virtual assets. Schedule 1 is non-binding guidance on five risk categories: organisational, technical, detection and response, customer virtual assets, and digital operational resilience.

Who it applies to

Every VASP licensed by VARA in Dubai outside the DIFC, its Board, Senior Management, Chief Information Security Officer, Data Protection Officer and Staff, and the third-party technology providers and external testers it engages for its systems and penetration testing.

Contents

English official text in 79 rules. Open the full text or jump to a provision:

1. Rule I.A.1
2. Rule I.A.2
3. Rule I.A.3
4. Rule I.A.4
5. Rule I.A.5
6. Rule I.A.6
7. Rule I.A.7
8. Rule I.B.1
9. Rule I.B.2
10. Rule I.B.3
11. Rule I.C.1
12. Rule I.D.1
13. Rule I.D.2
14. Rule I.D.3
15. Rule I.D.4
16. Rule I.E.1
17. Rule I.E.2
18. Rule I.E.3
19. Rule I.E.4
20. Rule I.E.5
21. Rule I.E.6
22. Rule I.E.7
23. Rule I.E.8
24. Rule I.E.9 — Third-party technology service providers
25. Rule I.E.10
26. Rule I.F.1
27. Rule I.F.2
28. Rule I.G.1
29. Rule I.G.2
30. Rule I.G.3
31. Rule I.H.1
32. Rule I.H.2
33. Rule I.I.1
34. Rule I.I.2
35. Rule I.I.3
36. Rule I.J.1
37. Rule I.K.1
38. Rule II.A.1
39. Rule II.A.2
40. Rule II.B.1
41. Rule II.B.2
42. Rule II.C.1
43. Rule II.C.2
44. Rule III.A.1
45. Rule III.A.2
46. Rule III.A.3
47. Rule III.A.4
48. Rule III.A.5
49. Rule A.1 — Comprehensive security framework standard
50. Rule A.2 — Secure development lifecycle standard
51. Rule A.3 — Workforce security management standard
52. Rule A.4 — Infrastructure management standard
53. Rule A.5 — Third-party technology service provider standard
54. Rule B.1 — Key generation standard
55. Rule B.2 — Wallet creation standard
56. Rule B.3 — Key storage security standard
57. Rule B.4 — Smart contract security standard
58. Rule B.5 — Multi-signature security standard
59. Rule B.6 — Transaction verification standard
60. Rule B.7 — Key compromise response standard
61. Rule B.8 — Key holder management standard
62. Rule B.9 — Authentication control standard
63. Rule B.10 — Developer workstations standard
64. Rule B.11 — Security testing standard
65. Rule B.12 — Unauthorised recovery standard
66. Rule B.13 — Audit logging standard
67. Rule C.1 — Transaction monitoring standard
68. Rule C.2 — Internal user activity monitoring standard
69. Rule C.3 — Enhanced monitoring standard
70. Rule C.4 — Tactical hardening standard
71. Rule C.5 — Investigation capability standard
72. Rule C.6 — On-chain analysis standard
73. Rule C.7 — Remediation standard
74. Rule D.1 — Customer authentication standard
75. Rule D.2 — Withdrawal control standard
76. Rule D.3 — User education standard
77. Rule D.4 — VA Wallet concentration risk standard
78. Rule E.1 — Digital operational resilience test standard
79. Rule E.2

Key provisions

Obligations and deadlines

• Submit the Cybersecurity Policy to VARA during licensing and have the CISO review it at least annually.
• Commission independent penetration testing at least annually and before launching any new system, application or product.
• Audit removal of key-access rights quarterly and revoke departing key signatories immediately.
• Test and update the Business Continuity and Disaster Recovery Plan every year.
• Report material cybersecurity events to VARA no later than 72 hours after detection.
• Notify VARA within 24 hours after reporting a personal data incident to a data regulator or data subject.
• Appoint a CISO who is not the Compliance Officer, and a Data Protection Officer.

Penalties

The Rulebook sets no fines of its own. Breaches are enforced under Part IX of the VARA Regulations, and Schedule 3 of those Regulations sets indicative fines for violations of Rules; enforcement can also include enforcement notices, limits on the licensed activities, suspension or revocation of the Licence and action against Responsible Individuals.

History and citations

“Cites” and “Cited by” are built automatically from references in the full texts held in this library; they cover only instruments in the library.

Related instruments

Related Polaris services

• Corporate Structuring & Group Design
• Corporate Secretary Services
• AML Compliance UAE — goAML, KYC