VARA sets minimum scope for audits of VASP reserve assets
On 6 October 2026, Dubai's Virtual Assets Regulatory Authority (VARA) published a circular titled "Reserve Assets Audit Report". The circular follows a thematic review of “all Proof of Reserve Assets reports submitted in 2025". It sets out the minimum that VARA expects an independent audit of a VASP's Reserve Assets to cover, and what the resulting audit report should contain.
The circular cites existing Rulebook requirements and sets out VARA's minimum expectations for how compliance with them is audited.
Purpose
VARA states that the circular's purpose is "to clarify VARA's minimum regulatory expectations in relation to the independent audit of Reserve Assets", and to promote a consistent and sufficiently detailed approach to verifying how client virtual assets are safeguarded. It is to be read with the applicable Rulebooks and with any reporting requirements or instructions VARA issues.
The rules it cites
Company Rulebook, Rule VI.E. VASPs must, "at all times", maintain Reserve Assets equivalent to 100% of liabilities owed to clients, hold them on a one-to-one basis in the same virtual asset that is owed, reconcile them daily, and have them audited by an independent third-party auditor "no less than every six (6) months". VASPs must include the audit reports in the subsequent quarterly report to VARA required under the Compliance and Risk Management Rulebook.
Compliance and Risk Management Rulebook, Rule V.B.3. Client virtual assets must be held in wallets separate from the VASP's own virtual assets, and wallets holding them must be labelled 'Client VA Wallet' in the VASP's books and records.
Compliance and Risk Management Rulebook, Rule V.B.4. Client virtual assets must be held on a one-to-one basis. Rehypothecation is not permitted unless the VASP has "explicit prior consent from the client providing discretionary authority to do so" and is appropriately authorised and licensed by VARA for all relevant VA activities in respect of those virtual assets.
Compliance and Risk Management Rulebook, Rule V.D. VASPs must maintain a system to ensure that accurate reconciliations of the virtual assets owned by each client are carried out daily, including full lists of individual client credit and debit ledger balances (V.D.1), and must notify VARA of any material reconciliation discrepancy that has not been rectified (V.D.2). The circular cites V.D.1.
The circular adds that appointing an external auditor "does not transfer or reduce the responsibility of the VASP, its Board, Senior Executive Officer or control functions" for ensuring ongoing compliance and the effective safeguarding of client virtual assets.
The minimum audit scope
The circular says the audit engagement "must be sufficiently detailed" for the auditor to form a clear conclusion on compliance. At a minimum, the auditor should:
Confirm that Reserve Assets were maintained at not less than 100% of aggregate client liabilities "throughout the review period".
Confirm that Reserve Assets were held one-to-one in the same type of virtual asset as the corresponding client liability, "without substitution by another Virtual Asset or equivalent value".
Cover all wallets used to hold client virtual assets, "including but not limited to" hot, warm and cold wallets, assets held through wallet infrastructure providers, and assets held with third-party custodians.
Assess whether the VASP segregated client virtual assets from the VASP's proprietary or operational assets, and identify any commingling.
Confirm whether the VASP maintained control over all client wallets during the review period, and describe the custody arrangement for each wallet: a licensed third-party custodian, or a self-custody solution, including wallets operated through third-party wallet technology providers.
Confirm that Reserve Assets were reconciled daily against client liabilities, and that appropriate evidence was obtained and reviewed appropriate evidence to verify that the reconciliation process was effective.
Confirm whether any rehypothecation, lending, pledging or other use of client virtual assets occurred during the review period and, if so, give details of the arrangements and the assets affected.
The audit report
For each of the seven points, VARA expects the report to describe the procedures performed, the evidence obtained, the sampling methodology (including how samples were selected across the review period), any reliance on third parties, and any scope limitations.
The report should set out the findings and explain how exceptions will be addressed, including whether the audit firm carried out follow-up or whether the VASP will manage them through its internal compliance and remediation framework. It should give a clear conclusion on each point, distinguishing "compliant outcomes, identified exceptions, scope limitations, and matters that could not be independently verified". The basis for each conclusion should be clearly documented.
On evidence, the circular states: "Where independent evidence is reasonably available, management representations alone should not be relied upon as sufficient audit evidence."
What the circular does not say
It sets no effective date. On our reading, the expectations apply to the next audit under Rule VI.E, which must take place at least every six months; the circular does not say this.
It does not publish the findings of the 2025 thematic review.
It does not refer to penalties or enforcement.
It does not name its addressees. It is signed "Market Assurance", VARA.
On wording: the circular uses "must" for the audit engagement being sufficiently detailed. The seven scope points and the report contents are framed as "should" or "VARA expects". The Rulebook requirements on VASPs use "must" and "shall".
Points for VASPs to consider
These are our observations, not statements in the circular.
Audit engagement letters for the next review period can be checked against the seven points and the reporting expectations, including the sampling approach across the period.
Point 1 asks for coverage to be confirmed "throughout the review period", not at a single date, and point 6 asks for evidence that the daily reconciliation process was effective. Daily reconciliation records and their supporting evidence are therefore directly relevant.
Under Rule V.B.4, rehypothecation requires the client's explicit prior consent giving discretionary authority, and the relevant VARA licensing. On our reading, lending or yield programmes that use client assets would need to meet this. Any rehypothecation, lending, pledging or other use during the period falls within point 7.
Point 2 asks the auditor to confirm there was no "substitution by another Virtual Asset or equivalent value", and Rule VI.E requires reserves in the same virtual asset that is owed. On our reading, holding one stablecoin against liabilities denominated in another would not meet this.
A wallet-by-wallet record of custody arrangements and control will support points 3 and 5.
Sources
VARA, Circular: Reserve Assets Audit Report, 6 October 2026: circular PDF, listed on the VARA news page. VARA Company Rulebook, Rule VI.E (Reserve Assets). VARA Compliance and Risk Management Rulebook, Rule V.B (Treatment of Client VAs) and Rule V.D (Reconciliation).
James Ross is Head of Advisory at denouement. This article is for information only and is not legal advice.
Comments