Dubai’s Virtual Assets Regulatory Authority (VARA) has introduced stricter anti money laundering guidelines for licensed crypto companies, targeting compliance and risk management. In the regulation published on June 12, VARA now requires companies to refresh their risk assessments more frequently and back up evaluations with concrete data. As a result, compliance obligations have intensified significantly for virtual asset service providers operating in Dubai.
More frequent and detailed risk analysis
Under the revised framework, companies can no longer rely on static compliance lists. VARA now demands ongoing evaluations of customer profiles, transaction types, offered products and services, distribution channels, and geographical risks. Countries classified as high risk or subject to enhanced monitoring by the Financial Action Task Force (FATF) must be swiftly incorporated into these risk analyses as well.
VARA’s updated guidelines transform risk assessment from a purely periodic license requirement into a continuous monitoring process, ensuring that licensed companies’ risk evaluations truly reflect their current business activities.
According to the new regulation, companies must review their risk assessments at least every three months. If a firm experiences changes in products, services, business models, partnerships, or corporate structure, the re evaluation must occur even earlier. Notably, firms can no longer consolidate risks such as money laundering, terrorist financing, proliferation financing, and targeted financial sanctions under a single category.
Mini glossary: FATF is the international body setting standards for combating money laundering and terrorist financing. The Travel Rule is a compliance requirement mandating the sharing of sender and recipient information during crypto transfers under certain conditions between financial institutions.
Increased accountability for top management
VARA expects senior executives, board members, and compliance officers to have direct and up to date knowledge of their organization’s residual risk levels and the strategies to manage them. The guidance also highlights areas requiring special attention, including risks associated with artificial intelligence and machine learning, anonymity enhancing transactions, and mass funding activities.
This guidance signals that Dubai’s regulatory hub for global crypto companies is adopting a more demanding approach. According to NeosLegal data, regulatory bodies in the United Arab Emirates including VARA, ADGM, DFSA, the UAE Central Bank, and CMA have licensed or authorized over 100 virtual asset service providers to date.
Dubai market stays open but compliance costs rise
The new guidelines largely align with FATF standards: sanctions screening, customer due diligence, risk based monitoring, and adherence to the Travel Rule are all enforceable elements within current regulations. This could offer partial advantages for global firms already familiar with stringent compliance regimes in the European Union, Singapore, Switzerland, or the United States.
Nevertheless, Dubai is setting the bar higher in some areas. The expectation for up to date sanction screening solutions, automatic monitoring tools, wallet address analysis, distributed ledger reviews, and more granular geographical risk controls stands out. Consequently, companies equipped only with basic compliance manuals may find the new regime challenging.
Regulatory scrutiny expands across the UAE
This update comes as financial crime oversight intensifies nationwide. Since the start of 2025, the UAE Central Bank has imposed penalties amounting to more than 370 million dirhams—over $100 million USD—against banks, exchange houses, insurance companies, and financial institutions for failing to prevent money laundering and terrorist financing.
Regulators in Dubai are also taking a tougher stance on privacy focused assets and transactions, reportedly increasing scrutiny due to the elevated money laundering risks. While the market remains open to crypto businesses, obtaining a license is no longer enough. Companies must now continuously prove that their risk management systems are properly scaled to the size, complexity, and exposure of their activities.
