VARA orders Dubai crypto firms to use FATF lists, real-time scoring
VARA ordered Dubai virtual asset firms to track FATF high-risk and blacklisted jurisdictions and to use data-driven risk models with assessments refreshed at least every three months.
On June 15, 2026, the Dubai Virtual Assets Regulatory Authority published guidance requiring virtual asset service providers to track FATF high-risk and blacklisted jurisdictions and to adopt quantitative, data-driven risk models with real-time scoring.
The guidance requires firms to maintain a fully documented business risk assessment based on quantitative inputs. Providers must integrate transaction and customer metrics into day-to-day scoring models, map customer profiles and product lines, and continuously evaluate geographic exposure with immediate inclusion of FATF high-risk and blacklisted countries.
Risk assessments must be updated at least every three months and must be refreshed immediately after any major change in a firm’s operational structure or product offering. The guidance requires separate risk treatments for proliferation financing and targeted financial sanctions rather than combining them with general money-laundering assessments. Firms must identify and document risks from AI-enabled processes and anonymity-enhanced transactions.
Firms must show that risk findings directly determine the allocation of compliance resources and daily enforcement actions. Compliance officers, senior managers and boards are expected to be aware of residual risk ratings and to take responsibility for managing risks tied to AI use and transactional activity. VARA warned that failure to maintain current, data-backed assessments may result in regulatory action.
The regulator emphasized real-time scoring rather than periodic manual checks. Quantitative data cited in the guidance includes transaction volumes and patterns, customer segment behavior, product usage metrics and geographic flow analysis, which firms must incorporate into monitoring and escalation models. Supervisors will use the guidance to assess firms’ controls and compliance programs.
The guidance follows VARA’s 2026 Business Risk Assessment thematic review and aligns with federal work such as the UAE National Risk Assessments. Firms operating in Dubai will likely need to invest in data systems, analytics and governance to produce auditable risk scores and evidence that those scores inform staffing levels, monitoring thresholds and transaction controls.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
