A Dubai VASP applies the federal AML framework in Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, and on top of it VARA's Compliance and Risk Management Rulebook, which requires a UAE-resident MLRO, a documented business risk assessment, customer due diligence calibrated to virtual asset risk, travel rule information on transfers, goAML registration and reporting, and records that VARA can inspect at any time.
Two layers of law
A virtual asset service provider in Dubai is a financial institution for the purposes of the federal AML framework. Federal Decree-Law No. 10 of 2025 and the Executive Regulations in Cabinet Resolution No. 134 of 2025 apply to it exactly as they apply to a bank, and the Financial Intelligence Unit's goAML portal is where its reports go. On top of that sits VARA's Compliance and Risk Management Rulebook, which translates the federal obligations into virtual asset terms and adds requirements that the federal law does not spell out. The rulebook also incorporates the targeted financial sanctions regime under Cabinet Decision No. 74 of 2020.
The practical consequence is that a VASP's manual cannot be a copy of a bank's manual with the word "bank" replaced. It must address how due diligence is done on a wallet, how source of funds is evidenced on-chain, how the travel rule is applied to transfers, and how blockchain analytics feed transaction monitoring.
The people
VARA requires a Money Laundering Reporting Officer who is a UAE-resident employee of the VASP, suitably qualified and experienced, independent of revenue-generating functions and with a direct line to the board. The MLRO cannot be outsourced to a consultancy, although the function can be supported from outside. A separate Compliance Officer is also required, and in smaller firms the roles are sometimes combined with VARA's agreement. Our guide to VARA key personnel covers the qualifications and the common rejection reasons.
The documents
- Business risk assessment. An enterprise-wide assessment of the money laundering, terrorist financing and proliferation financing risk of the VASP's actual activities: the activities licensed, the virtual assets supported, the chains, the customer segments, the geographies and the delivery channels. It must be dated, approved by the board and refreshed when the business changes.
- AML/CFT policy and procedures. Customer due diligence and enhanced due diligence, beneficial ownership, politically exposed persons, high-risk countries under Article 23 of the Executive Regulations, ongoing monitoring, suspicious transaction reporting, record keeping, sanctions screening and the travel rule.
- Customer risk assessment methodology. The factors and weights that put each customer into a risk band and the due diligence that follows from each band.
- Transaction monitoring design. What the analytics tool flags, what thresholds apply, who reviews alerts and how decisions are recorded.
- Training plan and records. Role-based training with attendance and testing recorded.
- Independent audit. A periodic independent review of the programme with findings tracked to closure. See independent AML review.
The travel rule
VARA's rulebook requires originator and beneficiary information to accompany virtual asset transfers between VASPs, in line with the FATF standard, and requires a documented approach to transfers to and from unhosted wallets. In practice that means a travel rule solution integrated with the platform, counterparty VASP due diligence before information is shared, and a policy on what the firm does when the counterparty cannot or will not comply. The policy matters as much as the technology: inspectors ask what happens when the solution returns no match.
Reporting
Suspicious transaction and suspicious activity reports go to the Financial Intelligence Unit through goAML, which means the VASP must be registered on goAML with its MLRO as the registered user. Tipping off is an offence. Separately, VARA receives the periodic compliance returns its rulebook requires and expects the MLRO to report to the board at least quarterly on the state of the programme. Our note on goAML reporting and tipping off covers the judgement calls.
What VARA inspects
Supervision is continuous after licensing. VARA asks for the risk assessment and the policies, then tests them against files: a sample of onboarding files, alert dispositions, sanctions hits and their resolution, travel rule records, training logs and board minutes. The gap most often found is not a missing policy but a policy that describes a process the evidence does not show. Our inspection and enforcement guide describes what to do when a findings letter arrives, and our VARA enforcement letter guide covers the regulator's own process.
Where we come in
We design and refresh the programme, write the risk assessment with the firm's own data, support the MLRO with a quarterly board report and a rulebook watch, run the independent review and handle VARA correspondence. Manpreet Kaur, our Director of Licensing and Regulatory Compliance, worked inside VARA on the framework that governs every licensed VASP in Dubai, which is useful when the question is what the regulator will accept rather than what the rulebook says. The full scope is on our AML compliance practice page.
Frequently asked questions
Does the federal AML law apply to VARA-licensed VASPs?
Yes. A VASP is a financial institution for the purposes of Federal Decree-Law No. 10 of 2025 and its Executive Regulations. VARA's Compliance and Risk Management Rulebook applies on top of the federal framework and adds virtual asset specific requirements such as the travel rule.
Can a VARA VASP outsource its MLRO?
No. VARA requires the MLRO to be a UAE-resident employee of the VASP who is independent of revenue functions and reports to the board. The MLRO can be supported by external counsel and compliance specialists, but the role itself must sit inside the firm.
What is the travel rule for Dubai VASPs?
VARA requires originator and beneficiary information to accompany virtual asset transfers between VASPs, in line with the FATF standard, and a documented approach to transfers involving unhosted wallets. It requires both a technical solution and a policy for cases where the counterparty cannot comply.
Where does a VASP file suspicious transaction reports in the UAE?
With the Financial Intelligence Unit through the goAML portal. The VASP must be registered on goAML, usually with the MLRO as the registered user, and tipping off the customer is an offence under the Decree-Law.
What does VARA look at in an AML inspection?
The business risk assessment and policies first, then evidence: sampled onboarding files, transaction monitoring alert dispositions, sanctions hits and their resolution, travel rule records, training logs and board minutes showing the MLRO's reports. The most common finding is a gap between the written process and the evidence.
This article is general information on the position at the date shown and is not legal advice. AML obligations turn on the licence, the regulator and the facts of each business; speak to us before relying on it.
