Virtual Assets Regulatory Authority (Dubai)

The VASP stays fully accountable. Outsourcing that would materially impair internal controls or VARA oversight is prohibited. The MLRO, CISO and DPO roles may be outsourced, but VARA can require in-house staff.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section A

Risk-assess each arrangement, including materiality. Due diligence covers capacity, financial soundness, reputation, regulatory status, reliance on subcontractors and virtual-asset expertise.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section B · Timing: Assess before start and at least annually; review providers at least annually

Notify VARA before any cross-border outsourcing, and promptly if an overseas authority seeks access to VASP information.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section F · Timing: Prior to cross-border outsourcing; overseas access request: as soon as possible

Notify VARA in advance of any new or materially changed Material Outsourcing. VARA may object, and its concerns must be resolved first.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section H.3-H.4 · Timing: In advance

Written contracts with mandatory terms. Material outsourcing adds service levels, contingency testing, regulator cooperation, exit assistance, insurance, and specified data and processing locations. Client data is returned or destroyed on exit.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section D · Timing: Provider breach notice to VASP: without undue delay

For material outsourcing, the VASP, VARA and appointed bodies get full access to premises, systems, data and staff. Pooled audits and certifications cannot replace the VASP's own audit right.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section G

Sub-outsourcing terms are required. The provider notifies planned changes, and the VASP may object or terminate.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section E

Keep an Outsourcing Policy and a register with provider, scope, location, dates, contacts, materiality, and whether personal or confidential data is involved.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section C

Give VARA access to compliance information within the timelines VARA sets.

VARA Technology and Information Rulebook · Part II, Section C, para 1 · Timing: As communicated by VARA

Notify VARA of a material breach of a Material Outsourcing agreement, or a development that could significantly affect operations, finances or reputation.

VARA Company Rulebook - Part IV Outsourcing · Part IV, Section H.1-H.2 · Timing: Immediately

Report a material cybersecurity event, or an event that triggers the BCDR plan and materially affects operations, with its nature, scope, impact and mitigation, and whether other authorities were told.

VARA Technology and Information Rulebook · Part I, Section K, para 1 · Timing: As soon as reasonably practicable, no later than 72 hours from detection

After notifying a data regulator or data subjects of a personal-data incident, notify VARA and give a summary (or a copy, if the regulator is in the UAE).

VARA Technology and Information Rulebook · Part II, Section C, para 2 · Timing: As soon as possible, within 24 hours of the other notification