Dubai’s Virtual Assets Regulatory Authority (VARA) has told crypto firms and their auditors exactly what a proof-of-reserve audit must check, after reviewing every such report submitted to it in 2025.
The , dated 6 October, sets out a minimum scope for the independent audits that licensed firms must commission to show they hold their clients’ crypto in full. VARA said, “The aim is a consistent, robust, and sufficiently detailed approach to verifying how firms safeguard client assets.” It didn’t say what its review of the 2025 reports found or how many firms fell short.
Seven checks every audit must make
Under VARA’s rules, a licensed firm must hold reserve assets equal to 100% of what it owes clients, in the same asset, reconciled daily and audited by an independent third party. Client assets must sit in wallets separate from the firm’s own and can’t be lent out without client consent and the right licence.
The circular says auditors must confirm, for the whole review period, that:
- reserves never fell below 100% of client liabilities;
- each liability was matched in the same asset, without substituting another coin of equal value;
- every wallet holding client assets was covered, including hot, warm and cold wallets, wallet-infrastructure providers and third-party custodians.
They must also check:
- that client assets were kept separate from the firm’s own, identifying any mixing;
- that the firm controlled every client wallet, describing the custody arrangement for each;
- that reserves were reconciled daily, with evidence the process worked;
- whether any client assets were lent, pledged or otherwise used, and if so, which.
Audit reports must describe the procedures, evidence and sampling behind each conclusion, and separate clean results from exceptions, scope limits and anything that couldn’t be verified.
“Where independent evidence is reasonably available, management representations alone should not be relied upon as sufficient audit evidence,” the circular says.
VARA added that hiring an auditor doesn’t move responsibility for safeguarding away from the firm’s board and senior management.
Intelligence-sharing deal with the FIU
The circular followed a between VARA and the UAE Financial Intelligence Unit (FIU) to share financial intelligence and coordinate on crypto-related financial crime. It was signed by Ali Faisal Ba’Alawi, head of the FIU, and Matthew White, VARA’s chief executive.
Ba’Alawi said, “The partnership strengthens our collective ability to detect and analyse suspicious activity involving virtual assets”.
White said: “Continued cooperation between regulators, the UAE FIU, law-enforcement bodies and industry is essential.”
VARA regulates virtual asset activity in Dubai outside the Dubai International Financial Centre, which has its own regulator. The circular is listed on .
The circular applies to the audits firms commission from now on. VARA hasn’t said whether any firm’s 2025 report led to action, or when it will next review the reports against the new scope.
