Dubai’s VARA tightens crypto AML rules, forcing firms to track FATF blacklists in real time

Dubai’s Virtual Assets Regulatory Authority has issued new anti-money laundering guidance that pushes licensed crypto firms toward more data-driven and frequently updated risk assessments.

The guidance, released on June 12, requires virtual asset service providers to integrate FATF high-risk and increased-monitoring jurisdictions into their compliance processes. It also raises expectations around risk monitoring, senior management oversight, AI-related risks, anonymity-enhancing transactions, and proliferation financing.

The update raises the compliance bar for one of the world’s most active crypto licensing hubs. NeosLegal estimates that more than 100 VASPs hold permits or approvals across UAE regulators, including VARA, ADGM, DFSA, CBUAE, and CMA.

For global exchanges and custodians operating in Dubai, the message is clear: access to the market now comes with heavier operational obligations.

VARA pushes crypto firms toward data-driven risk checks

VARA’s updated framework requires licensed firms to move beyond static compliance checklists and maintain risk assessments that reflect current business activity.

Firms must assess risks tied to customer profiles, transaction types, products, services, delivery channels, and geographic exposure. Countries identified by the Financial Action Task Force as high-risk or subject to increased monitoring must be factored into those assessments promptly.

Risk assessments must be reviewed at least every three months, or sooner if a firm changes its products, services, business model, ownership, or corporate structure. That makes compliance an ongoing process rather than a periodic licensing exercise.

The guidance also requires firms to distinguish between money laundering, terrorist financing, proliferation financing, and targeted financial sanctions risks. They cannot treat all financial crime risks as one broad category.

Senior managers, board members, and compliance officers are expected to understand the firm’s residual risk rating and how it is being managed. VARA also expects companies to account for emerging risks linked to AI and machine learning, anonymity-enhancing transactions, and crowdfunding activity.

Dubai’s crypto hub status now comes with higher compliance costs

Dubai has positioned itself as a regulatory hub for global crypto firms, but the new guidance shows that the regime is becoming more demanding.

The VARA framework is closely aligned with FATF standards. Its rulebooks incorporate FATF recommendations as enforceable requirements, including Travel Rule obligations, sanctions screening, customer due diligence, and risk-based monitoring.

That gives global firms some advantage if they already operate under strong compliance regimes in jurisdictions such as the EU, Singapore, Switzerland, or the United States. Many of the core controls overlap.

However, Dubai’s expectations go further in some areas. Firms are expected to maintain updated sanctions monitoring, automated screening, wallet-address analysis, distributed ledger analytics, and more detailed geographic-risk controls.

This means a company with a basic compliance manual will struggle. VARA expects firms to show that their risk models are supported by real operational data and can adapt as the business changes.

UAE enforcement makes the message harder to ignore

The guidance comes as UAE regulators continue tightening financial crime supervision across the broader financial sector.

Since early 2025, the UAE Central Bank has imposed more than AED 370 million, or over $100 million, in AML and counter-terrorist financing penalties on financial institutions, including banks, exchange houses, insurers, and finance companies.

Dubai regulators have also taken a stricter approach to anonymity-related risks, with privacy-enhancing assets and transactions receiving closer scrutiny because of their AML implications.

For crypto firms, the direction of travel is clear. Dubai remains open to virtual asset businesses, but it is no longer enough to obtain a licence and operate with static controls. Firms must keep proving that their risk systems match the size, complexity, and exposure of their business.

If you're reading this, you’re already ahead. Stay there with our newsletter.