VARA’s Licensing Procedure

1.    The entities having the interest to carry out work/ services as Virtual Asset ServiceProvider (“VASP”) are required to get themselves licensed with Virtual AssetRegulatory Authority (“VARA”), prior commencement without a license is not allowed.

2.    All the firms (including UAE-incorporated companies and overseas firms) are eligible for getting a license under “VARA”. VASPs shall have and maintain a legal entity in the Emirate in one of the legal forms approved by a commercial licensing authority in the Emirate.

3.    A limited liability company (LLC) or FZ CO is preferable for this sector. A sole proprietorship for this sector is not accepted by VARA. 

4.    UAE Resident Requirement - The senior management team is made up of appropriately competent professionals, and they choose two "Responsible Individuals" [RIs].

EachResponsible Person must be a full-time employee of the VASP, a fit and proper person, and a resident of the UAE or a passport holder from the UAE. VARA must approve Fit and Proper Persons.

5.    VARA License –the license issued to VASP is valid for 12 months, further the renewal is valid for 12 months. VARA issues renewal notifications 90 days in advance. The annual supervision fee is to be paid time of renewal.

6.    The license shall be issued on the basis of a new firm or existing firm

7.    Newfirms are required to go through a two-step approval

a.    Initialapproval application

·   Send an Initial Disclosure Questionnaire[IDQ] to the appropriate Free Zone Authority [FZA] or Dubai Economy &Tourism [DET]. Document required –business plan, details of firm’s beneficial owner, senior management

·   Make the initial payments [often equal to 50%of the license application fee] necessary to start the application evaluation.

·  Obtain initial approval to complete the formal incorporation of the business and operational setup, such as office space renting and personnel onboarding.

·   The company is not currently allowed to engage in Virtual Asset operations.

·    Issuance or modification of the existing license is to be completed by visiting the branch[1] of DET.

DET Centers offering commercial license – ALBarsha Mall; DED Café; Palm Strike Mall Jumeriah; Al TwarCentre, Dubai Mall; Clock Tower Deira;

 b.   “FullMarket Product” (FMP) License application

·   Following receipt of the Initial Approval, prepare and submit documents in accordance with the instructions provided by VARA.

·   Get direct feedback on the proposal from VARA, which may take the form of meetings, interviews, and the submission of further paperwork. Complete payment of the remaining license application costs and first-year supervision fees.

·  Obtain an FMP License, which can be conditioned on operational circumstances.

8. Existing company

a.   Before7 February 2023, companies conducting VAActivities in or out of Dubai [excluding DIFC] were needed to get in touch with their commercial licensor (DET or the applicable FZA) and submit an InitialDisclosure Questionnaire (IDQ) by 30 April 2023.

b.   Companies that did not finish the IDQ by April 30, 2023, should make an urgentappointment with their commercial licensor to do so.

c.   VARAhas started sending out Application Acknowledgement Notices (AAN) to businesses that have finished an IDQ. A company must submit an FMP License application after receiving an AAN before August 31, 2023. The process for finishing the License application is explained above. 

Paid-up Capital & Prudential Requirement(Company Rulebook Regulation 2023) 

The paid-up capital shall, at all times, be held and maintained in—

a.  a trust account with a licensed bank in the UAE with VARA stated as the beneficiary;

b. a surety bond furnished by a surety company authorized to conduct business in the UAE, which shall have no end date and states VARA as a beneficiary; or

c. any other manner as may be specified by VARA upon granting a License.

 Netliquid assets – VASPs must always keep and maintain enoughcurrent liquid assets such that their surplus over current obligations is worthat least 1.2 times their monthly operating expenditures (Net Liquid Assets).The reconciliation should be on a daily basis and a monthly report is sent toVARA.

FMPDocuments

1.    Corporate Structure and Governance

 a.    Certificateof entity incorporation

b.    List of beneficial owners

c.    Fit and proper person for inclusion in board and senior management

·    The person possess the necessary academicqualifications and in all cases, have relevant professional knowledge and/orindustry qualifications;

·   The person should be honest, reputable, haveintegrity and uphold the ethical standards reasonably expected of their role;

·    He/ She should possess adequate relevantglobal Virtual Asset sector and management experience, or such experience inanother relevant sector;

·    He/ She should possess a good understandingof the regulatory framework which governs the nature of the job or role and themarket; and

·    The person should be financially sound.

d.  Sourceof funds evidence – the entity establishing its business should bring money froma known banking channel. The funds should not be used for any illegal moneylaundering process. The VASP is required to comply with all AML/CTLregulations.

e.  OrOrganizational structure

·     The VASP shall maintain an entity structure thathas been approved by the commercial licensing authority in the Emirates.

·   The ownership structure should be clear andtransparent to identify the ultimate beneficial owners (identify the controllingentity)

f.     Governance framework

g.    Localentity website

h.    Keypersonnel

i.      Regulatorybusiness plan

j.      Financialprojections

k.    Grouplevel financial statement

l.      Proofof paid up capital

m.   Available capital locked up

n.    Reserve account report

o.    Insurancecertificates

·   It is mandatory for VASP to hold and maintainthe following insurance as per size and complexity of the business-

·   Professional indemnity insurance

·    Directors and officers insurance

·     Commercial crime insurance or similar typesfor all virtual assets stored in hot wallets

p.    Succession plan

q.    Winddown plan

2.    Riskand Compliance      

a.   Enterprise Risk Management framework and methodology

b.    Latest enterprise risk assessment

c.    Trades execution and settlement (Applicable for Exchange, Custody,VA Management and Investment Services, Broker-Dealer and Borrowing/Lendingservices only)

d.    Compliance manual

e.    Compliance monitoring program

f.     Group compliance breaches

g.    AML/CFT policy and procedures

·    The VASP must establish and maintain policy and procedure as perFATF guidelines which includes following

·    The VASP should not provide service and maintain a relationshipfor any financial or commercial transaction under an anonymous/fictitious name.

·    To maintain all records, documents and data for all transactionsand make all information available to VARA upon request.

h.  Current AML/CFT program status

i.    Outsourcing policy

j.    Outsourcing agreements

k.    Conflicts of interest policy

l.      Insider lists

m.   Terms and conditions (also referred to as Terms of Service, Termsof Use etc.) on client agreements

n.    Privacy policy

o.    Marketing policy and plan

p.    Sample marketing materials

q.    New product policy

r.     Market conduct policy

s.    VA listing policy (whereapplicable)

t.      VA assets analysis

u.    Records management policy

 3.   Technology

a.    Technology Infrastructuredesign

b.    Technology risk assessment framework and Methodology

c.    Business ContinuityManagement & IT Disaster Recovery Plan

d.    Cyber security policyoutlines the protection of electronic systems, client and counterparty datastored. The policy must be reviewed and update annually. VASP is required tosubmit a cyber security policy during licensing procedure.

·         informationsecurity;  

·         datagovernance and classification;

·         accesscontrols;

·         capacityand performance planning;

·         systemsoperations and availability concerns;

·         systemsand network security, consensus protocol methodology, code and smart contractvalidation and audit processes;

·         systemsand application development and quality assurance;

·         physicalsecurity and environmental controls, including but not limited to proceduresaround access to premises and systems;

·         proceduresregarding their facilitation of Virtual Asset transactions initiated by aclient including, but not limited to. considering multi-factor authenticationor any better standard for Virtual Asset transactions that

•      exceed transaction limits set by theclient, such as accumulative transaction limits over a period of time; and

•      initiated after a change of personaldetails by the client, such as the address of a VA Wallet;

e.    Key and wallet managementpolicy (Applicable for Exchange, Custody, VA Management and InvestmentServices, Broker-Dealer and Borrowing/Lending services only)

f.     UAE public keys and walletaddresses (Applicable for Exchange, Custody, VA Management and InvestmentServices, Broker-Dealer and Borrowing/Lending services only)

g.    Information security policy

h.    Penetration testing result –VASPs are required to work with an accredited and impartial third-party auditorto perform vulnerability assessments and penetration testing [including, to theextent relevant to the VASP's business and VA Activities, thorough audits ofthe effectiveness, enforceability, and robustness of all smart contracts] atleast once a year and ahead of the launch of any new systems, applications, andproducts. Upon request from VARA, VASPs must share the findings of any suchevaluations and testing.