#Dubai’s VARA issues rules on reserve asset audits; the key change is not a sudden increase in the reserve ratio to 100%. VARA’s website lists the October 6 circular, “Audit Reports on Reserve Assets.” Following its review of proof-of-reserves reports submitted in 2025, the circular clarifies what independent audits should examine and how reports should be written. Comparing the old rules with the new circular makes the update clear.
The first layer is the existing obligations. VARA’s current Company Rulebook already requires regulated virtual asset service providers to maintain 100% reserves against client liabilities, holding a one-to-one amount of the same virtual asset owed, reconciling daily, and undergoing independent third-party audits. So “100% reserves” and “daily reconciliation” are not new requirements introduced on October 6. The circular cites these existing requirements so audit opinions genuinely test whether they were met throughout the review period, rather than checking the balance on just one reporting date.
The second layer is the scope of verification. The circular requires audits to cover, at a minimum, all wallets holding clients’ virtual assets, including hot, warm, and cold wallets, technology service providers’ infrastructure, and third-party custodians. Audits must also check whether client assets are segregated from the provider’s own assets, whether the provider controls the relevant wallets, and whether any lending, staking, or other arrangements for using client assets existed during the review period. This provides more insight than a snapshot of total balances, but the circular itself does not declare any particular provider to be in violation.
The third layer is report traceability. Audit reports should specify the procedures performed, evidence obtained, sampling methods used across the review period, reliance on third-party materials, and any scope limitations. Conclusions should distinguish between compliance, identified exceptions, and items that could not be independently verified. Where independent evidence is available, management representations alone cannot be used as a substitute. External audits also do not relieve providers or their management of their ongoing responsibility to protect client assets.
What readers should look for next is whether subsequent audit reports from the covered providers disclose their scope, how exceptions were handled, and what verifiable evidence supports their conclusions—not whether the circular’s title is taken as a sign that an exchange has collapsed or that a token is set to benefit. VARA’s jurisdiction covers the relevant areas of Dubai, excluding the DIFC; the applicable rules also depend on the type of entity and activity. This is a comparison with the original text as of October 7 and does not imply any direction for prices.
The first layer is the existing obligations. VARA’s current Company Rulebook already requires regulated virtual asset service providers to maintain 100% reserves against client liabilities, holding a one-to-one amount of the same virtual asset owed, reconciling daily, and undergoing independent third-party audits. So “100% reserves” and “daily reconciliation” are not new requirements introduced on October 6. The circular cites these existing requirements so audit opinions genuinely test whether they were met throughout the review period, rather than checking the balance on just one reporting date.
The second layer is the scope of verification. The circular requires audits to cover, at a minimum, all wallets holding clients’ virtual assets, including hot, warm, and cold wallets, technology service providers’ infrastructure, and third-party custodians. Audits must also check whether client assets are segregated from the provider’s own assets, whether the provider controls the relevant wallets, and whether any lending, staking, or other arrangements for using client assets existed during the review period. This provides more insight than a snapshot of total balances, but the circular itself does not declare any particular provider to be in violation.
The third layer is report traceability. Audit reports should specify the procedures performed, evidence obtained, sampling methods used across the review period, reliance on third-party materials, and any scope limitations. Conclusions should distinguish between compliance, identified exceptions, and items that could not be independently verified. Where independent evidence is available, management representations alone cannot be used as a substitute. External audits also do not relieve providers or their management of their ongoing responsibility to protect client assets.
What readers should look for next is whether subsequent audit reports from the covered providers disclose their scope, how exceptions were handled, and what verifiable evidence supports their conclusions—not whether the circular’s title is taken as a sign that an exchange has collapsed or that a token is set to benefit. VARA’s jurisdiction covers the relevant areas of Dubai, excluding the DIFC; the applicable rules also depend on the type of entity and activity. This is a comparison with the original text as of October 7 and does not imply any direction for prices.
