Stay up to date with our latest news
VARA has told Dubai's virtual asset firms what a reserve audit must prove. On 6 October 2026, the Virtual Assets Regulatory Authority issued a Circular titled "Reserve Assets Audit Report", following its thematic review of the Proof of Reserve Assets reports VASPs submitted in 2025.
The Circular clarifies the audit expectations supporting existing regulatory obligations. It reinforces obligations VASPs already have and sets out, in more detail, what VARA expects an independent audit of Reserve Assets to cover, what evidence it should rest on, how findings should be reported and who stays accountable.
For VARA-licensed VASPs with relevant Client Virtual Asset liabilities or safeguarding arrangements, the Circular reinforces the importance of comprehensive, independently verifiable reserve controls, including where third-party custodians or wallet infrastructure providers are involved. Audit reports relying solely on management representations or excluding relevant wallet arrangements may fall short of VARA's expectations.
The rules VARA is reinforcing
The Circular restates existing requirements under two rulebooks.
Requirement | What it means | Rule |
|---|---|---|
100% reserve coverage | Reserve Assets equal to 100% of client liabilities at all times, across all Virtual Asset Activities | Company Rulebook, Rule VI.E |
One-to-one, same asset | Reserves held in the same Virtual Asset as the client liability; no substitution with another Virtual Asset or a monetary equivalent | Company Rulebook, Rule VI.E |
Daily reconciliation and independent audit | Reserves reconciled every day and audited by an independent third party | Company Rulebook, Rule VI.E |
Segregation | Client Virtual Assets kept separate from the VASP's proprietary or operational Virtual Assets | Compliance and Risk Management Rulebook, Rule V.B.3 |
Identification | Client assets identifiable in the VASP's books and records | Compliance and Risk Management Rulebook, Rules V.B.3 and V.B.4 |
Ledger-level reconciliation | Accurate daily reconciliations supported by individual client credit and debit ledger balances | Compliance and Risk Management Rulebook, Rule V.D.1 |
Rehypothecation | Restricted unless the required client consent and VARA licensing requirements are met[SA1] | Compliance and Risk Management Rulebook, Rule V.B.4 |
Under Rule VI.E of the Company Rulebook, VASPs are required to arrange an independent audit of Reserve Assets at least every six months, with the resulting audit report included in their subsequent quarterly regulatory reporting to VARA. The Circular is therefore directly relevant to VASPs preparing for their next independent reserve audit.
What an independent audit must now cover
The Circular sets a minimum scope. Auditors are expected to assess:
Whether the VASP maintained Reserve Assets equal to at least 100% of its aggregate client liabilities throughout the review period, supported by appropriate records and evidence demonstrating ongoing compliance rather than compliance solely at the reporting date
Whether reserves were held in the same Virtual Asset as the corresponding client liabilities.
The completeness of the relevant wallet arrangements within the audit scope, including hot, warm and cold wallets, as well as arrangements involving third-party custodians and wallet infrastructure providers.
How well client assets are segregated, and whether there is any commingling.
The VASP's control over the wallets holding Client Virtual Assets, and the nature of the custody arrangements.
How effective the daily reconciliation process is, and the evidence behind it.
Any rehypothecation, lending, pledging or other use of Client Virtual Assets during the review period.
Two points stand out. The test runs across the whole review period, so a clean position on the audit date isn't enough. And the scope reaches every wallet and every third party in the custody chain.
How audit reports and findings should be presented
VARA expects the audit report to give a clear, sufficiently detailed conclusion against each element of the minimum scope. The report should document:
the procedures performed
the evidence obtained
the sampling methodology
any reliance on third parties
any scope limitations
any exceptions identified
Management representations alone shouldn't be treated as sufficient evidence where independent supporting evidence is reasonably available. Every exception must come with an explanation of the follow-up or remediation in place.
In practice, VASPs should maintain independently verifiable supporting evidence, including relevant wallet records, third-party custodian statements and ledger-level reconciliations, enabling auditors to assess compliance beyond management-prepared summaries or representations.
Accountability stays with the VASP
Appointing an external auditor doesn't reduce or transfer regulatory responsibility. The VASP, its Board, its Senior Executive Officer and its relevant control functions remain responsible for ongoing compliance and for safeguarding Client Virtual Assets.
The independent audit provides assurance but does not replace the VASP's ongoing regulatory responsibilities. The Board and Senior Management should maintain effective oversight of reserve adequacy, segregation arrangements, reconciliation controls and the timely remediation of identified deficiencies.
What to do before your next reserve audit
Map every wallet and custodian. List hot, warm and cold wallets, third-party custodians and infrastructure providers, and confirm who controls each one.
Test coverage across the period. Check that reserves stayed at or above 100% of client liabilities every day, asset by asset, not just at month end.
Check like-for-like holdings. Confirm reserves sit in the same Virtual Asset as each client liability, with no substitutes.
Strengthen daily reconciliations. Make sure they tie back to individual client credit and debit ledger balances and leave an evidence trail an auditor can test.
Confirm segregation. Check that client and proprietary assets are separate and clearly identified in your books and records.
Review any use of client assets. Document any rehypothecation, lending or pledging, and the client consent and licensing that support it.
Agree the audit scope in writing. Make sure your auditor's engagement covers every element of VARA's minimum scope and reports against each one.
Brief the Board. Set out who owns reserve and custody controls, how exceptions are tracked, and how remediation is reported.
Where a reserve shortfall is identified, VASPs must also consider their immediate notification and ongoing reporting obligations under Rule VI.F of the Company Rulebook, independently of the periodic audit process.
How j. awan & partners can help
Our VASP specialists work with VARA-regulated firms and applicants on custody, safeguarding and regulatory compliance.
Where you are | How we help |
|---|---|
Licensed and holding Client Virtual Assets | A gap assessment of your Reserve Assets, segregation and reconciliation controls against the Circular, with a prioritised remediation plan |
Preparing for your next reserve audit | Readiness review of evidence, wallet mapping and audit scope, so the engagement covers VARA's minimum requirements |
Responding to audit exceptions | Remediation plans and documentation of follow-up actions for VARA |
Applying for a VARA licence | Custody arrangements, policies and internal controls designed to meet these expectations from the start |
Board and senior management | Briefings on accountability for Client Virtual Assets and the oversight VARA expects |
Expect your next reserve audit to be judged against this Circular. Speak to our VASP team about where your controls stand today.
Frequently asked questions
What is VARA's Reserve Assets Audit Report Circular? It is a Circular issued by Dubai's Virtual Assets Regulatory Authority on 6 October 2026. It sets out VARA's minimum expectations for independent audits of VASPs' Reserve Assets, after a thematic review of Proof of Reserve Assets reports submitted in 2025.
Does the Circular introduce new rules? It reinforces existing obligations under the Company Rulebook and the Compliance and Risk Management Rulebook, and sets more detailed expectations for audit scope, evidence, reporting and governance.
Can a VASP hold reserves in a different Virtual Asset or in cash? No. Reserves must be held one-to-one in the same Virtual Asset as the client liability. Substitution with another Virtual Asset or an equivalent monetary value isn't permitted.
Which wallets does the audit need to cover? All relevant wallet arrangements, including hot, warm and cold wallets, third-party custodians and wallet infrastructure providers.
Can auditors rely on management representations? Not on their own, where independent supporting evidence is reasonably available.
Does appointing an auditor transfer responsibility? No. The VASP, its Board, Senior Executive Officer and control functions remain responsible for compliance and for safeguarding Client Virtual Assets.
What happens if a VASP fails to maintain the required Reserve Assets?
Under Rule VI.F of the Company Rulebook, a VASP must notify VARA immediately of any failure to maintain the required Reserve Assets, provide details of the shortfall and proposed remediation, and submit daily updates unless otherwise directed by VARA.
VARA's Reserve Assets Audit Circular: What Dubai VASPs Must Show Their Auditors
VARA has told Dubai's virtual asset firms what a reserve audit must prove. On 6 October 2026, the Virtual Assets Regulatory Authority issued a Circular titled "Reserve Assets Audit Report", following its thematic review of the Proof of Reserve Assets reports VASPs submitted in 2025.
VARA's Reserve Assets Audit Circular: What Dubai VASPs Must Show Their Auditors
VARA has told Dubai's virtual asset firms what a reserve audit must prove. On 6 October 2026, the Virtual Assets Regulatory Authority issued a Circular titled "Reserve Assets Audit Report", following its thematic review of the Proof of Reserve Assets reports VASPs submitted in 2025.
VARA has told Dubai's virtual asset firms what a reserve audit must prove. On 6 October 2026, the Virtual Assets Regulatory Authority issued a Circular titled "Reserve Assets Audit Report", following its thematic review of the Proof of Reserve Assets reports VASPs submitted in 2025.
The Circular clarifies the audit expectations supporting existing regulatory obligations. It reinforces obligations VASPs already have and sets out, in more detail, what VARA expects an independent audit of Reserve Assets to cover, what evidence it should rest on, how findings should be reported and who stays accountable.
For VARA-licensed VASPs with relevant Client Virtual Asset liabilities or safeguarding arrangements, the Circular reinforces the importance of comprehensive, independently verifiable reserve controls, including where third-party custodians or wallet infrastructure providers are involved. Audit reports relying solely on management representations or excluding relevant wallet arrangements may fall short of VARA's expectations.
The rules VARA is reinforcing
The Circular restates existing requirements under two rulebooks.
Requirement | What it means | Rule |
|---|---|---|
100% reserve coverage | Reserve Assets equal to 100% of client liabilities at all times, across all Virtual Asset Activities | Company Rulebook, Rule VI.E |
One-to-one, same asset | Reserves held in the same Virtual Asset as the client liability; no substitution with another Virtual Asset or a monetary equivalent | Company Rulebook, Rule VI.E |
Daily reconciliation and independent audit | Reserves reconciled every day and audited by an independent third party | Company Rulebook, Rule VI.E |
Segregation | Client Virtual Assets kept separate from the VASP's proprietary or operational Virtual Assets | Compliance and Risk Management Rulebook, Rule V.B.3 |
Identification | Client assets identifiable in the VASP's books and records | Compliance and Risk Management Rulebook, Rules V.B.3 and V.B.4 |
Ledger-level reconciliation | Accurate daily reconciliations supported by individual client credit and debit ledger balances | Compliance and Risk Management Rulebook, Rule V.D.1 |
Rehypothecation | Restricted unless the required client consent and VARA licensing requirements are met[SA1] | Compliance and Risk Management Rulebook, Rule V.B.4 |
Under Rule VI.E of the Company Rulebook, VASPs are required to arrange an independent audit of Reserve Assets at least every six months, with the resulting audit report included in their subsequent quarterly regulatory reporting to VARA. The Circular is therefore directly relevant to VASPs preparing for their next independent reserve audit.
What an independent audit must now cover
The Circular sets a minimum scope. Auditors are expected to assess:
Whether the VASP maintained Reserve Assets equal to at least 100% of its aggregate client liabilities throughout the review period, supported by appropriate records and evidence demonstrating ongoing compliance rather than compliance solely at the reporting date
Whether reserves were held in the same Virtual Asset as the corresponding client liabilities.
The completeness of the relevant wallet arrangements within the audit scope, including hot, warm and cold wallets, as well as arrangements involving third-party custodians and wallet infrastructure providers.
How well client assets are segregated, and whether there is any commingling.
The VASP's control over the wallets holding Client Virtual Assets, and the nature of the custody arrangements.
How effective the daily reconciliation process is, and the evidence behind it.
Any rehypothecation, lending, pledging or other use of Client Virtual Assets during the review period.
Two points stand out. The test runs across the whole review period, so a clean position on the audit date isn't enough. And the scope reaches every wallet and every third party in the custody chain.
How audit reports and findings should be presented
VARA expects the audit report to give a clear, sufficiently detailed conclusion against each element of the minimum scope. The report should document:
the procedures performed
the evidence obtained
the sampling methodology
any reliance on third parties
any scope limitations
any exceptions identified
Management representations alone shouldn't be treated as sufficient evidence where independent supporting evidence is reasonably available. Every exception must come with an explanation of the follow-up or remediation in place.
In practice, VASPs should maintain independently verifiable supporting evidence, including relevant wallet records, third-party custodian statements and ledger-level reconciliations, enabling auditors to assess compliance beyond management-prepared summaries or representations.
Accountability stays with the VASP
Appointing an external auditor doesn't reduce or transfer regulatory responsibility. The VASP, its Board, its Senior Executive Officer and its relevant control functions remain responsible for ongoing compliance and for safeguarding Client Virtual Assets.
The independent audit provides assurance but does not replace the VASP's ongoing regulatory responsibilities. The Board and Senior Management should maintain effective oversight of reserve adequacy, segregation arrangements, reconciliation controls and the timely remediation of identified deficiencies.
What to do before your next reserve audit
Map every wallet and custodian. List hot, warm and cold wallets, third-party custodians and infrastructure providers, and confirm who controls each one.
Test coverage across the period. Check that reserves stayed at or above 100% of client liabilities every day, asset by asset, not just at month end.
Check like-for-like holdings. Confirm reserves sit in the same Virtual Asset as each client liability, with no substitutes.
Strengthen daily reconciliations. Make sure they tie back to individual client credit and debit ledger balances and leave an evidence trail an auditor can test.
Confirm segregation. Check that client and proprietary assets are separate and clearly identified in your books and records.
Review any use of client assets. Document any rehypothecation, lending or pledging, and the client consent and licensing that support it.
Agree the audit scope in writing. Make sure your auditor's engagement covers every element of VARA's minimum scope and reports against each one.
Brief the Board. Set out who owns reserve and custody controls, how exceptions are tracked, and how remediation is reported.
Where a reserve shortfall is identified, VASPs must also consider their immediate notification and ongoing reporting obligations under Rule VI.F of the Company Rulebook, independently of the periodic audit process.
How j. awan & partners can help
Our VASP specialists work with VARA-regulated firms and applicants on custody, safeguarding and regulatory compliance.
Where you are | How we help |
|---|---|
Licensed and holding Client Virtual Assets | A gap assessment of your Reserve Assets, segregation and reconciliation controls against the Circular, with a prioritised remediation plan |
Preparing for your next reserve audit | Readiness review of evidence, wallet mapping and audit scope, so the engagement covers VARA's minimum requirements |
Responding to audit exceptions | Remediation plans and documentation of follow-up actions for VARA |
Applying for a VARA licence | Custody arrangements, policies and internal controls designed to meet these expectations from the start |
Board and senior management | Briefings on accountability for Client Virtual Assets and the oversight VARA expects |
Expect your next reserve audit to be judged against this Circular. Speak to our VASP team about where your controls stand today.
Frequently asked questions
What is VARA's Reserve Assets Audit Report Circular? It is a Circular issued by Dubai's Virtual Assets Regulatory Authority on 6 October 2026. It sets out VARA's minimum expectations for independent audits of VASPs' Reserve Assets, after a thematic review of Proof of Reserve Assets reports submitted in 2025.
Does the Circular introduce new rules? It reinforces existing obligations under the Company Rulebook and the Compliance and Risk Management Rulebook, and sets more detailed expectations for audit scope, evidence, reporting and governance.
Can a VASP hold reserves in a different Virtual Asset or in cash? No. Reserves must be held one-to-one in the same Virtual Asset as the client liability. Substitution with another Virtual Asset or an equivalent monetary value isn't permitted.
Which wallets does the audit need to cover? All relevant wallet arrangements, including hot, warm and cold wallets, third-party custodians and wallet infrastructure providers.
Can auditors rely on management representations? Not on their own, where independent supporting evidence is reasonably available.
Does appointing an auditor transfer responsibility? No. The VASP, its Board, Senior Executive Officer and control functions remain responsible for compliance and for safeguarding Client Virtual Assets.
What happens if a VASP fails to maintain the required Reserve Assets?
Under Rule VI.F of the Company Rulebook, a VASP must notify VARA immediately of any failure to maintain the required Reserve Assets, provide details of the shortfall and proposed remediation, and submit daily updates unless otherwise directed by VARA.