VARA Technology and Information Rulebook · May 2025
VARA Cybersecurity Compliance for VASPs
We help crypto and virtual asset service providers meet the cybersecurity rules in VARA’s Technology and Information Rulebook. We build the policies and controls VARA expects, secure your wallets and keys, and run the independent penetration tests and smart contract reviews the rulebook requires.
- 23+ years in UAE cybersecurity
- 500+ clients
- 99% client satisfaction
What does VARA require on cybersecurity?
VARA, the Dubai Virtual Assets Regulatory Authority, sets its technology and cybersecurity rules in the Technology and Information Rulebook. Every licensed virtual asset service provider (VASP) must have a technology governance framework, a cybersecurity policy, secure key and wallet management, independent annual testing, a tested continuity plan and a Chief Information Security Officer.
| Regulator | Dubai Virtual Assets Regulatory Authority (VARA), set up under Dubai Law No. 4 of 2022 |
|---|---|
| Rulebook | Technology and Information Rulebook, current version issued 19 May 2025 |
| Applies to | All VASPs licensed by VARA, alongside the Company, Compliance and Risk Management, Market Conduct and activity rulebooks |
| Key roles | A Chief Information Security Officer, separate from the Compliance Officer, and a Data Protection Officer (the CISO may hold both roles) |
| Testing | Independent vulnerability assessment and penetration testing at least once a year and before any new system, application or product |
| Incident reporting | Material cybersecurity events reported to VARA within 72 hours of detection |
| Not covered | Virtual asset firms in DIFC and ADGM, which are regulated by the DFSA and the FSRA instead |
Do VARA’s cybersecurity rules apply to you?
They do if any of these describe you:
- You are applying for a VARA licence and need a cybersecurity policy ready for submission
- You run an exchange, broker-dealer, custody, lending, transfer or investment service for virtual assets in Dubai
- You hold client keys or wallets, directly or through a third-party custodian
- You are about to launch a new platform, app, smart contract or product
- VARA has asked for your latest penetration test, audit results or incident details
Licensed in DIFC or ADGM instead? Your regulator is the DFSA or the FSRA in ADGM, and different rules apply. We will confirm which ones cover you in the first call.
What VARA cybersecurity compliance involves
Part I of the rulebook covers technology governance, controls and security; Parts II and III cover personal data and confidential information. The work falls into eight areas.
Technology governance framework
A technology governance and risk assessment framework proportionate to your business, covering development, operations, backups, capacity and availability testing (Rule I.A).
Cybersecurity policy
A written policy protecting your systems and client data. It is submitted to VARA during licensing and reviewed at least once a year by your CISO (Rule I.B).
Keys and wallets
No single point of failure in access to virtual assets, backups of keys and seed phrases kept separately, strict access logs and quarterly reviews of removed access (Rule I.D).
Independent testing
Vulnerability assessments and penetration tests by a qualified, independent third party, including smart contract audits where relevant, at least annually and before new launches (Rule I.E).
Threat-led penetration testing
Advanced testing on live systems when VARA requires it, run by an external tester that meets VARA’s conditions (Rules I.E.5–10).
Business continuity
A business continuity and disaster recovery plan, tested and updated every year, that covers blockchain-specific risks such as network failure and key storage (Rule I.H).
CISO and staff competence
A CISO of good standing, senior management oversight, and staff kept aware of current cyber risks, including those specific to virtual assets (Rules I.I and I.J).
Incident reporting and data protection
Material cyber events reported to VARA within 72 hours (Rule I.K), a Data Protection Officer, and compliance with the UAE PDPL and other data laws (Part II).
How we get you VARA ready
Whether you are preparing a licence application or already licensed, the sequence is the same.
- 1
Scoping call
We review your licensed or planned activities, custody model, technology stack and any VARA deadline, and confirm what is in scope.
Week 0 · free
- 2
Gap assessment
Every relevant rule in the Technology and Information Rulebook checked against your current policies, controls and evidence, with gaps ranked by risk.
Weeks 1–3
- 3
Policies and governance
Your technology governance framework, a cybersecurity policy ready for VARA, key and wallet procedures, the continuity plan and an incident playbook built around VARA’s reporting deadlines.
Weeks 2–6
- 4
Independent testing
Vulnerability assessment and penetration testing of your infrastructure, applications, APIs and wallet systems, plus smart contract review where relevant.
Weeks 4–8
- 5
Remediation and retest
We help your team fix the findings, then retest so the report you hand VARA shows the issues closed.
Weeks 6–10
- 6
Ongoing compliance
Pre-launch testing for new products, the annual test cycle, continuity plan tests and CISO support.
Year round
Most VASPs complete stages 1 to 5 in 8 to 10 weeks. A licence application with a fixed submission date can be fast-tracked.
What you get
- Gap assessment against the Technology and Information Rulebook
- Technology governance and risk assessment framework
- Cybersecurity policy ready for submission to VARA
- Key, seed phrase and wallet management procedures
- Business continuity and disaster recovery plan, with a test record
- Incident response playbook covering the 72-hour and 24-hour VARA notices
- Independent penetration test report, with retest results
- Smart contract review report, where relevant
- Personal data compliance programme and DPO responsibilities
- Evidence pack organised by rule, ready for VARA requests
Choose how we work with you
VARA readiness assessment
2–3 weeksBest for: Knowing exactly where you stand
- · Gap report against the rulebook
- · Prioritised remediation plan
- · Licence-readiness view
VARA cybersecurity programme
8–10 weeksBest for: Licence application or full compliance
- · Policies and framework
- · Independent testing and retest
- · Evidence pack
Annual testing and CISO support
AnnualBest for: Licensed VASPs staying compliant
- · Annual and pre-launch testing
- · Continuity plan test
- · Virtual CISO support
Preparing a VARA licence application?
A 30-minute call is enough to tell you what the rulebook expects from your technology team and how long it will take to get there.
VARA cybersecurity deadlines and frequencies
The rules VASPs most often miss are the recurring ones. This is what the rulebook sets.
| Requirement | How often or how fast | Rule |
|---|---|---|
| Cybersecurity policy review | At least once a year, by the CISO | I.B.2 |
| Penetration testing and vulnerability assessment | At least once a year, and before any new system, application or product | I.E.1 |
| Review of removed key access | Every quarter | I.D.2 |
| Business continuity and disaster recovery plan | Tested and updated every year | I.H.1 |
| Material cybersecurity event | Reported to VARA within 72 hours of detection | I.K.1 |
| Personal data incident | Reported to VARA within 24 hours of notifying a data regulator or the people affected | II.C.2 |
| Threat-led penetration testing | When VARA requires it | I.E.5 |
What affects cost and timeline
You get a written scope and quote after the scoping call. These are the factors that move it:
- Licensed activities
- Exchange, custody and lending services carry more technology risk than advisory services.
- Custody model
- Self-custody with hot and cold wallets, multi-party computation or a third-party custodian each need different controls.
- Platform size
- The number of applications, APIs, blockchains and integrations to test.
- Smart contracts
- Whether your products rely on your own smart contracts that need review.
- Existing work
- ISO 27001, SOC 2 or earlier testing can be reused, which shortens the project.
- Deadlines
- A fixed licence submission date may need a larger team working in parallel.
Why VASPs choose Intello for VARA
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Compliance and testing under one roof. We write the policies and run the independent tests, so findings and fixes stay joined up.
Web3 security experience. We test wallets, APIs and blockchain applications as well as traditional infrastructure.
Built around VARA’s deadlines. Your playbooks, test cycle and evidence pack follow the timeframes the rulebook sets.
Dubai-based team. We work on site with your engineering and compliance teams.
Frequently asked questions
What is VARA’s Technology and Information Rulebook?
It is the VARA rulebook that sets technology, cybersecurity, personal data and confidential information requirements for virtual asset service providers in Dubai. The current version was issued on 19 May 2025. Every VARA-licensed VASP must comply with it alongside VARA’s other rulebooks.
Who must comply with VARA’s cybersecurity rules?
All virtual asset service providers licensed by VARA, which covers Dubai outside the DIFC. Firms in the DIFC are regulated by the DFSA, and firms in ADGM by the FSRA, under their own rules.
How often does a VASP need penetration testing?
At least once a year, and before introducing any new system, application or product (Rule I.E.1). The tests must be run by a qualified, independent third party, include smart contract audits where relevant, and the results must be given to VARA on request.
Does a VASP need a Chief Information Security Officer?
Yes. Rule I.I.1 requires a CISO who is responsible for compliance with Parts I and III of the rulebook. The CISO must be a different person from the Compliance Officer, must be of good standing and suitably experienced, and may also act as the Data Protection Officer. We can support your CISO with our virtual CISO service.
How quickly must a VASP report a cyber incident to VARA?
A material cybersecurity event, or an event that triggers your continuity plan and materially affects operations, must be reported as soon as reasonably practicable and no later than 72 hours from detection (Rule I.K.1). For personal data incidents, VARA must be told within 24 hours of notifying a data regulator or the people affected (Rule II.C.2).
What is threat-led penetration testing (TLPT)?
TLPT is an advanced, intelligence-led test of critical functions, which can be run on live production systems. VARA can require it when it considers it necessary, based on your risks and the criticality of your business. It must be carried out by an external tester that meets VARA’s conditions on expertise, accreditation and insurance.
Does VARA require smart contract audits?
Where smart contracts are relevant to your business, the annual independent testing must include comprehensive audits of their effectiveness, enforceability and robustness, and they must be tested before new products launch (Rule I.E.1).
Do data protection laws apply to VASPs?
Yes. Part II of the rulebook requires VASPs to comply with the UAE PDPL and any other data protection law that applies to them, to run a written personal data compliance programme, and to appoint a Data Protection Officer.
Related services
Get a clear view of your VARA position
Tell us a little about your business and we will set up a free 30-minute readiness check.
What happens next
- 1We reply within one business day
- 2A 30-minute call to scope your VARA requirements
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787
Last reviewed: October 2026. This page is general guidance, not legal advice.
Sources: Technology and Information Rulebook, 19 May 2025 (VARA) · Dubai Virtual Assets Regulatory Authority