VARA compliant platform development in the enforcement year

VARA compliant platform development in 2026 is no longer a question of which rules apply. Eleven of VARA's twelve rulebooks still carry the effective date they were given in June 2025. What changed this year is that Dubai started fining licensed firms and telling them their reserve reports were not detailed enough.

That shift matters more to a build than another rulebook version would. A rule you comply with is a feature; a rule you must evidence is a data model. What follows is what VARA's 2026 circulars and its one amended rulebook demand of a platform, which records must exist before an inspector asks, and where the jurisdictional line sits — read off VARA's rulebook portal and circulars as of 8 October 2026.

The rulebooks did not move in 2026 — one of them did

VARA published Version 2.0 of its activity-based rulebooks on 19 May 2025, granted a 30-day transition and required full compliance by 19 June 2025, with strengthened controls around margin trading and token distribution services and clearer definitions for collateral wallet arrangements. There is no Version 3.0. As of 8 October 2026, eleven of the twelve rulebooks on VARA's rulebook portal still show an effective date of 19 June 2025.

One moved. The Exchange Services Rulebook is now effective from 31 March 2026, and the amendment added an entire new part — Part V, Exchange Traded Derivative Services Rules — to a rulebook whose version history runs V.1 (7 February 2023), V.2 (19 May 2025), current.

Rulebook	Current version effective	What it binds in a build
Company	19 June 2025	Capital; reserve assets at 100% of client liabilities (Rule VI.E)
Compliance and Risk Management	19 June 2025	Client VA segregation; daily reconciliation and per-client ledgers
Technology and Information	19 June 2025	Systems, information and technology controls
Market Conduct	19 June 2025	Machine-readable public disclosures; insider lists
Exchange Services	31 March 2026	Adds Part V: exchange-traded derivatives, margin, close-out, reporting
Seven other activity rulebooks	19 June 2025	Advisory, broker-dealer, custody, lending and borrowing, management and investment, transfer and settlement, issuance

If you search for a VARA rulebook 3.0 you will find a "V.3" label and conclude the framework moved again. It did not. Version numbers are per rulebook, not suite-wide: the Virtual Asset Issuance Rulebook lists V.1 (7 February 2023), V.2 (19 September 2023) and V.3 (1 October 2024) in its history, and its current version is still the 19 June 2025 one. V.3 there is older than Version 2.0 of the suite. Getting this wrong sends a team building to an archived rule.

What vara compliant platform development means once the question is "can you evidence it"

The clearest statement of the 2026 posture is a circular VARA issued on 6 October 2026, two days before this was written. After a thematic review of all Proof of Reserve Assets reports submitted in 2025, VARA published minimum expectations for the independent audit of reserve assets. Read it as a specification, not a policy note.

The underlying obligations already existed. Company Rulebook Rule VI.E requires reserve assets equal to 100% of client liabilities at all times, held one-to-one in the same virtual asset the liability is owed in, reconciled daily and independently audited. Compliance and Risk Management Rulebook Rule V.D.1 requires systems ensuring accurate daily reconciliation per client, "including complete individual client credit and debit ledger balances".

What 2026 added is what the auditor must be able to do with your data. The audit must confirm reserves were at not less than 100% of aggregate client liabilities throughout the review period, cover every wallet holding client assets — hot, warm, cold, wallets at infrastructure providers and assets with third-party custodians — and state the sampling methodology, including how samples were selected across the period. One sentence does most of the engineering work: where independent evidence is reasonably available, management representations alone should not be relied upon as sufficient audit evidence.

A platform that stores current balances and recomputes history cannot satisfy that. "Throughout the review period" and "samples selected across the period" mean an auditor picks an arbitrary timestamp and asks what the position was then — an append-only ledger with each reconciliation stored as a dated artefact, not a nightly job whose output is overwritten. The same shape appears in the Market Conduct Rulebook's insider list rules: the identity of each person with access to inside information, the reason, the date and time access was obtained, and — for every update — the date and time the triggering change occurred, retained at least eight years and produced to VARA on request. That is a bitemporal audit log with a statutory retention period, specified in a rulebook. It is the pattern behind the full task audit trail in the enterprise workflow platform we built, deployed in India — here the retention period and field list are simply non-negotiable.

Disclosures have to be rendered at the moment, not reconstructed afterwards

The Market Conduct Rulebook requires public disclosures to sit in an easily accessible location on the VASP's website in a machine-readable format, accurate at all times: licence number, every licensed activity including restrictions VARA imposed as a licence condition, the validity period, all responsible individuals, and a risk disclosure statement. A hand-maintained marketing page does not meet that. It is an endpoint fed from the record of your licence.

The derivatives rules tie a disclosure to a moment. Under Rule V.J, a firm offering exchange-traded derivatives must monitor each client's trading account continuously and notify the client before margin is at risk of falling below the required level — and that notification must include a full re-statement of the applicable risks. The margin call is not a status row someone can query later; it is an event that had to be delivered, with content, at a point in time, and later proved to have been delivered.

Travel-rule and suspicious-activity data has to be captured at source

On 24 February 2026 VARA issued a circular on implementation of the UAE Virtual Assets Travel Rule, made under Cabinet Decision No. 134 of 2025 implementing Federal Decree-Law No. 10 of 2025. It applies across all free zones and financial free zones, and it is full of constraints that are cheap at design time and expensive later:

• A firm must not execute a qualifying transfer unless the travel-rule requirements are satisfied — a blocking pre-flight check in the transfer path, not a reporting job.
• Where transfers are batched, the required information must accompany each individual transfer within the batch.
• Beneficiary identity verification is required where daily aggregated transfer amounts reach AED 3,500 and the beneficiary has not previously been verified. Below that threshold the information must still accompany the transfer; only verification is relaxed, and not where there is suspicion. Running daily aggregates is a system requirement, not a report.
• For domestic transfers where the beneficiary's VASP already has verified data by other means, limited information may be transmitted — provided the full dataset can be produced within three working days on request. That is an SLA on retrieval.
• The originating firm must confirm the counterparty VASP is appropriately regulated before executing, and must not transfer to counterparties that are not.
• Intermediary providers must maintain logs of all transfers including rejected or failed attempts. Failures are evidence, so they cannot be dropped on the floor.
• Transfers involving privacy tokens must not be executed at all, and unhosted-wallet transfers need enhanced due diligence including source-of-funds verification.
• Suspicious-activity assessment must take information from both the originator and the beneficiary side of a transfer into account.

Transaction fees, including gas fees, are expressly out of scope — one of the few places the circular reduces work. Most teams meet the rest of this list after the transfer service is built, which is when a blocking check in the hot path becomes a rewrite. Getting the counterparty-status lookup and the travel-rule payload into your API design and integration layer early is the difference.

The derivatives rulebook is really a reporting specification

Part V of the amended Exchange Services Rulebook is where 2026's new engineering sits. The hard numbers are narrow: retail investors may not be given more than 5-to-1 leverage, because minimum retail initial margin is 20%. Margin and leverage limits must be monitored at client level across all of a client's accounts, which rules out per-account risk state. Price feeds must be validated from multiple sources, diversified and independent enough that one failure does not propagate.

Rule V.L is the part to read before choosing a schema. Records must include ongoing suitability assessments; liquidation and close-out data giving total number and value of liquidations, the same split by client classification, the percentage attributable to each classification expressed both as a share of all liquidations and as a share of clients within that classification, plus totals per derivative and per underlying asset; ongoing client profit and loss; the distribution of leverage limits across the client base; market makers' and counterparties' identity, selection criteria and historical trade data; and incident reporting for flash crashes, triggered loss-mutualisation mechanisms and market-maker distress. The records must let VARA monitor compliance, and copies go to VARA on request.

Little of that is computable after the fact from a trades table. Client classification changes over time, so a liquidation must carry the classification that applied when it happened. That is one decision at the start of a build or an expensive migration later — the kind of thing custom software development gets asked to retrofit once a regulator has already asked the question.

If you incorporated in DIFC, none of this binds you

VARA states the boundary plainly on its own site: it is the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of the Dubai International Financial Centre. A firm inside DIFC answers to the Dubai Financial Services Authority and a different rulebook. A firm anywhere else in Dubai carrying on virtual asset activities must be licensed by VARA before it commences operations.

This is the expensive mistake, and it is corporate rather than technical. A team that builds to VARA's Part V and then finds the entity sits in DIFC has a licensing problem, not a build problem — and the reverse costs just as much. Settle the jurisdiction before the architecture. A companion post in this series covers the DFSA and DIFC fintech side; this one is about the VARA perimeter only.

The strongest argument against building any of this

The honest counter-case is good: this is commodity compliance plumbing, vendors sell it, and an off-the-shelf licensed exchange stack arrives with reserve reporting, travel-rule messaging and margin engines already written. For a firm whose edge is distribution rather than mechanism, that is usually the right answer. A bespoke build is the wrong choice when your differentiator is the market you reach, not how you hold or price assets.

It weakens on two specifics. First, several obligations are shaped by decisions VARA approves for your firm: margin asset quality and valuation procedures must be approved as part of your ETD authorisation, with material changes pre-approved, and leverage limits must suit each individual client. A vendor default is not an approved procedure. Second, as of 8 October 2026 VARA's public register lists 57 VASP licences, all active, with categories including "Exchange Services (including Exchange Traded Derivative Services)" alongside the older "(including VA Derivatives Trading)" wording. That is a small, specialised market where a generic product may not fit the activity you are licensed for.

Build to the rulebook you will be assessed against, not today's

VARA's licensing route has two stages: an Approval to Incorporate, which lets you establish the entity and set up operations but explicitly does not permit carrying on virtual asset activities, then the full VASP licence application. Every applicant complies with four compulsory rulebooks — Company, Compliance and Risk Management, Technology and Information, Market Conduct — plus one per licensed activity. VARA publishes no committed timeline. The widely quoted six-to-twelve-month figure comes from advisers, not the regulator: Middle East Briefing puts Approval to Incorporate at one to two months, about three months to submit the licence application after that, and roughly a month of review. Treat it as a sourced planning estimate, not a service level.

What is not an estimate is that 2026 is being enforced. VARA issued notices of fines against CoinMENA FZE and MX Global (MEXC) on 22 June 2026, Peken Global (KuCoin) on 24 June 2026 and Shelbit General Trading on 24 July 2026. If your licence lands twelve months from now, you will be assessed against rules already being used to fine people — including, on current evidence, a reserve audit standard published after your architecture was agreed.

So the decision to make now is which records you make immutable. Pick the three or four facts an inspector will ask you to reconstruct at a timestamp — reserve position, per-client ledger, client classification at the moment of a liquidation, travel-rule payload including the failures — and make those append-only before anything is built on top of them. For what we do in this market, our software development company in Dubai page is the place to start, and the pattern is the one behind what a UAE corporate tax filing system must produce: the obligation is not the calculation, it is the artefact you can hand over.