Dubai's VARA sets a minimum scope for reserve audits at licensed firms

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

Dubai's Virtual Assets Regulatory Authority (VARA) issued a circular on 6 October 2026 that sets out the minimum an independent audit of a licensed firm's Reserve Assets must cover. The document comes from the regulator's Market Assurance function, is listed on VARA's news page under that date, and deals with one subject: how a virtual asset service provider, or VASP, shows that the assets it holds for clients are really there.

The circular is addressed to licensed virtual asset firms in general. It does not mention property. It matters to the property trade for one reason only: under the rules VARA has published, anyone who offers, markets or facilitates tokenised real estate in or from Dubai needs a VARA licence or approval. The firms behind Dubai's property tokens are therefore licence holders, and a circular written for licence holders reaches them like any other.

VARA circular on the Reserve Assets audit report, 6 October 2026; VARA Public Register as seen on 9 October 2026.

What VARA published on 6 October

According to the circular, the text follows a thematic review that VARA carried out on the 2025 Proof of Reserve Assets reports. In other words, the regulator read a year of reports from the firms it supervises, and then wrote down what it expects the next ones to contain.

The starting point is a rule that already exists. The circular restates that reserves must be at least 100 per cent of client liabilities at all times, and it points to the rules where that duty sits. Rule VI.E of VARA's Company Rulebook covers the 100 per cent coverage, the one-to-one holding, the daily reconciliation and the independent audit. Rules V.B.3 and V.B.4 of the Compliance and Risk Management Rulebook cover the segregation of client virtual assets, the one-to-one holding, and the ban on rehypothecation without consent and without the right licence. Rule V.D.1 of the same rulebook covers daily reconciliation and individual client ledgers.

So the circular creates no new reserve requirement. What it adds is a floor under the audit: a list of what the independent report must test, and a description of how that report must be written. The subject, in the circular's own framing, is the safeguarding of client virtual assets.

The seven points an audit must cover

The core of the circular is a minimum scope in seven points. Each one is a question the auditor has to answer about the period under review, and together they follow a client's asset from the ledger to the wallet.

Two words in that list do a lot of work. The first is "throughout". The coverage test is not a photograph taken on the last day of the period: the circular asks whether reserves stood at 100 per cent or more of what the firm owed its clients across the whole period. The second is "all". The third point lists five kinds of wallet by name, including those run by a wallet provider or a third-party custodian, so an arrangement outsourced to another company stays inside the audit.

The second point closes another door. A firm that owes its clients one kind of virtual asset is expected to hold that same kind, unit for unit. Holding something else of equal value does not meet the test, since the circular rules out substitution.

The seventh point is written as a question of fact. The auditor has to say whether client assets were lent, pledged, rehypothecated or used in any other way. The rulebook reference quoted next to it makes plain why: such use is not permitted without the client's consent and the corresponding licence.

How the report itself must be written

The circular then turns from what is tested to how the result is reported. According to VARA, a report must describe the procedures the auditor carried out, the evidence obtained, the sampling method, any reliance on third parties and any limitation on the scope of the work.

It must also sort its conclusions. The circular asks for four things to be kept apart: outcomes that were compliant, exceptions, scope limitations, and matters that could not be verified. A reader of the report should be able to tell at once which statements were confirmed, which were found wanting, and which the auditor was simply unable to check.

One sentence of the circular deals with the quality of the evidence. Management representations alone, it says, are not sufficient where independent evidence is reasonably available. A statement signed by the firm's own managers can support an audit; it cannot replace a check that the auditor was able to make directly.

Responsibility stays inside the firm

The circular is equally direct about who answers for the result. Appointing an external auditor, VARA writes, does not transfer or reduce the responsibility of the VASP, of its Board, of its Senior Executive Officer or of its control functions.

For a licensed firm, this means the audit is a check on the firm's own work, not a substitute for it. The daily reconciliation, the client ledgers and the separation of wallets are duties the rulebooks place on the firm every day of the year. The audit report is the moment an outsider tests them, and a weak report does not move the duty onto the auditor who signed it.

The circular names the Board and the Senior Executive Officer in that sentence. It is a reminder, addressed to the people who run a licensed firm, that the subject belongs on their table.

Where tokenised property comes in

The link between this circular and real estate has to be stated with care, since the document does not draw it.

What the published record does show is this. In a Consumer and Marketplace Alert dated 19 February 2026, VARA stated that anyone offering, marketing or facilitating tokenised real estate in or from Dubai needs a VARA licence or approval, citing Dubai Law No. 4 of 2022 and Cabinet Resolution No. 111 of 2022. The same alert told the public to check a firm's status on the VARA Public Register.

That register, as seen on 9 October 2026, showed 57 results. Among them are two licences issued on the same day, 24 May 2025, both with the status Active. Prypco FZE holds licence VL/25/05/001 for Broker-Dealer Services. Ctrl Alt Solutions DMCC holds licence VL/25/05/002 for Broker-Dealer Services and Category 1 VA Issuance.

The Dubai Land Department (DLD) supplies the property side of the record. In a release dated 29 May 2025, five days after those licences were issued, DLD announced its Property Token Ownership Certificate and said the first tokenised project had sold within one day on Prypco Mint, which the release describes as VARA-licensed.

Put together, the sources support a narrow statement: property tokens in Dubai are offered by firms that hold VARA licences, and the circular of 6 October sets expectations for licence holders. They do not support a wider one. The circular does not say how its seven points apply to a token that represents a share in a home, and VARA has published no property-specific reading of it. How much of a given platform's activity falls under the Reserve Assets rules depends on what that platform holds for its clients, which the public documents do not describe.

The pilot these firms work in

The scale of the property token market gives the circular its context. DLD launched the pilot phase of its Real Estate Tokenisation Project on 19 March 2025, with VARA and the Dubai Future Foundation, in connection with the Real Estate Sandbox. The department described itself in that release as the first registration body in the Middle East to tokenise title deeds, and projected that the tokenisation market would reach AED 60 billion by 2033, or 7 per cent of Dubai's real estate transactions. That figure is DLD's own projection, not a measured result.

The first sale was small in money and wide in reach. According to DLD's release of 29 May 2025, it drew 224 investors of 44 nationalities, with an average investment of AED 10,714. The department said 70 per cent of them were investing in Dubai property for the first time, and that the waiting list stood at more than 6,000 people. The certificate itself was developed with VARA, the Central Bank of the UAE and the Dubai Future Foundation, the release said.

Phase II changed the nature of the market. DLD announced on 9 February 2026 that resale in the secondary market would open on 20 February 2026, with about 7.8 million real estate tokens available for resale. VARA's alert of 19 February described Phase 1 as complete and Phase 2 as a controlled testing period that includes secondary-market mechanisms.

What is not known yet

Several points remain open on the date of this article, and the sources say so themselves.

The circular states no deadline. It does not say by which date reports must meet the minimum scope, nor whether reports already in preparation are concerned.

There has been no public enforcement step in the same period. VARA's listing of regulatory notices, as seen on 9 October 2026, carries no regulatory or enforcement notice dated September or October 2026; the most recent entry is a notice of fines dated 24 July 2026 that concerns another company. Nothing in the sources reviewed for this article ties the circular to any named firm, in property or elsewhere.

On the property side, DLD said in its Phase II release that it was studying the onboarding of additional platforms, subject to evaluation and regulatory approval. Any platform that joins would need the same VARA licence or approval as those already operating, under the rules cited in the February alert, and would come within reach of the same circulars.

For brokers and investors who meet tokenised property in their work, the practical reference has not changed. VARA's own advice, in its alert of 19 February 2026, is to check a firm on the Public Register before dealing with it.

Kooky, from Shaka

Kooky edits Agents Estate and builds Shaka, the payment router he made for real estate professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →