Dubai VARA mandates quarterly FATF blacklist checks for crypto firms

Dubai's Virtual Assets Regulatory Authority released new anti-money laundering guidance on June 12 that requires licensed crypto firms to integrate FATF high-risk and monitored jurisdictions into their compliance systems and update risk assessments at least every three months.

The guidance applies to all virtual asset service providers under VARA's remit. NeosLegal estimates more than 100 VASPs hold permits or approvals across UAE regulators including VARA, ADGM, DFSA, CBUAE, and CMA.

Risk assessments now must cover customer profiles, geographic exposure, transaction types, and the specific products and delivery channels each firm offers. Countries on FATF's high-risk and increased-monitoring lists have to be factored in promptly. The guidance also requires firms to distinguish money laundering and terrorist financing from proliferation financing as separate risk categories rather than treating all financial crime risks as one broad bucket. Senior managers and board members are expected to understand the firm's residual risk rating and how it is managed.

VARA also expects firms to account for emerging risks from AI and machine learning, anonymity-enhancing transactions, and crowdfunding activity. The refresh cycle is a minimum of three months. Immediate updates are required if a firm changes its products, services, business model, ownership, or corporate structure.

The VARA framework embeds FATF recommendations as enforceable requirements, including Travel Rule obligations under Recommendation 16, sanctions screening, customer due diligence, and risk-based monitoring. Firms already operating under strong regimes in the EU, Singapore, Switzerland, or the United States will find much of the core controls familiar. Dubai's expectations go further in areas such as wallet-address analysis and distributed ledger analytics. A company with a static compliance manual and no real-time operational data behind its risk model will struggle to meet the standard.

The guidance comes as UAE regulators tighten financial crime supervision across the broader financial sector. Since early 2025, the UAE Central Bank has imposed more than AED 370 million, or over $100 million, in AML and counter-terrorist financing penalties on banks, exchange houses, insurers, and finance companies. Dubai regulators have also been giving closer scrutiny to privacy-enhancing assets and transactions because of their AML implications.

For context on the broader market, see our crypto market analysis. For crypto firms, the rulebook makes compliance an ongoing operational requirement rather than a one-time licensing exercise. Firms that maintain static risk models will face gaps when VARA examines their controls. The penalty precedent from the Central Bank suggests that the cost of non-compliance can run into tens of millions of dollars for institutions that fall short.