VARA sets out what an audit of client reserve assets must cover
A VARA circular of 6 October 2026 sets a seven-point minimum scope for independent audits of client reserve assets, running from wallet coverage to rehypothecation. It follows VARA's review of the Proof of Reserve Assets reports filed in 2025.
An independent audit of client reserve assets must now cover at least seven set areas, Dubai's Virtual Assets Regulatory Authority (VARA) has told licensed virtual asset service providers. The Circular: Reserve Assets Audit Report, issued by VARA's Market Assurance function on 6 October 2026, follows a thematic review of the Proof of Reserve Assets reports that firms submitted in 2025. It sets a minimum audit scope and describes what the auditor's report should contain. It reaches every VARA-licensed firm that holds virtual assets for clients, and the audit firms they appoint.
What the rules say
The circular creates no new obligations. It explains how the existing rules in VARA's Rulebooks should be tested, and says it should be read with those Rulebooks and any reporting instructions VARA issues. The underlying rules are:
| Rule | Requirement |
|---|---|
| Company Rulebook, Rule VI.E | Reserve Assets kept at 100 per cent of client liabilities at all times, held one-to-one in the same virtual asset as the liability, reconciled daily and audited by an independent third-party auditor |
| Compliance and Risk Management Rulebook, Rules V.B.3 and V.B.4 | Client virtual assets held in wallets separate from the firm's own, identified in its books and records, held one-to-one and not rehypothecated unless client consent and VARA licensing requirements are met |
| Compliance and Risk Management Rulebook, Rule V.D.1 | Systems for accurate daily reconciliation of each client's virtual assets, including individual client ledger balances |
On that footing, the circular lists seven areas the auditor should cover:
- Whether Reserve Assets were at least 100 per cent of aggregate client liabilities throughout the review period.
- Whether they were held one-to-one in the same type of virtual asset, with no substitution.
- All wallets holding client assets: hot, warm and cold wallets, assets held through wallet infrastructure providers and assets with third-party custodians.
- Whether client assets were segregated from the firm's own, and any commingling.
- Whether the firm controlled all client wallets during the period, with a description of each custody arrangement.
- Whether daily reconciliation against client liabilities took place, and evidence that it worked.
- Whether any rehypothecation, lending, pledging or other use of client assets occurred, and if so the arrangements and assets involved.
For each item, the report should set out the procedures performed, the evidence obtained, the sampling method and its coverage across the period, any reliance on third parties and any limitation of scope. Each item needs a clear conclusion that separates compliant outcomes, exceptions, scope limitations and matters that could not be independently verified. Where independent evidence is reasonably available, management representations alone should not be relied on.
Appointing an external auditor, the circular adds, does not reduce the responsibilities of the firm, its Board, its Senior Executive Officer or its control functions.
Who is affected
Every VARA-licensed virtual asset service provider that holds or controls virtual assets for clients, directly or through custodians and wallet technology providers. Audit firms engaged to report on Reserve Assets will have to plan their work to the circular. Boards and Senior Executive Officers stay answerable for the result.
Key dates
| Date | Event |
|---|---|
| 2025 | Proof of Reserve Assets reports submitted and later reviewed by VARA |
| 6 October 2026 | Circular issued |
The circular gives no effective date and no submission deadline.
What it means in practice
In practice the reserve audit moves from a balance check at one point in time to a review of controls over a period. Auditors are asked to show coverage "throughout the review period", to test whether reconciliation works and to report what they could not verify.
Take a hypothetical exchange that keeps most client bitcoin in cold storage with a licensed custodian and a working balance in a hot wallet run on third-party technology. Under the circular the audit should cover both, describe each custody arrangement, confirm that client and house assets were never mixed, and say whether any client assets were lent or pledged. A clean report on the custodian balance alone would fall short.
If you are choosing where to establish, read the circular as a sign of how closely VARA supervises. It also adds audit cost and preparation time, and firms should budget for both.
What we do not yet know
The circular does not say when it applies or whether it governs audits already under way. It is also silent on how reports should be submitted and on what qualifications VARA expects of the auditor beyond independence. Watch for the reporting instructions the circular refers to.
This piece appeared in Jurisdicta, Issue 002. General information only; not legal, tax or investment advice.