by Soham Jethani and Rhea Shah

Dubai’s Virtual Assets Regulatory Authority (VARA) has clarified how independent audits should verify that customers’ virtual assets, such as bitcoin, are safeguarded. Its circular of 6 October 2026 follows a review of reserve reports submitted in 2025.^[1]

For anyone keeping virtual assets with a provider, the underlying question is straightforward: does the provider hold the assets it owes its customers, and are those assets properly protected?

What backing customer assets means

VARA’s existing rules require VARA-licensed providers to maintain reserves covering 100% of their liabilities to customers, in the same virtual asset, at all times. If a provider owes customers ten bitcoin, it must hold ten bitcoin to back that obligation. Holding another token worth the same amount does not satisfy the requirement. Providers must reconcile reserves daily, checking holdings against what they owe, and obtain an independent audit at least every six months. The report goes to VARA with the subsequent quarterly submission.^[2]

Customer assets must also be kept in digital wallets separate from the provider’s own assets and identified as customer wallets in its records. The records must make clear that those assets belong to customers.^[3]

What the audit must establish

The circular clarifies what VARA expects an independent reserve audit to establish:

• Reserve coverage and reconciliation: Reserves should cover at least 100% of customer liabilities throughout the review period, with each liability backed by the same virtual asset. The audit should also establish whether daily reconciliations between reserves and customer liabilities worked effectively.

• Wallet coverage and control: The review should extend to every wallet holding customer assets, including wallets operated through technology providers and assets held with third-party custodians. For each wallet, the report should explain the custody arrangement and whether the provider maintained control during the review period.

• Segregation and use of customer assets: The audit should assess whether customer assets were kept separate from the provider’s own assets and identify any commingling. Any lending, pledging, rehypothecation or other use of customer assets during the period should also be disclosed, together with the arrangements and assets affected.^[4]

The circular also sets out how audit findings should be reported:

• Evidence and conclusions: For each area reviewed, the report should describe the procedures performed, evidence obtained, sampling methodology (including selection across the review period), reliance on third parties and any scope limitations. It should distinguish between compliant outcomes, identified exceptions, scope limitations and matters that could not be independently verified, with a documented basis for each conclusion.

• Exceptions and follow-up: The report should explain how exceptions are being addressed, including whether the auditor performed follow-up procedures or whether the provider will manage them through its internal compliance and remediation framework.

• Continuing responsibility: Management representations alone are insufficient where independent evidence is reasonably available. Appointing an external auditor does not transfer or reduce the responsibility of the provider, its board, senior executive officer or control functions for ongoing compliance and safeguarding customer virtual assets.^[5]

What providers should do now

Providers should review the audit engagement with their auditor to ensure it covers each requirement in the circular and that the necessary records and supporting evidence are available before the report is finalised. A snapshot of balances cannot, by itself, establish compliance throughout a period.

Reserve shortfalls also require action when they arise. Existing rules require immediate notification to VARA if a provider cannot maintain, or fails to meet, its reserve requirements. That notification must explain the deficit, its cause, the remedial steps and their expected timing.^[6]

For customers, the value of a reserve audit lies in what it actually verifies. Providers should be able to explain that clearly, including any gaps in the evidence.