On June 15, 2026, Dubai’s Virtual Assets Regulatory Authority (VARA, the emirate’s crypto regulator) published new guidance that tightens what its licensed crypto firms have to do on anti-money-laundering (AML) and counter-terrorism financing (CTF). The headline change: risk models must be data-driven, refreshed at least every three months, and plugged into FATF high-risk and blacklisted country lists in real time.
The document, formally titled the VARA AML/CTF Business Risk Assessment Guidance 2026, sits inside VARA’s existing rulebook framework and applies to every Virtual Asset Service Provider (VASP, a crypto business allowed to operate under Dubai’s rules) with a VARA license.
What actually changed
The new guidance moves Dubai from principle-based AML compliance (“firms should know their customers, monitor risk, etc.”) to a more prescriptive, quantitative regime. Concretely:
- Real-time FATF integration. Firms must connect FATF high-risk and blacklisted jurisdictions (FATF is the Financial Action Task Force, the global anti-money-laundering standards body) directly into their transaction monitoring. When FATF adds a country to its counter-measure list, the firm’s screening should reflect that change without a lag.
- Data-driven risk scoring. Instead of narrative risk assessments, VARA now expects models built from actual business data: transaction volumes, customer geography, product mix. Scoring has to be quantifiable and repeatable.
- Quarterly refresh, minimum. Risk assessments must be updated at least every three months. Any major operational change (new product, new geography, new custody arrangement) triggers an immediate refresh regardless.
- Enhanced due diligence for FATF-flagged jurisdictions. For clients or transactions linked to countries like North Korea, Iran, and Myanmar, firms must apply stricter identity and background checks (called enhanced due diligence in AML terms).
- New risk categories. VARA explicitly asks firms to account for AI-enabled operations and anonymity-enhanced transactions (crypto activity designed to hide who is sending or receiving, such as mixers or privacy coins).
VARA framed the update in one line: “Innovation will continue to be heavily supported, but only if it is backed by world-class, data-verified financial integrity.”
Why this matters
Dubai’s pitch to crypto firms has always been the same: come to VARA, get a licence, run a real business. But that pitch only holds if Dubai stays off international AML watch lists. The FATF removed the UAE from its grey list in 2024, and keeping that status intact is now central to VARA’s playbook.
The practical impact is uneven across the market:
- Big licensed VASPs (Binance, BitOasis, OKX, Bybit, Crypto.com’s UAE arm, and the operators handling the newly approved dirham stablecoin DDSC) probably already run FATF-integrated screening and quarterly risk reviews. For them the guidance formalises existing practice.
- Smaller VASPs and new licensees face real compliance spend. Real-time FATF-list integration is not a spreadsheet exercise. It usually means integrating a specialist AML data vendor, plus internal engineering to plug the feed into transaction monitoring. Six-figure annual cost is normal.
- Firms without a proper Chief Compliance Officer are the ones actually exposed. VARA can pull a licence, suspend it, or refuse to renew.
The requirement to account for AI-enabled operations is worth flagging on its own. VARA is one of the first crypto regulators globally to name AI-driven crypto activity as an AML risk category inside a rulebook. It signals where enforcement attention will drift next: agent-driven trading, LLM-mediated customer onboarding, and synthetic identity fraud.
The wider UAE regulatory picture
Compliance load in Dubai is now clearly higher than in Abu Dhabi. VARA’s rulebook covers retail-facing exchanges, stablecoin issuers, and the whole VASP register, which is why AML detail keeps growing. Abu Dhabi’s ADGM (Abu Dhabi Global Market, the emirate’s international financial free zone) runs a more institution-focused regime, most recently adding Bitcoin Suisse to its licensed lineup for institutional custody and trading.
For UAE-based crypto firms, the choice of jurisdiction now has a clearer AML dimension. Retail exchange in Dubai equals a full VARA data-driven compliance stack. Institutional custody in Abu Dhabi equals ADGM’s own AML rulebook, which is lighter on real-time FATF-list mechanics but heavier on capital and prudential requirements.
What to watch
- First enforcement action. Which licensee gets pulled up first for a failed quarterly refresh or a missed FATF-list update. That sets the market’s understanding of how strict “at least every three months” actually is.
- AML data vendors. A new compliance-tech market is emerging in the UAE around FATF-feed integration, real-time screening, and quantitative risk scoring. Expect players like Elliptic, Chainalysis, and TRM Labs to expand their Dubai footprints.
- Cross-check with CBUAE. The UAE central bank (CBUAE) runs a parallel AML supervision regime for banks and payment firms. Alignment between VARA and CBUAE guidance, especially on stablecoin issuers, will decide whether a crypto business needs one AML programme or two.
- How the AI-risk category evolves. VARA has flagged AI-enabled crypto operations. Watch for follow-up guidance that specifies what “AI-enabled” means in an AML context, and what evidence firms are expected to produce.
The rules do not change what Dubai wants to be. VARA still wants Dubai to be the destination of choice for licensed crypto operators. It just wants them to prove, with actual data, that they are keeping the emirate off international AML watch lists.
Source: Bitcoin.com News: VARA Pushes Dubai Crypto Firms to Track FATF Blacklists, Sharpening Risk Controls
Independent editorial coverage of Bitcoin and crypto in the UAE, regulation, market moves, and policy analysis.
