Frameworks · Middle East
VARA Technology & Information Rulebook
The Technology and Information Rulebook is the Virtual Assets Regulatory Authority's binding rulebook for licensed virtual asset service providers in Dubai, outside the DIFC. It was issued on 19 May 2025 with a 30-day transition. It sets technology governance, cybersecurity, data protection and operational resilience obligations for every VARA licensee.
Who it applies to
It applies to virtual asset service providers licensed by VARA in the Emirate of Dubai, other than those in the DIFC. This covers exchange, broker-dealer, custody, lending, advisory and issuance activities.
Main requirements
Technology governance
The board is accountable for technology and information risk, sets policies and has an independent view of assurance.
Cybersecurity
Licensees manage access control, key and wallet security, network and system security, vulnerabilities and testing.
Data protection
Licensees protect client and personal data, and meet retention and residency requirements where the rulebook sets them.
Resilience & incidents
Licensees maintain business continuity, manage incidents and notify VARA.
How xmodo supports it
- 1
The rulebook is set up with each of its requirements. Each control has an owner, evidence and a calculated compliance status that the board can review before approval.
- 2
Wallet, key and custody controls have their own evidence requirements, stored with expiry dates.
- 3
Incident notification runs in the incident workflow, with the reporting deadline, the submission and the timestamps on one record.
- 4
xmodo maps the rulebook to ISO/IEC 27001, SOC 2 and the UAE PDPL, and to DFSA GEN 5.5 for groups with a DIFC entity.
Related frameworks
VARA Technology & Information Rulebook shares requirements with the frameworks below. Controls you already run for any of them count towards VARA Technology & Information Rulebook as well.
Frequently asked questions
Which edition does xmodo support?
xmodo supports the Technology and Information Rulebook issued on 19 May 2025. The rulebook date is stored as a field and checked against the current VARA rulebook.
We are a VASP in the DIFC. Does VARA apply?
No. VARA regulates virtual assets in Dubai outside the DIFC, and a DIFC firm answers to the DFSA. Groups with entities in both run each entity against its own regulator using one control library.