Q2 2026 Review to Enforce Data-Driven AML

Dubai’s Digital Property Regulatory Authority (VARA) has issued a proper warning to a number of Digital Asset Service Suppliers (VASPs). The warning follows 2024 and 2025 supervisory critiques that discovered “main weaknesses” of their Anti-Cash Laundering (AML) and Combating the Financing of Terrorism (CFT) Enterprise Danger Assessments (BRA).

Associated: VARA punishes 19 crypto firms for working in Dubai with out licenses

Firms have failed to deal with the dangers of AI and proliferation financing

VARA acknowledged that a number of VASPs failed to keep up correct documentation and data-driven methodologies for his or her danger assessments. A number of entities had been discovered utilizing unrealistic residual danger assessments.

Crucially, the regulator famous that firms had been ignoring new and rising threats. These embrace proliferation financing (PF), focused monetary sanctions (TFS) and the misuse of synthetic intelligence (AI).

The brand new round clarifies the obligations underneath Rule III.D of the Compliance and Danger Administration Rulebook. It requires every VASP to develop a clear, Council-approved methodology for assessing these dangers. This framework ought to outline clear danger classes, scoring scales and weighting logic.

Mandate requires NRA integration, quarterly critiques

VARA additionally acknowledged that these danger assessments have to be in step with nationwide and sectoral findings. Each VASP is now required to include the outcomes of the UAE Nationwide Danger Evaluation (NRA) and different sectoral reviews into its inner BRA and buyer danger frameworks.

The round requires that these BRA outcomes be fed “straight” into all AML/CFT insurance policies, buyer danger fashions and transaction monitoring programs. VASPs should additionally doc all quarterly assessments and keep model management of their assessments.

VARA units deadline for thematic evaluation in Q2 2026

These quarterly reassessments are actually necessary to make sure every BRA stays present. VARA expects suppliers to evaluation all latest information, together with buyer exercise, new product launches and jurisdictional publicity, no less than quarterly.

VARA confirmed that it’s going to conduct a thematic evaluation of all BRA frameworks within the second quarter of 2026. Firms that fail to supply a reputable, data-driven evaluation can be given 30 days to right deficiencies earlier than going through potential regulatory or enforcement motion.