Dubai raises the bar on crypto reserve audits: prove 100% backing for the whole review period, and don't just take management's word

Dubai's crypto regulator has told the auditors who check exchanges' reserves to dig deeper. In a circular dated October 6, the Virtual Assets Regulatory Authority (VARA) set out the minimum it expects from the independent audits that licensed firms must commission on the assets they hold for customers.

The circular does not change the underlying rule. Firms already have to hold reserves equal to 100% of what they owe clients, one for one in the same asset, reconcile them daily and have them independently audited. What changes is the proof. Auditors must confirm that reserves stayed at or above 100% throughout the review period, not at a single date, and that no other asset was substituted. They must cover every wallet holding client assets, hot, warm and cold, including those run by outside wallet providers and custodians.

They must also check that client assets were kept apart from the firm's own, that the firm controlled the wallets, and whether any client assets were lent, pledged or rehypothecated. VARA wrote that "management representations alone should not be relied upon as sufficient audit evidence" where independent evidence is reasonably available.

The circular follows VARA's review of the proof-of-reserves reports that firms filed in 2025. It states no deadline, and says that appointing an auditor does not reduce a firm's own responsibility.