Web3 & Blockchain
Institutional Crypto Custody in Dubai: The Compliance Checklist
Jul 01, 2026
Introduction
Institutional crypto custody in Dubai is a regulated activity under VARA with strict compliance requirements. For institutions, getting custody right is non-negotiable.
The Problem: Custody Is Heavily Regulated
Custody isn't simply about keeping crypto in a wallet. VARA requires custodians to ensure clients can always access their assets and that no one can touch assets improperly. Many firms underestimate the infrastructure required.
The Solution: A Compliance Checklist
Custody providers must be a separate legal entity from any other group entity. Each client's assets must live in their own dedicated wallet—no commingling and no rehypothecation. Private keys must follow industry best practices with no single point of failure. Annual vulnerability assessments and penetration testing are mandatory. Governance requires independent directors and quarterly board meetings.
Real Numbers: The Cost of Non-Compliance
VARA fines can reach AED 10 million for violations. UAE Central Bank has imposed over AED 370 million in AML penalties since early 2025.
UAE-Specific Security Considerations
VARA's Custody Services Rulebook applies alongside compliance, risk, and technology rulebooks. DIFC custody providers follow DFSA rules with firm-led token suitability assessments.
Why FortyFi
FortyFi helps institutions build VARA-compliant custody infrastructure.
FAQ
Is custody a standalone license? Yes. Custody requires a specific VARA license. Can I commingle client assets? No. Each client must have dedicated wallets. Rehypothecation is prohibited. How often are audits required? Annual vulnerability assessments and penetration testing are mandatory.
Build Compliant Custody
Message FortyFi on WhatsApp for a free custody consultation.
