VA Management and Investment Services Rulebook

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority VA Management and Investment Services Rulebook 19 May 2025

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 2 Contents INTRODUCTION....................................................................................................................................................................3 I. PART I – POLICIES, PROCEDURES AND PUBLIC DISCLOSURES.....................................................4 A. Policies and procedures.........................................................................................................................................................4 B. Public disclosures......................................................................................................................................................................4 II. PART II – VA MANAGEMENT AND INVESTMENT SERVICES RULES ...........................................6 A. Client suitability.........................................................................................................................................................................6 B. Staff competency......................................................................................................................................................................6 C. Verification of information..................................................................................................................................................7 D. Impermissible activities .........................................................................................................................................................7 E. Client reporting & valuation................................................................................................................................................8 F. Fees and charges.......................................................................................................................................................................8 G. Marketing......................................................................................................................................................................................8 H. Management practices...........................................................................................................................................................9 I. Receipt and transmission of orders ................................................................................................................................9 J. Risk management and due diligence ..............................................................................................................................9 K. Client Agreements.................................................................................................................................................................10 SCHEDULE 1 – DEFINITIONS........................................................................................................................................12

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 3 Introduction The Dubai Virtual Assets Regulatory Authority ("VARA") was established and authorised by Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai ("Dubai VA Law") to regulate Virtual Asset Service Providers ("VASPs"). This VA Management and Investment Services Rulebook is issued pursuant to, and forms part of, the Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time ("Regulations"), issued by VARA, and applies to all VASPs Licensed by VARA to carry out VA Management and Investment Services in the Emirate. This VA Management and Investment Services Rulebook applies in addition to all other requirements in the Regulations as may be in force from time to time. As such, VASPs Licensed by VARA to carry out VA Management and Investment Services must also comply with the following Rulebooks applicable to all VASPs—

1. Company Rulebook;
2. Compliance and Risk Management Rulebook;
3. Technology and Information Rulebook;
4. Market Conduct Rulebook; and
5. All Rulebooks specific to the VA Activities that a VASP is Licensed by VARA to carry out. For the avoidance of doubt, where a VASP is Licensed by VARA to carry out other VA Activities in the Emirate in addition to VA Management and Investment Services, it must comply with all Rulebooks which apply to those other VA Activities. Unless otherwise stated, the Rules in VA Activity specific Rulebooks apply cumulatively for each VA Activity a VASP carries out. Capitalised terms in this VA Management and Investment Services Rulebook have the meanings ascribed to them in the Regulations or as otherwise provided in Schedule 1.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 4 I. Part I – Policies, Procedures and Public Disclosures A. Policies and procedures

1. In addition to all other requirements in the Regulations and Rulebooks, VASPs providing VA Management and Investment Services shall establish, implement and enforce appropriate written internal policies and procedures relating to the following— a. the ability of clients to have access to and withdraw their Virtual Assets including, but not limited to, during periods of high uncertainty and/or extreme volatility; b. their assessment of client suitability for relevant products or services, including but not limited to the nature, features, costs and risks of investment services, Virtual Assets or other financial instruments selected for their clients, while taking into account cost and complexity; c. how they ensure all Staff providing VA Management and Investment Services to clients are sufficiently competent in accordance with Rule II.B.1 of this VA Management and Investment Services Rulebook; and d. such other policies and procedures as VARA may require from time to time.
2. VASPs providing VA Management and Investment Services shall assess and, in any case, at least yearly review the effectiveness of their policies and procedures and take appropriate measures to address any deficiencies. B. Public disclosures
3. VASPs providing VA Management and Investment Services shall publish on their website in a prominent place or make available by other publicly accessible means— a. a detailed description of any actual or potential conflicts of interest arising out of their activities, and how these are managed; b. their policies and procedures relating to data privacy, whistleblowing and handling of client complaints; c. a statement as to the ability of clients to have access to and withdraw their Virtual Assets, particularly in times of extreme volatility;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 5 d. a statement as to the VASP’s arrangements for the protection of clients’ assets held by the VASP and how it determines uses of client Virtual Assets including but not limited to a detailed description of such uses; e. a statement as to how they protect client Virtual Assets from counterparty risk; f. a statement as to how in the course of the provision on VA Management and Investment Services, client Virtual Assets are used and how clients’ interests in respect of those Virtual Assets are thereby respected; g. a statement explaining that client Virtual Assets used by the VASP in the course of the provision of VA Management and Investment Services may be at risk, including the types and nature of such risks, and a statement on the likelihood and severity of any losses which may be suffered; h. a statement in relation to order execution by the VASP; i. a statement as to how liquidity risk is managed; and j. such other information as VARA may require from time to time. 2. Other disclosable matters. To the extent permissible under applicable laws, VASPs providing VA Management and Investment Services shall publish on their website or by other publicly accessible means— a. details of any past convictions or prosecutions of any member(s) of their Senior Management or Board, whether before the courts of the UAE or the courts of another jurisdiction; and b. any such other information relating to their business or activities as VARA may reasonably require. 3. The disclosure requirements set out in this Rule I.B of this VA Management and Investment Services Rulebook are in addition to all disclosures required under the Market Conduct Rulebook and to all notifications to VARA required under the Compliance and Risk Management Rulebook.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 6 II. Part II – VA Management and Investment Services Rules A. Client suitability

1. VASPs providing VA Management and Investment Services shall only provide such services regarding Virtual Assets to clients for which they are suitable.
2. Where VASPs provide VA Management and Investment Services which include a personal recommendation to a client, they shall consider the following factors at a minimum in respect of that client— a. knowledge and experience in investing in Virtual Assets; b. investment objectives, including but not limited to risk tolerance, time horizon and venues through which they can acquire Virtual Assets; and c. financial circumstances including, but not limited to, their ability to bear sudden and significant losses or the proportion of their net worth which is invested in Virtual Assets.
3. VASPs providing VA Management and Investment Services shall collect all necessary information from clients for the purpose of assessing relevant factors in accordance with Rules II.A.1 and II.A.2 of this VA Management and Investment Services Rulebook, depending on the nature of the service and take all reasonable steps to ensure such information is accurate and up-to-date. All such information shall be maintained for at least eight (8) years.
4. To the extent Rule II.A.2 ofthis VA Management and Investment Services Rulebook is applicable, VASPs shall specify how the services are appropriate for a client by reference to the factors assessed by the VASP in accordance with Rule II.A.2 of this VA Management and Investment Services Rulebook. B. Staff competency
5. In addition to all requirements in the Company Rulebook, VASPs providing VA Management and Investment Services shall ensure all of their Staff are knowledgeable, competent and suitably trained given the nature of their role. In assessing Staff competency, VASPs shall consider the following factors at a minimum in the context of the role of the Staff member concerned— a. academic, professional and industry qualifications;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 7 b. experience in the Virtual Assets sector, including but not limited to hands-on working experience acquired through their employment by Entities carrying out activities similar to VA Activities outside of the Emirate; c. whether they have a good understanding of the VARA regulatory framework, including but not limited to the Regulations, Rules and Directives governing the provision of VA Management and Investment Services; and d. industry standards as may be applicable to the Virtual Assets sector from time to time. C. Verification of information

1. VASPs providing VA Management and Investment Services shall not provide statements, promises, forecasts or other types of information which they know or suspect to be misleading, false or deceptive or which they should have reasonably known to be misleading, false or deceptive at the time of making such statement, promise or forecast.
2. Prior to making any statement, promise or forecast, VASPs providing VA Management and Investment Services shall verify factual information against appropriate and reliable source materials and shall use all reasonable endeavours to verify the continued accuracy of such information. D. Impermissible activities
3. VASPs shall not authorise or permit rehypothecation of Virtual Assets for which they provide VA Management and Investment Services unless they have explicit prior consent from the client to do so.
4. VASPs providing VA Management and Investment Services shall only use or exercise authority relating to a Virtual Asset based on valid authorisation and/or specific instructions from the client.
5. Virtual Assets of a client used by a VASP in the course of, or in connection with, the provision of any VA Management and Investment Services shall be held on behalf of the client unless the Client Agreement expressly states otherwise.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 8 E. Client reporting & valuation

1. VASPs providing VA Management and Investment Services shall, at least monthly, provide to each client a written statement containing the following information— a. the total value of Virtual Assets in a client’s account; b. all transactions entered into between the VASP and the client in the reporting period; and c. the change in amount and valuation of Virtual Assets in a client’s account (both total and during the reporting period).
2. VASPs providing VA Management and Investment Services shall ensure that all assets under management are subject to ongoing independent valuation.
3. VASPs shall have comprehensive and well documented valuation policies and procedures in place to ensure the production of timely and accurate valuation in accordance with Rule II.E.1 of this VA Management and Investment Services Rulebook. F. Fees and charges
4. No payment may be made, or benefit given, to the VASP out of any Virtual Assets under its management, whether by way of fees for its services, reimbursement of expenses or otherwise, unless it is permitted by the Client Agreement and the Client Agreement specifies how it will be calculated and accrued, and when it will be paid.
5. VASPs must not introduce a new category of fees for their services or make any increase in the current rate or amount of its fees payable out of any Virtual Assets under its management unless the VASP has given not less than ninety (90) calendar days’ written notice of that introduction or increase and of the date of its commencement to its clients. G. Marketing
6. VASPs providing VA Management and Investment Services shall not represent in any Marketing that their services involve the distribution of 'staking' rewards in relation to any DLT with a 'proof-of-stake' consensus mechanism or any other similar protocol-based rewards to clients, unless the payments actually made to clients by the VASP directly originate from such 'staking' rewards or other similar protocol-based rewards.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 9 H. Management practices

1. When providing VA Management and Investment Services in respect of Virtual Assets on behalf of clients, VASPs shall act in the best interests of their clients at all times. Factors that VASPs may consider when assessing a client’s best interests may include, but are not limited to, client suitability, the price of Virtual Assets, costs, speed, likelihood of execution and settlement, size, nature, conditions of custody, and such other conditions as are relevant to the management of Virtual Assets, provided that the VASP must act in accordance with any specific instructions provided by the client. I. Receipt and transmission of orders
2. VASPs shall establish and implement procedures and arrangements for the prompt and proper transmission of client’s instructions in respect of Virtual Assets for which VA Management and Investment Services are provided.
3. VASPs shall not receive any remuneration, discount or other benefit for routing clients’ orders to a particular trading platform or VASP in the course of the provision of VA Management and Investment Services, unless disclosed in the Client Agreement and the VASP has obtained valid acceptance in accordance with applicable laws.
4. VASPs shall not misuse information relating to clients’ Virtual Assets and their management thereof. J. Risk management and due diligence
5. In addition to all requirements in the Company Rulebook, VASPs shall ensure that liquidity risk and market risk are each monitored and tested regularly, and appropriate measures put in place as required to address any such risk in a prompt manner.
6. All such risk management and due diligence must be regularly audited by an independent third party and provided to VARA upon request.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 10 K. Client Agreements

1. In addition to all requirements in the Market Conduct Rulebook, Client Agreements for VA Management and Investment Services shall set out the following, to the extent applicable— a. description of Virtual Assets in-scope of VA Management and Investment Services that are sufficient to identify them; b. the respective rights of the VASP, the client and any other Entity involved in the VA Management and Investment Services in respect of Virtual Assets that are the subject of the Client Agreement, including in respect of staking; c. how and when any proceeds are paid or payable, or in the case of variable proceeds, how they are calculated, how the proceeds may vary and how such variations will be communicated by the VASP to the client; d. whether or not Virtual Assets of a client used by a VASP in the course of, or in connection with, any VA Management and Investment Services, shall be held on behalf of the client; e. the consent of the client shall be clearly obtained in accordance with all applicable laws for the use of any Virtual Assets used in the course of the provision of VA Management and Investment Services by the VASP; f. any right of the client to withdraw any Virtual Assets held by the VASP; g. a statement explaining that client Virtual Assets used by the VASP in the course of the provision of VA Management and Investment Services may be at risk, including the types and nature of such risks, and a statement on the likelihood and severity of any losses which may be suffered; h. any rights of the VASP to vary the terms of the Client Agreement; i. any rights of the VASP and the client to terminate the Client Agreement and the consequences of termination; j. any terms relating to any fluctuation in value of the Virtual Assets to which the Client Agreement relates; k. consequences of any event of default; l. an explanation of the risks the client may be exposed to; m. full details of the VASP’s client complaints procedure; and

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 11 n. whether the VASP receives any remuneration, discount or other benefit for routing clients’ orders to a particular trading platform or VASP in the course of provision of VA Management and Investment Services.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 12 Schedule 1 – Definitions Term Definition "Board" has the meaning ascribed to it in the Company Rulebook. "Client Agreements" has the meaning ascribed to it in the Market Conduct Rulebook. "Company Rulebook" means the Company Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Compliance and Risk Management Rulebook" means the Compliance and Risk Management Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Directive" has the meaning ascribed to it in the Regulations. "Distributed Ledger Technology" or "DLT" has the meaning ascribed to the term “Distributed Ledger Technology” in the Dubai VA Law. "Dubai VA Law" means Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, as may be amended from time to time. "Emirate" means all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre. "Entity" means any legal entity or individual. "Licence" has the meaning ascribed to it in the Regulations. "Licensed" means having a valid Licence. "Market Conduct Rulebook" means the Market Conduct Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Marketing" has the meaning ascribed to it in The Regulations on the Marketing of Virtual Assets and Related Activities 2024. "Regulations" means the Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time. "Rule" has the meaning ascribed to it in the Regulations. "Rulebook" has the meaning ascribed to it in the Regulations.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 13 Term Definition "Senior Management" has the meaning ascribed to it in the Company Rulebook. "Staff" has the meaning ascribed to it in the Company Rulebook. "Technology and Information Rulebook" means the Technology and Information Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "UAE" means the United Arab Emirates. "VA Activity" means the activities listed in Schedule 1 of the Regulations, as may be amended VARA from time to time. "VA Management and Investment Services" has the meaning ascribed to it in Schedule 1 of the Regulations. "VA Management and Investment Services Rulebook" means this VA Management and Investment Services Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "VARA" means the Dubai Virtual Assets Regulatory Authority. "VASP" means an Entity authorised by VARA to conduct VA Activity(ies) in the Emirate. "Virtual Asset" or "VA" has the meaning ascribed to it in the Dubai VA Law.