Region

Jurisdiction

Regulator

2025-06-19

Custody Services Rulebook

Issued by Dubai’s Virtual Assets Regulatory Authority, this rulebook establishes comprehensive governance and operational standards for licensed virtual asset service providers offering custody services. It mandates strict client asset segregation, prohibits rehypothecation, requires continuous operational control, and enforces detailed wallet management protocols covering hot and cold storage, secure key generation, and multi-signature safeguards. The framework further dictates board composition, annual remuneration reporting, mandatory public disclosures, and specific compliance pathways for staking and collateral wallet services to ensure robust client asset protection.

United Arab Emirates

Virtual Assets Regulatory Authority

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 2 Contents INTRODUCTION....................................................................................................................................................................4 I. PART I – ADDITIONAL BOARD REQUIREMENTS ..................................................................................5 A. Board constitution ...................................................................................................................................................................5 B. Board committees ....................................................................................................................................................................6 C. Board remuneration reporting requirements............................................................................................................7 II. PART II – POLICIES, PROCEDURES AND PUBLIC DISCLOSURES ...................................................8 A. Policies and procedures.........................................................................................................................................................8 B. Public disclosures......................................................................................................................................................................8 III. PART III – VA STORAGE AND CUSTODY RULES .................................................................................10 A. General requirements..........................................................................................................................................................10 B. Segregation and control.....................................................................................................................................................10 C. VA Wallet management.....................................................................................................................................................11 D. Additional obligations..........................................................................................................................................................13 IV. PART IV – STAKING FROM CUSTODY SERVICES RULES ................................................................16 A. Compliance with Staking from Custody Services Rules....................................................................................16 B. Client instructions .................................................................................................................................................................17 C. Segregation and safekeeping of Virtual Assets ....................................................................................................17 D. Node management................................................................................................................................................................18 E. DLT Standards ........................................................................................................................................................................18 F. Risk disclosure statement.................................................................................................................................................20 G. Client Agreements.................................................................................................................................................................21 V. PART V – COLLATERAL WALLET SERVICES RULES ..........................................................................23 A. Compliance with Collateral Wallet Services Rules...............................................................................................23 B. Client instructions .................................................................................................................................................................23

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 4 Introduction The Dubai Virtual Assets Regulatory Authority ("VARA") was established and authorised by Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai ("Dubai VA Law") to regulate Virtual Asset Service Providers ("VASPs"). This Custody Services Rulebook is issued pursuant to, and forms part of, the Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time ("Regulations"), issued by VARA, and applies to all VASPs Licensed by VARA to carry out Custody Services in the Emirate. This Custody Services Rulebook applies in addition to all other requirements in the Regulations as may be in force from time to time. As such, VASPs Licensed by VARA to carry out Custody Services must also comply with the following Rulebooks applicable to all VASPs—

Company Rulebook;
Compliance and Risk Management Rulebook;
Technology and Information Rulebook;
Market Conduct Rulebook; and
All Rulebooks specific to the VA Activities that a VASP is Licensed by VARA to carry out. As stated in Rule III.B.5 of this Custody Services Rulebook, VASPs providing Custody Services must be an independent legal Entity – separate from any member of their Group that provides other VA Activities or linked services – except in respect of VA Transfer and Settlement Services. For the avoidance of doubt, where a VASP is Licensed by VARA to carry out VA Transfer and Settlement Services in the Emirate. in addition to Custody Services, it must comply with the VA Transfer and Settlement Services Rulebook. Unless otherwise stated, the Rules in VA Activity specific Rulebooks apply cumulatively for each VA Activity a VASP carries out. Capitalised terms in this Custody Services Rulebook have the meanings ascribed to them in the Regulations or as otherwise provided in Schedule 1.

The Board of a VASP providing Custody Services shall consist of executive directors and nonexecutive directors, with a minimum of one (1) director qualifying as an independent director as set out below.
The Board of a VASP providing Custody Services shall convene at least on a quarterly basis.
VASPs providing Custody Services shall mandate the length of each term, and number of terms each Board member may serve on the Board.
A Board member is not regarded as an independent director of a VASP if— a. they or any of their first-degree relatives are working or have worked as a member of the Senior Management, or held a role in the VASP’s Group equivalent to Senior Management within the two (2) years preceding the date of their nomination to the Board; b. they or any of their first-degree relatives have a direct or indirect interest in the contracts and projects concluded with the Group during the preceding two (2) years, provided that the aggregate value of such contracts and projects do not exceed the lower of (i) ten percent (10%) of the Paid-Up Capital of the VASP, or (ii) the amount of AED 5,000,000 or its equivalent in other foreign currency, unless such contracts and projects relate to the ordinary course of business of the VASP and do not contain any preferential conditions; c. they are working or have worked for the Group during the two (2) years preceding the date of their appointment to the Board; d. they work for, or are a partner of a company that performs consultancy services for the VASP or any members of its Group, or has performed such services during the preceding two (2) years; e. they have any personal service contracts with the VASP or any members of its Group, or have had such contract during the preceding two (2) years, excluding any contract under which they are appointed as a non-executive director;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 6 f. they are directly or indirectly linked to any Entity that receives substantial funding from the VASP’s Group; g. they or any of their first-degree relatives are a partner or an employee of the auditor of the VASP, or if, during the two (2) years preceding the date of their Board membership, were a partner or an employee of the auditor of the VASP; h. the ownership held by them and their first-degree relatives reaches ten percent (10%) or more of the share capital of the VASP; i. they have served more than seven (7) years as a Board member of the VASP; or j. they are the representative of an investor in the VASP holding ten percent (10%) or more of the share capital of the VASP. B. Board committees

The Board of a VASP providing Custody Services shall establish remuneration, nomination and audit committees, and may establish additional committees, to perform certain delegated functions on behalf of the Board. The Board may delegate specific authority, but not its responsibilities, to such committees, provided that it continuously monitors and oversees the work conducted by all committees.
Each committee created by the Board of a VASP providing Custody Services shall— a. have a charter or other instrument that sets out its membership, mandate, scope, working procedures and means of accountability to the Board; and b. report to the Board on findings and recommendations relating to the work entrusted by the Board to it regularly.
The Board and its committees shall keep minutes to record details of the matters discussed, recommendations made, decisions taken, resolutions passed, and any dissenting opinions at a Board meeting for a period, notwithstanding any requirements in any law or regulations, of not less than eight (8) years.

On an annual basis, VASPs providing Custody Services shall submit to VARA the following information— a. details of all compensation and/or remuneration of all members of the Board and its committees, including but not limited to salaries, allowances, expenses, bonuses, benefits, or other incentive programmes (whether or not denominated in Virtual Assets). Such details shall include the type, nature and conditions of all such compensation and/or remuneration; and b. reasons for all such compensation and/or remuneration.
All information submitted by VASPs in compliance with Rule I.C.1 of this Custody Services Rulebook shall be kept confidential by VARA, except to the extent that disclosure is required to comply with any applicable laws or regulations.

In addition to all other requirements in the Regulations and Rulebooks, VASPs providing Custody Services shall establish, implement and enforce appropriate written internal policies and procedures relating to the following— a. the ability of clients to have access to and withdraw their Virtual Assets including, but not limited to, during periods of high uncertainty and/or extreme volatility; and b. such other policies or procedures as VARA may require from time to time.
VASPs providing Custody Services shall assess and, in any case, at least yearly review the effectiveness of their policies and procedures, and take appropriate measures to address any deficiencies. B. Public disclosures
VASPs providing Custody Services shall publish on their website in a prominent place or make available by other publicly accessible means— a. a detailed description of any actual or potential conflicts of interest arising out of their activities, and how these are managed; b. their policies and procedures relating to data privacy, whistleblowing and handling of client complaints; and c. a statement of whether the VASP has accounts, funds or Virtual Assets maintained by a third party and if so, provide the identity of that third party.
Other disclosable matters. To the extent permissible under applicable laws, VASPs providing Custody Services shall publish on their website or by other publicly accessible means— a. details of any past convictions or prosecutions of any member(s) of their Senior Management or Board, whether before the courts of the UAE or the courts of another jurisdiction; and b. any such other information relating to their business or activities as VARA may reasonably require.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 9 3. The disclosure requirements set out in this Rule II.B of this Custody Services Rulebook are in addition to all disclosures required under the Market Conduct Rulebook, and to all notifications to VARA required under the Compliance and Risk Management Rulebook.

VASPs that provide Custody Services must comply with the provisions in this Part III of this Custody Services Rulebook.
To the extent any provisions are inconsistent with the Client VA Rules in the Compliance and Risk Management Rulebook, this Part III of this Custody Services Rulebook shall have precedence.
VASPs must ensure that all Custody Services are only provided in accordance with verified client instructions, or instructions from authorised agents of the client for whom the client has provided the VASP with a valid legal authority for the agent to provide instructions on the client's behalf. B. Segregation and control
Virtual Assets held by a VASP providing Custody Services are not depository liabilities or assets of the VASP.
VASPs shall not authorise or permit rehypothecation of Virtual Assets for which they provide Custody Services (regardless of whether they have obtained a client’s consent), and VASPs providing Custody Services shall not seek or attempt to obtain such consent as part of the Custody Services they provide.
VASPs providing Custody Services shall segregate the Virtual Assets of each client in separate VA Wallets containing the Virtual Assets of that client only.
VASPs must maintain control of each Virtual Asset at all times while providing Custody Services.
VASPs providing Custody Services must be a separate legal Entity from any member of their Group that provides services relating to VA Activities other than Custody Services.
As a limited exception to Rule 5III.B.5, VASPs providing Custody Services may apply to VARA to obtain a Licence for the provision of VA Transfer and Settlement Services, which shall only be granted subject to VARA's satisfaction of all relevant requirements, including the VASP's implementation and strict enforcement of policies and procedures to achieve necessary

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 11 segregation between operations relating to Custody Services and such VA Transfer and Settlement Services. 7. VASPs must have adequate policies and procedures to ensure that there is sufficient operational and physical segregation between individuals handling operations for Custody Services, and their other core businesses and operations including, but not limited to, other VA Activities conducted by their Group. Such policies and procedures shall establish a separate team to handle the VASP’s Custody Services only, consisting of individuals who have no conflicting duties or access to information which may give rise to any conflicts of interest. C. VA Wallet management

Hot and cold Virtual Asset storage. a. VASPs providing Custody Services shall at all times maintain appropriate certifications as may be required under industry best practices applicable to the safekeeping of Virtual Assets. b. VASPs providing Custody Services should conduct a risk-based analysis to determine the method of Virtual Asset storage including different types of VA Wallets (e.g. hot versus cold storage). c. VASPs providing Custody Services should document in detail, the methodologies and behaviour determining the transfer of Virtual Assets between different types of VA Wallets (e.g. hot, cold and warm wallets). The mechanisms for transfer between different types of VA Wallets should be well documented, and subject to internal controls and audits performed by an independent third-party auditor, ensuring compliance with Rule III.C.1.a of this Custody Services Rulebook.
Seed or key generation, storage, and use. a. When creating any seed, asymmetric private and public key combinations, or other similar mechanisms required for providing Custody Services, VASPs shall use industry best standards to create the seed, asymmetric private and public key combinations, or other similar mechanisms to ensure a secure generation mechanism. In addition, all VASPs providing Custody Services shall consider all risks associated with producing a private key or seed for a signatory including whether the signatory should be involved in

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 12 the generation process or whether creators of the seed, private key, or other similar mechanism should be prohibited from cryptographically signing any transaction or from having access to any relevant systems. b. VASPs providing Custody Services shall adopt industry best practices when using encryption, and secure device storage for a client’s private keys when not in use. VASPs must ensure that any keys stored online or in one physical location are not capable of conducting a Virtual Asset transaction, unless appropriate controls are in place to ensure that physical access itself by an individual is insufficient to conduct a transaction. c. All key and seed backups must be stored in a separate location from the primary key and seed. Key and seed backups must be stored with encryption at least equal to the encryption used to protect the primary seed and key. If VASPs use mnemonic back-up seed phrases, it should ensure that the mnemonic back-up seed phrase is broken into at least two (2) parts. Any backups that when combined could facilitate a transaction, must not be stored in a single point of access. d. VASPs providing Custody Services should consider using multi-signature approaches where appropriate. VARA reserves the right to require VASPs to use multi-signature approaches in specific situations, including for specific types of Virtual Assets. If a VASP has multi-signature arrangements that vary depending on the risk of the transaction, the VASP must have well-documented and audited procedures. e. VASPs providing Custody Services must mitigate the risk of collusion between all authorised parties or signatories who are able to authorise the movement, transfer or withdrawal of Virtual Assets held under custody on behalf of clients. The risk of collusion and other internal points of failure should be evaluated for materiality and probability, and effectively addressed during recurring operational risk assessments. 3. Lost or stolen keys. a. VASPs providing Custody Services shall establish, and maintain effective policies and procedures in the event that any seed or cryptographic keys of any VA Wallet are lost

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 13 or otherwise compromised. Such policies and procedures shall address matters including but not limited to— i. recovery of affected Virtual Assets; ii. timely communications with all clients and counterparties regarding consequences arising from relevant incidents, and measures being taken to remedy such consequences; iii. cooperation with law enforcement agencies and regulatory bodies; and iv. if applicable, preparation of wind-down arrangements and public disclosure of such arrangements. D. Additional obligations

Written agreements with clients. a. In addition to all applicable requirements in the Market Conduct Rulebook, Client Agreements entered into between VASPs providing Custody Services and clients should include the following— i. description of the overall custodial framework used by the VASP when providing Custody Services, including but not limited to security, risk mitigation, safeguarding procedures; ii. address what will happen when source code versions underlying a Virtual Asset supported by the VASP materially change in a way that may affect the Custody Services provided (e.g. a "'fork"' of the network protocol), including but not limited to—
notification requirements if the VASP will not support the original source code version;
notification requirements if the VASP will support the original source code version;
notification requirements if the original source code version will no longer exist, or is not reasonably expected to continue to exist, or if the original source code version will no longer function securely and/or as originally intended; and

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 14 4. actions that will be taken by the VASP if any/all of the above were to take place; iii. when and how the Virtual Assets under custody will be returned; iv. settlement finality, including when a Virtual Asset will be deemed fully transferred, and the VASP discharged of any obligations upon transfer of the Virtual Asset (including but not limited to withdrawals initiated by the client); v. the frequency of account statements to be provided to clients, and the content of those statements; vi. who (e.g. the VASP, its agent or another third party) is responsible for securing the Virtual Assets, and protecting them from theft or loss; vii. the VASP’s Outsourcing practices including, if the VASP Outsources some or all of the Custody Services to third parties, the qualifications of those third parties; viii. the VASP’s cybersecurity and data privacy policies, procedures, controls and systems, including how the VASP will respond to data breaches and cyberattacks, and notification, reimbursement and remediation policies; and ix. the VASP’s policies and procedures for safeguarding access to Virtual Assets, including policies and procedures related to multi-signature/multi-key safeguards, access management controls, and revocation of key signatories’ access. 2. Relationship between a VASP and client, for the provision of Custody Services. a. The provision of Custody Services shall be a contractual arrangement between a VASP and a client, under which a client lawfully in control of, or entitled to control, a Virtual Asset, transfers control of the Virtual Asset to a VASP, solely for the purpose of receiving the Custody Services, and does not in any way transfer to the VASP, any legal interest in the Virtual Asset, or any discretionary authority not explicitly authorised in the Client Agreement or otherwise agreed to by the client. b. In addition to all Reserve Assets requirements in the Company Rulebook, VASPs providing Custody Services will keep a register, and record of reconciliation of each

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 15 client’s positions that correspond to the client’s rights to the Virtual Assets that are subject to the Custody Services. 3. Outsourcing and third-party suppliers. a. If a VASP Outsources some or all of the Custody Services to third parties, the VASP is responsible for ensuring that all applicable laws, Regulations, Rules and Directives are complied with. b. VASPs must have established roles and responsibilities for its Custody Services operations, and its operational risk management. The responsibility for manually executed core functions of Custody Services, should only be performed by authorised employees. 4. Account statements. VASPs providing Custody Services must provide at least every month, and promptly at the request of a client, a statement with all Virtual Asset transactions specific to each client account, the dates and transaction amounts of the corresponding transactions, and balances and value for each type of Virtual Asset. 5. Audit. VASPs should maintain a full audit trail of all transaction activities that occur on a client’s account for at least eight (8) years. The audit trail should include specific information regarding each transaction, such as the date and time, the transaction type, the relevant signatories, and the Virtual Assets involved.

VASPs Licensed by VARA to carry out Custody Services may only provide Staking from Custody Services, if explicitly authorised to do so by VARA, and such authorisation is expressly stipulated in their Licence. VASPs will be subject to licensing and/or supervision fees incremental to the fees for Custody Services in Schedule 2 of the Regulations, or other fees published by VARA, as amended from time to time, in order to be able to undertake the regulated activity of Staking from Custody Services.
VASPs that are authorised to provide Staking from Custody Services must comply with this Part IV of this Custody Services Rulebook, at all times, when providing these services.
Staking from Custody Services is regarded by VARA to form part of the Custody Services that a VASP provides. As such, all VASPs providing Staking from Custody Services must continue to comply with all other Rules relating to Custody Services throughout the provision of Staking from Custody Services, for all Virtual Assets to which the Staking from Custody Services relate.
For the avoidance of doubt, VASPs Licensed by VARA to carry out Custody Services that are also authorised to provide Staking from Custody Services, may only provide Staking from Custody Services for Virtual Assets for which they are providing Custody Services.
VASPs Licensed by VARA to carry out Custody Services that are also authorised to provide Staking from Custody Services, may provide Staking from Custody Services through the same legal Entity. For avoidance of doubt, such authorisation for, and provision of Staking from Custody Services is considered to be sub-set of the Custody Services Activity, and is hence not subject to the requirement for a separate legal Entity stipulated under Rule III.B.5 of this Custody Services Rulebook.
VARA shall have the right to suspend or revoke any authorisation granted to a VASP to provide Staking from Custody Services, in respect of any specific DLT, or in its entirety across all DLTs, upon reasonable grounds VARA deems appropriate.

VASPs providing Staking from Custody Services must comply with Rule III.A.3 of this Custody Services Rulebook, and continue to act only on explicit instructions received from their clients throughout the provision of such services, including when they are required to vote or otherwise participate in the governance of any DLT on behalf of their clients.
If a VASP wishes to obtain and rely on any pre-authorised instruction from a client, the VASP must consider all reasonably foreseeable circumstances where such instruction is likely to be used by the VASP as authorisation, and the VASP must communicate all such circumstances clearly to the client, prior to the client providing such instruction. All pre-authorised instructions sought or obtained by a VASP must be sufficiently detailed, accurate and relevant for the client to understand both the circumstances in, and actions for which such instructions will be relied upon by the VASP.
Staking from Custody Services cannot be provided on an ‘opt-out’ basis, and the activity may only be initiated after the VASP has received a client’s specific instruction to do so. C. Segregation and safekeeping of Virtual Assets
Segregated client VA Wallets. VASPs providing Staking from Custody Services must ensure that each client’s Virtual Assets remain segregated in separate VA Wallets containing the Virtual Assets of that client only, throughout the provision of such Staking from Custody Services, as required under Rule III.B.3 of this Custody Services Rulebook.
Single client per node. VASPs providing Staking from Custody Services must ensure that no client’s Virtual Assets are pooled or otherwise combined with Virtual Assets of any other clients of the VASP or any other party(ies), whether to meet any minimum requirements of a given DLT or otherwise, and each node or instance of a DLT managed, operated or otherwise made available by the VASP may only hold, be delegated, or have committed to it, Virtual Assets belonging to that client only.
Safekeeping of Virtual Assets. VASPs providing Staking from Custody Services remain responsible to their clients for the safekeeping of the Virtual Assets for which Staking from Custody Services is being provided.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 18 4. Control of withdrawal keys. VASPs providing Staking from Custody Services must maintain control of the cryptographic keys and/or other mediums or methods through which the Virtual Assets may be withdrawn, or otherwise no longer ‘staked’. D. Node management

VASPs providing Staking from Custody Services must use all commercially reasonable endeavours to ensure all operational, maintenance or other requirements for participation (including, but not limited to, hardware, software, connectivity and upgrades of the same) determined by the relevant DLT are met in respect of Staking from Custody Services, in order to minimise the risk of ‘slashing’ or other penalties being incurred in respect of the Virtual Assets, for which the VASP is providing such Staking from Custody Services.
VA Wallet management. VASPs providing Staking from Custody Services shall continue to comply with all requirements in Rule III.C of this Custody Services Rulebook, and the above Rule IV.D.1 of this Custody Services Rulebook applies in addition to those requirements.
Outsourcing. In addition to the requirements in Rule III.D.3 of this Custody Services Rulebook, VASPs shall ensure that all third-party services used by the VASP in the provision of Staking from Custody Services, comply with Part IV of the Company Rulebook. E. DLT Standards
VASPs providing Staking from Custody Services shall establish standards for the DLTs for which it provides, or the DLTs it uses to provide Staking from Custody Services ("DLT Standards").
DLT Standards shall include, but not be limited to— a. security and immutability of the DLT protocol, including its level of centralisation, reliance on a single Entity, or any potential single points of failure; b. operating history of the DLT, including any periods of disruption or downtime; c. soundness of the staking protocol and operation, including the duration for which it has successfully been active;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 19 d. source of any rewards being offered by the DLT or any other party for a user’s participation, including whether such rewards are derived from the fees paid by users of the DLT, or from other means; e. the VASP’s ability to maintain all operational, maintenance or other requirements for participation; f. its design, features and use cases, whether or not intended by relevant developers; g. any features that present a risk of materially affecting the VASP’s compliance with applicable laws, Regulations, Rules or Directives, including but not limited to those relating to AML/CFT, sanctions, security and intellectual property; h. regulatory treatment by VARA and other appropriate authorities (including those outside of the Emirate); i. future development plans (e.g. "'roadmap"') of the DLT as communicated by relevant developers, and whether such developments may have an impact (positive or negative) on, or relevance to, any of the above factors; j. potential or actual conflicts of interest that may arise should the VASP provide any Staking from Custody Services in relation to the DLT, and relevant mitigations provisioned for such instances; k. background of the founders, management, and current core developers of the DLT, including, but not limited to, relevant experience in the Virtual Asset sector, and whether they have been subject to any investigations, penalties, or claims in relation to fraud or deceit etc.; and l. any additional factors that the VASP may require to be considered. 3. VASPs providing Staking from Custody Services shall take all reasonable steps, including but not limited to conducting relevant due diligence, prior to the provision of such services in respect of a DLT, to ensure the DLT meets all their prescribed DLT Standards. 4. VASPs providing Staking from Custody Services must actively monitor all DLTs for which Staking from Custody Services is provided, for continued compliance with their DLT Standards. 5. Upon becoming aware that a DLT no longer meets a VASP’s prescribed DLT Standards, the VASP must—

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 20 a. notify all affected clients and VARA immediately; b. cease accepting new Virtual Assets for Staking from Custody Services in respect of that DLT immediately; c. determine a course of action with such affected clients to cease all Staking from Custody Services for that DLT, as soon as practicable; d. continue to provide such Staking from Custody Services in accordance with this Part IV of this Custody Services Rulebook throughout the agreed course of action, and until such services have been effectively concluded; e. keep VARA informed of all actions being taken throughout such course of action; and f. take all other steps as VARA may direct. 6. VASPs providing Staking from Custody Services shall also set and implement conditions, under which the VASP will suspend accepting new Virtual Assets for Staking from Custody Services which, as required under Rule IV.E.5 of this Custody Services Rulebook above, must include where a DLT no longer meets the VASP’s DLT Standards. 7. VASPs must maintain all records relevant to such assessments under this Rule IV.E of this Custody Services Rulebook for eight (8) years, and provide such records for VARA’s inspection upon request. F. Risk disclosure statement

VASPs providing Staking from Custody Services must provide each client with a risk disclosure statement explaining (i) that Virtual Assets for which Staking from Custody Services is being provided, may be at risk of loss, reduction or penalty, (ii) the types and nature of such risks, (iii) the circumstances in which such risks may arise, and (iv) the likelihood and severity of consequences that may be suffered.
The risk disclosure statement required under Rule IV.F.1 above of this Custody Services Rulebook must be separate from the Client Agreement, and VASPs must independently obtain confirmation of the acceptance of such risk disclosure statement from each client, prior to the VASP providing Staking from Custody Services to that client.

In addition to all requirements in respect of Client Agreements in the Market Conduct Rulebook, and under Rule III.D of this Custody Services Rulebook, VASPs providing Staking from Custody Services shall include the following, to the extent applicable, in Client Agreements in respect of Staking from Custody Services— a. a description of the Virtual Assets for which Staking from Custody Services is being provided to such extent that the details are sufficient to identify them; b. operational, maintenance or other requirements for participation (including but not limited to hardware, software and connectivity) of the DLT(s), for which Staking from Custody Services is being provided, and that the VASP undertakes the responsibility to meet those requirements when providing such services. This Rule IV.G.1.b of the Custody Services Rulebook can be largely met by providing links to publicly available sources of where such information is officially maintained, for example, DLT website or source code repository etc.; c. respective rights of the VASP, the client and any other Entity involved in the Staking from Custody Services, in respect of Virtual Assets that are the subject of the Client Agreement; d. a detailed description of the source of all rewards received by clients from the Staking from Custody Services, including whether such rewards are generated solely from fees paid by users of the DLT, or whether such rewards are derived from any other source; e. proceeds to be paid or become payable, and in the case of variable proceeds, the method of calculation, factors that impact the amount, volatility and timing of the proceeds, and how and when such variations will be communicated by the VASP to its clients, including all rights that the client has to influence decisions at each stage; f. all fees to be charged for Staking from Custody Services, and the calculation thereof; g. rights of the client to withdraw or directly control decisions pertaining to any Virtual Assets, in respect of which Staking from Custody Services is provided, and any conditions/ circumstances under which the client may be unable to do so;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 22 h. statement explaining that Virtual Assets in respect of which Staking from Custody Services is provided may be at risk, including the types and nature of such risks, as well as the likelihood and severity of any losses that may be suffered; i. rights, if any, of the VASP to vary the terms of the Client Agreement; j. rights of the VASP and the client to terminate the Client Agreement, circumstances under which these rights can be activated, and the consequences of such termination; k. full details of the VASP’s client complaints procedure; and l. statement explaining whether the VASP receives any remuneration, discount or other benefit for using any third party (with a disclosure of specific Entities where applicable), in the course of the provision of the Staking from Custody Services.

Only VASPs Licensed by VARA to carry out Custody Services may provide Collateral Wallet Services.
VASPs Licensed by VARA to carry out Custody Services may only provide Collateral Wallet Services if explicitly authorised to do so by VARA, with such authorisation being expressly stipulated in the VASP's Licence.
VASPs providing Collateral Wallet Services will be subject to licensing and/or supervision fees incremental to the fees for Custody Services in Schedule 2 of the Regulations, or other fees published by VARA, as amended from time to time, in order to be able to provide Collateral Wallet Services.
VASPs that are authorised to provide Collateral Wallet Services must comply with this Part V of the Custody Services Rulebook, at all times, when undertaking the regulated activity of providing Collateral Wallet Services.
Collateral Wallet Services are regarded by VARA as ancillary services to the Custody Services that a VASP provides. As such, all VASPs providing Collateral Wallet Services must comply with all other Rules relating to Custody Services throughout the provision of Collateral Wallet Services, including but not limited to the Client Virtual Assets Rules in Part V of the Compliance and Risk Management Rulebook, subject only to the explicit exceptions contained in this Part V of the Custody Services Rulebook.
In addition to VARA's powers in Part IX of the Regulations, VARA shall have the right to limit, suspend or revoke any authorisation granted to a VASP to provide Collateral Wallet Services, upon reasonable grounds VARA deems appropriate at any time. B. Client instructions
VASPs providing Collateral Wallet Services must comply with Rule III.A.3 of this Custody Services Rulebook and continue to act only on explicit instructions received from their clients throughout the provision of such services.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 24 2. If a VASP wishes to obtain and rely on any pre-authorised instruction from a client, the VASP must consider all reasonably foreseeable circumstances where such instruction is likely to be used by the VASP as authorisation, and the VASP must communicate all such circumstances clearly to the client, prior to the client providing such instruction. 3. All pre-authorised instructions sought or obtained by a VASP must be sufficiently detailed, accurate and relevant for the client to understand both the circumstances in, and actions for, which such instructions will be relied upon by the VASP. 4. Collateral Wallet Services cannot be provided on an ‘opt-out’ basis, and the activity may only be initiated after the VASP has received a client’s specific instruction to do so. C. Receipts

Immediately after receiving a client's instructions to initiate a transfer of Virtual Assets to an account and/or VA Wallet for the purposes of Collateral Wallet Services, a VASP must provide the client with a receipt including the following information— a. confirmation of whether the transfer has been successfully initiated; b. date and time of receipt of the client’s instructions; c. amount and type of Virtual Assets in the transfer; d. transaction identification details and/or reference; and e. total balance of the client's Virtual Assets held in the client's account and/or VA Wallet for the purposes of Collateral Wallet Services.
Immediately after a transaction on the account and/or VA Wallet used for the provision of Collateral Wallet Services has been completed, a VASP must provide the client with a receipt including the following information— a. date and time of the transaction; b. details of the recipient including whether the transaction has been credited back to the client or to an Exchange; c. amount and type of Virtual Assets in the transaction; d. transaction identification details and/or reference;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 25 e. full details of all exchanges, trades or conversions completed in the course of the transaction (if applicable), including times and rates of the exchange; f. a breakdown of all fees paid or payable by the client and when they have been paid or become payable (as applicable); and g. total balance of the client's Virtual Assets held in the client's account and/or VA Wallet for the purposes of Collateral Wallet Services. D. VA Wallets and safekeeping of Virtual Assets

VASP must use VA Wallets which are specifically designated for the purposes of providing Collateral Wallet Services only ("CWS Client VA Wallet"). VASPs must identify CWS Client VA Wallets used for providing Collateral Wallet Services as such in their internal books and records. CWS Client VA Wallets used for providing Collateral Wallet Services cannot be re-purposed or used for any other purpose either during or after the provision of Collateral Wallet Services.
As a limited exception only, Rule III.B.3 of this Custody Services Rulebook shall not apply to the CWS Client VA Wallets used by the VASP for the provision of Collateral Wallet Services.
VASPs providing Collateral Wallet Services remain responsible to their clients for the safekeeping of the Virtual Assets for which Collateral Wallet Services are being provided. E. Settlement integration with trading venues
VASPs providing Collateral Wallet Services may only provide the Collateral Wallet Services to their clients for trading or other transactions on venues which are Licensed by VARA to carry out Exchange Services ("Exchange").
VASPs providing Collateral Wallet Services may only provide the Collateral Wallet Services in respect of one Exchange per client account and/or VA Wallet. A VASP's client may have multiple accounts and/or VA Wallets with the VASP through which Collateral Wallet Services are provided, in order for the client to trade or transact on different Exchanges, however each account and/or VA Wallet may only be in respect of one Exchange.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 26 3. Further to Rule V.E.2 of this Custody Services Rulebook above, VASPs providing Collateral Wallet Services may only permit one Exchange to have any rights or claims over Virtual Assets held in any given CWS Client VA Wallet used for the provision of the Collateral Wallet Services. 4. In addition to all requirements under Part II.C of the Company Rulebook, VASPs providing Collateral Wallet Services must identify and disclose all conflicts of interest between the VASP and its clients in the provision of the Collateral Wallet Services including, but not limited to, any conflicts which arise because of the VASP's commercial arrangements with any Exchange. F. Risk disclosure statement

VASPs providing Collateral Wallet Services must provide each client with a risk disclosure statement in respect of the Collateral Wallet Services explaining— a. co-mingling of Client VAs. To the extent applicable, that Client VAs may no longer be held in segregated VA Wallets containing the Virtual Assets of that client only; b. safekeeping. A detailed description of how Client VAs are held, including but not limited to if Client VAs are held in accounts and/or VA Wallets containing Virtual Assets of more than one client of the VASP; and c. rights of Exchanges. The nature of all rights or claims that any Exchange has over Client VAs, accounts, Client VA Wallets and/or any CWS Client VA Wallet.
The risk disclosure statement required under Rule V.F.1 above of this Custody Services Rulebook must be separate from the Client Agreement and VASPs must independently obtain confirmation of the acceptance of such risk disclosure statement from each client, prior to the VASP providing Collateral Wallet Services to that client. G. Client Agreements
In addition to all requirements in respect of Client Agreements in the Market Conduct Rulebook, and under Rule III.D of this Custody Services Rulebook, VASPs providing Collateral Wallet Services shall include the following, to the extent applicable, in Client Agreements in respect of the Collateral Wallet Services—

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 27 a. a description of the Virtual Assets for which Collateral Wallet Services are provided to such extent that the details are sufficient to identify them; b. respective rights of the VASP, the client and any other Entity involved in the Collateral Wallet Services, in respect of Virtual Assets that are the subject of the Client Agreement; c. rights of the client to withdraw, manage or directly control decisions pertaining to any Virtual Assets, in respect of which the Collateral Wallet Services are provided, and any conditions or circumstances under which the client may be unable to do so; d. a statement explaining that Virtual Assets in respect of which the Collateral Wallet Services are provided may be at risk, including the types and nature of such risks, as well as the likelihood and severity of any losses that may be suffered; and e. a statement explaining whether the VASP receives any remuneration, discount or other benefit for using any third party (with a disclosure of the specific Entities where applicable), in the course of the provision of the Collateral Wallet Services. H. Reporting and notification

Reporting. In addition to all other applicable requirements in respect of regulatory reporting in the Regulations, Rulebooks or its Licence, VASPs providing Collateral Wallet Services shall, on a monthly basis, submit to VARA the following information— a. in respect of the Client Virtual Assets held in CWS Client VA Wallets used for the provision of the Collateral Wallets Services— i. a list of all Virtual Assets held in the and the total number held of each Virtual Asset; and ii. the total value, denominated in AED, for each Virtual Asset listed in Rule V.H.1.a.i of this Custody Services Rulebook; b. total number of clients to whom the VASP provides or has provided the Collateral Wallets Services in the relevant reporting period; and c. the names of each of the Exchanges with whom the VASP has settlement integrations and/or who have any rights or claims over any CWS Client VA Wallet, in accordance with Rule V.E.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 28 2. Notifications. In addition to all other notification requirements in the Regulations, Rulebooks or its Licence, VASPs providing Collateral Wallet Services shall notify VARA immediately in the event of any of the following, at any time during the provision of the Collateral Wallet Services— a. system, reporting or reconciliation delay or failure; and b. an error or inaccuracy in the recording of any client’s balance.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 29 Schedule 1 – Definitions Term Definition "Client Agreements" has the meaning ascribed to it in the Market Conduct Rulebook. "Collateral Wallet Services" means the provision of accounts and/or VA Wallets, containing Client's Virtual Assets, which are used to facilitate net settlement of clients' positions between a VASP Licensed by VARA to provide Custody Services and a VASP Licensed by VARA to carry out Exchange Services. "Company Rulebook" means the Company Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Compliance and Risk Management Rulebook" means the Compliance and Risk Management Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Custody Services" has the meaning ascribed to it in Schedule 1 of the Regulations. "Custody Services Rulebook" means this Custody Services Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "CWS Client VA Wallet" has the meaning ascribed to it in Rule V.D.1 of this Custody Services Rulebook. "Directive" has the meaning ascribed to it in the Regulations. "DLT Standards" has the meaning ascribed to it in Rule IV.E.1 of this Custody Services Rulebook. "Dubai VA Law" means Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, as may be amended from time to time. "Emirate" means all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre. "Entity" means any legal entity or individual.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 30 Term Definition "Exchange" has the meaning ascribed to it in Rule V.E.1 of this Custody Services Rulebook. "Group" has the meaning ascribed to it in the Company Rulebook. "Licence" has the meaning ascribed to it in the Regulations. "Licensed" means holding a valid Licence. "Market Conduct Rulebook" means the Market Conduct Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Outsourcing" has the meaning ascribed to it in the Company Rulebook. "Paid-Up Capital" has the meaning ascribed to it in the Company Rulebook. "Regulations" means the Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time. "Reserve Assets" has the meaning ascribed to it in the Company Rulebook. "Rule" has the meaning ascribed to it in the Regulations. "Rulebook" has the meaning ascribed to it in the Regulations. "Staking from Custody Services" means ‘staking’ or otherwise using, committing, pledging or locking up Virtual Assets, for which the VASP is providing Custody Services, for the purposes of participating in the consensus mechanisms or other maintenance, operation or functioning of a DLT to which those Virtual Assets relate, and may include receiving rewards generated and distributed for that participation. "Senior Management" has the meaning ascribed to it in the Company Rulebook. "UAE" means the United Arab Emirates. "VA Activity" means the activities listed in Schedule 1 of the Regulations, as may be amended from time to time. "VARA" means the Dubai Virtual Assets Regulatory Authority. "VASP" means an Entity Licensed by VARA to conduct VA Activity(ies) in the Emirate. "Virtual Asset" or "VA" has the meaning ascribed to it in the Dubai VA Law.