Lending and Borrowing Services Rulebook

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority Lending and Borrowing Services Rulebook 19 May 2025

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 2 Contents INTRODUCTION....................................................................................................................................................................3 I. PART I – POLICIES, PROCEDURES AND PUBLIC DISCLOSURES.....................................................4 A. Policies and procedures.........................................................................................................................................................4 B. Public disclosures......................................................................................................................................................................4 C. Activity-specific disclosures................................................................................................................................................5 D. Other disclosures......................................................................................................................................................................6 II. PART II – LENDING AND BORROWING SERVICES RULES.................................................................7 A. General requirements.............................................................................................................................................................7 B. Client reporting & valuation................................................................................................................................................8 C. Additional record-keeping requirements.....................................................................................................................9 D. Risk management and due diligence ..............................................................................................................................9 E. Client Agreements.................................................................................................................................................................10 SCHEDULE 1 – DEFINITIONS........................................................................................................................................12

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 3 Introduction The Dubai Virtual Assets Regulatory Authority ("VARA") was established and authorised by Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai ("Dubai VA Law") to regulate Virtual Asset Service Providers ("VASPs"). This Lending and Borrowing Services Rulebook is issued pursuant to, and forms part of, the Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time ("Regulations"), issued by VARA, and applies to all VASPs Licensed by VARA to carry out Lending and Borrowing Services in the Emirate. This Lending and Borrowing Services Rulebook applies in addition to all other requirements in the Regulations as may be in force from time to time. As such, VASPs Licensed by VARA to carry out Lending and Borrowing Services must also comply with the following Rulebooks applicable to all VASPs—

1. Company Rulebook;
2. Compliance and Risk Management Rulebook;
3. Technology and Information Rulebook;
4. Market Conduct Rulebook; and
5. All Rulebooks specific to the VA Activities that a VASP is Licensed by VARA to carry out. For the avoidance of doubt, where a VASP is Licensed by VARA to carry out other VA Activities in the Emirate in addition to Lending and Borrowing Services, it must comply with all Rulebooks which apply to those other VA Activities. Unless otherwise stated, the Rules in VA Activity specific Rulebooks apply cumulatively for each VA Activity a VASP carries out. Capitalised terms in this Lending and Borrowing Services Rulebook have the meanings ascribed to them in the Regulations or as otherwise provided in Schedule 1.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 4 I. Part I – Policies, Procedures and Public Disclosures A. Policies and procedures

1. In addition to all other requirements in the Regulations and Rulebooks, VASPs providing Lending and Borrowing Services shall establish, implement and enforce appropriate written internal policies and procedures relating to the following— a. the ability of clients to have access to and withdraw their Virtual Assets including, but not limited to, during periods of high uncertainty and/or extreme volatility; and b. such other policies and procedures as VARA may require from time to time.
2. VASPs providing Lending and Borrowing Services shall assess and, in any case, at least yearly review the effectiveness of their policies and procedures and take appropriate measures to address any deficiencies. B. Public disclosures
3. VASPs providing Lending and Borrowing Services shall publish on their website in a prominent place or make available by other publicly accessible means— a. a detailed description of any actual or potential conflicts of interest arising out of their activities, and how these are managed; b. their policies and procedures relating to data privacy, whistleblowing and handling of client complaints; c. a statement as to the ability of clients to have access to and withdraw their Virtual Assets, particularly in times of extreme volatility; d. a statement as to the VASP’s arrangements for the protection of clients’ assets held by the VASP and how it determines uses of client Virtual Assets, including but not limited to a detailed description of such uses; e. a statement as to how they protect client Virtual Assets from counterparty risk, including but not limited to whether the VASP only enters into over-collateralised loans; f. a statement as to how in the course of the provision of Lending and Borrowing Services, client Virtual Assets are used and how clients’ interests in respect of those Virtual Assets are thereby respected;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 5 g. a statement explaining that client Virtual Assets used by the VASP in the course of the provision of Lending and Borrowing Services may be at risk, including the types and nature of such risks, and a statement on the likelihood and severity of any losses which may be suffered; h. a statement as to how liquidity risk is managed; and i. such other information as VARA may require from time to time. 2. Other disclosable matters. To the extent permissible under applicable laws, VASPs providing Lending and Borrowing Services shall publish on their website or by other publicly accessible means— a. details of any past convictions or prosecutions of any member(s) of their Senior Management or Board, whether before the courts of the UAE or the courts of another jurisdiction; and b. any such other information relating to their business or activities as VARA may reasonably require. 3. The disclosure requirements set out in this Rule I.B of the Lending and Borrowing Services Rulebook are in addition to all disclosures required under the Market Conduct Rulebook and to all notifications to VARA required under the Compliance and Risk Management Rulebook. C. Activity-specific disclosures

1. Interest payments to clients. VASPs providing Lending and Borrowing Services shall, at a minimum, clearly disclose the following in relation to Virtual Assets they borrow from clients— a. the denomination of interest payments (e.g. the type of Virtual Assets) and whether the client has an option to select such denomination and modify the selection at any time; b. the amount and nature (e.g. whether it is a fixed rate or a variable rate) of interest offered to clients in the form of annual percentage yield denominated in the type of borrowed Virtual Asset; c. whether the amount of interest disclosed in Rule I.C.1 of this Lending and Borrowing Services Rulebook is an estimation and if so, provide a description of how such estimation is made by the VASP; d. the frequency at which interest accrues and is credited to client accounts; and

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 6 e. whether interest is accrued on a simple or compound basis and, if the VASP adopts a tiered approach which offers compound interest for a maximum value of Virtual Assets, the details of such tiered approach. D. Other disclosures

1. Lending and Borrowing Services explanation. VASPs shall publish a prominent explanation of— a. their Lending and Borrowing Services; b. specification of which Lending and Borrowing Services are available to which client types; and c. any licensing and regulatory restrictions on Lending and Borrowing Services available to different client types.
2. Lending and borrowing asset and liability report. VASPs shall publish and update at least every three (3) months a lending and borrowing asset and liability report, including but not limited to values of Virtual Assets held, lent or borrowed, pledged or posted as collateral, and how they are held.
3. Governance controls. VASPs providing Lending and Borrowing Services shall publish a clear and transparent explanation of all governance arrangements in respect of— a. protocol governance structures to the extent relevant and applicable to the provision of Lending and Borrowing Services, and the loaning and pledging of Virtual Assets to and by clients, as applicable, including client risks in respect of the same; and b. whether or not the VASP uses any proprietary protocols in the course of the provision of the Lending and Borrowing Services.
4. Third parties. To the extent that a VASP’s Lending and Borrowing Services are made available through, or information communicated via, a third party, the VASP shall also procure that all disclosures and information required by this Part I of the Lending and Borrowing Services Rulebook is provided in an easily accessible location on the website of that third party, in plain and transparent language, in a machine-readable format, and is kept accurate and up-to-date at all times.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 7 II. Part II – Lending and Borrowing Services Rules A. General requirements

1. Liquidity. VASPs providing Lending and Borrowing Services shall, at all times, ensure that— a. they have sufficient Virtual Assets to provide services and satisfy client obligations; and b. sufficient collateral has been posted by borrowers in accordance with agreed amounts, and that both are monitored and audited on a regular basis.
2. VASPs providing Lending and Borrowing Services shall notify VARA immediately if the requirements in Rule II.A.1 of this Lending and Borrowing Services Rulebook are not met, or may not be materially met in the foreseeable future.
3. Withdrawals. VASPs providing Lending and Borrowing Services shall ensure all clients are fully aware when Virtual Assets are not able to be withdrawn as part of the Lending and Borrowing Services they provide. To the extent Virtual Assets are able to be withdrawn, VASPs shall ensure all clients can withdraw such Virtual Assets at all times, and complete withdrawal requests so that Virtual Assets which are the subject of such requests are transferred in accordance with client instructions within twenty-four (24) hours, subject to any factors outside of the VASP’s control including limitations or malfunctioning of any DLT not controlled by the VASP or its Group.
4. Collateral. All Virtual Assets held by a VASP providing Lending and Borrowing Services may only be used in accordance with the terms of its Lending and Borrowing Services which, in addition to the requirements in Rule II.E of this Lending and Borrowing Services Rulebook, shall be clearly set out in its Client Agreements. VASPs providing Lending and Borrowing Services shall ensure that they have adequate governance frameworks, policies, systems and controls in place to manage how collateral is held and that it is used responsibly, including in line with Client Agreements at all times.
5. Virtual Assets of a client used by a VASP in the course of, or in connection with, the provision of any Lending and Borrowing Services shall be held on behalf of the client, unless the Client Agreement expressly states otherwise.
6. Counterparty due diligence. VASPs providing Lending and Borrowing Services shall, on a regular basis, conduct comprehensive due diligence on all clients and counterparties such that they are

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 8 satisfied that client Virtual Assets are not subject to undue counterparty risk. In particular, VASPs shall collect and verify the following information of each counterparty— a. the purpose(s) of loans; b. the nature and type of business; c. financial situation and overall liquidity; and d. all other information which a prudent lender would require to assess risks associated with a particular loan. B. Client reporting & valuation

1. VASPs providing Lending and Borrowing Services shall, at least monthly, provide to clients a written statement containing the following information— a. the total value of Virtual Assets in a client’s account; b. all lending and borrowing transactions entered into between the VASP and the client in the reporting period; c. the amount of interest accrued from and credited to the client’s account for lending transactions (both total and during the reporting period); d. the amount of interest paid and debited from the client’s account for borrowing transactions (both total and during the reporting period); and e. the amount of collateral posted by the client for borrowing transactions in the reporting period (both total and during the reporting period).
2. VASPs shall maintain accurate and reliable records that are sufficient to confirm and identify all client positions.
3. VASPs providing Lending and Borrowing Services shall ensure that all client positions are subject to independent valuation and client reporting.
4. VASPs shall have comprehensive and well documented valuation policies and procedures in place to ensure the production of timely and accurate valuations in accordance with Rule II.B.1 of this Lending and Borrowing Services Rulebook.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 9 C. Additional record-keeping requirements

1. VASPs providing Lending and Borrowing Services shall maintain the following for at least eight (8) years— a. records of all transactions in relation to their Lending and Borrowing Services, including but not limited to all Client Agreements, agreements with other counterparties and client instructions; and b. information collected from counterparties in accordance with Rule II.A.6 of this Lending and Borrowing Services Rulebook.
2. All records maintained in accordance with Rule II.C.1 of this Lending and Borrowing Services Rulebook must be immediately provided for VARA inspection upon request. D. Risk management and due diligence
3. Before providing any Lending and Borrowing Services to a client, a VASP shall carry out sufficient due diligence to satisfy itself— a. as to the risk profile of such client and transaction at that time and during the course of the Lending and Borrowing Services; b. as to the need for, and the suitability of, any collateral to be provided by the client; and c. that any collateral is capable of being pledged including under all applicable laws.
4. Before providing any Lending and Borrowing Services on behalf of a third party, VASPs shall ensure that sufficient steps are taken on behalf of such third party to meet the requirements set out in Rule II.D.1 of this Lending and Borrowing Services Rulebook.
5. VASPs shall ensure that liquidity risk and market risk are each monitored and tested regularly, and appropriate measures are put in place as required to address any such risk in a prompt manner.
6. VASPs shall ensure that, to the extent that collateral, including Virtual Assets, is held by them, such collateral is adequate and appropriately protects the VASP against applicable risks. VASPs shall monitor any such risk and record the assessment of such risk regularly and on an ongoing basis. VASPs shall put appropriate measures in place as required to address any such risk in a prompt manner.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 10 5. All such risk management and due diligence must be regularly audited by an independent third party. E. Client Agreements

1. In addition to all requirements in the Market Conduct Rulebook, Client Agreements for Lending and Borrowing Services shall set out the following, to the extent applicable— a. descriptions of the Virtual Assets lent, borrowed, and/or used as collateral that are sufficient to identify such Virtual Assets; b. any loan-to-value ratio(s) applicable under the Client Agreement; c. the respective rights of the VASP, the client and any other Entity involved in the Lending and Borrowing Services in respect of Virtual Assets that are the subject of the Client Agreement, including in respect of collateral; d. how and when any interest is paid or payable, the applicable rate, or in the case of a variable rate, how it is calculated and how interest may vary, and how such variations will be communicated by the VASP to the client; e. how and when any Virtual Assets lent or borrowed, or held as collateral, are to be held and returned; f. whether or not Virtual Assets of a client used by a VASP in the course of, or in connection with, carrying out any Lending and Borrowing Services, shall be held on behalf of the client; g. any right of the client to withdraw any Virtual Assets lent or borrowed or held as collateral; h. a statement explaining that client Virtual Assets used by the VASP in the course of the provision of Lending and Borrowing Services may be at risk, including the types and nature of such risks, and a statement on the likelihood and severity of any losses which may be suffered; i. any rights of the VASP to vary the terms of the Client Agreement; j. any rights of the VASP and the client to terminate the Client Agreement and the consequences of termination;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 11 k. any terms relating to any fluctuation in value of the Virtual Assets to which the Client Agreement relates; l. consequences of any event of default; m. an explanation of the risks the client may be exposed to; n. full details of the VASP’s client complaints procedure to enable clients to register complaints, as required in relation to the VASP or the services provided by the VASP; and o. any requirements necessary for compliance with the governing law of the Client Agreement. 2. In addition to all requirements in the Market Conduct Rulebook, Client Agreements for Lending and Borrowing Services shall obtain the consent of all clients to the use by the VASP of any Virtual Assets of such clients by the VASP (as applicable), in the course of the provision of Lending and Borrowing Services by the VASP. Such consent must be clearly and transparently obtained in accordance with all applicable laws.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 12 Schedule 1 – Definitions Term Definition "Board" has the meaning ascribed to it in the Company Rulebook. "Client Agreements" has the meaning ascribed to it in the Market Conduct Rulebook. "Company Rulebook" means the Company Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Compliance and Risk Management Rulebook" means the Compliance and Risk Management Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Distributed Ledger Technology" or "DLT" has the meaning ascribed to the term "Distributed Ledger Technology" in the Dubai VA Law. "Dubai VA Law" means Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, as may be amended from time to time. "Emirate" means all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre. "Entity" means any legal entity or individual. "Licence" has the meaning ascribed to it in the Regulations. "Licensed" means having a valid Licence. "Lending and Borrowing Services" has the meaning ascribed to it in Schedule 1 of the Regulations. "Lending and Borrowing Services Rulebook" means this Lending and Borrowing Services Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Market Conduct Rulebook" means the Market Conduct Rulebook issued by VARA pursuant to the Regulations, as may be amended from time to time. "Regulations" means the Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 13 Term Definition "Rule" has the meaning ascribed to it in the Regulations. "Rulebook" has the meaning ascribed to it in the Regulations. "Senior Management" has the meaning ascribed to it in the Company Rulebook. "UAE" means the United Arab Emirates. "VA Activity" means the activities listed in Schedule 1 of the Regulations, as may be amended from time to time. "VARA" means the Dubai Virtual Assets Regulatory Authority. "VASP" means an Entity authorised by VARA to conduct VA Activity(ies) in the Emirate. "Virtual Asset" or "VA" has the meaning ascribed to it in the Dubai VA Law.