VARA Penetration Testing and Smart Contract Audit Rules

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Yes. VARA Rule I.E.1 requires qualified, independent third-party vulnerability assessments and pentests at least yearly and before new systems, applications and products, including smart contract audits where relevant. VARA can also order threat-led testing by notice.

Watch: VARA Penetration Testing and Smart Contract Audit Rules 1:37

Video transcript

Yes, VARA requires penetration testing, and smart contract audits where relevant. The rules are short, binding, and start before licensing.

A qualified, independent third party must run vulnerability assessments and pentests at least yearly, and before any new system, application or product. Pentest results are also part of your license application.

Schedule 1 guidance goes further. It expects quarterly vulnerability assessments, continuous automated scanning, and tests before production updates.

Smart contract audits follow the same cycle, to the extent relevant. The rule does not define relevant. Our reading is that contracts holding or moving client assets are likely in scope, so confirm with counsel.

Exchanges and broker-dealers must also publish whether each token had an independent audit. Distributors must check every contract was audited and remediated.

VARA can also order threat-led red team testing by notice. An external tester runs it, and findings and remediation plans go to VARA promptly.

VARA keeps no approved list. Testers must be qualified and independent, and for threat-led tests, of good repute, certified, and insured.

Guardian runs both. Pentests end with a retest, audits include a fix review, and both reports map to VARA's testing rule.

Read the full article for the complete testing calendar, or talk to Guardian about one test plan for VARA.

Dubai's Virtual Assets Regulatory Authority (VARA) regulates virtual assets across Dubai, except in the DIFC. Its Technology and Information Rulebook applies to every virtual asset service provider (VASP) it licenses.

The testing rules are short and binding. The detail on how to test sits in Schedule 1, which is guidance.

Testing starts before the license. VARA lists penetration testing results among the technology documents for an application.

This article explains the technical and security side of VARA's Technology and Information Rulebook and related VARA rulebooks. It is not legal advice; confirm how it applies to you with counsel.

What the Rulebook Says

Part I.E, Testing and Audit, holds the core rules. The current rulebook is dated May 19, 2025 and has been in force since June 19, 2025.

Its requirements are binding Rules unless it says otherwise.

Rule	Requirement	Verb
I.E.1	Third-party vulnerability assessments and pentests; smart contract audits where relevant	must
I.E.2	Regular security testing; internal and external vulnerability audits	must
I.E.3	Test and audit evidence documented, available to VARA immediately on request	must
I.E.4	Regular independent audits of processes, controls and compliance	shall
I.E.5	Threat-led penetration testing (TLPT), when VARA notifies you	may (VARA)
I.B.3.f	Cybersecurity Policy covers code and smart contract validation and audit	must

Schedule 1 works differently. VASPs “should consider” it, and its standards say what VASPs “are expected to” do.

Annual and Pre-Launch Testing

Rule I.E.1 sets two triggers. Tests run “at least on an annual basis and prior to the introduction of any new systems, applications and products.”

VARA sees the results when it asks. The rule says VASPs must provide them “upon VARA’s request.”

Rule I.E.2 adds regular testing of infrastructure and applications, and internal and external vulnerability audits. These must also run whenever VARA asks.

The guidance goes further. Schedule 1's security testing standard expects tests “regularly, and in all events prior to any update to a production system.” They include:

Annual pentesting by qualified third parties.
Quarterly vulnerability assessments.
Continuous automated security scanning.
Regular security exercises for high-value systems.
Formal tracking of remediation.

Its operational resilience standard expects independent external testers, and yearly tests of all systems supporting Critical or Important Functions. Its list of tests includes source code reviews and pentests.

A testing calendar

When	What	Source
Before you file	Penetration testing results	VARA application list
Yearly	Third-party vulnerability assessment and pentest	Rule I.E.1
Before new systems, applications, products	The same tests	Rule I.E.1
Quarterly	Vulnerability assessments	Schedule 1, expected
Before production updates	Security tests	Schedule 1, expected
Yearly	Continuity plan tested; Cybersecurity Policy reviewed by the CISO	Rules I.H.1, I.B.2

When Smart Contract Audits Apply

The audit sits inside Rule I.E.1, in brackets. The third-party testing includes:

“to the extent relevant to the VASP’s business and VA Activities, comprehensive audits of the effectiveness, enforceability and robustness of all smart contracts”.

So the audit runs on the same cycle: yearly, and before new systems, applications and products.

The rule does not define “relevant.” Our reading: contracts that hold, move or account for client assets in your service are likely in scope. Confirm yours with counsel.

Schedule 1's smart contract security standard expects four things.

Static and dynamic code analysis.
Independent third-party audits before deployment, and formal verification where applicable.
Comprehensive penetration testing.
Regular re-assessment of deployed contracts.

Tokens you offer or distribute

Two activity rulebooks reach the tokens themselves.

Exchange Rule II.B.1.c.v and Broker-Dealer Rule I.B.1.c.v: publish whether each asset offered had an independent smart contract audit, and the latest audit’s date.
Broker-Dealer Rule IV.B.3.e: a distributor's due diligence shall include that all the asset's smart contracts had comprehensive audits, with findings satisfactorily remediated.

The first is a disclosure, not a duty to audit. The second is a check a distributor must make on each token it distributes.

TLPT on Notification

VARA defines TLPT as a controlled, intelligence-led red team test of a VASP's critical live production systems, mimicking real threat actors.

It has no fixed cycle. Under Rule I.E.5, VARA may notify a VASP that TLPT is required, where VARA considers it necessary and proportionate.

VARA weighs the VASP's specific risks, the criticality of its business and any other relevant risks.

Rule I.E.6 then sets the conditions.

An external tester runs each TLPT.
VARA may require it to cover Critical or Important Functions and, where required, run on live production systems.
Where third-party service providers must be in scope, the VASP ensures they take part.
The VASP limits risk to data, assets and services during the test.
The VASP and tester produce a findings summary, remediation plans and documents showing the test met the rules.
The VASP sends all of it to VARA promptly.

For how the EU runs threat-led tests, see DORA penetration testing requirements.

Tester Independence and Reports

For the yearly and pre-launch tests, Rule I.E.1 requires a “qualified and independent third-party auditor.” It names no firms or approved list.

TLPT testers face a longer list. Under Rule I.E.7, VASPs must ensure their external testers:

are suitable and of good repute;
show specific expertise in threat intelligence and penetration testing;
are certified by an accreditation body, or follow formal codes of conduct or ethical frameworks;
give independent assurance, or an audit report, on how they manage the test's risks;
carry professional indemnity insurance, including for misconduct and negligence.

Contracts with them must require sound handling of results and data, and create no added risk (Rule I.E.8).

What goes to VARA

Yearly and pre-launch results: on VARA's request (Rule I.E.1).
All test and audit evidence: documented, and available for inspection immediately on request (Rule I.E.3).
TLPT: findings, remediation plans and documentation, promptly (Rule I.E.6).
Material cybersecurity events: reported as soon as reasonably practicable, within 72 hours of detection (Rule I.K.1).

Other VARA audits also need independent auditors: client reserves every six months, and financial statements yearly. See VARA's reserve assets audit circular.

For VARA beside DORA, NYDFS and others, see pentest requirements by regulation. For fees and capital, see VARA license cost.

How Guardian Helps

Guardian's pentests cover infrastructure, web apps, APIs, browser extensions, SDKs and offchain automation. Each is closed out with a retest.

Every finding is reproduced and ranked by what reaching it would do. The report states the scope and test window.

Guardian's smart contract audit runs in three passes: design review, an invariant suite, then senior researchers. Its report includes a fix review at a pinned commit.

Guardian maps both reports to VARA Rule I.E.1. Its regulatory readiness assessment lists each provision with the control that meets it and the evidence that proves it.

Frequently Asked Questions

How often does VARA require penetration testing?

At least yearly, and before any new system, application or product (Rule I.E.1). A qualified, independent third party must run it. VARA's Schedule 1 guidance also expects quarterly vulnerability assessments and tests before any production update.

Does VARA require a smart contract audit?

Where relevant to your business, yes. Rule I.E.1 includes comprehensive audits of all smart contracts in the third-party testing cycle. Exchanges and broker-dealers must also publish whether each asset they offer has had an independent audit.

Does VARA keep a list of approved auditors?

The rules we read set criteria, not a list. Rule I.E.1 asks for a qualified, independent third party. For threat-led tests, Rule I.E.7 adds good repute, certification or a code of conduct, and indemnity insurance.

Can VARA require red team testing?

Yes. Under Rule I.E.5, VARA may notify a VASP that it must run threat-led penetration testing. An external tester runs it, possibly on live production systems, and VARA receives the findings and remediation plans.

Sources

Meet VARA Rule I.E.1 with one test plan

Guardian runs the pentests and smart contract audits VARA asks for, and maps each report to the rule.

Talk to Guardian Explore regulatory compliance