VARA Reserve Assets Audit Circular: The Minimum Scope

Video transcript

VARA has set the minimum scope for Dubai reserve assets audits. One snapshot will not prove it, and management's word alone may not be enough.

Reserves must never fall below one hundred percent of client liabilities during the period, held in the same asset. Another coin of equal value does not count.

The auditor should also cover every wallet, including third-party custodians, then segregation, the VASP's control of each wallet, daily reconciliation, and any rehypothecation.

Control is mostly an onchain question. Build an address inventory for the whole period, sign auditor-chosen messages across it, show multisig thresholds, and have custodians confirm directly.

Daily reconciliation needs proof it worked. Each record should show the block height, onchain balances, client liabilities from the ledger, and every break and its resolution.

Onchain balances are public, so auditors can re-read them. The circular says management representations alone should not be relied on where independent evidence is reasonably available.

Procedure seven asks whether client assets were lent, pledged or rehypothecated. Check the chain first. The circular does not name staking, so ask counsel.

VARA requires an independent third-party auditor at least every six months. Guardian works on the evidence behind it: readiness assessments, technical evidence packs, and Managed Security between audits.

Read the full article for the audit preparation checklist, or talk to Guardian at guardian.security to get your evidence ready.

On October 6, 2026, Dubai's Virtual Assets Regulatory Authority (VARA) issued a circular on the reserve assets audit report.

It followed a thematic review of all Proof of Reserve Assets reports submitted in 2025. VARA wants a consistent, detailed approach to verifying how client assets are safeguarded.

The circular clarifies VARA's minimum expectations for an audit its rulebooks already require. It states no separate start date or transition period.

This article explains the technical and security side of VARA's Circular: Reserve Assets Audit Report. It is not legal advice; confirm how it applies to you with counsel.

The Rules Behind It

The circular rests on rules in two VARA rulebooks:

Rule VI.E.3 also says the audit report goes into the VASP's next quarterly report to VARA.

CRM Rule V.C.1 adds that VASPs shall comply with any further requirements VARA sets to show reserves cover client liabilities.

Hiring an auditor does not shift responsibility. The circular says the VASP, its Board, Senior Executive Officer and control functions stay responsible for safeguarding client assets.

For VARA's wider technology rules, see our guide to crypto regulatory compliance.

The Seven Minimum Procedures

“At a minimum, the auditor should”:

1. Coverage: confirm reserves stayed at 100% or more of client liabilities throughout the period.
2. Same asset: confirm one-to-one holdings in the same asset, with no substitution.
3. Every wallet: cover hot, warm and cold wallets, wallet providers and third-party custodians.
4. Segregation: assess separation from proprietary and operational assets, and identify commingling.
5. Control: confirm whether the VASP controlled every client wallet, and describe each custody arrangement.
6. Reconciliation: confirm daily reconciliation, with evidence that the process worked.
7. Other use: confirm whether rehypothecation, lending, pledging or other use occurred.

Two phrases do most of the work. “Throughout the review period” means a single snapshot cannot answer the first procedure.

“Without substitution by another Virtual Asset or equivalent value” means a different coin of equal value does not count.

The circular does not address wrapped, bridged or liquid-staked versions of an asset. Ask counsel or VARA before counting one as the same asset.

Wallet Control and Segregation

Procedures 3 to 5 are mostly onchain questions, with evidence an auditor can check independently.

Start with an address inventory

List every address that held client assets during the period, not just today's:

• Chain, address and wallet type: hot, warm or cold.
• Custody arrangement: licensed custodian, self-custody or third-party wallet technology.
• Label: client or proprietary, matching your books and records.
• Dates each wallet was opened, rotated or retired.

Prove control more than once

A message signed with a wallet's key shows control of that key when it was signed. For Ethereum addresses, ERC-191 defines the signed message format.

Procedure 5 asks about control “during the review period”. So sign messages the auditor chooses, on dates spread across the period, not once at year end.

For a multisig, show the signer set and threshold read from the chain. For a custodian or wallet provider, arrange for it to confirm holdings to the auditor directly.

Show segregation onchain

Commingling shows up in transaction history. Every transfer between client and operational wallets needs a record the auditor can trace.

Daily Reconciliation Evidence

Procedure 6 asks for more than a policy. The auditor should obtain and review evidence that the daily process was effective.

Rule V.D.1 sets the content: full lists of individual client credit and debit ledger balances, as recorded by the VASP.

A daily record that holds up includes:

• The cutoff time, and the block height read on each chain.
• The onchain balance per asset, per wallet in the inventory.
• Client liabilities per asset, from the ledger at the same cutoff.
• The difference, who reviewed it, and when.
• Every break, its cause and the date it was resolved.

Keep every day's record. VARA expects the report to explain how samples were selected across the review period.

Rule V.D.2 adds a duty to notify VARA of a material discrepancy that has not been rectified.

Onchain balances are public, so an auditor can re-read them at your block heights. The circular says management representations alone should not be relied on where independent evidence is reasonably available.

Rehypothecation and Other Use

Procedure 7 asks whether client assets were rehypothecated, lent, pledged or otherwise used. If so, the auditor should give the arrangements and the assets affected.

The rules differ by license:

• CRM Rule V.B.4: no rehypothecation without explicit prior client consent and licensing for every relevant activity.
• Custody Services Rule III.B.2: custody providers may not permit it, even with client consent.

The circular does not name staking. If client assets are staked or delegated, tell the auditor, and ask counsel whether it counts as other use.

Check the chain yourself first. Token approvals, delegations and deposits into lending protocols from client wallets are all public.

The Audit Report

For each of the seven procedures, VARA expects the report to describe:

• The procedures performed and the evidence obtained.
• The sampling method, including how samples span the period.
• Any reliance on third parties.
• Any scope limitations.

Each element should get a clear conclusion, with its basis documented. The report should separate compliant outcomes, exceptions, scope limitations and matters that could not be independently verified.

It should also list findings and say how exceptions are handled: follow-up by the audit firm, or the VASP's own remediation framework.

Preparing for the next audit

1. Rebuild the address inventory for the whole period, retired wallets included.
2. Map each wallet to its custody arrangement and its books-and-records label.
3. Agree a schedule of signed control proofs across the period.
4. Line up direct confirmations from custodians and wallet providers.
5. Export every daily reconciliation, with block heights and breaks.
6. List any rehypothecation, lending, pledging, staking or delegation, with consents.
7. Check wrapped or bridged holdings against the same-asset test with counsel.
8. Plan the six-month audit cycle and the quarterly report that carries it.

For a comparable Hong Kong circular, see the SFC's cold wallet standards. To vet custodians, use our vendor due diligence questionnaire.

How Guardian Helps

Rule VI.E.3 calls for an independent third-party auditor. Guardian works on the technical evidence behind the audit.

Guardian's regulatory readiness assessment covers custody and safeguarding: segregation, key generation and storage, signing thresholds, cold storage ratios and recovery.

Each is assessed against the custody rules your license carries, VARA's included.

Guardian's Technical Evidence packs include signer inventories, thresholds and timelocks read from the chain, with key ceremony and recovery records. Each artifact is dated and mapped to the provisions it answers.

Between audits, Managed Security maps every path to your funds and reviews every multisig transaction before it is signed.

Frequently Asked Questions

What does VARA require in a reserve assets audit?

VARA's October 6, 2026 circular says the auditor should confirm reserves never fell below 100% of client liabilities, held one to one in the same asset. It should also cover every wallet, segregation, wallet control, daily reconciliation and any rehypothecation.

How often must a VARA reserve assets audit happen?

Company Rulebook Rule VI.E.3 requires an audit by an independent third-party auditor no less than every six months. The VASP includes the audit report in its next quarterly report to VARA.

Are management representations enough audit evidence?

Not on their own where independent evidence is reasonably available, the circular says. Onchain balances and signed messages can be checked without relying on the VASP's word.

Does the audit cover wallets run by third-party providers?

Yes. The scope covers all wallets holding client assets, including assets held through wallet infrastructure providers and third-party custodians. The auditor should describe each wallet's custody arrangement.

Sources

• VARA: Circular: Reserve Assets Audit Report (October 6, 2026)
• VARA: Company Rulebook, Part VI.E Reserve Assets (version effective June 19, 2025)
• VARA: Compliance and Risk Management Rulebook, Part V.B Treatment of Client VAs (version effective June 19, 2025)
• VARA: Compliance and Risk Management Rulebook, Part V.C Proof of Reserves (version effective June 19, 2025)
• VARA: Compliance and Risk Management Rulebook, Part V.D Reconciliation (version effective June 19, 2025)
• VARA: Custody Services Rulebook, Part III.B Segregation and Control (version effective June 19, 2025)
• Ethereum Improvement Proposals: ERC-191 Signed Data Standard (January 20, 2016)
• Guardian: Regulatory and Compliance Assessments
• Guardian: Managed Security