table of contents
- custody in the vara framework
- private key management
- cold and hot storage requirements
- client asset segregation
- insurance and fidelity coverage
- technology governance standards
- operational resilience
- sub-custody and delegation
- reporting and audit requirements
- comparative analysis
custody in the vara framework
Custody of virtual assets is among the most critically regulated activities in VARA’s seven-category framework. The Custody Activity Rulebook establishes detailed requirements for the safekeeping, administration, and management of virtual assets and the private keys or other cryptographic instruments that provide control over those assets. Custody regulation is foundational to market confidence — the security of custodied assets determines whether institutional investors will participate in the UAE’s virtual asset market.
VARA’s custody rules reflect lessons learned from high-profile custody failures in the crypto industry. The collapse of FTX in November 2022, which resulted in billions of dollars of client asset losses due to commingling and misappropriation, informed VARA’s stringent segregation and governance requirements. The regulatory framework aims to prevent similar failures by mandating structural safeguards at every level of the custody operation.
The custody activity requires a separate VARA license with enhanced capital requirements exceeding those for advisory or broker-dealer activities. The elevated capital threshold reflects the heightened risk profile of custody operations, where a single security breach or operational failure can result in irreversible loss of client assets. For the licensing process, see the VARA complete framework analysis.
private key management
VARA’s private key management requirements establish the core technical standards for custody operations. Licensed custodians must implement multi-signature and multi-party computation (MPC) architectures for private key generation and use. Private keys must be generated in hardware security modules (HSMs) that meet international certification standards. Key generation ceremonies must be conducted under dual-control procedures with independent witnesses. Backup and recovery procedures must ensure that private keys can be reconstituted in the event of hardware failure without exposing key material to unauthorized access.
The requirements prohibit single points of failure in private key management. No single individual may have the ability to independently authorize a transaction or access a private key. Administrative access to key management infrastructure must be logged, audited, and subject to periodic review.
These technical requirements are among the most detailed in any jurisdiction globally, reflecting VARA’s commitment to operational security standards that match or exceed institutional custody standards in traditional financial markets.
cold and hot storage requirements
VARA mandates that licensed custodians maintain the majority of client assets in cold storage — offline storage systems that are not connected to the internet and are therefore resistant to remote cyber attacks. The specific cold-to-hot storage ratio may vary based on operational requirements, but the regulatory expectation is that only the minimum amount of assets necessary for operational liquidity is maintained in hot wallets.
Cold storage infrastructure must be housed in physically secure facilities with multi-layer access controls, environmental monitoring, and 24/7 security. Geographic diversification of cold storage locations is recommended to mitigate concentration risk from localized physical threats.
Hot wallets — online systems connected to the internet to facilitate real-time transactions — must implement enhanced cybersecurity protections including network segregation, real-time monitoring, anomaly detection, and automated transaction limits. Hot wallet exposure limits must be approved by senior management and reported to VARA on a regular basis.
client asset segregation
VARA’s client asset segregation requirements mandate that client virtual assets are held separately from the custodian’s proprietary assets at all times. This segregation must be maintained both on-chain (through separate wallet addresses) and in the custodian’s internal records and systems.
The segregation requirement extends to sub-custodians and third-party service providers. Where a licensed custodian delegates custody functions to a sub-custodian, the segregation requirements must be contractually imposed on the sub-custodian and verified through regular auditing.
Client asset segregation is designed to protect client assets in the event of the custodian’s insolvency. Properly segregated assets should not be available to the custodian’s general creditors and should be returnable to clients through an orderly wind-down process. The DFSA’s client asset protection framework provides a comparative reference.
insurance and fidelity coverage
VARA requires licensed custodians to maintain insurance coverage and/or fidelity bonds that provide financial protection against losses resulting from theft, fraud, cybersecurity breaches, and operational errors. The minimum coverage levels are calibrated to the value of client assets under custody.
Insurance requirements recognize the nascent state of the crypto custody insurance market. VARA has worked with industry participants and insurance providers to develop coverage structures that address the specific risks of digital asset custody, including coverage for hot wallet breaches, cold storage compromises, and internal fraud.
technology governance standards
Beyond private key management, VARA’s technology governance standards for custody operations cover cybersecurity framework implementation including penetration testing and vulnerability assessment, incident response planning and testing, software development lifecycle controls for custody platform development, change management procedures for infrastructure modifications, third-party technology risk management, and blockchain network monitoring and fork management.
These standards reflect the recognition that custody technology is the primary risk surface for digital asset safekeeping operations. The ADGM FSRA’s technology governance approach provides a comparative reference.
operational resilience
VARA requires custody licensees to maintain business continuity plans and disaster recovery capabilities that ensure the continuity of custody services under adverse conditions. Operational resilience standards cover geographic redundancy for critical infrastructure, recovery time and recovery point objectives for custody systems, regular testing of business continuity and disaster recovery plans, communication protocols for client notification during service disruptions, and succession planning for key custody management personnel.
sub-custody and delegation
VARA permits delegation of custody functions to sub-custodians under specified conditions. Licensed custodians remain responsible for the safekeeping of client assets regardless of delegation arrangements. Sub-custodians must meet standards equivalent to those imposed on the licensed custodian, and the delegation arrangement must be approved by VARA. Regular audits of sub-custodians are required to verify ongoing compliance.
reporting and audit requirements
Licensed custodians must submit periodic reports to VARA covering client asset holdings and their composition, cold and hot storage utilization, security incidents and their resolution, operational metrics including uptime and transaction processing, and capital adequacy. Annual external audits must verify the custodian’s compliance with VARA’s requirements and confirm the existence and segregation of client assets.
comparative analysis
VARA’s custody rules are among the most detailed and prescriptive in the global regulatory landscape. Compared to ADGM FSRA custody standards, VARA’s requirements are more granular in their technical specifications. Compared to DFSA standards, VARA covers a broader range of assets and custodial arrangements. Compared to emerging EU standards under MiCA, VARA’s rules provide greater specificity on operational requirements.
For the full comparative picture, see the VARA vs ADGM vs DFSA comparison and the UAE vs EU MiCA comparison.
For official custody standards, visit vara.ae and FATF for international standards.