Dubai's Virtual Assets Regulatory Authority (VARA) now expects every licensed Virtual Asset Service Provider (VASP) to review and update its AML/CFT Business Risk Assessment every 90 days, including explicit risk ratings for stablecoins, DeFi exposure, and tokenized real-world assets (RWAs).

Dubai's Virtual Assets Regulatory Authority completed a sector-wide thematic review of AML/CFT Business Risk Assessments in early 2026. The findings are now published. For institutions holding or servicing digital assets in the UAE, they represent a significant compliance gap, and a direct requirement for the kind of continuous risk infrastructure Webacy provides.

What VARA Requires

VARA is Dubai's standalone virtual asset regulator, separate from the UAE's federal framework. Every licensed VASP must maintain an AML/CFT Business Risk Assessment under Rule III.D of the VARA Rulebook. The BRA must be reviewed every three months, approved by the Board of Directors, and demonstrably connected to live operational decisions. Not a once-a-year filing. A live document that updates when risk changes.

The 2026 thematic review found most firms are not there yet. VARA is specifically looking for evidence that risk ratings move when the underlying data moves, and that what happened in the market is reflected in the next quarterly submission.

Stablecoin and DeFi: The Two Requirements Most Institutions Are Unprepared For

VARA names stablecoins and DeFi as distinct, explicitly scored risk categories in the BRA, and they are the two areas where most licensed institutions have the least defensible existing frameworks.

On stablecoins: VARA's guidance explicitly cites "current typology findings on the prevalence of stablecoins in on-chain illicit activity" and requires VASPs to assess stablecoin transaction volumes, counterparty exposure, and sanctions evasion risk as a named, scored, board-reviewed obligation every quarter. For any institution holding stablecoins as operational assets or as collateral in tokenized products, this is not a background consideration. It is a primary BRA line item, and it needs to update when peg stability, collateral composition, or liquidity conditions change.

On DeFi: VARA requires VASPs to formally score smart contract interactions, DEX activity, and exposure to non-custodial or protocol-level intermediaries as a standalone risk category. That means every institution with vault exposure, RWA product allocations, or yield strategies running through DeFi infrastructure needs to assess that exposure independently, not fold it into a generic emerging technology bucket. The guidance is specific: oracle dependencies, governance structures, and cross-chain bridge mechanisms all require their own scoring and narrative.

Both categories share the same structural problem: they change faster than any quarterly static document can reflect on its own.

Where Webacy Fits

Webacy's platform was built to provide exactly the evidence layer VARA is asking for. Our stablecoin monitoring tracks peg stability, collateral composition, supply velocity, and liquidity depth in real time, flagging structural changes before they become visible to price-based monitors. In both the USR and StablR exploits this year, Webacy detected anomalous minting activity and issued alerts before official announcements. That is the kind of evidence base a quarterly BRA needs to demonstrate that stablecoin risk ratings are data-driven, not self-assessed.

For DeFi and RWA exposure, Webacy's vault ratings cover the structural risks VARA flags: smart contract governance, oracle dependencies, collateral quality, and liquidity under stress. For wallet and counterparty risk, our KYW product provides continuous scoring across multiple chains, covering sanctions exposure, high-risk counterparty activity, and contamination from flagged addresses.

The Infrastructure Gap

VARA has created a regulatory mandate for continuous onchain risk monitoring. The quarterly cycle, board accountability, and data-evidenced control effectiveness standard all require something point-in-time audits and static models cannot provide: a live view of how the assets on your books are performing structurally, right now.

Institutions that plug Webacy's ratings and monitoring into their BRA process will have a defensible, data-driven answer every 90 days. Institutions that don't will be explaining to their Board and to VARA why their stablecoin and DeFi risk scores have not moved, in a market where the assets themselves rarely stand still.

Webacy is built for this. Get in touch!