Dubai’s Virtual Assets Regulatory Authority (VARA) treats staking as an integral extension of Custody Services, not a standalone activity. This approach, formalized in the Custody Services Rulebook (with Part IV dedicated to Staking from Custody Services), allows licensed VASPs to offer staking without needing a separate VA Management & Investment Services license — provided they obtain explicit additional authorization.
As of 2026, this framework remains in force following the 2023 amendments and subsequent rulebook updates (e.g., effective June 2025 versions). It balances innovation with strong client protections, especially around risks like slashing, key control, and asset segregation.
1. Authorization Requirements
- Only VASPs already licensed for Custody Services can apply for staking authorization.
- Authorization must be explicitly stipulated in the VASP’s license.
- Incremental licensing/supervision fees apply (per Schedule 2 of the Regulations or VARA-published fees).
- Staking is a subset of Custody Services → no need for a separate legal entity (exception to general segregation rules).
Key Point: VARA can suspend or revoke staking authorization for any specific DLT (Distributed Ledger Technology) or entirely, at its discretion.
2. Client Instructions & Consent (Part IV.B)
- Staking cannot be provided on an “opt-out” basis.
- Requires specific, explicit client instructions before initiation.
- VASPs must act only on client instructions, including for governance/voting on the DLT.
- Pre-authorized instructions are allowed if all foreseeable uses are clearly communicated and detailed in advance.
This ensures informed consent and prevents unauthorized staking of client assets.
3. Segregation & Safekeeping (Part IV.C)
- Strict segregation: Each client’s assets must remain in separate VA Wallets containing only that client’s assets — no pooling with other clients or the VASP’s own assets.
- Single client per node: No pooling even to meet minimum staking thresholds. Each node/instance can only hold/delegate assets of one client.
- VASPs retain full safekeeping responsibility.
- VASPs must maintain control of withdrawal/unstaking keys or mechanisms.
These rules prioritize client asset protection and prevent commingling risks common in pooled staking models.
4. Node Management & Operational Duties (Part IV.D)
- VASPs must use “all commercially reasonable endeavours” to meet DLT operational requirements (hardware, software, connectivity, upgrades) to minimize slashing or penalty risks.
- Continued compliance with general custody wallet management rules.
- Outsourcing to third parties must comply with Company Rulebook standards (e.g., due diligence, oversight).
Practical Implication: Robust validator selection, monitoring, and incident response are expected. Board-approved risk frameworks should cover these.
5. Risk Disclosure (Part IV.F)
- Provide a separate risk disclosure statement (not buried in the client agreement) covering:
- Potential loss, reduction, or penalties (e.g., slashing).
- Types, nature, circumstances, likelihood, and severity of risks.
- Obtain independent client confirmation/acceptance before providing staking services.
Additional Compliance Layers
Staking falls under the broader Custody Services Rulebook and the four compulsory rulebooks (Company, Compliance & Risk Management, Technology & Information, Market Conduct). Key overlays include:
- Client Asset Protection: Full segregation, no rehypothecation.
- Governance: Board oversight, fit-and-proper requirements, documented policies.
- Technology & Cybersecurity: Secure key management, audits, resilience standards.
- AML/CFT & Reporting: Enhanced due diligence, suspicious activity monitoring.
- Insurance & Capital: Adequate coverage for operational risks; capital maintenance per activity.
Rewards, Slashing & Liability
- VASPs are responsible for safekeeping during staking → they bear operational accountability for losses due to negligence.
- Clients typically bear protocol-level risks (slashing, volatility), but clear disclosures are mandatory.
- Rewards distribution must align with client instructions and be transparent.
- No specific VARA-prescribed reward split; commercial terms apply, subject to fair treatment rules.
Comparison Context
- Vs. ADGM FSRA: ADGM has proposed/expanded staking frameworks with similar client protections but integrates more with traditional fund rules.
- Vs. Singapore MAS: MAS is more cautious on retail staking/yield products, with stricter promotion rules and stablecoin focus.
- VARA’s model is notably custody-centric and modular, making it attractive for institutional and hybrid operators in the MENA region.
Best Practices for VASPs in 2026
- Architect early: Build staking into custody license applications (hot/cold splits, MPC support, single-client nodes).
- Validator due diligence: Document selection criteria, performance monitoring, and slashing mitigation.
- Client journey: Clear dashboards for staking status, rewards, risks, and easy unstaking.
- Incident response: Pre-defined plans for slashing events, outages, or protocol forks.
- ESG considerations: Public disclosures on energy use for staking-related activities (per broader rulebooks).
- Engage specialized legal/compliance advisors — VARA applications involving staking require strong demos of tech and governance.
Why This Matters for Founders
VARA’s staking rules position Dubai as a competitive hub for institutional custody with yield services. The framework avoids over-restriction (no separate license needed) while enforcing high standards on segregation and risk management — appealing to sophisticated investors seeking regulated, transparent staking.
Caveats: Rules can evolve; always check the latest on rulebooks.vara.ae. Staking authorization is not automatic with custody licensing and involves additional scrutiny.
This client-centric, risk-aware approach reflects VARA’s philosophy: enabling innovation while safeguarding the ecosystem. For crypto founders building in Dubai, integrating compliant staking can be a powerful value-add — but only with robust infrastructure and governance. Consult VARA directly or licensed professionals for tailored guidance.