Dubai orders crypto exchanges to retain transaction records for 8 years, effective immediately

Dubai’s Virtual Assets Regulatory Authority has ordered crypto firms operating in the emirate to keep far more detailed transaction and dispute records, effective immediately, with no transition period, after a case in which a user’s transaction dispute couldn’t be resolved due to inadequate documentation.

The change comes after a reported case involving a user identified as Adam, whose transaction discrepancies could not be resolved quickly because of inadequate records.

The episode highlighted the practical consequences of incomplete transaction documentation and provides the context for the regulator’s push toward stronger VARA VASP compliance.

VARA VASP compliance rules raise record-keeping standards

Under the updated framework, VASPs are required to keep their books and records properly, including appropriate audit trails for transactions. VARA’s rulebook specifies that these records can include transaction amounts, dates and times, payment instructions, fees and charges, client account or wallet information and, where practicable, information concerning other entities involved in a transaction.

The requirements extend beyond transaction histories. VASPs must maintain records demonstrating compliance with applicable laws and regulatory requirements, preserve information produced by third parties concerning clients, keep records that facilitate audits and maintain a general ledger covering assets, liabilities, equity, income and expenses.

Client statements and valuations provided to clients and counterparties must also be retained. The rules additionally require firms to preserve communications and documentation associated with investigations into client complaints and the resolution of transaction errors.

That means VARA VASP compliance is not limited to recording transfers on a blockchain. It also encompasses the supporting documentation needed to reconstruct what happened when a transaction is disputed or an operational error occurs.

Why transaction records matter to Dubai’s crypto market

The central issue behind the stricter VARA VASP compliance requirements is accountability. When a transaction is disputed, regulators and service providers need enough information to establish what happened, when it happened and which accounts or wallets were involved.

VARA’s rules require relevant records to be retained for at least eight years, while records that may relate to UAE national security can be retained indefinitely. VASPs must also furnish records to VARA when required under applicable regulations, rules or directives.

The framework also separately requires VASPs to retain virtual asset transaction records and certain client due-diligence and monitoring records for no less than eight years.

For firms operating in Dubai, stronger VARA VASP compliance therefore creates an operational requirement that extends well beyond the point at which a transaction is completed. Records must remain accessible long enough to support regulatory reviews, audits, investigations and the resolution of client complaints.

Client reporting adds another layer of oversight

The regulator’s broader record-keeping framework also contains requirements concerning client money. VASPs must maintain up-to-date records of the receipt and payment of client money and movements within internal systems, allowing differences in balances or positions to be reconciled.

The rules also require client statements to be provided or made available at least monthly, unless otherwise agreed with the client. Such statements must include relevant balances and the amount, date and value of credits and debits during the reporting period.

These provisions make VARA VASP compliance closely connected to reconciliation and client reporting rather than treating record keeping as a standalone administrative function.

VARA also requires daily reconciliation of client accounts under its framework, with firms expected to investigate unresolved discrepancies and take corrective action where necessary. Material discrepancies that remain unresolved must be reported to the regulator.

VASPs face immediate operational adjustments

The immediate effective date means firms subject to the updated requirements cannot rely on a lengthy transition period to prepare their systems. Compliance teams may need to review existing transaction logs, audit-trail systems, client reporting procedures and document-retention practices to ensure they meet the regulator’s expectations.

The requirements also reinforce VARA’s position as the regulator responsible for virtual assets across Dubai’s mainland and free zones, excluding the Dubai International Financial Centre. (VARA Rulebook).