Dubai’s VARA Releases Updated Anti-Money Laundering Guidelines, Requiring Crypto Firms to Integrate Real-Time Risk Controls Against FATF Blacklists

According to Bitcoin.com, the Dubai Virtual Assets Regulatory Authority (VARA) recently released an updated Anti-Money Laundering (AML) regulatory guidance, requiring cryptocurrency firms operating in Dubai to integrate FATF high-risk and blacklist country data into their risk-scoring models in real time—replacing the previous static compliance tracking mechanism. Under the new rules, firms must update their risk assessments at least once every three months, and immediately upon any material change to their operational structure or product offerings. Additionally, proliferation financing risks and targeted financial sanctions risks must be assessed separately and may not be broadly conflated with AML compliance. Firms are also required to formally document risks arising from AI-assisted operations and privacy-enhancing exchanges. VARA stated that compliance officers, senior management, and board members bear full responsibility for their company’s residual risk rating, signaling a regulatory shift from post-hoc enforcement toward proactive, systemic risk management.