The Dubai Virtual Assets Regulatory Authority has issued a circular clarifying its minimum expectations for independent audits of virtual asset service providers’ reserve assets, following a thematic review of proof of reserve asset reports submitted in 2025. The circular seeks consistent assurance that client virtual assets exist, are properly held and reconciled, and remain protected across all custody arrangements. Audits should confirm that reserve assets remained at least equal to 100% of aggregate client liabilities throughout the review period and were held one to one in the same virtual asset as each liability. The scope should cover all client wallets, assess segregation from proprietary assets, verify wallet control and custody arrangements, test daily reconciliations, and identify any rehypothecation, lending, pledging or other use of client assets. Existing rules permit rehypothecation only where client consent and applicable licensing requirements are satisfied. Reports should document the procedures, evidence, sampling methods, third-party reliance and scope limitations for each area reviewed. They should distinguish compliant outcomes from exceptions, limitations and matters that could not be independently verified, explain remediation and follow-up, and avoid relying solely on management representations where independent evidence is reasonably available. Appointment of an external auditor does not reduce the responsibilities of the provider, its board, senior executive officer or control functions.

Original source