AI Is Reshaping Crypto Supervision: VARA, FCA, and HKMA Signal a New Era
Three of the world's most influential financial regulators have, within weeks of each other, publicly committed to rebuilding their supervisory models around artificial intelligence. The Dubai Virtual Assets Regulatory Authority (VARA), the UK Financial Conduct Authority (FCA), and the Hong Kong Monetary Authority (HKMA) have each described, in substantial detail, how the current paradigm of periodic inspections and sample-based reviews is incompatible with a financial system increasingly driven by digital assets and AI agents. For accounting firms, auditors, and CFOs responsible for crypto compliance, the practical implications arrive faster than most realise. The right crypto accounting software infrastructure must evolve alongside this regulatory direction, not after it.
VARA: The Case for Programmable Compliance
Matthew White, CEO of VARA, published a detailed article in Forbes on 7 July 2026 setting out his view of where regulatory supervision must go. VARA was established in 2022 as the world's first cryptoasset-specific regulatory body, and White's perspective carries particular weight given that its mandate covers an asset class that is, by design, always on.
Why quarterly inspections no longer work
White's central argument is direct: you cannot audit a 24/7 cross-border smart contract through a quarterly inspection, and you cannot police an autonomous lending protocol through paperwork. The mismatch between legacy supervisory cadences and the operational reality of on-chain activity is, in his view, a structural problem that incremental reform cannot fix.
His proposed alternative is a three-part shift: on-chain audits replacing sampled reviews, real-time monitoring replacing after-the-fact reporting, and programmable compliance replacing rule-engine workflows. Each of these has concrete implications for how crypto firms record transactions, maintain audit trails, and demonstrate AML adherence to regulators.
Two waves of AI-driven change
White identifies two distinct phases of transformation. In the near term, meaning the next two years, AI will allow regulated firms to cut false positives in AML and counter-terrorist financing (CFT) monitoring alerts significantly. Resources currently absorbed by chasing low-quality alerts can be redirected to genuinely high-risk activity. Simultaneously, regulators themselves will use AI to accelerate authorisation reviews, reducing the time between application and decision.
The second wave, projected over the next five years, is more fundamental. The supervisory model itself changes: regulators stop receiving periodic data submissions and instead maintain continuous monitoring through live data feeds, with AI-powered analytics detecting risk patterns in real time. White frames this as a net positive for the private sector too, arguing that the operational compliance burden on firms falls when supervision is more targeted and risk-based.
He is candid, however, about the condition that must be met first. Regulators need to resolve questions of human accountability for AI-generated outputs and decisions. Jurisdictions that clarify these accountability frameworks proactively, he argues, will be the ones that attract compliant, sophisticated digital asset businesses over the coming decade.
The FCA and Bank of England: Rethinking What Regulation Means
VARA's position does not stand alone. On 24 June 2026, Nikhil Rathi, chief executive of the FCA, delivered a speech in which he stated that the authority is "re-thinking what it means to be an effective regulator in the age of AI," explicitly referencing both agentic commerce and tokenisation as the dual developments driving that rethink. Rathi described specific use cases the FCA is already exploring, including using AI to monitor for market manipulation in real time across financial markets.
When traditional rulemaking breaks down
Rathi's remarks contained a notable admission: in some areas, traditional rulemaking simply will not work anymore. The pace of AI-related technological change means that by the time a conventional rule is drafted, consulted on, and enacted, the technology it was designed to address has already moved on. The FCA's response is a shift toward what Rathi called "stewardship," working with firms and markets collaboratively to navigate change, and acting before legislation catches up rather than waiting for it.
To support this, the FCA is expanding its existing initiatives. Its AI Lab, Supercharged Sandbox, and AI Consortium will be joined by additional programmes designed to let financial sector firms test and deploy AI in real-world use cases under supervisory oversight. For crypto firms seeking regulatory clarity on AI-assisted compliance tools, these sandboxes represent a meaningful route to engagement.
The Mills Review and agentic supervision
On 6 July 2026, the FCA published the Mills Review, a report by FCA Executive Director Sheldon Mills commissioned by the FCA's Board to assess AI's impact on financial services. Its central recommendation is that the UK build and adopt an "AI-enabled agentic supervisory model." In practice, this means deploying AI agents within supervisory workflows to improve consistency and efficiency, and using live data and AI analytics to maintain a continuous, real-time picture of sector-wide risks rather than waiting for quarterly or annual returns.
The review describes this as moving from "periodic reporting towards more continuous, event-driven data and intelligence flows." For any firm currently meeting its regulatory obligations through scheduled submissions, this is a signal that the format those obligations take is likely to change materially within the decade.
These themes were reinforced by Sarah Beerden, Deputy Governor for Financial Stability at the Bank of England, in a speech on 30 June 2026. Beerden acknowledged that existing regulatory frameworks were not built to contemplate autonomous agents, and that requiring a human in the loop for every agent action is unlikely to be realistic at scale. More sophisticated governance and accountability frameworks will be needed, she argued, a view that maps directly onto the challenge facing crypto firms whose AML systems increasingly incorporate automated decisioning.
HKMA: From Productivity Tool to Strategic Intelligence Partner
In the Asia-Pacific region, the HKMA published a report on 22 June 2026 documenting how Hong Kong banks are currently using AI in AML and CFT compliance, and setting out its ambitions for where that use should go. The HKMA's framing is deliberate: it distinguishes between AI as a productivity tool, which is how most firms are deploying it today, and AI as a strategic intelligence partner, which is where it wants the sector to move.
Current state versus the HKMA's target state
Right now, Hong Kong financial institutions are using AI primarily for efficiency gains: more effective alert triaging, reduced manual review workloads, and faster processing of routine compliance tasks. The HKMA acknowledges this is valuable but treats it as a floor, not a ceiling. Its target state is AI that enables earlier threat detection, supports complex AML decision-making, and facilitates proactive disruption of financial crime networks before harm crystallises.
To get there, the HKMA is committing to work directly with firms to clarify expectations around accountability and governance of AI systems. This is consistent with the position taken by both VARA and the FCA: the technology is ready before the accountability frameworks are, and resolving that gap is the regulator's job, not something firms should try to navigate unilaterally.
What This Means for Crypto Firms and Their Advisers
Taken together, these three regulatory voices, drawing on a common analytical framework even though they arrived at it independently, describe a compliance environment that will look very different within five years. Accounting firms, auditors, and CFOs advising or overseeing crypto operations need to think about that shift now, because the infrastructure decisions made today will determine whether adapting is straightforward or disruptive.
AML and transaction monitoring systems
The immediate operational priority is AML alert quality. All three regulators have singled out false positives as a key inefficiency in current compliance workflows. A system generating large volumes of low-quality alerts is not just a drain on resources: it is the kind of compliance posture that will look increasingly inadequate as regulators move to AI-powered, risk-based supervision and expect firms to demonstrate they are doing the same. Crypto bookkeeping software and compliance platforms need to be evaluated not just for their ability to record transactions, but for their capacity to integrate with AML monitoring tools that can demonstrate alert quality and decision rationale to an AI-enabled regulator.
Audit trails and on-chain data
The shift to on-chain audits described by VARA has direct implications for how digital asset accounting software captures and retains transaction-level data. If regulators intend to audit smart contract activity directly rather than through sampled reviews, firms need to ensure their record-keeping systems can produce granular, timestamped, on-chain verifiable records on demand. This is not a future requirement: firms operating in VARA's jurisdiction under existing licensing conditions should already be assessing whether their current systems could support this kind of scrutiny. See also our coverage of how VARA licensing affects digital asset accounting software decisions in the UAE for further context on local obligations.
Governance frameworks for AI-assisted decisions
Each regulator has raised the same concern: who is accountable when an AI system makes a compliance decision? For firms already using automated tools in transaction screening, sanctions checking, or risk scoring, this is not a theoretical question. Any AI-assisted output that informs a regulatory filing, a Suspicious Activity Report, or a client onboarding decision needs a documented human accountability trail. Boards and audit committees should be asking now whether their current governance frameworks explicitly address AI-generated outputs, and whether those frameworks would survive regulatory scrutiny.
Licensing and authorisation timelines
VARA's CEO flagged that AI will speed up authorisation reviews in the near term. For firms currently navigating licensing applications in the UAE, UK, or Hong Kong, this is welcome news in principle. However, faster processing also means regulators will expect higher-quality applications with fewer information gaps. Firms that submit documentation relying on legacy compliance architecture may find that a more AI-enabled regulator identifies weaknesses more quickly than a human reviewer would have done previously. For context on how AML-driven licensing pressure is playing out in other markets, see our analysis of AML licensing developments in South Korea.
The Global Dimension
These developments in the UAE, UK, and Hong Kong are not isolated. Regulators in Singapore and the United States have made comparable statements, and international standard-setters have begun publishing frameworks for responsible AI adoption across the financial sector. The convergence is significant: it suggests that the shift toward AI-enabled, real-time supervision is becoming a global baseline expectation rather than a jurisdictional experiment.
For accounting firms and CFOs with multi-jurisdictional crypto portfolios, this means the compliance architecture designed for one market will increasingly need to be compatible with live-data, AI-auditable standards across all of them. The firms that treat this as a near-term infrastructure project, rather than a distant regulatory possibility, will carry a material advantage when the supervisory model completes its transition.
Frequently Asked Questions
What is VARA and why do its views on AI supervision matter?
VARA, the Virtual Assets Regulatory Authority in Dubai, was established in 2022 as the world's first regulatory body dedicated specifically to cryptoassets. Its CEO's public statements on AI supervision carry weight because VARA sets the licensing and compliance framework for crypto firms operating in the UAE, one of the most active crypto markets globally.
How does the shift to real-time regulatory monitoring affect my firm's AML obligations?
If regulators move from periodic reporting to continuous, live-data monitoring, firms will need AML systems that can generate and transmit transaction-level data on demand rather than in scheduled batches. Alert triaging quality, decision rationale, and audit trails will all be subject to more frequent and more granular scrutiny. Firms should audit their current systems against this expectation now.
What does "programmable compliance" mean in practice?
Programmable compliance refers to embedding regulatory rules directly into on-chain processes or automated workflows, so that compliance is enforced at the point of transaction rather than checked retrospectively. In practical terms, it means smart contracts or automated monitoring systems that apply AML rules in real time, without waiting for a human review cycle. It is an emerging concept, and the governance frameworks to support it are still being developed by regulators.
Does the Mills Review create any new legal obligations for UK crypto firms?
The Mills Review is a commissioned report with recommendations, not binding regulation. However, it signals the FCA's strategic direction clearly, and firms that ignore its recommendations risk being caught off guard when the FCA formalises its agentic supervisory model. Firms should treat it as forward guidance and begin assessing their data and AI governance frameworks accordingly.
How should a CFO approach accountability for AI-generated compliance outputs?
All three regulators have identified human accountability for AI-generated outputs as an unresolved but urgent issue. A CFO's immediate step should be to document which compliance decisions in the firm's workflow involve AI-assisted outputs, identify who in the organisation is accountable for each, and ensure that accountability is reflected in board-level governance documentation. This will become a standard expectation during regulatory inspections and licensing reviews.
Source: Elliptic