VARA Unlocks Staking from Custody: What Dubai VASPs Must Know
Dubai's Virtual Assets Regulatory Authority has amended its Custody Services Rulebook to permit licensed custodians to offer staking directly to clients, under a single legal entity and without a separate licence for VA Management and Investment Services. The change is immediate, and it carries concrete approval, fee, and accounting obligations that every VARA-licensed custodian and its advisers need to understand now.
What VARA Has Actually Changed
The revised Custody Services Rulebook introduces a defined activity called "Staking from Custody Services." Before this amendment, a VASP wanting to both safeguard client assets and put those assets to work through staking would typically have needed an additional licence covering VA Management and Investment Services. That structural barrier has been removed, but it has not been replaced by a free pass.
The single-entity permission
A VASP already holding a VARA Custody Services licence may now deliver staking services from the same legal entity. This matters for group structures because it avoids the cost and complexity of establishing, capitalising, and running a second regulated entity for what is, operationally, a tightly linked service. Clients benefit because their assets do not need to be transferred out of the custody entity to access staking, which reduces counterparty hops and the associated settlement and slippage risk.
The additional approval requirement
Permission is not automatic. The custodian must obtain specific additional approval from VARA before going live with staking. This is a distinct regulatory gate, separate from the original custody licence application. VARA has not published a single consolidated timeline for this approval, so firms should engage VARA's supervisory team early to understand the expected review period and the documentation pack required.
Fees
Additional licensing and supervision fees are payable for the staking service line. VARA has not disclosed the precise fee schedule in the public announcement, but the principle is clear: the expanded permission is a chargeable addition to the existing regulatory relationship. Budget holders at licensed custodians should treat this as a recurring cost item, not a one-off registration charge, given that supervision fees are typically annual.
Regulatory Context: Why This Move Makes Sense for Dubai
VARA is the competent authority for virtual asset services across the Emirate of Dubai, excluding the Dubai International Financial Centre, which sits under its own regime. Since VARA's framework came into force, the authority has built a layered licensing structure covering exchange, broker-dealer, custody, lending and borrowing, and management and investment services as distinct activity categories.
Staking has always sat awkwardly across that structure. Technically it involves the custodian deploying client assets to validate transactions on a proof-of-stake network, generating rewards. Whether that activity is best characterised as custody-adjacent or as discretionary asset management has been a live debate in every major jurisdiction. VARA's answer is pragmatic: it is a custody-adjacent activity, but one that requires an extra layer of approval and supervision rather than a full management licence.
This is consistent with the direction of travel seen in other maturing jurisdictions. Reviewing Q2 2026 global crypto policy shifts shows regulators broadly moving toward activity-specific add-ons rather than requiring entirely new licences for services that are operationally integrated with permitted activities.
Who Is Directly Affected
Licensed custody VASPs in Dubai
Any VASP holding a VARA Custody Services licence is now eligible to apply for the additional staking approval. Firms should audit their current licence scope, assess client demand for staking, and decide whether the incremental regulatory and operational investment is commercially justified. Eligibility does not equal automatic approval, and firms that begin offering staking before receiving VARA's specific sign-off would be in breach of their licence conditions.
Accounting firms and auditors serving Dubai VASPs
The amendment creates a new service line that must be reflected in client financial statements, regulatory capital calculations, and AML/KYC documentation. Auditors need to understand how their VASP clients intend to treat staking rewards, custody of staked assets, and any client-facing reward distributions. These are not hypothetical accounting questions; they are live disclosure items the moment a client activates the new permission.
CFOs at VASPs considering the expansion
The additional supervision fee is a P&L line item. Beyond that, staking from custody introduces revenue recognition questions, liability treatment for staked client assets held on-balance-sheet or off-balance-sheet, and the need to segregate staking reward flows from custody fee income in management accounts. Each of these has implications for how digital asset accounting software is configured and what data fields it needs to capture.
Accounting and Tax Implications for Custody VASPs
Revenue recognition for staking rewards
When a custodian stakes client assets and receives rewards, the key question is whether the reward income belongs to the client or passes through the custodian's own books. The answer depends entirely on the contractual structure. Under a principal model, the custodian receives and recognises the rewards, then pays out an agreed amount to the client. Under an agent model, the reward is the client's income from the moment it is received, and only the service fee nets through the custodian's P&L. VARA's rulebook amendment does not dictate which commercial model a custodian must adopt, so firms have a design choice, and that choice has direct accounting consequences under both IFRS 15 and IFRS 9.
On-balance-sheet vs. off-balance-sheet treatment of staked assets
Client assets held in custody are typically off-balance-sheet for the custodian, recorded only in a custody ledger. Once those assets are staked, they are temporarily locked or delegated to a validator. The custodian needs to confirm whether that delegation constitutes a transfer of control under IFRS 9 or whether the assets remain the client's beneficial property throughout. In most proof-of-stake architectures, the client retains beneficial ownership, so the off-balance-sheet treatment should be defensible, but auditors will rightly want to see the legal opinion and the smart contract review that supports it.
Segregation of staking reward flows
Good crypto bookkeeping software must be able to tag each reward event with the underlying staking transaction, the client account, the validator used, and the reward amount in both the native asset and its AED-equivalent fair value at receipt. Without that granularity, the custodian cannot produce the per-client reward statements that VARA supervision will almost certainly require, nor can it support an accurate tax position for the reward income passing through its books.
Tax treatment in the UAE
The UAE introduced a corporate tax regime with effect from financial years starting on or after 1 June 2023. VASPs operating in Dubai's mainland are in scope. Staking rewards received by the custodian under a principal model would form part of taxable income at receipt, valued at fair market value of the asset at that point. Rewards passed on to clients as a distribution raise further questions about deductibility and timing. Firms should confirm their position with UAE tax counsel given that the Federal Tax Authority has not yet published specific guidance on staking reward taxation for licensed VASPs.
Compliance and AML Considerations
Expanding a custody licence to include staking does not reset the KYC file, but it does expand the risk surface. Staked assets are typically locked for a period, and the validator relationship introduces a new counterparty that the custodian's AML framework needs to address. Firms should review their VASP due diligence and onboarding frameworks to confirm they capture the validator as a business relationship, assess the validator's own AML controls, and document the review.
Client risk assessments
Clients who choose to stake their assets are taking on liquidity risk during the lock-up period and potentially concentration risk if the validator is slashed. From an AML perspective, the source of staking rewards is the protocol itself, which is generally lower risk than a peer-to-peer transfer. However, if reward assets are immediately sold or transferred off-platform, the custodian's transaction monitoring system needs to flag and review those flows under its existing suspicious transaction reporting obligations to VARA and the UAE Financial Intelligence Unit.
Documentation for the additional approval
When applying to VARA for the specific staking approval, custodians should expect to demonstrate: an updated business model description covering the staking activity, a revised risk assessment, updated policies for conflicts of interest (particularly if the custodian has any economic interest in the validator), and confirmation of the technical and operational controls governing the staking process. Firms that already have robust digital asset accounting software and AML tooling in place will have a material head start in assembling this pack.
Practical Next Steps for Firms and Advisers
Immediate actions
First, confirm whether your client or your own entity holds a current VARA Custody Services licence in good standing. Only those entities are eligible. Second, assess client appetite for staking services and build a commercial case that accounts for the additional supervision fee as a recurring cost. Third, engage VARA's supervisory team to understand the approval timeline and documentation requirements, because the rulebook amendment creates the permission in principle but the approval process is the operative gate.
Medium-term preparation
Update your AML policies and business risk assessments to cover staking as a distinct activity. Review your digital asset accounting software configuration to confirm it can capture validator-level staking data, reward receipt events with fair-value timestamps, and client-level reward distributions. Prepare a legal opinion on the beneficial ownership treatment of staked assets, because auditors will ask for it. Brief your tax adviser on the revenue model you intend to adopt so that the corporate tax position can be confirmed before the service goes live.
Source: Virtual Assets Regulatory Authority (VARA)
Frequently Asked Questions
Does a VARA-licensed custodian automatically have permission to offer staking after this amendment?
No. The revised rulebook creates eligibility, not automatic permission. Each custodian must apply for and receive specific additional approval from VARA before offering staking services. Operating without that approval would be a licence breach.
Is a separate legal entity required for the staking activity?
No, that is precisely what the amendment removes. A licensed custodian can now deliver staking from the same legal entity, provided it has the specific VARA approval in place.
What additional fees should custodians expect?
VARA states that additional licensing and supervision fees are payable for the staking service. The precise amounts are not set out in the public announcement. Firms should contact VARA directly or review the fee schedule available through VARA's official portal to confirm the cost before filing the approval application.
How should staking rewards be classified on the custodian's books?
That depends on the contractual structure. Under a principal model, rewards are the custodian's income at receipt, recognised at fair value, and the client payment is a separate cost. Under an agent model, only the service fee nets through P&L. The choice must be documented, consistently applied, and supported by the underlying client agreement. IFRS 15 and IFRS 9 both bear on this classification.
Does this change apply to VASPs operating within the Dubai International Financial Centre?
No. VARA's jurisdiction covers the Emirate of Dubai excluding the DIFC, which has its own regulatory framework under the Dubai Financial Services Authority. VASPs regulated by the DFSA should refer to DFSA guidance for any equivalent staking permissions.