The Gap Between Declaration and Investigation
Most VASP applicants applying for a licence in Dubai submit a Fit and Proper declaration, attach a CV and a passport copy, run a sanctions screen, and consider the principal person assessment complete. That is not what VARA's Company Rulebook requires. It is a starting point, and a thin one. The regulatory standard is substantively higher, the scope of persons caught is broader than many operators realise, and the evidentiary threshold that separates a defensible assessment from a compliance gap is one that database-only processes reliably fail to meet.
The stakes are clear. VARA can impose fines of up to AED 50 million per offence, bar individuals personally from future authorisation across VARA, DFSA and FSRA, and refer natural persons to public prosecution under Federal Decree-Law No. 20 of 2018 on anti-money laundering and counter-terrorism financing. In the UAE's 2024 National Risk Assessment, the virtual assets sector was classified as high risk for money laundering and terrorist financing. VARA's 2025 rulebook update, issued on 19 May 2025 with a 30-day implementation window, made personal accountability for directors, Responsible Individuals and MLROs explicit in the enforcement provisions. Principal person due diligence is no longer a governance formality. It is a substantive investigative obligation.
What VARA Means by "Principal Person"
VARA does not use the phrase "principal person" as a standalone term, but the category it creates is defined and wide. The Company Rulebook (Version 2.0, 19 May 2025), issued under the Virtual Assets and Related Activities Regulations 2023 pursuant to Dubai Law No. 4 of 2022, requires Fit and Proper assessment of every Board member, every member of Senior Management, each of the two mandatory Responsible Individuals, and any "Person Exercising Control."
The last category is the most commonly mishandled. VARA defines Control functionally, not formally. Any individual who can direct, influence or otherwise shape the policies, strategy or risk decisions of a VASP falls within scope, whether or not they hold a formal title, whether they are resident in the UAE, and whether their influence operates through equity, voting rights, contractual arrangements, token governance mechanisms, or informal relationships. A founder based in Riyadh with no UAE residence who holds sign-off rights over capital allocation is in scope. A foreign strategic investor whose stake falls below 25 percent but whose approval is required for board appointments is in scope. The Schedule 1 Definitions in the Company Rulebook make no geographic carve-out.
UBOs are subject to a parallel and overlapping regime. Under Rule I.A.3 of the Company Rulebook, VASPs must maintain a company structure with a clear chain of ownership and all associated voting powers such that VARA can clearly identify any Controlling Entities and the UBOs. Under Cabinet Resolution 58 of 2020, as amended by Resolution 109 of 2023, all relevant UAE businesses must maintain a UBO register and file declarations with the relevant licensing authority. Failure to update the register within 15 days of an ownership change carries administrative fines ranging from AED 50,000 to AED 1,000,000. Where a VASP seeks to change its UBO structure, Rule I.A.5 requires VARA's prior written approval and mandates that declarations be filed confirming the incoming UBO is not a Politically Exposed Person and is not subject to any form of economic sanction.
What the Fit and Proper Standard Actually Requires
Part III of the Company Rulebook sets out the Fit and Proper criteria in six sub-sections: Qualification, Industry Experience, Management Experience, Financial Status or Solvency, Honesty, Integrity and Reputation, and Continuing Requirements. Each has specific evidentiary content.
Qualification and Experience
A qualifying individual must possess a degree relevant to the role or, where that is absent, demonstrable professional qualifications and experience. More specifically, the individual must show understanding of: the structure of the applicable regulatory framework; the Regulations, Rules and Directives that govern their function; fiduciary obligations to clients; and the specific VA Activities the VASP is licensed to carry out. Industry experience is defined as hands-on operational experience in VA Activities in the Emirates or in activities of a similar nature in other industries or jurisdictions; VARA explicitly looks to the substance of the experience and may examine whether it is directly relevant to the specific function being discharged. For Board and Senior Management positions, management experience must involve supervising and managing essential VA Activities and staff; administrative or advisory roles carry less weight.
A curriculum vitae submitted at IDQ stage is not verification of any of this. It is a self-declaration. The obligation on the VASP is to assess the individual, not to accept the individual's own account. That assessment is required to be documented, and it must be revisited at least annually for Board members and Responsible Individuals.
Financial Status or Solvency
An individual will not satisfy the Fit and Proper standard if they are an undischarged bankrupt, currently subject to bankruptcy proceedings, or a bankrupt who has recently been discharged. Receivership and analogous proceedings are also disqualifying. VARA also considers whether the individual has failed to meet any judgment debt, evaluated by reference to the circumstances and recency of the failure. A compromise or scheme of arrangement with any creditor involving more than AED 50,000 is a specific factor VARA will examine.
UAE court records are not publicly searchable in a manner comparable to common law jurisdictions. Regional insolvency proceedings, debt compromises and judgment debts in Bahrain, Kuwait, Jordan, Egypt and other GCC and MENA markets are even less accessible. A database check of UAE national registries will not surface these. Verification requires targeted enquiry, including direct reference conversations with institutions, counterparties and professional advisers who have dealt with the individual in financial contexts.
Honesty, Integrity and Reputation
This is the most substantive sub-section and the most commonly under-investigated. Under Rule III.F of the Company Rulebook, VARA will have regard to: criminal convictions, with particular consideration given to offences of dishonesty, fraud, financial crime, and offences under laws relating to companies, banking, insolvency, money laundering and insider dealing; adverse civil findings or settlements relating to financial business, misconduct, fraud or company management; existing or previous regulatory investigations and disciplinary proceedings; breaches of regulatory requirements; justified complaints; and whether the individual has been connected with a business that went into insolvency, liquidation or administration within one year of their involvement.
VARA will also assess whether the individual has ever been dismissed for cause, disqualified as a director, or removed from a position of trust. Critically, Rule III.F.1.j requires assessment of whether the individual has been candid and truthful in all dealings with any regulatory body and demonstrates a readiness to comply with regulatory requirements. This is not a retrospective criminal records check. It is a character and conduct assessment that requires evidence from people who have worked alongside, or had dealings with, the individual.
The May 2025 update to Rule III.F.2 introduced an important qualifier: a prior criminal conviction does not automatically bar VARA approval. VARA will now also consider the measures and controls the individual and the VASP will have in place in response to such a conviction. This discretion reflects the reality of high-profile convictions among founders of major crypto firms internationally, but it does not dilute the obligation to investigate. It means the investigative record must be thorough enough to support a considered determination, not a gap.
Continuing Requirements and Change of Control
Fit and Proper assessment is not a one-time event. Board members must be reassessed at least annually, and Responsible Individuals must be validated and records maintained on an annual cycle. The VASP must notify VARA without delay if any event occurs that could affect the fitness and propriety of a principal person, including changes in criminal, regulatory or financial status. Failure to notify is itself an enforcement trigger.
Any change of control requires VARA's prior written approval under Part VIII of the Company Rulebook. The incoming controller must submit detailed information to VARA in a form acceptable to the authority, and VARA has up to 30 working days to approve or deny the application, extendable at its discretion. VARA assesses whether the incoming entity could direct the board, influence policies, or solicit proxy votes; the test is functional, not nominal. Any attempt to proceed with a structural change without prior written approval is a separate breach.
Where Current Practice Fails the Standard
The pattern of inadequacy in VASP principal person assessments falls into three categories.
Scope Under-Definition
VASPs identify the named board and the two Responsible Individuals, conduct basic screening on those individuals, and treat the exercise as closed. Non-resident founders with effective influence, offshore holding company controllers, and informal advisers with contractual veto rights over key decisions are left outside the assessment framework entirely. When those individuals later surface in enforcement actions in other jurisdictions, or when a structural change brings them into formal view, the remediation cost significantly exceeds what a properly scoped initial investigation would have required.
Insufficient Evidentiary Standard
Sanctions screening and adverse media searches against commercial databases are necessary but not sufficient. They do not detect: judgment debts in non-indexed regional courts; private debt compromises; regulatory investigations that have not resulted in published findings; dismissals for cause in private equity or asset management firms; or the reputational factors that matter most in the GCC context: specifically whether an individual has been candid with regulators and counterparties and whether their track record in analogous roles reflects genuine substance or a history of structural proximity to failure.
Treating Continuing Obligations as Administrative
Annual confirmations are filed; actual re-evaluation rarely occurs unless there is a visible trigger. The regulatory requirement is not an annual declaration. It is an annual assessment, with documentation.
What a Satisfactory Assessment Actually Looks Like
A defensible principal person investigation for a VARA application has six components.
1. Governance Mapping
A governance mapping exercise that applies VARA's functional definition of Control, not the legal ownership chart. This means identifying every individual, regardless of formal title or geographic location, with the practical capacity to direct or materially influence the VASP's operations, strategy or risk framework.
2. Document Collection
Document collection that goes beyond passport and CV: source of funds evidence, financial statements or tax disclosures relevant to financial solvency, evidence of academic and professional qualifications, and records of prior regulatory applications and their outcomes in every jurisdiction where the individual has operated.
3. Multi-Jurisdictional Public Record Research
Conducted with an understanding of what is and is not accessible in each relevant jurisdiction. GCC court records, commercial registration data, insolvency filings and regulatory disciplinary registers have specific access pathways that are not replicated in commercial databases.
4. Structured Reference Interviews
With individuals who have worked alongside or had professional dealings with the subject, specifically directed at the honesty, integrity and candour criteria in Rule III.F. Database searches do not generate testimony about conduct; interviews do.
5. Written Assessment Memorandum
That documents the basis for the conclusion, identifies any areas of residual uncertainty, and explains why those uncertainties are not material to the Fit and Proper determination. VARA's instruction to look to the substance of the requirements and the materiality of any failure is an invitation to apply judgment, but that judgment must be recorded and defensible.
6. Continuing Obligations Calendar
Built into the compliance function's annual cycle, that triggers re-assessment of each in-scope individual against the Fit and Proper criteria, not merely a request for a self-certification.
The Exposure a Superficial Assessment Creates
A VASP that presents a principal person assessment consisting of passport copies, self-completed declarations, and a sanctions database result has not discharged its obligation under the Company Rulebook. It has created a documented gap. If a subsequently identified adverse matter could have been discovered through competent investigation, VARA's enforcement analysis will examine whether the VASP conducted an adequate assessment, not merely whether it conducted any assessment.
Personal liability follows the same logic. Under the May 2025 amendments to the Compliance and Risk Management Rulebook, VARA can now take enforcement action directly against directors, Responsible Individuals and MLROs for AML/CFT compliance failures. The natural extension of that enforcement posture to the Fit and Proper assessment framework is not speculative. It follows from the same regulatory logic: if the people at the top of the structure are the point of accountability, the investigation of those people must meet a standard proportionate to the consequence of getting it wrong.
What the Regulations Actually Require
The Company Rulebook requires a genuine investigation, not a form-filling exercise. The scope is defined by function and influence, not by formal title. The evidentiary standard covers qualification, experience, financial soundness, and a multi-dimensional assessment of honesty, integrity and reputation that cannot be satisfied by automated screening alone. The obligation is continuous, not transactional.
Those who design their principal person due diligence process around what can be efficiently completed rather than what the regulation actually requires are making a risk management decision they may not have consciously acknowledged. The cost of that decision, when it surfaces, is not administrative. It is personal.