UAE Virtual Asset Regulatory Authority (VARA) Regulations CO-IV.A: Company Rulebook IV.A: Outsourcing scope, prohibitions and accountability

What does CO-IV.A require?

The outsourcing rules cover all outsourcing except legally required third-party functions, market data, global network infrastructure, services the firm would not otherwise perform, and non-core arrangements whose failure would not impair licence compliance. Outsourcing must not materially impair internal controls or VARA's ability to supervise; the MLRO, CISO and DPO roles may be outsourced only if the individuals accept personal responsibility to VARA (VARA may require them in-house); CBUAE outsourcing rules for banks apply where relevant and international principles must be considered; the firm remains fully accountable for outsourced functions.