Compliance Handbook

FATF Mutual Evaluation Preparation

How VASPs Should Prepare for the June 2026 FATF/MENAFATF Onsite Assessment

Published February 16, 2026 · UAE Tokenization Regulations Editorial Team

The June 2026 FATF mutual evaluation represents a watershed moment for the UAE's virtual asset regulatory framework. VASPs that demonstrate compliance excellence during this period strengthen both their individual regulatory standing and the national framework's international credibility — creating competitive advantages that persist well beyond the evaluation cycle through enhanced institutional partnerships and cross-border regulatory cooperation.

This implementation guide provides step-by-step instructions for practitioners navigating this aspect of UAE virtual asset compliance. Designed for compliance officers, in-house legal teams, VASP founders, and regulatory consultants, the guide translates regulatory requirements into actionable operational procedures that can be implemented within existing compliance workflows. All regulatory citations reference official publications from the relevant UAE regulatory authorities, with guidance current as of February 2026.

Regulatory Framework Context

The UAE's virtual asset regulatory architecture encompasses five distinct authorities: VARA governing Dubai mainland and free zones (excluding DIFC), ADGM FSRA operating as an independent international financial center in Abu Dhabi, DIFC DFSA functioning as a separate common-law jurisdiction within Dubai, the SCA/CMA providing federal-level securities oversight, and the CBUAE retaining exclusive authority over payment tokens and AED-denominated stablecoins. Each regulator maintains distinct requirements, and practitioners must identify the applicable regulatory authority before implementing compliance measures. All guidance in this handbook reflects the regulatory framework as of February 2026, incorporating VARA Rulebook 2.0 (effective June 2025), ADGM FRT framework (effective January 2026), and DIFC Consultation Paper 168 proposals.

Implementation Considerations

Compliance implementation in the UAE requires navigating jurisdictional complexity that goes beyond simply meeting a single regulator's requirements. Multi-jurisdictional operators — holding licenses in both VARA and ADGM, for example — must maintain parallel compliance programs tailored to each regulator's specific rulebook requirements. The August 2025 CMA-VARA mutual recognition agreement is reducing some of this burden through shared frameworks, but operational compliance teams should continue to treat each jurisdiction's requirements independently until formal harmonization is confirmed. Technology compliance, AML/CFT programs, and governance structures must be documented separately for each licensing jurisdiction, even where underlying systems are shared across entities.

Practical Recommendations

Engage specialist UAE virtual asset legal counsel before committing to a regulatory pathway — the choice of jurisdiction has cascading implications for licensing costs, capital requirements, operational structure, and client access. Begin banking engagement immediately upon receiving initial VARA or ADGM approval, as account opening typically takes 3-6 months and can delay operational launch. Build OECD CARF-compliant data collection infrastructure from inception rather than retrofitting existing systems. Invest in technology compliance from day one — the cost of implementing TGRAF, penetration testing, and custody standards increases significantly when bolted onto existing infrastructure versus being designed into the platform architecture from the ground up. For the latest regulatory guidance, consult official sources: VARA Regulations, ADGM Digital Assets, and DFSA. This guide is for informational purposes only and does not constitute legal, financial, or regulatory advice.

Gap Assessment Methodology

Conduct a systematic gap assessment against FATF Recommendation 15 and its Interpretive Note. Evaluate: customer due diligence procedures for completeness and risk-based calibration, transaction monitoring system effectiveness (detection rates, false positive ratios, rule calibration currency), Travel Rule implementation with evidence of successful cross-border information transmission, sanctions screening coverage and update frequency, STR filing quality (narrative depth, timeliness, follow-up documentation), staff training comprehensiveness and assessment results, governance structures demonstrating board-level AML/CFT oversight, and record retention compliance for all required documentation categories.

Demonstrating Effectiveness

FATF evaluators assess effectiveness — not just technical compliance. This means demonstrating that your AML program actually works: monitoring rules detect suspicious activity (provide metrics), STRs lead to investigations (document outcomes where available), training changes staff behavior (test with scenarios), and governance structures enable real-time compliance decision-making (provide meeting minutes with compliance agenda items). Quantitative metrics — detection rates, alert resolution times, STR filing statistics, training completion percentages — provide the strongest evidence of program effectiveness during evaluator assessment.

Documentation for Evaluators

Prepare evidence packages that evaluators can review independently without requiring verbal explanation. Create compliance program summary documents covering: organizational chart showing compliance function reporting lines, AML/CFT policy manual with last-reviewed dates, transaction monitoring system architecture with rule descriptions and calibration rationale, Travel Rule implementation evidence including protocol configuration and counterparty test results, STR filing statistics with quality metrics, training program curriculum and completion records, governance meeting minutes excerpts demonstrating board-level AML/CFT engagement, and internal audit reports with remediation tracking. While regulators — not individual VASPs — interface directly with FATF evaluators, your regulator's ability to demonstrate supervisory effectiveness depends on the quality of compliance programs across their licensed population.

Industry Coordination

The FATF mutual evaluation assesses the UAE's regulatory framework effectiveness across the entire virtual asset sector — not individual VASPs in isolation. Participate in industry coordination efforts through VARA consultations, industry working groups, and collective initiatives to raise compliance standards. Share best practices with peer VASPs through industry associations while maintaining competitive confidentiality. Regulators are better positioned to demonstrate supervisory effectiveness when their supervised population collectively demonstrates high compliance standards. Individual VASPs with strong compliance programs contribute to the national assessment outcome while simultaneously strengthening their own regulatory standing and institutional credibility in the global virtual asset market.

Related Guides

The Complete Compliance Handbook

VARA License Cost Breakdown · ADGM Authorization Guide · AML Program Guide