Dubai’s Virtual Assets Regulatory Authority (VARA) has updated its anti-money laundering guidance to require crypto firms to use real-time risk scoring models that incorporate FATF high-risk and blacklisted country data. Firms must refresh risk assessments at least every three months and immediately after major operational or product changes. The guidance also requires separate assessments of proliferation financing, targeted sanctions, AI-assisted operations and privacy-enhancing trading platform risks. The changes deepen VARA’s shift away from static compliance reviews toward continuous, data-driven monitoring of financial crime exposure.