| 1. |
VASPs shall establish and maintain an effective compliance management system [CMS] which—
|
| |
a. |
covers all relevant aspects of their operations, including the unfettered access to necessary records and documentation by the Board and relevant Staff; |
| |
b. |
is independent of all operational and business functions; |
| |
c. |
ensures that the CO is notified of any material non-compliance promptly; |
| |
d. |
comprises technical competence, resources [including financial and non-financial] and experience necessary for the performance of their functions; and |
| |
e. |
comprises a testing and monitoring programme that is risk-based and designed to regularly select and review different areas of the business and analyse key performance and risk indicators, |
| |
in order to allow them to identify potential compliance violations and to ensure that they comply with all applicable laws and regulatory requirements, and their own internal policies and procedures at all times.
|
| 2. |
The CO shall ultimately be responsible for establishing and administering the CMS and notifying VARA and other relevant authorities of the occurrence of any material non-compliance by the VASP, its Board or its Staff with applicable legal and regulatory requirements. |
| 3. |
VASPs shall establish, maintain and enforce clear and detailed compliance policies and procedures to enable all Staff and the Board to—
|
| |
a. |
comply with all applicable legal and regulatory requirements at all times, including all conditions in respect of a Licence, record keeping, business practices, AML/CFT, and compliance with relevant client, proprietary and Staff dealing requirements; |
| |
b. |
ensure that client complaints are handled properly with appropriate remedial action. Complaints should be handled and investigated by Staff who are not directly involved in the subject matter of the complaint; and |
| |
c. |
have access to all necessary information required to perform a business transaction.
|
| 4. |
The CMS and the compliance policies and procedures shall be reviewed and updated from time to time to ensure that they are aligned with the changing business and regulatory landscape applicable to the global Virtual Asset sector. |
| 5. |
VASPs shall ensure that all Staff performing compliance functions are Fit and Proper Persons and possess the necessary skills, qualifications and experience for their roles. |
| 6. |
To the extent that VASPs carry out any VA Activities or similar business activities anywhere other than the Emirate, VASPs shall comply with all applicable law and regulatory requirements in any jurisdiction in which they carry out such VA Activities or similar business activities.
|