Firms Cannot Outsource Accountability, Even To AI, Says Dubai Regulator

(MENAFN- Khaleej Times) Virtual asset firms licensed in Dubai cannot use vendors or artificial intelligence (AI) tools as a shield against accountability, a senior official at the Virtual Assets Regulatory Authority (Vara) has said, as the regulator's licensed base has grown nearly fourfold in just over two years.

Speaking at the FutureSec 20206 conference organised by Khaleej Times, Sean McHugh, Senior Director of Market Assurance at Vara, said the authority's regulatory approach is built around ensuring firms are commercially successful while protecting customers, and is designed in line with the Dubai government's D33 economic agenda to develop the sector responsibly.

Recommended For You

Stay up to date with the latest news. Follow KT on WhatsApp Channels.

McHugh said Vara's supervision rests on four focus areas: customer protection, cybersecurity risk, financial crime, and the financial soundness of firms themselves – with the latter closely tied to cybersecurity, since poorly controlled firms can lose client assets very quickly.

“A big part of what we've tried to do on the trust layer is to license these firms in the appropriate way, make sure that they're focused on the right things,” he said during a fireside chat with Rahul Banga, Regional Information Security Officer, GIG Gulf, on the Trust in Every Transaction – Building a Resilient Financial Ecosystem.

McHugh said the goal is for UAE residents and international clients to trust that trades on regulated platforms would receive best execution and be free of bad actors such as sanctioned wallets and scammers.

The third edition of FutureSec 2026 conference saw a packed participation from the public and private sector executives. Mohamed Al Kuwaiti, Head of Cyber Security for the UAE Government, delivered the opening key note address.

No 'get out of jail free card' for vendors or AI

Addressing growing reliance on third-party technology and artificial intelligence, McHugh said firms remain fully responsible for systems acting on their behalf, whether those are outsourced vendors or AI tools.

“Having a vendor is not a get out of jail free card. You're taking client assets, you're engaged with clients, you're engaged with the market... they're standing in your shoes, they're acting on your behalf. When they help you make a lot of money, you want to take credit for that. If they lose money or blow something up, you can't point to them. The up and the down is on your balance sheet,” he said during the third edition of FutureSec 2026.

On AI specifically, McHugh said Vara distinguishes between systems that interact directly with customers or markets – such as trading bots – and those used for internal operations like compliance or finance.

Market-facing AI, he said, needs a functioning“kill switch” so firms can intervene if an algorithm malfunctions.

He compared AI systems to capable new recruits:“I kind of see AI like new grads – super smart new grads. They don't need a break, they don't sleep, they can work 24/7. But like any firm that hires new grads, you train them up, you do your best, and they make mistakes.” Firms remain accountable for those mistakes regardless of headcount, he said.

On-chain hacks fall, but other vulnerabilities rise

McHugh noted a shift in the nature of security incidents across the industry. While hacks targeting blockchains and smart contracts directly have declined as DeFi infrastructure has matured, incidents linked to web interfaces, insider threats and distributed remote workforces have increased.

“It's almost less about the chain, the blockchain, and it's more about the other nature of the business,” he said.

McHugh said Vara's licensed population has expanded rapidly since his arrival in Dubai just over two years ago.

“When I first got here, we had 14 licensed firms. We just this week licensed our 57th firm,” he said, describing an ecosystem that now includes major institutional traders, hedge funds and algorithmic trading firms alongside startups.

He said Vara's rulebook is principles-based rather than prescriptive, aiming to let firms scale commercially without Vara becoming a“box-ticking” exercise.

Requirements are calibrated to a firm's size and business model: a two-person startup is not held to the same standard as a large global trading platform, though both are expected to treat cybersecurity as embedded culture rather than an annual audit.

ALSO READ

UAE fintech moves from rapid growth to responsible innovation 'We will be outnumbered 46 to 1 by AI agents,' says cybersecurity leader From adoption to institutional readiness: How the UAE is building the infrastructure for digital assets

MENAFN03092026000049011007ID1111616531