This is our published view
The bench stands behind it
For your facts, in confidence, put the question to the firm.
The bench stands behind it
The position
The relationship between a VARA-licensed firm and its client is papered by rule, not by market practice.
The relationship between a VARA-licensed firm and its client is papered by rule, not by market practice. The framework requires a written agreement with prescribed minimum content, validly accepted before any activity is provided; it classifies every client into one of three tiers that gates what the firm may offer them; it requires a public disclosure set on the firm’s website, machine-readable and current at all times; and it runs complaints on fixed clocks, free of charge, with resolution the firm cannot delegate. And the agreement at the centre of all this is not routine paperwork: it is the document on which the framework’s largest defaults turn, as this article’s closing section draws together.
The agreement itself is specified before its content is. Every VASP shall enter into a written Client Agreement with each client, specifying the firm’s duties and responsibilities across all services (Market Conduct Rulebook, Rule II.A.1, current as at 1 July 2026), and must comply with it at all times (Rule II.A.2). Above the document sits a standard: in addition to all applicable laws, consumer protection laws expressly included, every agreement must comply with the firm’s general duty to act honestly, fairly and in the best interests of its clients and the integrity of the market (Rule II.A.3), the same pairing of client and market this series has met in the compliance principles. The agreement must be fair, clear, transparent, accurate and not misleading, and sufficiently clear for its intended market (Rule II.A.4). Its life cycle is prescribed: valid acceptance in a legally compliant form before the firm provides any VA activity (Rule II.A.5), a copy to the client after entry (Rule II.A.6), at least thirty calendar days’ notice before any change takes effect (Rule II.A.7), any right of unilateral change made explicit in the document itself (Rule II.A.8), and a full version history from which every change between versions can be identified (Rule II.A.9).
What the agreement must say is a mandatory list, and its centre is the client-asset block. The list runs from the identities of the parties, a description of the firm’s group, the services, the communication methods, all fees, the governing law, and the third-party and group providers the services depend on, to the four disclosures on which everything this series has written about client assets converges: the agreement must clearly identify if and when any virtual assets are no longer under the firm’s control and which entity is then liable for them and where; must state clearly that neither client virtual assets nor client money “benefit from any form of deposit protection”; must state clearly that all client assets remain owned by the client; and must clearly identify if and when any assets will not be owned by the client at any time (Rules II.B.1.a to k). Section III reads that block slowly, because it is where the paper meets the insolvency questions this series has traced.
Who may be offered what is decided before any agreement is signed. A firm may only carry out, or attempt to carry out, a VA activity for the investor classes VARA permits it, through the Regulations, its licence and conditions, and anything further VARA imposes (Rule IV.A.1), and the word attempt puts the mis-targeted offer inside the rule before any trade occurs. Retail is the residual and most protected class, everyone who is not something else (Rule IV.A.2). Qualified requires demonstrated relevant knowledge plus wealth, net assets of at least AED 3,500,000 with prescribed exclusions and a fifty-percent haircut on crypto holdings, or annual income of AED 700,000 or more (Rule IV.A.3). Institutional covers regulated entities, VASPs themselves, knowledgeable governments and multilateral agencies, and central-bank-function institutions (Rule IV.A.4). Section IV works the tests and their traps.
The public leg and the complaints leg complete the paper. Every firm must keep a defined disclosure set in an easily accessible location on its website, in a machine-readable format, accurate and up to date at all times: its licence number, every activity it is licensed for with any restrictions and the licence’s validity period, the names of all its Responsible Individuals, so the accountable individuals this series has examined are public by rule, and a Risk Disclosure Statement describing all material risks, with five statements mandatory in terms, that virtual assets may lose value in part or in full and are subject at times to extreme volatility, may not always be transferable and some transfers are irreversible, may not be liquid, that some transactions are not private and may be recorded on public ledgers, and that they may be subject to fraud, manipulation and theft, including through hacks, and may not benefit from legal protections (Part V chapeau, Rules V.A.1 to V.A.3 and V.B.1). Complaints run on clocks: acknowledged within one week, resolved within four, or, in extraordinary circumstances, a status update with the explanation at four weeks and resolution within eight; intake is multi-channel by rule, with a template provided but recognition never gated to one channel or form; no fee may be charged for submitting or handling any complaint; where third parties are involved the firm coordinates but remains responsible for resolution; records are kept of every complaint, measure and outcome; the procedures are published on the website; and the firm must analyse complaints for common root causes, consider whether those causes affect other processes, services or products not complained of, and correct them (Rules III.A.1 to III.A.5 and III.B.1 to III.B.3).
So the short answer is that the client of a VARA firm is owed a contract with prescribed candour, a classification honestly applied, a public disclosure set that never goes stale, and a complaints process with deadlines and no fee. The reason this article treats that paper as more than consumer protection is where the series has already been: the consent that lets a firm touch client assets, the reversal that turns an owner into a creditor, and the redemption right behind a stablecoin all live inside the Client Agreement, so the document this rulebook prescribes is the hinge of the whole framework’s client-asset architecture. The rest of this article works through it: the agreement’s requirement and standards, its mandatory content read closely, the classification gate and its traps, the public disclosures, the complaints machinery, and finally the hinge itself, with what is settled and what remains open.
Before the rulebook prescribes a word of the agreement’s content, it regulates the document itself: that it exists, the standards it meets, and the controlled lifecycle it lives on. The effect of those rules, taken together, is that a VASP’s client contract is not private paper. It is a regulated object, and the firm’s own promises inside it are enforceable by its regulator.
Existence and force come first. Every VASP shall enter into a written agreement with each client specifying the firm’s duties and responsibilities when providing services including all VA activities (Market Conduct Rulebook, Rule II.A.1, current as at 1 July 2026), and the drafting of that scope deserves notice: the document papers the service relationship as a whole, with the licensed activities included in it rather than marking its boundary, a reading of the rule’s own words. The firm must then comply with its Client Agreements at all times (Rule II.A.2), and that single sentence does structural work: it converts a breach of the firm’s own contract into a breach of the rulebook, so the client’s contractual grievance and VARA’s supervisory interest run on the same facts, a consequence drawn from the rule’s placement rather than stated in it.
Two standards then sit above every agreement, one of conduct and one of drafting. The conduct standard: in addition to all applicable laws, expressly including consumer protection laws, every agreement must comply with the firm’s general duty to act honestly, fairly and in the best interests of its clients and the integrity of the market (Rule II.A.3). Two things travel inside that sentence. The federal consumer-protection layer this series identified in the companion article “Which federal laws stand behind a VARA licence?” arrives here as a term of the agreement standard itself, so the Arabic-language, misleading-advertising and consumer-data duties of that law sit beneath every Dubai client contract. And the pairing of the client’s interests with the market’s integrity is the same ranking this framework uses in its compliance principles, the client served, the market preserved. The drafting standard: agreements must at all times be fair, clear, transparent, accurate and not misleading, and must be sufficiently clear to the client “having regard to the nature of the services and the intended market” (Rule II.A.4). The qualifier calibrates clarity to the audience: the same product documented for a retail market carries a higher comprehension bar than the identical product documented for institutions, a reading of the qualifier’s words, and one that makes the classification regime of Section IV a drafting input, not only an access gate.
Acceptance is the gate through which every client passes. The firm must obtain valid acceptance from every client entering an agreement, given in a form compliant with all applicable laws, and prior to the firm providing any VA activities to that client (Rule II.A.5). No valid acceptance, no service: the rule places the signature before the first trade, the first deposit and the first transfer, and the words compliant with all applicable laws import whatever formal validity the law of the chosen form requires, electronic or otherwise, without this rulebook restating it. After entry, the firm sends the client a copy (Rule II.A.6), so the client holds the document the relationship runs on.
Change is then controlled in three rules that reward reading together. The firm must notify clients of any change at least thirty calendar days before it takes effect (Rule II.A.7), calendar days rather than working days, so the notice period is a month of real time and does not stretch across holiday calendars. If the firm holds a right to unilaterally change a service, any part of one, or a VA activity, that right must be made explicit in the agreement itself (Rule II.A.8), and the reading that follows is the rule’s practical force: silence in the document means the right is not held, so a firm that varies a service without an explicit clause has breached the agreement and, through the compliance rule above, the rulebook with it. And the firm must maintain a record of all versions of its agreements and be able to identify all changes made between versions (Rule II.A.9), the evidence spine of the whole Part: which version any client accepted, and exactly what moved between that version and the next, is answerable from the firm’s own records by rule, so the dispute about what was agreed is designed to be a lookup rather than a contest of recollection.
So the agreement exists by rule, meets a conduct standard that imports the federal consumer layer and a drafting standard calibrated to its audience, cannot precede acceptance, and lives under version-controlled change with a month’s notice. What the document must actually say is where the framework’s client-asset architecture lands on paper, and Section III reads that content list slowly.
The content rule opens with its own scope note: Client Agreements shall include, but not be limited to, the listed items (Market Conduct Rulebook, Rule II.B.1, current as at 1 July 2026), so the list is a floor of candour, not the whole drafting job. Its architecture runs in four movements: an identity-and-terms half that maps the relationship, a client-asset block that maps the client’s true position, conditional content for the conduct native to this sector, and a link mechanism that extends the agreement into the firm’s website.
The identity-and-terms half makes the relationship legible end to end. The agreement states the identities of both parties including the firm’s legal name and registered address, describes the firm’s group, describes the services, fixes the communication methods the parties will use, states all fees charged by the firm for the services, and names the governing law (Rules II.B.1.a to f). Two of those items carry more than they appear to. The word all in the fees item is the totality requirement: a fee not stated in the agreement is a fee the agreement does not provide for, a reading of the item’s own word. And item (g) is a dependency map: the third-party service providers, and any entities within the firm’s own group, utilised by the firm and necessary for the services must be identified, disclosable in the form of a description of the services they perform, so the client can see what the offering actually runs on, the custody sub-provider, the group technology company, the outsourced function, before relying on any of it.
The client-asset block begins at the control seam, and its third limb is the quiet one. The agreement must clearly identify if and when any virtual assets are “no longer under the control of the VASP” during the provision of any VA activity, and describe the entities liable for the assets at all times, including but not limited to where such entities are located (Rule II.B.1.h). Three limbs: the seam itself, when control leaves; the liability chain, who answers for the assets at every moment, not only at the moment of departure; and the geography, the jurisdictions in which those liable entities sit. That last limb discloses, in advance and in the contract, the map on which the companion article “If my VASP fails, where does my crypto sit?” found the hardest question would be fought: the framework asserts the ring-fence and defers the forum, and this disclosure tells the client which forums are in play, a consequence of the limb rather than a stated purpose.
Then the protection statement and the ownership pair, which read together as designed candour. The agreement must state clearly that neither client virtual assets nor client money benefit from any form of deposit protection (Rule II.B.1.i); must state clearly that all client assets, including but not limited to client money and client virtual assets, remain owned by the client, a formulation wider than the two defined terms it names (Rule II.B.1.j); and must clearly identify if and when any assets, money or virtual assets included, will not be owned by the client at any time (Rule II.B.1.k). The pairing of (j) and (k) is where the framework’s most consequential default becomes visible on paper. The companion article “What can a VASP do with client virtual assets?” traced the held-on-behalf architecture in which a service model can turn the client from owner into creditor; item (k) is the clause where any such reversal must be said in terms, so the client who is about to become a creditor is told so in the same document that states the ownership default. And the block as a whole has an honesty structure worth naming: the framework requires the strong claim, ownership, and the weak truth, no protection, side by side in one contract, which is the accurate description of the client’s position this series’ failure analysis reached, an observation about the block’s design rather than a stated rule.
The conditional content is conditional in inclusion but not in consideration. When forming agreements, firms must also consider, and include to the extent applicable to the services provided, three further sets of provisions (Rule II.B.2), so every firm weighs each item and the applicable ones go in, a reading of the rule’s two verbs. The sets are: a specification of which virtual assets are or will be supported; a description of how the firm will respond to newly created assets, an airdrop, and to a previously supported asset it can no longer support, a fork or similar change, which must include obligations on the firm to assess the impact as soon as possible upon becoming aware of the change’s nature and impact and to communicate clearly with all affected clients throughout the process, a continuous duty rather than a single notice; and provisions addressing the risk of loss from a failure of the services including any custody services, with all mitigation measures outlined where appropriate (Rules II.B.2.a to c). The function of the middle set deserves stating plainly: the agreement must answer, in advance, what happens when the protocol does something unilateral, which is the question crypto contracts historically left to the terms nobody read.
The link mechanism then lets the conditional content live where clients actually find it, on two conditions that keep it regulated. The information required under the conditional rule may be provided by directing clients to published policies or procedures, provided those policies themselves comply with the fair, clear, transparent, accurate and not-misleading standard, and provided all links or other references to them are maintained and accurate at all times (Rule II.B.3). The consequence is that the agreement extends into the website: the linked policy is agreement-grade content held to the agreement’s standard, and a stale or broken link is a live breach of the rule on its own words, with the version-control discipline of Section II following the content wherever it sits.
So the mandatory content makes the agreement a candid map of the client’s actual position: who serves them and through whom, at what total price, under which law, where their assets sit and who answers for them in which jurisdictions, when ownership would flip and the fact that no deposit protection stands behind any of it, what happens when the protocol forks, and where the living detail is published. Who may be offered any of this in the first place is decided before the agreement is signed, and Section IV turns to the classification gate.
Before any agreement is signed, the framework decides who may be offered what, and it places both the decision and the evidence for it on the firm. A VASP shall only carry out a VA activity, or attempt to carry out one, in relation to the investor classifications VARA permits, subject at all times to restrictions imposed through the Regulations, Rules and Directives, through the firm’s own licence and its conditions, and through any further conditions VARA imposes from time to time (Market Conduct Rulebook, Rule IV.A.1, current as at 1 July 2026). Two features of that gate set its character. The word attempt puts the mis-directed offer inside the rule before any trade occurs, so targeting is regulated conduct, not preparation. And the three-source structure means the class-to-product map is not in this rulebook at all: it lives in each firm’s licence and conditions, so two firms holding the same activity can lawfully face different class permissions, a reading of the structure rather than a stated rule.
Retail is defined by what it is not, and the definition does quiet protective work. A Retail Investor is an Entity that is not an Institutional Investor or a Qualified Investor (Rule IV.A.2). Because the class is a pure residual, classification failure defaults downward: a client whose qualified status the firm cannot evidence is retail by operation of the definition, so retail is not a category a firm assigns but the state that remains when nothing else is proven, a reading of the residual structure, and the most protected treatment follows automatically.
The Qualified class for individuals runs on two limbs, knowledge and wealth, and the traps sit in the provisos. The knowledge limb requires relevant knowledge of virtual assets or complex structured products for the nature of the activities to be provided, and the manner of demonstrating it shall be defined by the VASP prior to offering any products or services and demonstrated to VARA on request (Rule IV.A.3.a), so the firm must build, document and hold its knowledge test before the first offer exists, and be ready to show the methodology itself to the regulator. The wealth limb is satisfied either by income, AED 700,000 or more annually, or by net assets of at least AED 3,500,000 in equivalent value, and the asset route is where the provisos bite. The composition is closed: fiat currency, financial instruments, virtual assets and equity in tangible real estate, in any combination. The proof is documentary and forward-looking: account statements or equivalent illustrating that the assets “have remained, and will remain, liquid for a reasonable period of time”, checked periodically, so both past and future liquidity are asserted and the check recurs. Three asset types are excluded outright: the primary residence including any net equity in it, rights under qualifying insurance contracts, and pensions or other benefits payable on termination, death or retirement. And virtual assets count at half: only fifty percent of their market value may be included. The arithmetic consequence of that haircut, an application of the proviso rather than a stated figure, is that a client whose wealth is entirely in crypto needs AED 7,000,000 of market value to clear the threshold, and an asset-rich profile built on a home, a pension and a token portfolio can fail the test entirely once the exclusions and the haircut bite.
The entity route is narrower than the individual one in a way firms miss. A legal entity qualifies only if validly incorporated where it is located, maintaining the same AED 3,500,000 net assets under the same composition, proof, liquidity and periodic-checking provisos and the same fifty-percent haircut, and only if its directors have relevant knowledge for the activities, demonstrated under a methodology the firm defines in advance (Rule IV.A.3.b). There is no income alternative for entities, assets only, a structural point from the rule’s silence, and the knowledge requirement sits at board level in the plural, so a corporate client qualifies through its directors’ demonstrated understanding, not through the sophistication of whoever operates the account.
The Institutional class is a list, and its first item has just been renamed by federal law. An Institutional Investor is any Entity regulated by a competent financial-services regulator in its home jurisdiction, the rule’s examples being the Central Bank of the UAE, the federal capital-markets regulator, which the rule names under its former title and which, with effect from 1 January 2026, is the CMA, its legal successor, with references to the former authority in existing legislation deemed references to the CMA under the reconstituting decree-laws as the authority’s own announcement and consistent practitioner reporting record, and the financial-services regulators of the two financial free zones; any VASP, so every VARA-licensed firm is institutional to every other by definition; any government with relevant, demonstrably held knowledge of virtual assets for the activities provided; any institution performing the functions of a central bank; and any multilateral agency with the same demonstrated knowledge, the demonstration methodology in each knowledge-based case being the firm’s to define in advance and VARA’s to inspect (Rule IV.A.4).
The operating consequences of this Part run back through everything this article has covered. The periodic-checking provisos mean classification is a state, not an event: a client’s assets can fall below the threshold and the classification falls with them, so the book must be re-verified on a cycle the firm can defend. The intended-market clarity standard of Section II makes classification a drafting input, since the comprehension bar of every agreement is set by the class it is written for. And the targeting rule this series verified in the companion article “Who must follow VARA’s marketing rules, and what do they require?”, that marketing must present only appropriate assets to the audience it reaches, makes classification a marketing input before it is an onboarding one. What every class is owed in public, regardless of classification, is the disclosure set, and Section V turns to it.
The public leg of the client relationship is what everyone sees before any classification is made or any agreement signed, and the rulebook regulates its placement and its format before its content. VASPs shall ensure the information in this Part is provided in an easily accessible location on their website, “in a machine-readable format”, and is kept accurate and up to date at all times (Market Conduct Rulebook, Part V chapeau, current as at 1 July 2026).
Each of the chapeau’s three duties carries its own consequence. Easy accessibility governs placement: the set cannot live behind a login or at the bottom of a policy archive. The format duty is an engineering requirement with no counterpart elsewhere in the compulsory rulebooks: machine-readable means, at minimum, that software can parse the disclosures, so a scanned poster or an image of text does not discharge it, a reading of the term’s minimum sense, since the rulebook does not define the qualifying formats. And the standing-currency duty, accurate and up to date at all times, means the set can never lawfully go stale: a restriction VARA imposes, a licence that lapses, a Responsible Individual who changes, each makes the published page inaccurate from the moment it happens, so the publication is a maintained state, not an uploaded document, a consequence of the words at all times.
What must be published divides into the licence set and the risk statement. The licence set is three items: the licence number VARA issued; all VA activities the firm is licensed to carry out in the Emirate, including any restrictions stated by VARA as a condition of the licence, together with the validity period of the licence; and the names of all Responsible Individuals (Rules V.A.1 to V.A.3). The parenthetical in the second item deserves its own sentence: restrictions are published alongside permissions, so the public sees not only what the firm may do but what VARA has restrained it from doing, and the validity period makes the licence’s expiry a public fact. The third item completes a thread this series has followed: the two named individuals answerable for the firm’s compliance, whose position the companion article “Who is personally accountable when a VASP breaks the rules?” set out, are public by rule, named on the firm’s own website for as long as they hold the role.
The Risk Disclosure Statement is drawn as a floor beneath a wider duty. The firm shall publish a detailed description of all material risks associated with virtual assets, including but not limited to a specific statement that virtual assets may lose their value in part or in full and are subject to extreme volatility at times; may not always be transferable, and some transfers may be irreversible; may not be liquid; that some transactions are not private and may be recorded on public DLTs; and that they may be subject to fraud, manipulation and theft, including through hacks and other targeted schemes, and may not benefit from legal protections (Rule V.B.1). Two features of the drafting matter. The duty is all material risks, so the five statements are the mandatory minimum, not the whole job, and a firm whose services carry a material risk outside the five must describe it. And the closing words of the fifth statement, may not benefit from legal protections, put on the public page the same candour this series found in the agreement block, where ownership is asserted and deposit protection disclaimed in the same breath.
Read against the rest of the framework, the statement is one list told from two directions. The marketing rules this series examined in the companion article “Who must follow VARA’s marketing rules, and what do they require?” fix a floor of truths that no promotion may contradict, value loss and volatility, transfer irreversibility, illiquidity, public-ledger visibility, exposure to fraud and theft; this Part requires the firm to state substantially the same truths affirmatively on its own website. The design consequence, drawn from the two instruments read in their own turns, is consistency by construction: the advertisement may not contradict what the disclosure must state, and both must match the agreement the client eventually signs, so the framework has arranged for the client to meet the same facts in the promotion, the public page and the contract.
The wider synthesis this section closes on is what the website has become. This one rulebook mandates four publication sets on it: the Part V disclosures in machine-readable form, the complaints procedures in clear and easy-to-understand form, the firm’s VA Standards, and any policies its client agreements incorporate by link, each carrying its own currency duty. The firm’s website is therefore a regulated surface rather than marketing real estate, and staleness anywhere on it, a dead link, an unpublished restriction, an outdated procedure, is a live breach of the rule that put the content there. One of those four sets, the complaints procedures, opens the machinery every client can invoke against the firm, and Section VI turns to it.
Whatever a client’s classification, the complaints machinery is the remedy they hold against the firm, and the rulebook builds it around four properties: it is clocked, it is free, it cannot be delegated, and it is systemic by design.
The clocks come first, and they anchor to the complaint’s making. VASPs shall investigate all complaints promptly and resolve them as soon as practicable, acknowledging every complaint within one week of its being made and resolving it within four weeks of its being made, except in extraordinary circumstances, in which case the firm must provide the client a status update and an explanation of the extraordinary circumstances delaying resolution within the same four weeks, and must resolve the complaint no later than eight weeks from when it was made (Market Conduct Rulebook, Rule III.A.1, current as at 1 July 2026). Two features of the drafting set the regime’s character. What counts as extraordinary is left undefined and judgmental, but the outer bound is not: no later than eight weeks is absolute on the rule’s words, so even the hard case has a ceiling, and the client facing delay is owed the reason for it in writing at week four, not silence until week eight.
Who decides when the clock starts is answered by two rules that bound each other. The firm’s procedures must establish when it will consider a complaint to have been made, and the mediums and channels through which it will monitor and recognise complaints (Rule III.B.2), so the trigger definition is the firm’s to write. But the firm must make available an easy-to-use template form and accessible means with clear instructions, and shall not limit customers to one channel or one form in order for a submission to be recognised as a complaint (Rule III.A.2), so the definition the firm writes is bounded by the rule: recognition cannot be gated to the official form or the designated inbox, and a complaint arriving through any reasonable channel the firm monitors is a complaint whose clock is running, a reading of the two rules together rather than a stated scheme.
The remedy is free, and it cannot be pushed onto anyone else. No fees or charges may be imposed for the submission or handling of any complaint (Rule III.A.4). Where the services involve third-party entities, the firm must establish procedures to facilitate the handling of complaints between its clients and those third parties, and shall remain responsible for the resolution of such complaints (Rule III.A.3). The consequence, drawn from the rule’s last sentence, is that outsourced services do not outsource the remedy: the client complains to the firm and is answered by the firm, and whatever back-to-back arrangements the firm needs with its custody provider, its technology vendor or its group affiliate to make that possible are the firm’s engineering problem, not the client’s. Records are kept of every complaint received, every measure taken in response, and every resolution (Rule III.A.5), records that feed the books this series examined in the companion article “What does VARA expect your compliance function to produce?”, where the further rule was verified that complaints are investigated by staff not directly involved in their subject matter.
The procedures around all of this are public, and their most demanding duty points forward rather than back. The firm shall establish and maintain effective procedures for the prompt, fair and consistent handling of complaints, disclosed on its website in a clear and easy-to-understand manner (Rule III.B.1), one of the four publication sets Section V counted on the regulated surface of the firm’s site. And in handling complaints the firm must take reasonable steps to identify and remedy recurring or systemic problems: analysing the causes of complaints to identify common root causes, considering whether those root causes may also affect other processes, services or products, “including those not directly complained of”, and correcting them (Rule III.B.3). Read for its direction, the duty converts each complaint into a systemic probe: one client’s grievance about one service obliges the firm to examine the sibling products nobody complained about, and leaving a known root cause uncorrected in an uncomplained-of process is itself a failure of the reasonable-steps duty, on the rule’s own words.
With the complaints machinery in place, the client’s paper position is complete: a contract with prescribed candour, accepted before anything happens and changed only on a month’s notice; a classification honestly applied and periodically re-checked; a public page that names the licence, its restrictions and the accountable individuals, and never lawfully goes stale; and a remedy that is free, clocked, and answered by the firm itself. What remains is the argument this article has been building toward, that the agreement at the centre of all this paper is the hinge of the framework’s entire client-asset architecture, and what in that architecture remains open. Section VII closes there.
The client’s paper position, assembled across this article, is settled and coherent. The contract is a regulated object: written, accepted before anything happens, held to a candour standard calibrated to its audience, changed only on a month’s notice, and version-controlled so that what any client agreed is a lookup rather than a contest (Section II). Its content is a mandatory map of the client’s true position, down to the jurisdictions in which the entities liable for their assets sit (Section III). Access to the services runs through a classification the firm must evidence and re-check, defaulting to the most protected class when proof fails (Section IV). The public page names the licence, its restrictions and the accountable individuals, machine-readable and never lawfully stale (Section V). And the remedy is free, clocked and non-delegable (Section VI).
The reason this article has treated that paper as more than consumer protection is what the rest of this series found operating inside it. The companion article “What can a VASP do with client virtual assets?” traced the framework’s central protection, that client assets are held on the client’s behalf and used only within consent, and located the consent in the Client Agreement’s terms; it also traced the service models in which that default reverses and the owner becomes a creditor, a reversal that operates through agreement terms, which is exactly what disclosure (k) of Section III forces into the open. The companion article “How are stablecoins regulated, and what falls to the Central Bank instead?” found the holder’s redemption right running through a valid client agreement, so the instrument that makes a fiat-referenced token redeemable is this document. And the companion article “If my VASP fails, where does my crypto sit?” found the framework asserting client ownership while the insolvency machinery that would test it remains unbuilt, which is the precise position disclosure block (h) through (j) papers: ownership stated, protection disclaimed, the liable entities and their jurisdictions named. The conclusion this series can now state from its own verified parts is that the Client Agreement is the hinge of the framework’s client-asset architecture: the consents, reversals and redemption rights on which everything turns are switched on or off inside it, clause by clause, and the candour list exists to make every switch visible to the person it affects.
What remains open is the question the hinge itself cannot answer. The ownership statement the agreement must carry is an assertion the framework requires; whether it survives contact with a contested insolvency, against a liquidator, foreign creditors and whatever forum the geography disclosure maps, is the standing open question of this series, unresolved by any authority as far as its verified sources reach. Beneath that flagship question sit this article’s own smaller opens: what circumstances count as extraordinary for the complaint clocks, which formats satisfy machine-readable, and the structural fact that the class-to-product map lives in individual licences rather than the public rulebook, so which class may be offered which service is knowable per firm, not per framework. And one watch item at identification level: the federal capital-markets reconstitution that renamed the securities regulator is reported to bring virtual assets within the federal perimeter, an unread development whose boundary with VARA’s mandate is a matter for its own future piece.
The practical instruction, for both sides of the paper, follows from the design. For the client, the true position is in the four disclosures, not the marketing: read where control goes, who is liable and where, what is not protected, and when ownership would flip. For the firm, the drafting duty is candour calibrated to the audience the classification defines, and the compliance duty is the version-controlled proof of what every client accepted. In this framework the paper is the position, and both the client’s protection and the firm’s defence are built from the same clauses.
This analysis rests on the Market Conduct Rulebook in the version effective 19 June 2025, loaded from VARA’s live rulebook, read with the companion analyses named above for the marketing, federal, compliance, client-asset, failure and stablecoin layers, each verified in its own build. It is live. A new version of the rulebook, any change to a firm’s licence-condition class permissions, which move firm by firm rather than by instrument, a loaded reading of the capital-markets reconstitution, or the issue of the data law’s Executive Regulations, which govern the client files behind all of this paper, would each be a reason to read this analysis again against the source. The question in the title, on that basis, has a short answer after all: a VASP owes its clients the truth of their position, in writing, before anything happens, kept current for as long as the relationship lasts, and the framework has drafted the clauses that make that truth unavoidable.
For your facts, in confidence, put the question to the firm.
The bench stands behind it