Two rules that should not be collapsed

A crypto platform can describe customer assets as segregated while offering several services with different legal and operational consequences. The important question is which activity governs the specific arrangement. This explainer reviews VARA materials available on 31 October 2026; it does not announce a new rule or suggest that every Dubai service has identical permissions.

VARA’s general client virtual-asset rules say customer assets are not the provider’s property and should be separated from its own assets. Those rules contain a conditional provision concerning client consent and appropriate permissions for rehypothecation. The custody-specific rules impose a stricter prohibition on rehypothecation for assets held under custody services. Reading only the general provision can therefore produce the wrong conclusion about a custody product.

Turn the distinction into questions

Ask the provider to identify the contracting entity, the licensed activity and the terms applying to the balance you hold. Then ask whether activating an additional product changes the legal treatment of those assets. A product name such as vault, earn or flexible balance does not answer those questions. This is an analytical framework for comparing disclosures, rather than a finding about any named company.

Consider a hypothetical customer who deposits tokens for safekeeping and later sees an invitation to earn a return. Before accepting, the customer needs an explanation of what changes: the service, the counterparty, the asset location and any right to reuse assets. The attractive number on the screen is less informative than the terms governing the transition.

Evidence before reassurance

A useful due-diligence file pairs the relevant rule with the provider’s actual agreement and written explanation. It should make responsibility visible: who holds keys, who processes withdrawals and who answers a reconciliation discrepancy. These are practical questions proposed by CryptoGov, not a claim that one document proves full compliance.

Segregation also should not be treated as a promise of uninterrupted access. Legal protection, operational resilience and the time needed to resolve a dispute are different considerations. A customer can reasonably want evidence about all three without assuming that regulation eliminates every failure scenario.

The conclusion is specific: assess custody against the custody rules and assess any additional activity on its own terms. A general reference to client consent cannot substitute for identifying the governing service. That discipline makes the conversation with a provider concrete and helps prevent a familiar mistake: interpreting a reassuring label as a complete explanation of where control and risk sit.

Go deeper on CryptoGov

Sources & verification

Researched and published by CryptoGov Editorial Desk. Source publication and effective dates are explained in the article where relevant.