What is the cyber incident reporting deadline in ADGM?

The FSRA expects immediate notification on discovery of a reportable IT or cyber incident. Since January 31, 2026, its cyber risk management rules add a 24-hour backstop for the initial report, using Template A.

Do UAE regulators require exchanges to compensate clients after a hack?

UAE rules focus on custody controls, segregation of client assets, capital and disclosure. In practice, regulators expect a licensed firm to show how client losses will be covered and to communicate that plan clearly.

Does a crypto licence protect an exchange from hacks?

No licence prevents every hack. Licensing requires firms to have cybersecurity policies, tested incident response plans and board oversight, so that the response is fast and client assets are protected.

What should a VASP do in the first hour after a hack?

Contain the incident, record the time of detection, pause affected withdrawals, convene the incident team and start preparing the regulator notification. The detection time starts every regulatory clock.

What does the CMA require after a crypto exchange hack?

A CMA-licensed VASP must report a material cyber incident within 72 hours of becoming aware of it and promptly tell clients what happened and how it is limiting the harm. Where the firm is responsible for an unauthorized transfer of client virtual assets, it must restore the client's position within three business days and hold compensation arrangements for losses it cannot reverse.

How quickly must a payment token provider report a hack to the CBUAE?

Under Article 35 of the CBUAE's Payment Token Services Regulation, a payment token service provider must report major security and operational incidents, including downtime, to the CBUAE immediately or as the CBUAE directs. It must also keep a cyber incident response plan and an audit trail of every payment token transfer.

Crypto Exchange Hack: What UAE Regulators Expect (2026)

Key takeaways

The $6.3 billion Binance hack on October 29, 2026 is the largest crypto theft on record.
VARA: report a material cybersecurity event within 72 hours of detection.
ADGM FSRA: notify immediately, with a 24-hour backstop since January 31, 2026.
DFSA: notify within 72 hours of a material cyber incident, via the ePortal.
CMA: notify within 72 hours, and restore clients within three business days after an unauthorized transfer.
Hot wallet limits, multi-party signing and compensation capacity decide whether clients are made whole.

On October 29, 2026, attackers drained about $6.3 billion from Binance hot wallets in roughly 20 minutes. For every exchange, broker and custodian licensed in the UAE, the useful question is practical: if this happened to us tonight, what would our regulator expect, and when?

This guide sets out what VARA, ADGM’s FSRA, the DFSA, the federal CMA and the CBUAE expect from a virtual asset service provider (VASP) after a hack. It covers notification deadlines, client communication, customer asset protection and the incident response plan regulators want to see before you are licensed. NeosLegal has advised exchanges, custodians and brokers across all five UAE regulators since 2016.

What the Binance Hack Means for UAE-Licensed Exchanges

The Binance hack shows the full sequence a regulator will look for: detection, containment, disclosure and compensation. Binance’s preliminary findings point to a compromised engineer’s laptop that gave the attacker access to a service container able to submit withdrawals. The exchange suspended deposits and withdrawals, disclosed the scale publicly, and pledged to cover all losses from its SAFU fund and corporate funds. About $3 billion was frozen on-chain with help from stablecoin issuers and analytics firms.

Binance holds a VARA licence for its Dubai operations, so the incident is a live case study for the UAE framework. Most licensed firms are far smaller. The obligations are the same.

Managing the First 72 Hours After a Crypto Exchange Hack

The first 72 hours decide most of the regulatory outcome. UAE regulators expect a firm to act in a set order, and to keep a record of each step.

Contain. Freeze affected wallets, revoke compromised credentials and pause withdrawals on affected networks. Record the time of detection, because every regulatory clock runs from it.
Assess materiality. Decide whether the event is material under your regulator’s test. If in doubt, treat it as material.
Notify the regulator. File the initial report within the deadline (immediately and within 24 hours in ADGM; within 72 hours under VARA and the DFSA). Send what you know and update it later.
Notify other authorities. Tell VARA or your lead regulator which other authorities you have informed, such as law enforcement or a data regulator.
Communicate with clients. Tell clients what happened, whether their assets are affected and when they will hear more. Keep public statements consistent with what you file with the regulator.
Trace and freeze. Work with blockchain analytics firms, stablecoin issuers and other exchanges to trace and freeze stolen assets.
Fund recovery. Confirm how client losses will be covered, from which reserves, and on what timeline.

VARA: Incident Reporting Under the Technology and Information Rulebook

VARA requires a licensed VASP to report a material cybersecurity event, or any event that triggers its business continuity and disaster recovery (BCDR) plan, as soon as reasonably practicable and no later than 72 hours from detection. The report must cover the nature, scope and impact of the event, the mitigation steps taken, and whether other authorities have been notified.

The Technology and Information Rulebook sets the wider framework. Every VASP must appoint a Chief Information Security Officer and submit a Cybersecurity Policy to VARA for assessment during licensing. That policy must cover access controls and incident response, including root cause analysis and steps to prevent a repeat. Where a breach involves personal data, VARA must also be told within 24 hours of any notice given to a data regulator or affected individual.

ADGM FSRA: Immediate Notification and a 24-Hour Backstop

The FSRA expects an Authorised Person to notify it immediately on discovering a reportable IT or cyber incident. Since its cyber risk management rules took effect on January 31, 2026, there is also a 24-hour backstop for the initial report, running from the moment the firm has information that reasonably suggests an incident has occurred.

Firms file the initial report using the FSRA’s Template A to its incident mailbox, copying their supervisor, and then send progressive reports at a frequency the supervisor sets. The rules also require a board-approved cyber risk management framework and contracts that oblige technology providers to report incidents. For virtual asset firms, COBS Chapter 17 adds technology governance requirements on wallets, private keys and custody.

DIFC DFSA: Cyber Risk Management Rules and the 72-Hour Rule

The DFSA’s Cyber Risk Management Rules, in force since January 1, 2024, require firms to notify the DFSA as soon as reasonably practicable and within 72 hours of becoming aware of a material cyber incident, using the form on the DFSA ePortal. Firms must hold a written cyber risk management framework approved by their governing body. The DFSA expects board and senior management to understand the firm’s cyber vulnerabilities and resource them properly.

For firms dealing in crypto tokens, the DFSA’s updated framework (effective January 12, 2026) also requires prominent client risk warnings that include the risk of cyber theft.

Federal CMA: Expectations Outside Dubai and the Financial Free Zones

The CMA’s virtual asset framework under Decision No. 4/R.M/2026 governs onshore virtual asset activity outside the emirate-level and financial free zone regimes. It has three modules: General Framework, Business Regulation and Alternative Trading System (ATS). For firms licensed under the federal CMA regime, a hack engages several specific rules.

Regulator notification. The General Framework Module requires a board-approved cyber risk management framework and reporting of material cyber incidents to the CMA within 72 hours of becoming aware of them. Separately, Article 87 of the ATS Module requires an exchange to notify the CMA promptly of any actual or anticipated event that could cause serious financial consequences for the firm or its clients.
Client notification. A firm that becomes aware of a significant operational or security incident must promptly inform clients and explain the measures it is taking to limit the harm (Business Regulation Module, Article 98; ATS Module, Article 64).
Restoring clients. If the firm is responsible for an unauthorized or incorrectly executed transfer of client virtual assets, it must put the client back in their previous position within three business days. It must also hold adequate compensation arrangements for losses it cannot reverse, and review them at least once a year (Business Regulation Module, Article 97; ATS Module, Article 64).
Suspending services. A firm may restrict or suspend client access on reasonable security grounds, but must restore access or offer an alternative as soon as the issue is resolved.
Technology audit. Exchanges and custodians must appoint an independent external auditor to review their technology and governance controls every year and file the report with the CMA within four months of year end.
Client agreements. Custody agreements must set out policies for breaches, theft and fraud, how the firm will communicate with clients if one occurs, and when clients are entitled to compensation.

CBUAE: Incident Duties Under the Payment Token Services Regulation

The CBUAE regulates payment tokens, such as dirham stablecoins, through its Payment Token Services Regulation (Circular No. 2/2024). The regulation covers payment token issuance, conversion, and custody and transfer. Article 35 sets the incident rules for payment token service providers:

Report immediately. Report major security and operational incidents, including downtime, to the CBUAE immediately, or in the form and on the basis the CBUAE directs.
Keep a cyber incident response plan to isolate and neutralize a threat swiftly and resume affected services as soon as possible.
Log every transfer. Record all payment token transfers with an appropriate audit trail.
Board ownership. The board, or a committee it designates, is responsible for the technology risk management framework.

Under Article 34, a provider must also tell the CBUAE immediately if its annual risk assessment shows it cannot meet its obligations. A hot wallet loss that affects reserves or client holdings is likely to engage this duty.

The regulation applies to payment tokens only; other virtual asset tokens fall to VARA, the CMA or the free zone regulators. Firms that hold or transfer payment tokens for clients should check whether the Payment Token Services Regulation applies alongside their other licence.

Comparing UAE Regulator Expectations After a Crypto Hack

The CBUAE and ADGM expect immediate notice, with ADGM adding a 24-hour backstop; VARA, the DFSA and the CMA allow up to 72 hours, though each expects notice as soon as practicable. The CMA adds the most specific client restoration rule.

UAE regulator expectations after a crypto hack, compared
Regulator	Who it covers	Initial notification deadline	How to report	Framework requirements
VARA	VASPs in Dubai, outside the DIFC	As soon as reasonably practicable, max 72 hours from detection	Report to VARA with nature, scope, impact and mitigation	CISO, Cybersecurity Policy assessed by VARA, BCDR plan, root cause analysis
ADGM FSRA	Authorised Persons in ADGM	Immediately, with a 24-hour backstop	Template A to the FSRA incident mailbox, then progressive reports	Board-approved cyber framework, ICT provider contracts, COBS 17 wallet and key controls
DIFC DFSA	Authorised Persons in the DIFC	As soon as reasonably practicable, max 72 hours from awareness	Form on the DFSA ePortal	Governing body approved cyber framework, board and senior management oversight
Federal CMA	Onshore VASPs under Decision No. 4/R.M/2026	Material cyber incidents within 72 hours of awareness; prompt notice of events with serious financial consequences (ATS Art. 87)	Notify the CMA; inform clients promptly of significant security incidents (BR Art. 98)	Board-approved cyber framework, client restored within 3 business days for unauthorized transfers, compensation arrangements, annual independent technology audit
CBUAE	Payment token issuers, custody and transfer providers, and conversion providers	Immediately, or as the CBUAE directs (PTS Regulation, Art. 35)	Notice to the CBUAE in the form it directs	Board-owned technology risk framework, cyber incident response plan, audit trail for every token transfer

Protecting Client Assets Before and After a Hack

Regulators judge an exchange hack on one outcome above all: whether clients are made whole. That depends on decisions taken long before the incident.

Hot and cold wallet split. Keep in hot wallets only what daily withdrawals need, and document the limit in your custody policy.
Multi-party signing. No single device, engineer or service should be able to approve large withdrawals alone. The Binance attack started on one engineer’s laptop.
Key management. Hold private keys in hardware security modules or MPC setups, with access logged and reviewed.
Compensation capacity. Know how much of a hot wallet loss you could repay from capital, insurance or a dedicated reserve, and say so in your client disclosures.
Segregation. Keep client assets separate from firm assets and reconcile them often, so you can prove exactly who lost what.

Building an Incident Response Plan UAE Regulators Will Accept

A plan regulators accept is specific, tested and owned by the board. Use this checklist to test yours.

Named incident lead and deputy, reachable 24 hours a day, including weekends
Clear materiality test that matches your regulator’s wording
Pre-filled notification templates for VARA, the FSRA or the DFSA, and for law enforcement
Client communication templates for the first hour, first day and first week
Runbook to pause withdrawals by network, revoke keys and rotate credentials
Agreements or contacts with blockchain analytics firms and stablecoin issuers for tracing and freezing
BCDR plan tested at least once a year against a hot wallet compromise scenario
Board approval of the plan and minutes showing its last review
Root cause analysis template and a remediation tracker for after the incident

Frequently Asked Questions

A VARA-licensed VASP must report a material cybersecurity event as soon as reasonably practicable and no later than 72 hours from detection. The report must cover the nature, scope and impact of the event and the steps taken to mitigate it.
The FSRA expects immediate notification on discovery of a reportable IT or cyber incident. Since January 31, 2026, its cyber risk management rules add a 24-hour backstop for the initial report, using Template A.
DFSA-authorised firms must notify the DFSA as soon as reasonably practicable and within 72 hours of becoming aware of a material cyber incident, using the form on the DFSA ePortal.
UAE rules focus on custody controls, segregation of client assets, capital and disclosure. In practice, regulators expect a licensed firm to show how client losses will be covered and to communicate that plan clearly.
No licence prevents every hack. Licensing requires firms to have cybersecurity policies, tested incident response plans and board oversight, so that the response is fast and client assets are protected.
Contain the incident, record the time of detection, pause affected withdrawals, convene the incident team and start preparing the regulator notification. The detection time starts every regulatory clock.
A CMA-licensed VASP must report a material cyber incident within 72 hours of becoming aware of it and promptly tell clients what happened and how it is limiting the harm. Where the firm is responsible for an unauthorized transfer of client virtual assets, it must restore the client's position within three business days and hold compensation arrangements for losses it cannot reverse.
Under Article 35 of the CBUAE's Payment Token Services Regulation, a payment token service provider must report major security and operational incidents, including downtime, to the CBUAE immediately or as the CBUAE directs. It must also keep a cyber incident response plan and an audit trail of every payment token transfer.

About the Author

Irina Heaver is the Founder and Managing Partner of NeosLegal, the UAE's first crypto-native law firm, founded in 2016. She has advised more than 350 crypto companies, exchanges, custodians, stablecoin issuers and funds across VARA, ADGM, DIFC, CBUAE and the federal CMA, and drafted virtual asset regulations for multiple governments. She was named Best Crypto & Web3 Lawyer UAE 2026 and is the author of The Founder's Guide to UAE Crypto Laws (2026). Proofread by Zainab Kamran, Associate NeosLegal.

Share this article