The Dubai Virtual Asset Regulatory Authority (VARA) has introduced new guidelines requiring cryptocurrency businesses to adopt data-driven risk models. These models must utilize quantitative business data to create real-time risk scoring systems, replacing traditional static tracking methods. Crypto companies are mandated to update their risk assessments quarterly or immediately following significant operational changes. Under the new regulations, firms must integrate risks from Financial Action Task Force (FATF) high-risk and blacklisted countries into their systems. Additionally, they must distinguish between risk assessments for proliferation financing and targeted financial sanctions, separate from general anti-money laundering measures. VARA also requires companies to document risks associated with emerging technologies like AI-driven operations and anonymity-enhanced transactions, ensuring these assessments influence compliance and resource allocation.