Virtual Assets Regulatory Authority (VARA) may accept a fractional or outsourced compliance arrangement on a case-by-case basis for a Virtual Asset Service Provider (VASP). While not VARA in particular, this is a model that we have operated under for years for customers where they are interfacing with regulated entities. This enables businesses to find someone on a fractional role with senior experience, in particular SMEs and startups. If a VASP where to find a CISO, then the CISO would typically combine roles with a DPO however this is something that I would recommend to find a dedicated person functioning as DPO in order to solicit an objective, third-party and legal-focused opinion on matters relating to data protection.
If you are a VASP looking for CISOs to fulfill this gap, we have an entity based in the UAE. Please contact us for more information!
