VARA & UAE Virtual Assets — licensing, Travel Rule, enforcement

The Virtual Assets Regulatory Authority (VARA) is Dubai's dedicated virtual asset regulator, established by Dubai Law 4 of 2022. Operational since March 2022. Jurisdiction: all VA activities physically conducted from, or marketed to, Dubai mainland (excluding DIFC). Cabinet Decision 111/2022 confirmed VARA's federal recognition. VARA is the world's first dedicated virtual asset regulator with a separate statutory mandate (rather than an extension of an existing financial regulator).

VARA Regulations 2023 + Activity Specific Rulebooks: (1) Advisory Services; (2) Broker-Dealer Services; (3) Custody Services; (4) Exchange Services; (5) Lending and Borrowing Services; (6) Virtual Asset Management and Investment Services; (7) Virtual Asset Transfer and Settlement Services. Plus issuer-side: VA Issuance approval. Each Activity has its own Rulebook. All licensees must comply with the four Compulsory Rulebooks: Company; Compliance and Risk Management; Technology and Information; Market Conduct.

VARA and FSRA operate independently, but VARA's framework draws on the FSRA experience. Cross-border activity between Dubai mainland and ADGM requires VARA licence + ADGM licence where physical activity occurs in both. Many groups operate parallel ADGM/Dubai mainland licences.

VARA does not operate a "crypto token" classification in the same way as DFSA — VARA's framework focuses on activities (Q2), with token-level scrutiny via the Issuance Approval process. A token issued under DFSA approval is not automatically marketed-permitted in Dubai mainland — VARA approval is separately required.

CBUAE Payment Token Services Regulation (Regulation 2/2024) supersedes any VARA framework on stablecoin issuance. VARA-licensed entities engaging in PT-related activities (issuance, conversion, custody, transfer) require both VARA activity licence AND CBUAE Payment Token Service Provider authorisation. Coordination memorandum between VARA and CBUAE.

VARA Compliance and Risk Management Rulebook Part V implements the Travel Rule. VARA-licensed VASPs must collect, hold and securely transmit originator and beneficiary information for VA transfers above USD 1,000. Required data: name, account/wallet identifier, physical address (or DOB / national ID), beneficiary name and account. Sunrise problem (where one side is in a non-Travel-Rule jurisdiction) addressed via VARA's Counterparty VASP Diligence framework.

VARA Compliance and Risk Management Rulebook + Federal AML Law FDL 20/2018 + Cabinet Decision 10/2019. Requirements: appointment of MLRO; risk-based AML/CFT programme; customer due diligence (CDD) including beneficial owner identification; enhanced due diligence for high-risk customers (PEPs, high-risk jurisdictions); ongoing transaction monitoring; suspicious-transaction reporting to UAE FIU through goAML portal; record-keeping 5 years minimum; staff training; Travel Rule (Q6); periodic risk assessment.

VARA Marketing Regulations 2023: marketing of VA products to Dubai-resident retail clients requires a VARA licence with appropriate retail authorisation. Marketing must be fair, clear, not misleading; risk warnings prominent; influencer arrangements disclosed; targeted advertising restrictions for under-18s; "do your own research" disclaimers required. VARA has actively enforced marketing rules including issuing public warnings and orders against non-compliant promoters.

VARA Custody Services Rulebook + Compulsory Technology and Information Rulebook: client assets segregated from firm assets; minimum cold-storage threshold (not less than 80-90% per asset type per Rulebook); hot-wallet limits; multi-signature key management; insurance coverage; periodic third-party penetration testing; reconciliation requirements; audit by approved auditor; bankruptcy-remote structures preferred.

VARA does not regulate NFTs that are "unique, non-fungible, and not used as a means of payment" — these fall outside the Dubai Law 4/2022 definition of Virtual Asset. Substance test: where an NFT exhibits fungibility characteristics (fractional ownership, mass-issued series traded on liquid markets, used as payment, or marketed as investment), VARA may treat it as a Virtual Asset and require licensing. NFT marketplaces facilitating speculative trading of fungible-character NFTs typically need VARA licensing.

Tokens conferring securities-like rights (equity, debt, profit-share) fall under SCA federal jurisdiction (SCA Decisions 22/2020, 23/2020) where offered to UAE residents. VARA coordinates with SCA on dual-jurisdiction matters. Pure security-token offerings to professional investors only may obtain bespoke approvals.

VARA licence required where (i) VA activities are physically conducted from Dubai mainland; (ii) services are marketed to or offered to Dubai-resident retail clients ("solicitation" trigger). Pure outbound trades by Dubai-resident clients on foreign platforms (no marketing into Dubai) generally outside VARA scope but may have AML/CFT implications. Reverse-solicitation defence narrowly construed.

VARA-SCA coordination: where a Dubai-licensed VARA entity conducts security-token activity, SCA approval is also required for the security-token element. Information-sharing memorandum.

DMCC (Dubai Multi Commodities Centre) free zone "crypto" trade licence permits trading and incorporation activities, but does NOT confer VA-services authorisation. A DMCC entity offering VA services to Dubai-resident clients still requires VARA licence. DMCC is a corporate / trade-licence layer, not a VA regulator. Same applies to IFZA, Meydan FZ, JAFZA: they license corporate vehicles but VARA / FSRA / DFSA / SCA / CBUAE are the conduct regulators.

VARA-licensed Dubai mainland VASPs subject to standard FDL 47/2022 corporate tax (9% above AED 375,000). Trading in virtual assets, transaction fees, custody fees etc. are taxable income. Cabinet Decision 100/2023 QFZP regime is generally not available to mainland VARA entities (mainland is not a Free Zone). Specific guidance on virtual-asset cost basis, valuation and FX treatment in FTA Public Clarification CT P-005 (2024).

Under Dubai Law 4/2022 and VARA Regulations 2023: (i) investigations + production orders; (ii) administrative fines (up to AED 50m+ for serious breaches); (iii) licence suspension/revocation; (iv) public censure; (v) restitution / disgorgement orders; (vi) prohibition on individuals; (vii) referral to public prosecution for criminal offences. VARA appeals lie through the Dubai Courts administrative circuit. VARA has actively used enforcement tools — public warnings, license cancellations, and fines published since 2023.

Capital and fees vary by Activity (per Activity Specific Rulebook): typical paid-up capital ranges AED 100k (Advisory) to AED 5m+ (Exchange / Custody). Application fees AED 40k-100k+; annual supervision fees on a percentage-of-revenue or activity-tier basis. Substance: physical office in Dubai, qualified personnel in scope (MLRO, COO, CEO, CTO/Head of Cyber as applicable), local board/committee meetings, audited UAE accounts.

VARA Compulsory Rulebook on Market Conduct + Activity-specific COB rules: retail clients receive enhanced suitability assessment, mandatory risk warnings, complaint-handling procedures, leverage caps, marketing restrictions. Professional Clients (institutional investors meeting AUM and experience thresholds) and Qualified Investors face lighter-touch protections. Retail-targeted VA derivatives generally restricted (similar to FCA UK retail-derivative ban 2021).

VARA Compulsory Rulebook on Technology and Information: cybersecurity programme; multi-signature key management with HSMs; cold-storage minimums; penetration testing (annual minimum); incident-reporting (within 24-72 hours per severity); business-continuity plan; cybersecurity-incident insurance encouraged. Aligns with NIST Cybersecurity Framework + ISO 27001 + UAE Information Assurance Standards.

VARA has signed MOUs with multiple international regulators (HK SFC, MAS Singapore, FCA UK, regulators in Switzerland, France, Hong Kong) for information-sharing and supervisory cooperation. No formal equivalence regime — a foreign-licensed firm wishing to serve UAE clients still needs UAE licence. VARA encourages cross-listing of recognised assets (e.g. major exchange tokens).