sboghossian Knowledge Pack — VARA (Dubai Virtual Assets Regulatory Authority)
Scope
This pack covers VARA — the Virtual Assets Regulatory Authority — the world's first dedicated regulator for virtual assets, established under Dubai Law 4/2022. VARA's rules took effect in February 2023. This pack covers:
- VARA's establishment and jurisdiction
- Virtual asset service categories
- License tiers and capital requirements
- The VARA Rulebook suite
- Marketing rules
- AML/CFT obligations
- Stablecoin regulation
- Tokenization and NFTs
- VARA enforcement record
- Comparison with ADGM FSRA
VARA — establishment and jurisdiction
Legal basis
Dubai Law 4/2022 established VARA as an independent regulatory authority in Dubai. VARA is distinct from the UAE federal regulator (CBUAE) and from DIFC's DFSA.
Geographic scope
VARA regulates virtual asset activities conducted:
- In Dubai (mainland and free zones) except DIFC
- DIFC remains under DFSA's separate virtual asset framework
What VARA regulates
"Virtual Asset" under Dubai Law 4/2022 means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. NFTs with certain investment characteristics may be captured.
Activities requiring a VARA license
| Activity | Description |
|---|---|
| Advisory Services | Providing advice on VA investing, VA structures |
| Broker-Dealer Services | Acting as intermediary to buy/sell VAs for clients |
| Custody Services | Safekeeping and managing VAs for clients |
| Exchange Services | Operating a VA exchange (spot and/or derivatives) |
| Lending and Borrowing | Providing VA lending products; borrowing using VA as collateral |
| Payments and Remittances | Using VAs for payments; VA-based remittance |
| Management and Investment | Discretionary VA portfolio management |
| Issuance Services | Issuing new VAs (ICOs, IDOs, IEOs); token generation events |
License categories and capital
VARA uses a tiered licensing structure. Each licensed entity holds a Virtual Asset Service Provider (VASP) License with specified permitted activities.
Minimum capital requirements (approximate — verify current Rulebook)
| Activity tier | Approximate minimum capital |
|---|---|
| Advisory only | AED 100,000 |
| Broker-dealer or custody | AED 2,000,000+ |
| Exchange | AED 5,000,000+ |
| Issuance | AED 1,000,000+ |
| Lending/borrowing | AED 2,000,000+ |
Exact capital requirements are set in the Virtual Asset Activities Rulebook and updated by VARA. Higher capital may be required based on risk profile and scale.
The VARA Rulebook Suite
VARA issued a comprehensive Rulebook structured as seven modules:
| Rulebook | Scope |
|---|---|
| Company Rulebook | Entity structure; senior management; governance; fit and proper |
| Compliance and Risk Rulebook | Compliance program; risk management; MLRO; AML/CFT |
| Technology and Information Rulebook | Cybersecurity; IT systems; disaster recovery; key management |
| Market Conduct Rulebook | Market integrity; fair dealing; conflicts of interest |
| Marketing Rulebook | Advertising and marketing of virtual assets (see below) |
| Virtual Asset Activities Rulebook | Specific requirements per activity type (capital, operational, custody etc.) |
| VA Issuance Rulebook | Token offering requirements; disclosure; whitepaper |
Marketing rules
VARA's Marketing Rulebook is one of the most detailed and strictly enforced parts of the framework. Key rules:
- Marketing of virtual assets in Dubai requires the marketer to be:
- A VARA-licensed entity, OR
- A registered marketer (registered with VARA for marketing activities only)
- Marketing materials must include:
- Clear risk warning: "Virtual assets may fluctuate significantly in value."
- Clear identification of the marketing entity
- VARA license number
- Prohibited claims: guaranteed returns; risk-free; "best" or "safest" without substantiation
- Influencer marketing: influencers marketing VAs must be registered as marketers OR associated with a VARA-licensed entity
Enforcement of marketing rules
VARA has actively enforced marketing rules. Unlicensed persons marketing VAs in Dubai face fines and operational bans.
Key operational requirements
Local presence
All VARA-licensed entities must maintain an operating office in Dubai with:
- Qualified senior management physically present
- Day-to-day operations conducted from Dubai (not a mailbox office)
Governance requirements
- Board: minimum 3 members; majority independent for exchange and lending activities
- Fit and proper: all board members and senior management subject to VARA approval
- Senior management: CEO, CFO, Chief Compliance Officer, MLRO — each named and VARA-approved
Compliance and MLRO
- Designated Compliance Officer responsible for regulatory compliance
- Designated MLRO (Money Laundering Reporting Officer) for AML/CFT
- Both roles require VARA approval; must have relevant experience
AML/CFT obligations
All VARA licensees are subject to:
goAML registration
Mandatory registration on the UAE FIU's goAML platform for SAR filing.
FATF Travel Rule
Transfers of virtual assets above USD/EUR 1,000 require:
- Originator information passed to receiving VASP
- Beneficiary information (where known)
- Compliance with FATF Recommendation 16
VARA licensees must implement Travel Rule compliance technology (e.g., via Travel Rule protocol solutions).
CDD
- Standard CDD on all customers
- EDD for PEPs, high-risk jurisdictions, large/unusual transactions
- Transaction monitoring: blockchain analytics required for exchange and custody activities
Sanctions screening
Real-time screening against:
- UN Security Council lists
- CBUAE targeted financial sanctions
- OFAC (for USD-connected transactions)
Stablecoin regulation
VARA has specific rules for stablecoin issuers:
- Reserve requirements: 1:1 reserve backing required; reserves must be held in qualifying liquid assets (cash, government bonds)
- Audits: regular attestation of reserves by independent auditor
- Redemption rights: customers must be able to redeem stablecoins at par
- AED-pegged stablecoins: require CBUAE coordination; potentially CBUAE approval in addition to VARA license
The UAE Central Bank has issued regulatory guidance on payment tokens (stablecoins) that overlaps with VARA's stablecoin rules — entities must navigate both frameworks.
Tokenization and NFTs
Asset-backed tokens
VARA covers tokenized real-world assets (real estate tokens, commodity tokens, etc.) under the Issuance Rulebook if they are issued as virtual assets (not securities — securities would require DFSA/FSRA or SCA regulation).
Real estate tokenization
Dubai has a specific focus on real estate tokenization through the Dubai Land Department (DLD) pilot programs. VARA licenses are required for issuers and exchanges for real estate tokens if they qualify as virtual assets.
NFTs
NFTs for purely collectible purposes may not be subject to VARA licensing. NFTs with investment characteristics, fractionalized ownership, or financial returns may be captured under VARA's definition of virtual assets or the Issuance Rulebook. VARA has indicated it will assess NFTs on a case-by-case basis.
Enforcement record (2024–2025)
VARA has been actively enforcing its rules:
- Unlicensed operators: several entities fined and barred from Dubai market for operating without VARA license
- Marketing violations: fines issued to influencers and entities marketing without proper authorization
- International cooperation: VARA participating in IOSCO and FATF coordination on cross-border VA enforcement
VARA's enforcement posture signals it is a substantive regulator, not a light-touch regime.
DIFC — separate regime
DIFC operates under DFSA virtual asset rules, separate from VARA:
- DIFC-based VA activities require a DFSA license (not VARA)
- Cross-licensing: a VARA-licensed entity cannot offer services in DIFC without DFSA authorization; vice versa
- The two regimes are being progressively harmonized but remain distinct as of knowledge cutoff
VARA vs ADGM FSRA — selection guide
| Factor | VARA Dubai | ADGM FSRA |
|---|---|---|
| Jurisdiction | Dubai (excl. DIFC) | ADGM (Abu Dhabi) |
| Legal system | Dubai Law / emiri decrees | Common-law (English-based) |
| Track record | 2022+ | 2018+ |
| Asset coverage | Broad; fewer restrictions on asset types | Restricted to Accepted Crypto Assets list |
| Best for | Consumer-facing, retail, Dubai ecosystem | Institutional, complex products, common-law framework |
| Marketing | Detailed Marketing Rulebook | Less prescriptive |
| Capital (entry level) | AED 100K for advisory | USD 1M+ for most activities |
| Enforcement | Active; growing | Strong reputation |
Practical licensing timeline
- Pre-application consultation with VARA: free; recommended
- Application submission: business plan, compliance manuals, key personnel CVs
- VARA review: 3–6 months for straightforward applications
- Conditional approval: conditions to satisfy (capital, office, personnel)
- Inspection/readiness assessment: VARA inspects operations
- Full license: issued when all conditions met
How to use this pack
Load this pack when the user:
- Is exploring VARA licensing for a Dubai-based virtual asset business
- Needs to understand VARA activity categories and applicable rules
- Has questions about VARA's marketing rules or enforcement posture
- Is advising on AML/CFT compliance for a VARA licensee
- Is comparing VARA and ADGM FSRA for a licensing decision
Caveats & currency
VARA is a new regulator and its rules are actively evolving. The Rulebook has been updated multiple times since February 2023. Capital requirements may change. CBUAE payment token framework is developing concurrently with VARA's stablecoin rules. Always verify current VARA requirements at vara.ae.
Related skills
- [[kb-crypto-adgm]] — ADGM FSRA crypto framework for comparison
- [[kb-banking-regulation-cbuae]] — CBUAE payment token and banking framework
- [[kb-aml-fatf-mena]] — MENA AML context for virtual assets
- [[kb-corporate-law-uae]] — UAE entity structures for VARA-licensed businesses
- [[draft-aml-policy]] — AML policy template for VASP