Dubai Virtual Assets Regulatory Authority (VARA)

Overview

The Virtual Assets Regulatory Authority (VARA) is Dubai's dedicated regulator for virtual asset services and activities, established as the world's first independent virtual asset regulator. Launched in March 2022 following the enactment of Law No. 4 of 2022, VARA operates under the Dubai World Trade Centre Authority (DWTCA) and serves as a transparent, trusted authority guiding the virtual asset sector across the Emirates.

VARA's mission is to provide a world-leading regulatory framework to protect investors, maintain high levels of risk assurance, and facilitate virtual asset innovation while maintaining regulatory integrity across Dubai's mainland and free zones (excluding the Dubai International Financial Centre).

Key Fact: VARA is the first dedicated independent regulator globally established exclusively for virtual assets regulation.

Basic Identity

Classification

Inclusion Justification

What This Entity Oversees

Compliance Requirements

Anti-Money Laundering and Counter-Terrorism Financing (AML/CFT)

VARA-licensed VASPs must implement effective AML/CFT policies aligned with:

• Federal UAE law and regulations
• Financial Action Task Force (FATF) Recommendations 15 and 16
• UAE Executive Office guidance
• VARA-specific AML/CFT rulebook sections

Key Elements:

• Customer due diligence (CDD) at account opening
• Enhanced due diligence (EDD) for high-risk customers
• Beneficial ownership verification
• Suspicious activity reporting to Financial Intelligence Unit (FIU)
• Transaction monitoring and screening
• Record retention for minimum 5 years

Customer Data Exchange (Travel Rule)

VARA-aligned VASPs must exchange standardized counterparty data with foreign virtual asset firms in accordance with FATF Travel Rule standards, enabling simplified compliance with Recommendation 16.

Asset Segregation and Custody

Entities providing custody services must:

• Segregate customer assets from firm proprietary assets
• Maintain clear accounting separation
• Specify cybersecurity measures and safekeeping protocols
• Implement disaster recovery and business continuity plans
• Maintain adequate insurance coverage

Market Conduct and Consumer Protection

Disclosure Requirements:

• Retail investors receive the highest level of consumer protection
• Suitability assessments required before recommending virtual asset services
• Enhanced disclosures for high-risk products
• Clear fee and risk disclosure

Leverage Restrictions:

• Retail investors: Maximum 5x leverage on crypto derivatives
• Professional investors: Higher leverage available with enhanced risk acknowledgment

Operational Standards:

• Written policies and procedures for all VA activities
• Regular compliance audits and testing
• Qualified compliance officers with appropriate reporting lines
• Annual compliance certifications

VARA's Examination Powers

VARA possesses comprehensive examination and investigation authority over all entities conducting virtual asset activities in Dubai:

Scope of Authority:

• Conduct examinations at any time or manner deemed necessary
• Demand full access to books, records, and premises
• Require production of all documentation related to VA activities
• Interview directors, officers, and employees
• Engage qualified auditors and specialists
• Examine compliance with all regulatory obligations

Examination Focus Areas:

• AML/CFT compliance and transaction monitoring effectiveness
• Risk management and internal controls
• Asset segregation and custody safeguards
• Technology systems security and resilience
• Customer complaint handling and remediation
• Financial condition and capital adequacy
• Governance and management competency

Continuous Compliance Monitoring

All entities must maintain compliance readiness at all times and:

• Provide requested information within specified timeframes
• Maintain audit trails and transaction records
• Report material changes in operations or ownership
• Notify VARA of compliance incidents or breaches
• Participate in industry surveys and data collection

Critical Service Provider Designation

Entities designated by VARA as Critical Service Providers (CSPs) are subject to:

• Direct and ongoing supervision by VARA
• Enhanced examination authority and frequency
• Specific monitoring requirements and reporting obligations
• Additional capital or liquidity requirements as determined by VARA

Investor Safeguards Framework

VARA maintains a comprehensive consumer protection regime designed to protect retail investors and maintain market integrity:

Core Protections:

1. Licensing Enforcement – Only VARA-licensed entities authorized to offer VA services
2. Capital and Liquidity Requirements – Ensuring solvency and ability to return customer assets
3. Asset Segregation – Customer assets maintained separately from firm assets
4. Cybersecurity Standards – Mandatory security controls for fraud and theft prevention
5. Complaints Handling – Formal complaint procedures with documented resolution
6. Disclosure Mandates – Full transparency on fees, risks, and service terms

Market Conduct Rules

VARA's market conduct framework prevents fraud and manipulation:

• Prohibition on misleading marketing and solicitation practices
• Disclosure of conflicts of interest
• Fair pricing and execution standards
• Suitability assessments for retail customers
• Risk acknowledgment and investor understanding verification

Leverage and Risk Protections

• Retail Access: 5x maximum leverage cap on cryptocurrency derivatives
• Professional Investors: Higher leverage available with enhanced risk warnings
• Risk Disclosure: Clear communication of volatility, counterparty risk, and loss potential

Consumer Complaint Resolution

Requires verification from official sources VARA maintains a complaints procedure requiring licensed entities to:

• Acknowledge complaints within specific timeframes
• Investigate complaints thoroughly and fairly
• Provide written responses with detailed explanations
• Maintain complaint registries for supervisory review
• Remediate valid complaints with restitution where appropriate

Regulatory Powers

Enforcement Measures and Sanctions

VARA possesses comprehensive enforcement authority to address non-compliance with Dubai Law No. 4 of 2022 and VARA regulations:

Enforcement Actions Available:

1. Enforcement Notices – Requiring rectification of identified violations within specified timeframes
2. License Scope Limitations – Restricting or revising the scope of licensed VA activities
3. Enhanced Monitoring – Imposing additional supervision, monitoring, or reporting requirements
4. License Suspension – Temporary suspension for material breaches
5. License Revocation – Permanent removal from VARA register
6. Cease Operations Orders – Requiring immediate cessation of specific VA activities
7. Civil Penalties – Monetary fines for regulatory violations
8. Public Warnings – Publication of warnings about unlicensed operators or serious breaches

Penalties and Fines

Maximum Civil Penalties:

• Standard violations: Up to AED 1 million (approximately USD 270,000)
• Serious breaches: Up to AED 5 million (approximately USD 1.36 million)
• Critical failures: Up to AED 10 million (approximately USD 2.7 million)
• Repeat Offenses: Penalties may be doubled for violations within one year of prior enforcement action

Enforcement Cases:

• Requires verification from official sources VARA has published enforcement notices against unlicensed operators and issued public warnings regarding non-compliant entities
• Enforcement actions include both formal proceedings and settlement negotiations

Unlicensed Operations

VARA actively monitors and enforces against unlicensed virtual asset service provision:

• Operation without license constitutes criminal and administrative violation
• VARA publishes public warnings identifying unlicensed operators
• Customers using unlicensed services have limited regulatory protections
• VARA coordinates with law enforcement on egregious violations

Regulatory Role and Function

Legal Foundation

Statutory Foundation

VARA operates under Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, issued by His Highness Sheikh Mohammed bin Rashid Al Maktoum, Vice President and Ruler of Dubai, and effective as of 2022. This law provides the complete legal framework for virtual asset regulation and VARA's supervisory powers within Dubai's jurisdiction.

Law No. 4 of 2022 Components:

• Defines virtual assets as any digital representation of value tradable or transferable through electronic means
• Establishes VARA as the regulatory body with exclusive jurisdiction
• Outlines scope of regulation covering seven major virtual asset service provider activities
• Sets enforcement, examination, and supervisory powers
• Defines consumer protection and market conduct requirements

Legal References:

• Primary Statute: Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai
• Regulatory Framework: VARA Rulebook (comprehensive guidance documentation)
• Jurisdiction: Emirate of Dubai, including Special Development Zones and Free Zones (excluding DIFC)

Regulatory Status and Authority Level

Licensing and Authorization Relevance

Scope of Licensed Activities

VARA licenses seven categories of virtual asset service provider (VASP) activities:

1. Advisory Services – Providing advice regarding virtual assets or virtual asset activities
2. Broker-Dealer Services – Trading virtual assets on behalf of clients
3. Custody Services – Holding and safekeeping of virtual assets for customers
4. Exchange Services – Operating platforms for buying and selling virtual assets
5. Lending and Borrowing Services – Facilitating virtual asset lending/borrowing arrangements
6. Payments and Remittance Services – Transferring value using virtual assets
7. Management and Investment Services – Portfolio management and investment services for virtual assets

Mandatory Licensing Requirement

All entities providing virtual asset services in or from Dubai must be licensed by VARA prior to commencing operations. This applies to:

• Domestic and international firms
• Entities in Dubai Free Zones (excluding DIFC)
• Special Development Zones within Dubai

Exemptions: UAE government entities and their affiliated organizations may apply for exemption status if they notify VARA and obtain non-objection confirmation. Professional exemptions extend to lawyers, accountants, and licensed consultants who incidentally engage in virtual asset activities.

License Validity and Renewal

• Validity Period: 1 year from issuance
• Renewal: Annual renewal required with submission of updated compliance documentation
• Multiple Activities: Entities may aggregate multiple licensed activities under a single overarching license (except certain Custody Services with specific restrictions)

Application Process

VARA employs a two-stage licensing application process:

Stage 1: Approval to Incorporate (ATI)

• Submit Initial Disclosure Questionnaire (IDQ) with business plan and beneficial ownership details
• Provide senior management information and organizational structure
• Pay initial application fee (typically 50% of total license application fee)
• Obtain approval to establish legal entity and commence operational setup

Stage 2: VASP License Application

• Submit comprehensive compliance documentation per VARA guidance
• Participate in VARA meetings, interviews, and information requests
• Demonstrate operational readiness and compliance systems
• Pay remaining application fees and first-year supervision fees
• Receive final VASP license approval

Application Channels:

• Mainland entities: Dubai Economy and Tourism (DET)
• Free Zone entities: Respective Dubai Free Zone authority
• Submission platform: VARA integrated application portal

Core Licensing Requirements

All VASP applicants must demonstrate:

Payments and Money Movement Relevance

The Dubai Virtual Assets Regulatory Authority (VARA) has the following relevance to payments and money movement in United Arab Emirates:

Payment Systems Governed or Overseen

The Dubai Virtual Assets Regulatory Authority (VARA) has the following relationship to payment infrastructure in United Arab Emirates:

This entity's role in payment systems is primarily regulatory and supervisory rather than operational. It does not directly operate national payment infrastructure but contributes to the regulatory framework governing payment activities in United Arab Emirates.

Relationship to Other Regulators

FATF Alignment and Mutual Evaluation

VARA operates within the UAE's framework of compliance with Financial Action Task Force (FATF) Recommendations on virtual asset regulation and AML/CFT. The UAE underwent FATF Mutual Evaluation assessing its AML/CFT regimes and received recognition for regulatory frameworks governing financial institutions and virtual assets.

Key Coordination Points:

• Adoption of FATF Recommendation 15 (VASPs should be licensed/regulated)
• Implementation of FATF Recommendation 16 (Travel Rule for standardized data exchange)
• Participation in FATF's virtual asset working groups
• Regular reporting on compliance metrics and enforcement actions

Memoranda of Understanding (MoU)

VARA-DFSA Coordination (2024):

VARA and the Dubai Financial Services Authority (DFSA) signed a Memorandum of Understanding establishing a cooperation framework across financial and virtual asset sectors:

• Joint coordination on licensing, supervision, and enforcement
• Enhanced AML/CFT, terrorism financing, and proliferation financing controls
• Regular exchange of regulatory information
• Reinforcement of market integrity and transparency

Unified UAE Virtual Asset Framework

VARA participates in the broader UAE virtual asset regulatory partnership with:

• Securities and Commodities Authority (SCA)
• Other UAE financial regulators
• Collective efforts to harmonize policy frameworks across emirates
• Joint institutional capacity building
• Active participation in international regulatory bodies

Strategic Objectives:

• Elevate governance standards across the UAE
• Enhance supervisory integration and coordination
• Build international cooperation through FATF participation
• Position UAE as global frontrunner in regulatory excellence

Geography and Jurisdiction Notes

Important Departments and Divisions

Key Public Resources

Official Website and Contact Portal

Primary Website: vara.ae

Dedicated Sections:

• License Applications: vara.ae/licenses-and-register/licence-applications/
• Licensed Activities: vara.ae/licenses-and-register/licensed-activities/
• Enforcement Actions: vara.ae/enforcement/
• News and Updates: vara.ae/news/

Contact Form: Available on vara.ae/contact/ – inquiries responded to by VARA team

Leadership

Former Leadership:

• Previous CEO: Henson Orser (transitioned to consultant role)

Office Location and Mailing Address

Operating Headquarters:

• DWTCA (Dubai World Trade Centre Authority) Free Zone
• Dubai, United Arab Emirates

Contact Email: [email protected]

Mailing Address: P.O. Box 9292, Dubai, United Arab Emirates

Regulatory Documentation and Rulebook

VARA Rulebook: rulebooks.vara.ae

• Comprehensive regulatory guidance and requirements
• All seven VA activity categories and compliance rules
• AML/CFT, market conduct, and governance standards
• Examination and enforcement procedures
• Regular updates and amendments

Key Document: VARA_EN_18_VER992_2.pdf – VARA Supervision, Examination and Enforcement Framework

• VARA Rulebook – Complete regulatory framework
• VARA Licenses and Register – Licensed VASP directory
• Dubai Law No. 4 of 2022%20of%202022%20Regulating%20Virtual%20Assets.html) – Full statutory text
• Financial Action Task Force – International regulatory standards
• DFSA Dubai – Financial Services Regulator (related coordination)

Notes on Naming and Language