VARA: Virtual-Asset Regulation in Dubai

The Virtual Assets Regulatory Authority (VARA) is Dubai’s dedicated virtual-asset regulator, established by Dubai Law No. 4 of 2022 – among the world’s first standalone regimes of its kind. VARA regulates virtual-asset activity across the Emirate of Dubai, including its free zones, but excluding the DIFC (which has its own regime under the DFSA). It licenses by activity – seven categories, from broker-dealer and exchange to custody and advisory – under the Virtual Assets and Related Activities Regulations 2023 and a suite of activity-specific and cross-cutting rulebooks, substantially updated by Rulebook Version 2.0 in May 2025 and tightened marketing rules from October 2024. Federally, the securities regulator – the SCA, now the CMA – is the federal virtual-asset authority under Cabinet Decision No. 111 of 2022, and a mutual-recognition arrangement lets a VARA licence be recognised for servicing the wider UAE outside the financial free zones. VARA has stepped up enforcement against unlicensed activity. The rulebooks change frequently – confirm the current version at the time of use.

How Dubai’s virtual-asset regime licenses and supervises crypto businesses – and how it fits the federal picture.

At a glance

• Regulator: The Virtual Assets Regulatory Authority (VARA) – Dubai’s dedicated virtual-asset regulator
• Law: Dubai Law No. 4 of 2022 on the regulation of virtual assets
• Perimeter: The Emirate of Dubai, including its free zones – but excluding the DIFC (DFSA)
• Licensing: Seven activity-based licences under the Virtual Assets and Related Activities Regulations 2023
• Rulebooks: Activity-specific plus cross-cutting Compliance & Risk, Market Conduct and Marketing rules; major update (V2.0) in May 2025
• Federal link: The CMA (formerly the SCA) is the federal VA authority (Cabinet Decision No. 111 of 2022); VARA licence recognised for wider-UAE servicing

1. What VARA is

VARA is the Virtual Assets Regulatory Authority of Dubai, established by Dubai Law No. 4 of 2022 as a dedicated regulator for virtual assets and related activities. It was among the first standalone virtual-asset regulators in the world, created to give the sector a bespoke licensing and supervisory framework rather than fitting it awkwardly within existing securities or banking regulation. VARA authorises and supervises virtual-asset service providers operating in or from Dubai, sets the rulebooks they must follow, and enforces against unlicensed or non-compliant activity. Its remit reflects Dubai’s ambition to be a regulated home for the crypto and Web3 industry – an ambition that has made the Emirate a magnet for international virtual-asset businesses, including many founded by Indian entrepreneurs. The framework remains in force in 2026, operating alongside the federal developments described below.

2. The perimeter – Dubai, excluding the DIFC

VARA’s authority runs across the Emirate of Dubai, including its special development zones and free zones – with one important exception: the DIFC. Virtual-asset activity within the DIFC is regulated by the Dubai Financial Services Authority (DFSA) under the DIFC’s own regime, not by VARA. This is the first distinction a business must get right: a virtual-asset firm in Dubai is generally within VARA’s perimeter unless it sits inside the DIFC. The position differs again in Abu Dhabi, where the ADGM regulates virtual assets through the FSRA. The result is a layered national picture – VARA for Dubai (excluding the DIFC), the DFSA for the DIFC, the FSRA for the ADGM, and the federal regulator (the CMA) for onshore matters – in which identifying the correct regulator is the threshold question for any UAE crypto venture.

3. The licensing framework – seven activities

VARA licenses by activity rather than issuing a single, all-purpose authorisation. There are seven licensed virtual-asset activities: Advisory; Broker-Dealer; Custody; Exchange; Lending and Borrowing; Management and Investment; and Transfer and Settlement. A firm must hold authorisation for each activity it carries on, so a business that, say, both operates an exchange and provides custody needs to be licensed for both. Authorisation involves meeting VARA’s fit-and-proper, capital, governance, technology and compliance requirements, and ongoing supervision follows. This activity-based architecture lets VARA calibrate its requirements to the risks of each function – custody and exchange, for example, carry heavier obligations than advisory – but it also means a multi-service business faces a correspondingly broader set of authorisations and continuing obligations.

4. The rulebooks

The detail of the regime sits in VARA’s rulebooks. The Virtual Assets and Related Activities Regulations 2023 form the backbone, supplemented by activity-specific rulebooks (one for each licensed activity) and a set of cross-cutting rulebooks – notably Compliance and Risk Management, Market Conduct, Company and Marketing. VARA keeps this framework under active revision: it issued a comprehensive Rulebook Version 2.0 in May 2025, tightening risk-control and market-conduct obligations across all providers, and it has continued to update individual rulebooks since – including an updated Exchange Services Rulebook taking effect on 31 March 2026 that addresses exchange-traded virtual-asset derivatives. Because the rulebooks are revised on a regular cycle, the current version of any applicable rulebook should be confirmed at the time of use rather than taken from earlier guidance.

5. Marketing and promotion

Marketing is a distinct and increasingly strict part of the VARA regime. The Marketing Regulations govern how virtual-asset products and services may be promoted to persons in the UAE, and they were tightened with effect from October 2024 – introducing, among other things, mandatory risk disclaimers and, in certain cases, a requirement for prior VARA authorisation before promoting to UAE residents. The significance is that the marketing rules can bite on businesses that are not otherwise licensed in Dubai but that promote virtual assets to people in the UAE. Any firm running campaigns, influencer promotions or other marketing reaching the UAE should check whether the Marketing Regulations apply and what disclaimers or approvals are required, because marketing breaches have featured prominently in VARA’s recent enforcement.

6. The federal interface – VARA, the CMA and the free zones

VARA does not operate in isolation from the federal system. Under Cabinet Decision No. 111 of 2022, the federal securities regulator – the SCA, now reconstituted as the Capital Market Authority (CMA) – is the federal virtual-asset authority, with power to delegate licensing to local authorities such as VARA. A mutual-recognition arrangement that began with the SCA in September 2024 allows a VARA licence to be recognised at federal level, so that a VARA-licensed provider can service the wider UAE (outside the DIFC and ADGM) without a separate federal licence. With the SCA’s reconstitution as the CMA from 1 January 2026, the federal role passes to the CMA, and the federal capital-markets reforms have brought investment virtual assets within the CMA’s onshore perimeter. The precise terms of the CMA-era recognition arrangement are still settling, so the current federal position should be verified. The practical takeaway is that a Dubai virtual-asset business increasingly has to map both the VARA regime and the federal CMA regime.

7. Enforcement

VARA has moved from framework-building to active enforcement. In October 2025 it penalised 19 firms with fines reported in the range of AED 100,000 to AED 600,000 for operating without a licence and for breaches of the Marketing Regulations, accompanied by a public warning; in October 2024 it had already fined several unlicensed entities and issued cease-and-desist orders. The framework provides for substantial maximum penalties – up to several million dirhams for certain violations, with higher exposure for repeat offences – alongside public censure. The message from VARA’s enforcement record is consistent: operating without the correct activity licence, or marketing virtual assets to UAE residents outside the rules, carries real and escalating risk. Businesses should treat licensing and marketing compliance as prerequisites to operating, not as matters to regularise later.

8. The India–UAE dimension

Dubai has become one of the leading global hubs for Indian-founded crypto, Web3 and virtual-asset businesses, drawn by a dedicated regulator and a clear (if demanding) licensing path. For these businesses a VARA licence is the gateway to operating in Dubai and, through federal recognition, to servicing the wider UAE outside the financial free zones. From 2026, however, the picture is two-layered: a Dubai virtual-asset business must also consider the federal CMA regime, including the CMA’s 2026 virtual-asset rulebook, its token-admission gateway and its extraterritorial marketing reach. Indian promoters therefore face a dual-compliance reality – VARA at the Emirate level and the CMA at the federal level – and, where a DIFC or ADGM presence is contemplated, the DFSA or FSRA regimes as well. Mapping the right combination at the outset is essential.

9. The VARA & virtual-asset practice

ATB Legal advises virtual-asset and Web3 businesses on VARA licensing across the seven activity categories; on the rulebook obligations – compliance and risk, market conduct, custody, technology and governance; on the Marketing Regulations and how to promote lawfully to UAE audiences; and on the federal interface with the CMA, including recognition and the 2026 virtual-asset rulebook. For India-facing founders, the VARA route is mapped against the federal CMA regime and any DIFC or ADGM alternative, so that the structure rests on the correct perimeter, alongside VARA engagement and enforcement matters.

Key points at a glance

Frequently asked questions