The Scale of VARA’s Enforcement Against Unlicensed Operators
Since its establishment, VARA has conducted what amounts to a systematic enforcement campaign against entities operating virtual asset services in Dubai without the required licensing authorization. As of early 2026, VARA has taken public enforcement action against more than 36 entities for unlicensed virtual asset activities, with the pace of enforcement intensifying throughout 2024 and 2025 before continuing into 2026 with the action against VESTA PRIME PORTAL CO. L.L.C. in January.
This enforcement record is central to understanding VARA’s regulatory philosophy: the authority is willing to take action against both small local operators and larger entities, and it treats both direct virtual asset services and marketing of virtual asset activities as regulated activities subject to enforcement.
Chronological Enforcement Pattern
2024: Establishing Enforcement Precedent
The earliest published enforcement actions in VARA’s public record date from August and September 2024:
- BTC BAY PAYMENT SERVICES PROVIDER LLC (September 3, 2024) — unlicensed virtual asset activities and marketing
- COINCASHY COMMERCIAL BROKERS LLC (August 23, 2024) — unlicensed activities and marketing
- CRYPTO FORCE DMCC (August 23, 2024) — unlicensed activities and marketing
- STABIT DMCC (August 23, 2024) — unlicensed activities and marketing
- KOTO CRYPTO DMCC (August 23, 2024) — unlicensed activities and marketing
These initial actions established the enforcement template: cease-and-desist orders combined with financial penalties for entities engaged in unlicensed virtual asset activities within Dubai’s jurisdiction.
January 2025: The First Major Enforcement Wave
On January 2, 2025, VARA published enforcement actions against 12 entities simultaneously — the largest single batch of enforcement actions in the authority’s history at that time. The entities included:
A TO Z GLOBE DMCC, ALMIZAN ALFEDHI PAYMENT SERVICE PROVIDER L.L.C, BINALEX POINT PAYMENT SERVICES PROVIDER L.L.C. AND BINALEX CAPITAL FZCO, MKAN COIN DMCC, COIN SWAPZ TRADING DMCC, CRYPTO DESK EXCHANGE SERVICES L.L.C, THE CRYPTOVERSE TECHNOLOGIES EST, CRYPTOHOME PAYMENT SERVICES PROVIDER L.L.C, CRYPTO HOME DMCC, and SHELBIT GENERAL TRADING L.L.C.
The scale of this wave reflected the expiration of deadlines for legacy operators to engage with VARA’s licensing process. As VARA’s November 2023 market notice warned, “Market-wide enforcements pick-up pace as final VARA deadline for Virtual Asset Service Provider licensing engagement lapses.”
March 2025: Continued Enforcement Intensity
On March 13, 2025, VARA issued another major wave of enforcement actions against 11 entities: MASTERCOIN DMCC, COIN ASKA DMCC, AIRDANCE GLOBAL FZCO, MERCY CRYPTO DMCC, MARINACOINS TECHNOLOGIES L.L.C, COINSBOOTH PAYMENT SERVICES CO L.L.C, TIRUPATI CAPITALS FZCO (“PAYCIO”), I TELLER COMMERCIAL BROKERS L.L.C, BLUEAXIS COMMERCIAL BROKERS LLC, and MYARBIT L.L.C-FZ.
Mid-2025: Escalating to More Complex Cases
The enforcement actions in May through August 2025 included cases with additional complexity:
- TRIPLE A TECHNOLOGIES PTE LTD (May 6, 2025) — a Singapore-based entity, demonstrating VARA’s willingness to take action against foreign entities serving Dubai customers
- MORPHEUS SOFTWARE TECHNOLOGY FZE (FUZE) (August 18, 2025) — the most complex enforcement case, combining unlicensed activities with regulatory breaches including AML programme failures and failure to disclose material information
- THE OPEN NETWORK FOUNDATION (July 24, 2025) — enforced for regulatory breaches (marketing regulation violations) rather than unlicensed activity
2026: Continued Enforcement
The January 13, 2026 action against VESTA PRIME PORTAL CO. L.L.C. demonstrates that VARA’s enforcement campaign continues into 2026, with no indication of reduced enforcement intensity.
Entity Categories Targeted
Analysis of the enforcement record reveals several categories of entities targeted:
Payment Service Providers and Commercial Brokers
A significant number of enforced entities operated as payment service providers or commercial brokers that facilitated crypto-to-fiat or fiat-to-crypto transactions. These entities — often operating physical exchange locations — provided basic virtual asset exchange services without VARA licensing.
DMCC-Registered Entities
Multiple enforcement targets were registered with the Dubai Multi Commodities Centre (DMCC), a free zone that hosted numerous crypto-related businesses before VARA’s licensing requirements came into full effect. While DMCC registration provided corporate legitimacy, it did not substitute for VARA licensing for virtual asset activities.
Free Zone Entities (FZCO/FZE)
Several entities registered in various Dubai free zones faced enforcement, demonstrating that free zone registration — regardless of the specific free zone — does not exempt entities from VARA licensing requirements for virtual asset activities.
International Entities
The action against TRIPLE A TECHNOLOGIES PTE LTD (Singapore) demonstrates that VARA’s jurisdiction extends to foreign entities providing virtual asset services to Dubai customers, regardless of where the entity is incorporated.
Enforcement Measures Applied
The enforcement actions follow a consistent pattern of measures:
Standard Package
The vast majority of enforcement actions result in:
- Cease-and-Desist Orders — requiring the entity to immediately stop all virtual asset activities
- Financial Penalties — monetary fines imposed for the regulatory violations
Enhanced Measures
In more complex cases, additional measures include:
- Appointment of a Skilled Person — as in the MORPHEUS SOFTWARE TECHNOLOGY FZE case, requiring the entity to engage an independent expert to review and remediate compliance failures
- Public Statement — as in THE OPEN NETWORK FOUNDATION case, issuing a public statement about the enforcement action and the entity’s violations
- Take-down Notices — requiring entities to remove websites or marketing materials
Lessons for Market Participants
1. Marketing Alone Is Sufficient for Enforcement
Several entities were enforced solely for “Advertising and Marketing virtual asset activities in Dubai” — even without evidence of directly conducting virtual asset transactions. This establishes that marketing virtual asset services to a Dubai audience is itself a regulated activity.
2. Free Zone Registration Is Not a Substitute for VARA Licensing
Entities registered in DMCC, DAFZA, or other Dubai free zones still require VARA licensing to conduct virtual asset activities. The free zone corporate licence does not authorize regulated activities.
3. International Entities Are Within Scope
Entities incorporated outside the UAE that provide virtual asset services to Dubai customers face enforcement risk from VARA.
4. Compliance Failures Compound Enforcement
The MORPHEUS SOFTWARE TECHNOLOGY FZE case demonstrates that compliance failures (AML programme controls, governance, disclosure) can compound unlicensed activity violations, resulting in more severe enforcement outcomes.
5. The Window for Voluntary Compliance Has Closed
The transition deadlines for legacy operators have expired. Entities currently operating without VARA licensing face immediate enforcement risk.
For the latest enforcement data, see our enforcement actions dashboard. For case studies of specific enforcement actions, see our analyses of VESTA PRIME PORTAL and MORPHEUS/FUZE.
For information on how to obtain proper licensing, see our licensing guide and how-to guide. For a comparison of enforcement approaches across UAE regulators, see our VARA vs ADGM analysis.
For broader regulatory enforcement intelligence, visit UAE Tokenization Regulations.
Comprehensive Enforcement Record
VARA’s enforcement campaign against unlicensed virtual asset service providers is the most visible expression of its regulatory authority. Through early 2026, the public enforcement record includes actions against entities spanning multiple free zone registrations, corporate structures, and violation types.
Complete Enforcement Timeline
January 2026:
- VESTA PRIME PORTAL CO. L.L.C. — Advertising and marketing unlicensed VA activities
August 2025:
- UAEC DIGITAL FINTECH FZCO — Engaging in and advertising unlicensed VA activities
- MORPHEUS SOFTWARE TECHNOLOGY FZE (FUZE) — AML failures, unlicensed activities, material non-disclosure
July 2025:
- THE OPEN NETWORK FOUNDATION — Marketing regulation breaches
May 2025:
- UEEX TECHNOLOGY LTD AND UEEX TECHNOLOGY SERVICES LLC
- LBK BLOCKCHAIN FZCO
- GLEEC DMCC
- TRIPLE A TECHNOLOGIES PTE LTD
- HATOM LABS FZCO
- HOKK FINANCE FZCO
April 2025:
- EA WORLD LLC-FZ
March 2025 (Batch Enforcement — 11 entities):
- MASTERCOIN DMCC
- COIN ASKA DMCC
- AIRDANCE GLOBAL FZCO
- MERCY CRYPTO DMCC
- MARINACOINS TECHNOLOGIES L.L.C
- COINSBOOTH PAYMENT SERVICES CO L.L.C
- TIRUPATI CAPITALS FZCO (PAYCIO)
- I TELLER COMMERCIAL BROKERS L.L.C
- BLUEAXIS COMMERCIAL BROKERS LLC
- MYARBIT L.L.C-FZ
February 2025:
- SHENZHOU CRYPTO DMCC AND REP. OFFICE
January 2025:
- A TO Z GLOBE DMCC
2024:
- ALMIZAN ALFEDHI PAYMENT SERVICE PROVIDER (and additional entities)
Patterns in Free Zone Registration
Enforcement targets have been registered across multiple Dubai free zones:
- DMCC: Shenzhou Crypto, A to Z Globe, Mastercoin, Coin Aska, Gleec, Mercy Crypto
- FZCO entities: UAEC Digital Fintech, LBK Blockchain, Airdance Global, Hatom Labs, HOKK Finance, Morpheus/FUZE, Tirupati Capitals
- LLC (mainland): Vesta Prime Portal, Marinacoins Technologies, Coinsbooth Payment Services, I Teller Commercial Brokers, BlueAxis Commercial Brokers
This distribution confirms that free zone registration does not provide exemption from VARA’s licensing requirements. Entities in any Dubai free zone — or mainland Dubai — require VARA authorisation for virtual asset activities.
Violation Categories
Most enforcement actions fall into two categories:
- Engaging in unlicensed virtual asset activities — actual operation of VA services
- Advertising and marketing virtual asset activities — promoting VA services without authorisation
Some entities face both violations, while others face only advertising violations (Vesta Prime Portal) or additional violations (FUZE’s AML failures and material non-disclosure).
Enforcement Trend Analysis
The enforcement record shows clear acceleration:
- Fewer, individual actions in 2024 (approximately 5 published actions)
- Batch enforcement emerging in early 2025 (March: 11 entities simultaneously)
- Complex enforcement developing mid-2025 (FUZE case with skilled person appointment)
- Continued enforcement into 2026 without pause
This trajectory suggests that VARA’s enforcement capabilities — surveillance, investigation, and action — are scaling rapidly. The November 2023 market notice warning that enforcement would “pick-up pace” proved accurate, and the pace continues to increase.
Impact on Market Dynamics
VARA’s enforcement campaign serves several market functions:
Deterrence: Each published action signals to potential unlicensed operators that VARA identifies and penalises non-compliance Market Integrity: Removing unlicensed operators reduces consumer risk and protects the reputation of Dubai’s regulated virtual asset ecosystem Competitive Fairness: Licensed entities including Binance Dubai, OKX Middle East, BitOasis, and others benefit when unlicensed competitors face enforcement Regulatory Credibility: The enforcement record demonstrates to international observers that VARA’s licensing requirements have real consequences
Enforcement as Market Development Tool
VARA’s systematic enforcement against unlicensed operators serves as a market development tool beyond its primary compliance function. By progressively clearing the market of unlicensed entities, VARA creates an environment where:
Licensed entities benefit from reduced competition from unregulated operators who may undercut on price by avoiding compliance costs. Entities like Binance Dubai, BitOasis, and Crypto.com Dubai invest significantly in compliance infrastructure — enforcement ensures this investment translates into competitive advantage rather than cost disadvantage.
Consumer trust increases as the distinction between licensed and unlicensed operators becomes clearer. The SCA-VARA unified register and VARA’s public VASP register enable consumers to verify licensing status before engaging with a virtual asset service provider.
International credibility strengthens as VARA’s enforcement record demonstrates that Dubai’s regulatory framework has real teeth. This credibility supports the UAE’s FATF assessment, facilitates banking relationships for licensed VASPs, and attracts institutional investment into Dubai’s regulated virtual asset ecosystem.
Regulatory precedent develops through the accumulation of enforcement cases. Each case — from simple unlicensed-activity orders to the complex FUZE case — builds the body of regulatory practice that guides future enforcement and compliance expectations.
The Free Zone Enforcement Pattern
VARA’s enforcement record reveals that unlicensed operators have been registered across virtually every major Dubai free zone — DMCC, DAFZA, IFZA, FZCO structures, and mainland LLCs. This comprehensive geographic coverage demonstrates that VARA’s surveillance extends across the entire emirate, not just specific free zones. The message is clear: no free zone provides a safe harbour for unlicensed virtual asset activities.