VARA — Virtual Assets Regulatory Authority Profile

Entity Overview

The Virtual Assets Regulatory Authority (VARA) is the world’s first independent regulator dedicated exclusively to virtual assets. Established under the Dubai World Trade Centre Authority (DWTCA), VARA is responsible for regulating and overseeing the provision, use, and exchange of virtual assets in and from the Emirate of Dubai, excluding the Dubai International Financial Centre (DIFC). VARA describes itself as “a transparent and trusted guiding authority for the emerging world of virtual assets” with a mission to “take its mission global by creating an easy to replicate framework to regulate the industry.”

VARA occupies a unique position in the global regulatory landscape. While other jurisdictions have assigned virtual asset oversight to existing financial regulators — the SEC and CFTC in the United States, the FCA in the United Kingdom, MAS in Singapore, or the FSRA within ADGM — Dubai created a purpose-built regulator focused exclusively on the virtual asset sector. This structural decision reflects Dubai’s assessment that virtual assets warrant specialised regulatory attention rather than adaptation of legacy financial services frameworks.

Regulatory Mandate

VARA’s mandate encompasses all virtual asset activities within its jurisdiction, including advisory services, broker-dealer operations, custody services, exchange operations, lending and borrowing, payment and remittance services, and VA management and investment services. The authority’s regulatory framework is built on the Virtual Assets and Related Activities Regulations 2023, which established clear requirements for all entities providing virtual asset products and services in the Emirate of Dubai.

The mandate extends to both entities physically present in Dubai and those directing virtual asset services at Dubai-based customers from other jurisdictions. This extraterritorial dimension of VARA’s authority has been demonstrated through enforcement actions against entities registered in various Dubai free zones — including DMCC, DAFZA, IFZA, and others — that conducted virtual asset activities without VARA authorisation.

VARA’s regulatory philosophy rests on what it describes as “the principles of economic sustainability, consumer protection and cross-border financial security.” This three-pillar approach shapes the design of its rulebooks, circulars, and enforcement strategy, aiming to balance innovation enablement with investor protection and financial crime prevention.

Key Regulatory Instruments

VARA’s regulatory output has been prolific. The following instruments form the core of its framework:

• Virtual Assets and Related Activities Regulations 2023 — Foundational regulatory framework issued February 7, 2023, establishing the legal basis for VARA’s authority over all VA activities in Dubai (excluding DIFC)
• Version 2.0 Activity-Based Rulebooks — Updated May 2025 to “strengthen market integrity and risk oversight,” described as “the latest milestone in Dubai’s ongoing commitment to delivering a future-ready regulatory framework”
• Marketing Regulations — First issued August 2022, the earliest VARA regulatory output, establishing standards for advertising and promotional materials related to virtual assets
• Custody Services Rulebook (Amended) — August 2023, permitting staking from custody services within prescribed requirements
• Asset Reference Token Rules — October 2023, described as “the first-of-its-kind regulatory position on issuance of specific categories of Virtual Assets backed by Real World Assets”
• Proprietary Trading Licence Code — May 2023, creating a distinct licence category for proprietary VA trading

Circulars and Regulatory Guidance

VARA has issued 41 circulars and announcements through early 2026, covering:

• AML/CFT/CPF Requirements: Multiple circulars establishing and updating anti-money laundering obligations, including the March 2026 implementation circular on UAE AML requirements applicable to VASPs
• Virtual Assets Travel Rule: February 2026 implementation circular mandating originator and beneficiary information exchange
• FATF High-Risk Jurisdictions: Periodic updates on enhanced measures for jurisdictions identified by the Financial Action Task Force, including the January 2026 circular based on October 2025 FATF lists
• Qualified Investor Classification: January 2026 circular on onboarding and classification requirements
• UAE Federal AML Decree-Law: November 2025 circular requiring mandatory gap assessment for VASPs
• EOCN Sanctions Screening: November 2025 updated guidance on targeted financial sanctions
• CARF Consultation: October 2025 public consultation on UAE implementation of the Crypto-Asset Reporting Framework
• UAE National Risk Assessment: June 2025 circular on the updated NRA on AML
• Risk Assessment Guidance: November 2025 guidance on Rule III D risk assessments

The pace of circular issuance has accelerated: VARA published four circulars in January-March 2026 alone, indicating an increasingly active supervisory posture as the regulatory framework matures.

Leadership

VARA’s leadership transition reflects the authority’s evolution from start-up regulator to full-market operations:

• Henson Orser served as inaugural CEO, guiding VARA through its establishment phase and the development of its initial regulatory framework
• Matthew White was appointed as new CEO in November 2023 to lead VARA through “its next phase of ramp up to full scale market operations.” The transition was described as VARA moving “to full-market operations with leadership transition”

The CEO transition coincided with VARA’s shift from primarily licensing-focused activity to a more balanced programme encompassing ongoing supervision, enforcement, and regulatory development. Under White’s leadership, VARA has expanded its enforcement activity, published the v2.0 rulebooks, and accelerated circular issuance.

Enforcement Record

VARA has taken public enforcement action against 36+ entities for unlicensed virtual asset activities and regulatory breaches. The enforcement record demonstrates a systematic approach to market integrity:

2026 Enforcement Actions:

• VESTA PRIME PORTAL CO. L.L.C. — January 2026, penalised for advertising and marketing virtual asset activities without a licence

2025 Enforcement Actions:

• UAEC DIGITAL FINTECH FZCO — August 2025, penalised for engaging in and advertising unlicensed activities
• MORPHEUS SOFTWARE TECHNOLOGY FZE (FUZE) — August 2025, the most complex case involving AML programme failures, unlicensed activities, failure to disclose material information, and appointment of a skilled person
• THE OPEN NETWORK FOUNDATION — July 2025, penalised for breaches of VARA Marketing Regulations (the first enforcement action focused specifically on marketing violations by a known project)
• UEEX TECHNOLOGY, LBK BLOCKCHAIN, GLEEC DMCC — May 2025, batch enforcement for unlicensed activities
• TRIPLE A TECHNOLOGIES, HATOM LABS, HOKK FINANCE — May 2025, further batch enforcement
• EA WORLD LLC — April 2025, unlicensed activities
• Eleven entities simultaneously — March 2025, the largest single batch enforcement action

2024-Earlier:

• SHENZHOU CRYPTO DMCC — February 2025
• A TO Z GLOBE DMCC — January 2025
• Multiple entities throughout 2024

The enforcement toolkit includes supervisory warnings, cease-and-desist orders, financial penalties, licensing measures, public statements, take-down notices, and the appointment of skilled persons. The FUZE case introduced the skilled person remedy, demonstrating VARA’s ability to impose remediation measures beyond financial penalties.

Licensing Activity

VARA administers a two-step licensing process comprising MVP Preparatory and MVP Operational licence stages. The process requires detailed submissions covering corporate governance, technology infrastructure, AML/CFT programme design, risk management, financial resources, and fitness-and-propriety of key personnel. As of 2026, VARA has licensed approximately 21 VASPs across seven activity categories.

Licensed entities include major international exchanges (Binance Dubai, OKX Middle East, Crypto.com Dubai, Bybit Dubai), regional platforms (BitOasis, Rain Financial), and specialised service providers. BitOasis achieved the distinction of being the first broker-dealer to secure the full MVP Operational Licence in May 2023.

The fee structure for VARA licensing was clarified in a June 2023 announcement covering NOC issuance, amendments, withdrawal of licence applications, and whitepaper submissions.

Key Relationships

• SCA Coordination: July 2023 agreement with the Securities and Commodities Authority to maintain a unified VA sector register across the UAE, ensuring regulatory clarity at the federal level
• DET Partnership: August 2023 MOU with Dubai’s Department of Economy and Tourism establishing “best-in-class market assurance standards” and an “integrated city model for Consumer Protection and Responsible VA Operations”
• CBUAE Interface: Coordination on payment token service requirements, stablecoin regulation, and the July 2025 circular on CBUAE PTSR Non-Objection Registration requirements
• DWTCA: Institutional home providing administrative infrastructure, publishing systems, and free zone services
• UAE Financial Intelligence Unit: Reporting channel for suspicious activity reports filed by licensed VASPs, with the May 2025 circular on IEMS requirements

Comparison with Other Regulators

VARA’s position as a dedicated virtual asset regulator distinguishes it from other UAE and international regulatory bodies:

• vs ADGM FSRA: ADGM’s Financial Services Regulatory Authority regulates virtual assets within its broader financial services framework, applying common law principles within the ADGM free zone in Abu Dhabi
• vs DFSA: The Dubai International Financial Centre’s regulator maintains its own approach to virtual assets within the DIFC
• vs EU MiCA: The EU’s Markets in Crypto-Assets regulation takes a harmonised pan-European approach, contrasting with VARA’s emirate-level jurisdiction
• vs Singapore MAS: MAS regulates virtual assets through its existing financial regulatory architecture, unlike VARA’s dedicated approach
• vs Global Regulators: Comparative analysis across multiple regulatory models

Contact Information

• Website: vara.ae
• Regulations: rulebooks.vara.ae
• Email: Available through VARA’s contact page

For analysis of VARA’s regulatory framework, see our VARA Framework section. For licensing guidance, enforcement data, and regulatory comparisons, explore the relevant sections of this platform. For complementary intelligence on federal UAE regulation, visit UAE Tokenization Regulations.

VARA’s Institutional Evolution

VARA’s evolution from a newly established regulator to a mature supervisory authority has occurred at a pace unusual in financial regulation. Key institutional milestones include:

• 2022: Establishment, first regulations (marketing), first major licences (Binance Dubai)
• 2023: Foundational regulations, first operational licences (BitOasis), 15 circulars, DET partnership, SCA coordination, CEO transition to Matthew White
• 2024: Enforcement scaling, ongoing licensing
• 2025: v2.0 rulebooks, 30+ enforcement actions, complex FUZE case, batch enforcement (11 entities in March), 15+ circulars
• 2026: Continued enforcement (Vesta Prime Portal), four circulars in first quarter alone

This trajectory demonstrates institutional capacity building that typically takes traditional financial regulators decades to achieve. VARA’s dedicated focus on a single sector — virtual assets — enables this acceleration by concentrating expertise and resources.