Enforcement Notice

Definition

An enforcement notice is a formal regulatory instrument issued by VARA requiring a virtual asset service provider or other entity to rectify identified non-compliance within a specified period of time. Under the Virtual Assets and Related Activities Regulations 2023, VARA describes enforcement notices as “issuing enforcement notices requiring non-compliance to be rectified within a specified period of time (accompanied if necessary with a periodic penalty payment / daily financial penalty).”

Enforcement notices occupy a distinct position in VARA’s enforcement toolkit, functioning as corrective instruments that give entities an opportunity to remedy breaches before more severe sanctions are applied. Unlike cease-and-desist orders, which require immediate cessation of activity, enforcement notices typically set a deadline for remediation.

Legal Basis and Mechanism

VARA’s authority to issue enforcement notices stems from the Virtual Assets and Related Activities Regulations 2023. The enforcement notice mechanism includes several components:

• Identification of Non-Compliance: The notice specifies the particular requirements that the entity has failed to meet
• Remediation Period: A defined timeframe within which the entity must bring itself into compliance
• Periodic Penalty Payments: Where necessary, enforcement notices can be accompanied by daily financial penalties that accrue for each day the non-compliance continues beyond the deadline
• Escalation Path: Failure to comply with an enforcement notice may lead to more severe actions including financial penalties, licence suspension, or cease-and-desist orders

Position in VARA’s Enforcement Toolkit

VARA’s enforcement framework provides a range of tools, from least to most severe:

1. Supervisory Warnings: Written reprimands (breach letters) identifying concerns
2. Enforcement Notices: Formal orders requiring rectification with deadlines and potential daily penalties
3. Cease-and-Desist Orders: Directives requiring immediate cessation of specified activities
4. Financial Penalties: Fines imposed in accordance with Schedule 3 of the Regulations
5. Licensing Measures: Limiting, suspending, or revoking a VASP licence
6. Supervisory Add-Ons: Additional monitoring, reporting, or compliance requirements
7. Skilled Person Appointments: Requiring an entity to engage an independent expert to assess or remediate deficiencies — as used in the FUZE case
8. Take-Down Notices: Instructing entities to remove websites or publishing materials
9. Public Interest Orders: Restraining entities from activities deemed harmful to the public interest

In VARA’s published enforcement actions through early 2026, enforcement notices are referenced as part of the action categories. The enforcement actions dashboard tracks all published enforcement measures.

Application in Practice

Against Licensed Entities

Enforcement notices are particularly relevant for licensed VASPs that may fall short of specific compliance requirements without rising to the level of deliberate misconduct. For example, a licensed entity that fails to implement the Travel Rule by the implementation deadline, or that has deficiencies in its AML programme identified during VARA’s supervisory review, might receive an enforcement notice requiring remediation rather than immediate licence revocation.

Against Unlicensed Entities

For unlicensed operators, enforcement notices may form part of a broader enforcement package alongside cease-and-desist orders and financial penalties. In such cases, the enforcement notice typically requires the entity to cease unlicensed activities and either apply for a licence or exit the market.

Enforcement Record Context

VARA has taken action against more than 36 entities through early 2026. Cases such as Vesta Prime Portal (January 2026) and UAEC Digital Fintech (August 2025) involved multiple enforcement tools deployed simultaneously. The Morpheus Software Technology (FUZE) case (August 2025) — involving AML programme failures, unlicensed activities, and material non-disclosure — required the most comprehensive enforcement response, including skilled person appointment.

Compliance Implications

Licensed entities including Binance Dubai, OKX Middle East, BitOasis, and Crypto.com Dubai must maintain compliance with VARA’s evolving requirements — including 41 circulars issued through early 2026 — to avoid receiving enforcement notices. Key areas of compliance risk include FATF high-risk jurisdiction screening, qualified investor classification, and rulebook v2.0 implementation.

For the full enforcement framework, see our enforcement section and guide to navigating VARA enforcement. For related terms, browse our glossary.

Distinction Between Enforcement Notices and Circulars

It is important to distinguish enforcement notices from VARA’s regulatory circulars. Circulars — of which VARA has issued 41 through early 2026 — are general regulatory communications applying to all licensed VASPs or the broader market. They establish or clarify compliance requirements. Enforcement notices, by contrast, are directed at specific entities in response to identified non-compliance.

However, circulars can create the conditions for enforcement notices. When VARA issues a circular establishing a new obligation (such as the February 2026 Travel Rule implementation circular), entities that fail to comply by the specified deadline may receive enforcement notices requiring rectification. This dynamic means that each new circular potentially creates new enforcement notice risk for licensed VASPs.

The increasing pace of circular issuance — four circulars in January-March 2026 alone — means that compliance teams at entities like Bybit Dubai and Rain Financial must continuously monitor, interpret, and implement new requirements to avoid enforcement action.