Supervisory Warning

Definition

A supervisory warning is a formal written reprimand — also known as a breach letter or warning letter — issued by VARA to a virtual asset service provider or other entity that has been identified as non-compliant with specific regulatory requirements. Under the Virtual Assets and Related Activities Regulations 2023, VARA lists supervisory warnings as the first category in its enforcement toolkit, describing them as “issuing written reprimands.”

Supervisory warnings represent the lightest formal enforcement action in VARA’s graduated enforcement approach. They serve as documented regulatory signals that non-compliance has been identified and that the entity must address the identified deficiencies to avoid escalation to more severe enforcement measures.

Position in VARA’s Enforcement Hierarchy

VARA’s enforcement framework operates on a graduated basis, with supervisory warnings at the lower end and licence revocation, public interest orders, and skilled person appointments at the upper end:

1. Supervisory Warnings — Written reprimands identifying specific concerns (this entry)
2. Enforcement Notices — Formal orders requiring rectification within a specified period, potentially with daily penalties
3. Cease-and-Desist Orders — Directives requiring immediate cessation of specified activities
4. Financial Penalties — Monetary fines in accordance with Schedule 3 of the Regulations
5. Licensing Measures — Limiting, suspending, or revoking a licence
6. Supervisory Add-Ons — Additional monitoring, reporting, or compliance requirements
7. Take-Down Notices — Instructing entities to remove websites or publishing materials
8. Public Interest Orders — Restraining entities from activities harmful to the public interest
9. Skilled Person Appointments — As used in the FUZE case

Characteristics of Supervisory Warnings

Not Publicly Published

Unlike cease-and-desist orders and financial penalties, which appear on VARA’s public enforcement record, supervisory warnings are typically private communications between the regulator and the entity. This means the 36+ published enforcement actions on VARA’s record represent only the more severe end of the enforcement spectrum — the actual volume of supervisory engagement, including warning letters, is likely substantially higher.

Documented Regulatory Record

While not public, supervisory warnings create a documented record of non-compliance. If an entity receives multiple warnings without remediation, this record strengthens VARA’s case for escalating to more formal enforcement action. The documented history can influence penalty severity when formal enforcement eventually occurs.

Remediation Expectation

Supervisory warnings typically identify specific deficiencies and set expectations for remediation. The entity is expected to address the identified issues and demonstrate compliance within a reasonable timeframe. Failure to respond appropriately to a warning may trigger escalation to an enforcement notice or more severe action.

Application Across VARA’s Supervision

For Licensed Entities

Licensed VASPs including Binance Dubai, OKX Middle East, BitOasis, Crypto.com Dubai, Bybit Dubai, and Rain Financial are subject to ongoing VARA supervision. Areas where supervisory warnings might arise include:

• Deficiencies in AML/CFT programme implementation
• Delays in implementing Travel Rule requirements (February 2026 circular)
• Non-compliance with FATF high-risk jurisdiction screening requirements
• Marketing regulation breaches that do not rise to the level of formal enforcement
• Failures in qualified investor classification procedures
• Gaps identified during VARA’s review of rulebook v2.0 implementation

Enforcement Context

The Morpheus Software Technology (FUZE) case (August 2025) illustrates how compliance deficiencies can escalate beyond supervisory warnings. FUZE’s “failures in AML programme controls, related governance, compliance and internal systems and controls” resulted in formal enforcement action including financial penalties and skilled person appointment — suggesting that supervisory engagement had not achieved sufficient remediation.

Comparison with Other Jurisdictions

• ADGM FSRA: The Financial Services Regulatory Authority similarly uses private warnings as part of its supervisory approach before escalating to formal enforcement
• EU MiCA: National competent authorities under MiCA have similar graduated enforcement tools
• Singapore MAS: MAS uses supervisory actions including warning letters as part of its enforcement toolkit

For the full enforcement framework, see our enforcement section and enforcement actions dashboard. For related terms, browse our glossary.

The Role of Supervisory Warnings in Ongoing Supervision

Supervisory warnings are most relevant during VARA’s ongoing supervision of licensed entities, rather than in the enforcement of unlicensed operations. When VARA conducts supervisory reviews — examining a licensed VASP’s compliance programme, AML controls, or operational arrangements — minor deficiencies may be addressed through supervisory warnings rather than formal enforcement action.

This graduated approach benefits both the regulator and the regulated entity. VARA can address issues early without the resource intensity of formal enforcement proceedings, and the entity can remediate without the reputational impact of public enforcement action. However, the effectiveness of this approach depends on entities taking supervisory warnings seriously and implementing remediation promptly.

The November 2023 market notice indicating VARA’s transition to “full scale market operations” under CEO Matthew White signalled an intensification of supervisory activity. With 21 licensed VASPs under supervision and 41 circulars establishing compliance expectations, the volume of supervisory interaction — including supervisory warnings — has likely increased substantially since late 2023.