The Foundation of Dubai’s Virtual Asset Regulatory Architecture
The Virtual Assets and Related Activities Regulations 2023 represent the foundational legal instrument through which the Virtual Assets Regulatory Authority (VARA) exercises its mandate over virtual asset activities in the Emirate of Dubai. Issued on 7 February 2023, these Regulations established what remains the most comprehensive standalone virtual asset regulatory framework operated by a dedicated, independent regulator anywhere in the world.
Understanding this regulatory instrument is essential for any entity considering VARA licensing, any compliance professional managing ongoing obligations, and any investor evaluating the regulatory environment surrounding licensed VASPs in Dubai.
Jurisdictional Scope and Applicability
The Regulations apply to all virtual asset activities conducted in or from the Emirate of Dubai, with one significant carve-out: the Dubai International Financial Centre (DIFC), which operates under its own regulatory authority, the DFSA. This jurisdictional delineation is a frequent source of confusion for incoming market participants and warrants careful attention.
VARA’s jurisdiction encompasses Dubai’s mainland and all free zones within the Emirate, including the Dubai World Trade Centre Authority (DWTCA) free zone, which serves as the primary hub for licensed virtual asset operations. The Dubai Multi Commodities Centre (DMCC), Dubai Silicon Oasis, Dubai Internet City, and all other Dubai free zones fall under VARA’s regulatory perimeter.
The practical effect of this scope is significant: any entity providing virtual asset services to customers in Dubai — regardless of where that entity is incorporated — must either hold a VARA licence or cease operations. The enforcement record makes this abundantly clear: of the 36+ entities subject to VARA enforcement actions through early 2026, the majority were penalized specifically for engaging in unlicensed virtual asset activities within Dubai’s jurisdiction.
Definition of Virtual Assets
The Regulations adopt a deliberately broad definition of “virtual assets” that encompasses cryptocurrencies, utility tokens, security tokens, stablecoins, and non-fungible tokens (NFTs), among other digital representations of value. This definition is materially broader than many comparable international frameworks and reflects VARA’s intent to future-proof its regulatory perimeter.
Critically, the definition includes virtual assets that are “used as a medium of exchange, unit of account, or store of value” — language that captures most forms of cryptocurrency — but also extends to assets that serve other functions, including governance tokens, protocol-native assets, and tokenized representations of real-world assets.
What falls outside the definition is equally important. Central bank digital currencies (CBDCs), conventional electronic money regulated by the Central Bank of the UAE (CBUAE), and certain securities already regulated under existing UAE federal legislation are excluded from VARA’s direct scope, though the boundaries remain subject to ongoing regulatory coordination between VARA and federal authorities.
Regulated Virtual Asset Activities
The Regulations define seven categories of regulated virtual asset activities, each of which requires specific licensing from VARA:
1. Advisory Services
Providing advice to clients on virtual asset transactions, portfolio management, or investment strategies. This category captures both traditional financial advisory services adapted for virtual assets and crypto-native advisory models.
2. Broker-Dealer Services
Acting as an intermediary in buying, selling, or exchanging virtual assets on behalf of clients. BitOasis, the first entity to receive a VARA MVP Operational Licence for broker-dealer services (May 2023), operates under this category.
3. Custody Services
Safekeeping and administration of virtual assets on behalf of clients. The August 2023 revision of the Custody Services Rulebook expanded this category to include staking from custody services, a significant market development.
4. Exchange Services
Operating a platform for the exchange of virtual assets, including both fiat-to-crypto and crypto-to-crypto trading. Major licensed exchanges operating in Dubai include Binance Dubai and OKX Middle East.
5. Lending and Borrowing Services
Providing lending or borrowing services involving virtual assets, including both centralized lending platforms and DeFi-adjacent lending protocols operating through licensed entities.
6. Payment and Remittance Services
Using virtual assets for payment processing or cross-border remittance services. This category intersects with CBUAE payment regulations, requiring careful compliance with both VARA and central bank requirements, as highlighted in the July 2025 circular on CBUAE PTSR Non-Objection Registration.
7. VA Management and Investment Services
Managing virtual asset portfolios or investment vehicles on behalf of clients, encompassing fund management, discretionary portfolio management, and collective investment schemes involving virtual assets.
Each activity category has a dedicated rulebook published by VARA, with Version 2.0 of all activity-based rulebooks released in May 2025 to “strengthen market integrity and risk oversight,” according to the official VARA announcement.
The Two-Step Licensing Process
The Regulations establish a two-step licensing process that every applicant must follow:
Step 1 — MVP Preparatory Licence: The initial licence stage requires applicants to demonstrate operational readiness, governance structures, compliance frameworks, and financial resources. During this phase, entities establish their operations in Dubai but cannot yet offer services to the public. Entities like Crypto.com Dubai (March 2023) and OKX Middle East (June 2023) received MVP Preparatory Licences as their initial regulatory approvals.
Step 2 — MVP Operational Licence: Upon satisfying all preparatory requirements and demonstrating operational capability, entities receive the operational licence permitting them to serve customers. This step involves additional scrutiny of technical systems, AML/CFT controls, and customer protection mechanisms.
The term “MVP” — Minimum Viable Product — is intentional and reflects VARA’s iterative approach to licensing. The framework is designed to allow licensed entities to begin operations with a defined scope of activities, with the potential for expansion as both the entity and the regulatory framework mature.
Compliance Framework Architecture
The Regulations establish several foundational compliance obligations that apply to all licensed VASPs:
Anti-Money Laundering and Counter-Terrorism Financing
VASPs must maintain comprehensive AML/CFT programmes compliant with both VARA rulebooks and UAE federal requirements. The March 2026 circular on “Implementation of the UAE Anti-Money Laundering, Counter-Terrorism Financing and Proliferation Financing Requirements Applicable to VASPs” represents the most recent strengthening of these obligations, requiring VASPs to align their programmes with the updated UAE Federal Decree-Law on AML/CFT/CPF published in November 2025.
The Virtual Assets Travel Rule, implemented through the February 2026 circular, imposes specific wire transfer-style information requirements on virtual asset transactions, requiring originator and beneficiary information to travel with transactions above specified thresholds.
Consumer Protection
The Regulations embed consumer protection requirements across all activity categories, including disclosure obligations, fair dealing requirements, complaint handling procedures, and asset segregation mandates. These requirements are designed to ensure that retail participants in Dubai’s virtual asset market receive protections comparable to those in traditional financial services.
Marketing Regulations
VARA’s marketing regulations, first issued in August 2022 as the earliest regulatory output from VARA, impose strict requirements on how virtual asset products and services may be advertised in Dubai. The enforcement action against THE OPEN NETWORK FOUNDATION in July 2025 — specifically for “Breaches of the VARA Marketing Regulations” — demonstrates that these requirements carry real enforcement consequences.
Risk Management
The Regulations require VASPs to implement enterprise-wide risk management frameworks, including operational risk, market risk, liquidity risk, and technology risk. The November 2025 guidance on “Rule III D Risk Assessments” provides additional detail on VARA’s expectations for risk assessment methodologies.
Governance and Internal Controls
Licensed VASPs must maintain governance structures that include qualified senior management, independent compliance functions, internal audit capabilities, and board-level risk oversight. These requirements reflect traditional financial services governance standards adapted for the virtual asset sector.
Enforcement Powers
The Regulations grant VARA extensive enforcement powers, detailed in our enforcement section. These include the authority to issue supervisory warnings, cease-and-desist orders, financial penalties, and licensing measures including suspension or revocation. The enforcement record as of early 2026 demonstrates active use of these powers, with actions against entities ranging from small local operators to international firms.
Relationship to UAE Federal Law
The Regulations operate within the broader UAE federal regulatory architecture. VARA coordinates with the Securities and Commodities Authority (SCA) at the federal level, as formalized in the July 2023 agreement establishing a “Unified VA Sector Register of Regulated VASPs for the UAE.” This coordination ensures that VARA’s Dubai-specific framework operates consistently with federal securities regulations.
The relationship with the CBUAE is equally important, particularly for VASPs involved in payment and remittance services or stablecoin issuance, where central bank regulations may apply alongside VARA requirements.
Version 2.0 Rulebooks — May 2025 Update
The May 2025 publication of Version 2.0 activity-based rulebooks marked the most significant update to the regulatory framework since its initial issuance. According to VARA’s announcement, the updated rulebooks aim to “strengthen market integrity and risk oversight” and represent “the latest milestone in Dubai’s ongoing commitment to delivering a future-ready regulatory environment.”
The update addressed several areas where the original rulebooks required refinement based on operational experience, including enhanced requirements for technology infrastructure, strengthened AML/CFT controls, and more detailed guidance on emerging activities such as staking and proprietary trading.
International Context and Comparative Position
VARA’s framework is frequently compared with the approaches taken by ADGM’s Financial Services Regulatory Authority (FSRA) in Abu Dhabi and the DFSA in the DIFC. While all three regulators oversee virtual asset activities within their respective jurisdictions, VARA is unique in being a standalone regulator dedicated exclusively to virtual assets, rather than a division or programme within a broader financial regulator.
Internationally, the framework is often benchmarked against Singapore’s MAS licensing regime, Hong Kong’s SFC/HKMA framework, and the EU’s Markets in Crypto-Assets (MiCA) regulation. For a detailed comparison of these approaches, see our VARA vs International Frameworks analysis.
Practical Implications for Market Participants
For entities considering entry to the Dubai virtual asset market, the Regulations establish several clear requirements:
All virtual asset activities require licensing — there is no exemption for small operators, foreign entities serving Dubai customers remotely, or entities operating through Dubai free zones other than the DIFC.
The licensing process is substantive — the two-step MVP process requires demonstrable compliance infrastructure, not merely corporate registration.
Ongoing compliance is monitored — VARA’s supervisory function provides continuous oversight, with enforcement consequences for non-compliance.
The framework is evolving — with 41 circulars and announcements issued through early 2026, VASPs must maintain active regulatory monitoring to stay compliant.
For detailed guidance on navigating the licensing process, see our Licensing Guide section. For understanding the enforcement landscape, see our Enforcement Tracker.
For intelligence on how Dubai’s framework compares with Abu Dhabi’s approach, see our VARA vs ADGM comparison. For broader UAE regulatory context, visit UAE Tokenization Regulations.
The Foundation of Dubai’s VA Regulatory Framework
The Virtual Assets and Related Activities Regulations 2023, published on February 7, 2023, are the foundational legal instrument establishing VARA’s regulatory authority over virtual assets in the Emirate of Dubai. These regulations replaced the earlier, less comprehensive framework under which VARA had been operating since its establishment, providing a structured legal basis for licensing, supervision, and enforcement.
Key Provisions
Scope and Jurisdiction: The Regulations define VARA’s jurisdiction as covering all virtual asset activities in the Emirate of Dubai, explicitly excluding the DIFC. This jurisdictional definition is critical — it establishes that VARA’s authority extends to all entities operating within Dubai (regardless of free zone registration) and to entities directing virtual asset services at Dubai customers from outside the emirate.
Regulated Activities: The Regulations define seven categories of regulated virtual asset activities that require VARA licensing: advisory services, broker-dealer operations, custody services, exchange operations, lending and borrowing, payment and remittance, and VA management and investment.
Enforcement Powers: The Regulations grant VARA a comprehensive enforcement toolkit including supervisory warnings, enforcement notices, cease-and-desist orders, financial penalties, licensing measures, supervisory add-ons, take-down notices, public interest orders, and other actions. Schedule 3 of the Regulations provides the framework for financial penalty calculation.
Licensing Framework: The Regulations establish the two-step MVP licensing process and define the standards for granting, modifying, and revoking licences.
Legacy Operator Transition
The April 2023 announcement — “Dubai’s DET and Free Zone Council activate applications for legacy virtual asset operators to become fully regulated under VARA” — described how the Regulations affected existing market participants. The announcement noted that the Regulations “establishes clear requirements for the VA sector to be fully regulated under VARA in the Emirate of Dubai, including all businesses offering products and services related to virtual assets.”
The March 2023 circular set a deadline of March 31, 2023, for existing operators to file for VARA registration or licensing, with the November 2023 market notice confirming that enforcement would intensify against entities that failed to engage.