Dubai’s emergence as a global hub for virtual asset businesses is not an accident. It is the result of a deliberate, multi-year regulatory architecture that culminated in the establishment of the Dubai Virtual Assets Regulatory Authority (VARA), the world’s first dedicated virtual asset regulator at the city-state level. For Virtual Asset Service Providers (VASPs), token issuers, and Web3 founders evaluating Dubai as their operational base, understanding the VARA regulatory framework is no longer optional. It is the threshold question.
This guide sets out the current VARA compliance landscape as of 2026. It covers the substantial Rulebook 2.0 updates that took effect in June 2025, the new framework for virtual asset issuance, the operational requirements that separate a compliant VASP from a non-compliant one, and the enforcement risks that have made VARA one of the more active virtual asset regulators globally.

VARA was established in March 2022 under Dubai Law No. 4 of 2022 Concerning the Regulation of Virtual Assets in the Emirate of Dubai. Its jurisdiction covers Dubai mainland and the Dubai free zones, with one significant exception. The Dubai International Financial Centre (DIFC) remains under the separate regulatory authority of the Dubai Financial Services Authority (DFSA). Abu Dhabi Global Market is similarly regulated by its own Financial Services Regulatory Authority (FSRA).
At the federal level, the Securities and Commodities Authority (SCA) holds overarching authority over virtual assets pursuant to Cabinet Resolution No. 111 of 2022 on the Regulation of Virtual Assets and their Service Providers. By Cabinet Resolution No. 112 of 2022, the SCA delegated its licensing and supervisory powers in relation to Dubai-based VASPs to VARA. After the September 2024 cooperation agreement between VARA and the SCA, entities licensed by VARA are automatically registered with the SCA, which lets them operate throughout the UAE.
What this means in practice is a layered but coherent regulatory ecosystem. A VASP operating in or from Dubai mainland or a Dubai free zone (excluding DIFC) requires a VARA licence. That licence, once granted, brings federal recognition through the SCA. Activities in the DIFC need a DFSA authorisation, and activities in ADGM need an FSRA authorisation. The choice of jurisdiction is itself a significant strategic decision.

VARA’s licensing requirements apply to entities conducting any of the regulated Virtual Asset Activities defined in the Virtual Assets and Related Activities Regulations. The regulated activities include virtual asset exchange services, broker-dealer services, custody services, lending and borrowing services, payment and remittance services, advisory services, and virtual asset management services. Most recently, VARA’s 2025 Virtual Asset Issuance Rulebook has brought token issuance squarely within the licensing framework for specified categories of issuance.
Importantly, businesses are not permitted to offer regulated virtual asset services or activities in or from Dubai without VARA approval. The prohibition has been actively enforced. Between August 2024 and August 2025, VARA issued enforcement notices against 36 firms for violations including unlicensed virtual asset activities and unauthorised advertising. Operating without the required licence exposes the entity, its directors, and its officers to significant civil and criminal liability.

On 19 May 2025, VARA published Version 2.0 of its activity-based Rulebooks, with full compliance required by 19 June 2025. The update was substantial and reflects VARA’s transition from an early-stage regulator into one of the more sophisticated virtual asset regulators globally. Several changes deserve specific attention from compliance teams.

Rulebook 2.0 harmonised definitions across the previously activity-specific rulebooks. Key concepts like client assets, qualified custodians, and collateral standards are now applied consistently across exchange, broker-dealer, custody, lending, and transfer services. This reduces the previous risk of regulatory arbitrage between activity categories and brings Dubai’s framework more closely into line with the FATF standards and international best practice.

The updated rulebooks intensify the focus on market abuse, including wash trading, spoofing, layering, pump-and-dump schemes, and other forms of market manipulation. VASPs are required to implement dynamic, behaviour-based monitoring that incorporates both onchain and offchain signals into a unified picture of client conduct. Static rule-based systems no longer satisfy VARA’s supervisory expectations.
Suspicious Transaction Reports (STRs) must be filed through the UAE’s goAML portal in line with Federal Decree-Law No. 10 of 2025 on Combating Money Laundering. The expectations regarding the speed, completeness, and analytical quality of STRs have meaningfully increased under the new framework.

The introduction of a dedicated Virtual Asset Issuance Rulebook is among the most significant developments. Dubai became the first jurisdiction globally to codify virtual asset issuance in regulatory text, establishing a three-tier framework for token issuance.
Category 1 issuances cover Fiat-Referenced Virtual Assets (FRVAs) and a new category of Asset-Referenced Virtual Assets (ARVAs). ARVAs cover any virtual asset which represents or purports to represent current or future ownership of any Real-World Asset (RWA), including commodities, real estate, traditional financial instruments, and other tangible or intangible assets. Category 1 issuances require a VARA Category 1 issuance licence, a detailed whitepaper, a risk disclosure statement, substantial minimum capital (AED 1.5 million or two per cent of reserves, whichever is higher), monthly independent audits, and ongoing supervisory reporting.
Category 2 issuances cover other virtual asset issuances that fall outside Category 1 and outside the exempt categories. No VARA licence or prior approval is required for the issuer, but placement or distribution must be carried out through a VARA Licensed Distributor, which is then responsible for compliance verification.
Exempt Virtual Assets, the third category, cover non-transferable virtual assets and redeemable closed-loop virtual assets, with no issuance-stage VARA requirements.

Rulebook 2.0 expanded VARA’s supervisory powers, including rights of immediate access to all premises, data, books, and records of licensed entities. VARA additionally holds the power to suspend issuances, restrict activities, impose fines, and revoke licences. The VARA Grievance Committee, established in June 2023, provides an internal appeals mechanism for regulated entities seeking to challenge enforcement actions.

The VARA licensing process is a two-stage exercise that typically takes several months from initial engagement to operational approval. Stage one involves submission of a complete application covering corporate governance, ownership structure, fit-and-proper assessments of senior personnel, business plan, technology architecture, AML/CFT framework, risk management policies, capital adequacy, custody arrangements where applicable, and a detailed compliance manual.
Stage two, contingent on stage one approval, involves operational readiness verification. This includes independent audits of technology systems, demonstration of market surveillance capabilities, finalisation of regulatory reporting infrastructure, and confirmation of insurance and capital arrangements. Only after stage two clearance does the licence transition from pending to active operational status.
The application standards are exacting. The common reasons applications stall or fail are inadequate AML/CFT frameworks, insufficient demonstration of effective governance separation between business and compliance functions, weak technology controls particularly around custody and transaction monitoring, and unclear ownership structures involving jurisdictions of regulatory concern. Working with experienced counsel from the pre-application stage significantly improves both the speed and the success rate of applications.

Holding a VARA licence is not the end of the compliance journey. It is the beginning. VARA adopts a risk-based, outcomes-focused supervisory approach, which means firms have to demonstrate that their controls actually work in practice, not just on paper. The ongoing obligations include transaction monitoring and sanctions screening with periodic effectiveness validation, trade surveillance with documented evidence of false-positive and true-positive resolution, conflicts of interest management with centralised oversight of employee personal trading, outside activities, and relationships, fit-and-proper governance with continuous suitability assessment of senior managers, market conduct compliance under the expanded Market Offences provisions, and regulatory reporting in compliance with timeframes that have shortened under Rulebook 2.0.
VARA also requires VASPs to comply with the Marketing Regulations 2024. The Marketing Regulations apply to all entities including foreign entities marketing virtual assets to UAE persons, regardless of licensing status. The Marketing Regulations are accompanied by detailed Guidance and carry meaningful enforcement consequences for breach.

VARA has shown a clear willingness to enforce its rules. Enforcement actions to date have included formal warnings, public censures, financial penalties, suspension of regulated activities, and licence revocations. The reputational consequences of enforcement action extend beyond the immediate sanction. They affect banking relationships, investor confidence, and the ability to secure equivalent licensing in other jurisdictions.
For unlicensed actors, the consequences are more severe. Operating without a VARA licence where one is required exposes the entity and its principals to criminal prosecution under federal cybercrime legislation, civil claims from affected clients, regulatory penalties, and personal liability for directors and officers. The ‘crypto wild west’ narrative that some founders bring to the UAE from other jurisdictions has no application in Dubai.