An overview of the regulation of virtual assets in Dubai (UAE)

Regulation of virtual assets and offerings of virtual assets in Dubai (UAE)

Regulation of VASPs in Dubai (UAE)

Regulation of other crypto-related activities in Dubai (UAE)

Other relevant regulatory information

Pending litigation and judgments related to virtual assets in Dubai (UAE) (if any)

Government outlook on virtual assets and crypto-related activities in Dubai (UAE)

Advantages of setting up a VASP in Dubai (UAE)

1. Virtual asset laws and regulations in Dubai (UAE)

Dubai has been at the forefront of developing its virtual assets regulatory landscape. In March 2022, Dubai enacted the Regulation of Virtual Assets law (VAL) and established the Dubai Virtual Assets Regulatory Authority (VARA) to oversee the regulation of virtual assets in Dubai. The VARA is responsible for licensing and regulating virtual assets, including crypto assets, digital assets, and NFTs, across Dubai’s mainland and free zone territories, except for the Dubai International Financial Centre (DIFC). Additionally, Dubai Multi Commodities Centre Authority (DMCCA) and Dubai Airport Freezone Authority (DAFA) both have their own regulatory frameworks for virtual assets, aimed at aligning with the requirements laid out in the SCA Virtual Asset Regulation Framework.

What is considered a virtual asset in Dubai (UAE)?

As per the definition given in Law No.4 of 2022 on the regulation of VAL, a ‘virtual asset’ is a digital representation of value which can be digitally traded or transferred or used as an exchange or payment tool for investment purposes and does not include digital representation of fiat currencies or financial securities and a ‘virtual token’ is a digital representation of a group of rights which can be issued and traded digitally through a virtual asset platform (a platform operated by a virtual asset provider licensed by VARA).

What are the relevant laws and regulations in Dubai (UAE)?

Here is an outline detailing the applicable laws on virtual assets in Dubai and their evolution:

1. Sharia Ruling on Cryptocurrencies (Fatwa No. 89043): In 2018, the UAE’s General Authority for Islamic Affairs and Endowments issued a fatwa (89043) declaring Bitcoin and cryptocurrencies ineligible for trading. According to Sharia criteria, these virtual currencies lack state recognition, making them impermissible under Islamic law.
   While the quoted fatwa deems cryptocurrencies impermissible, it notes that regulated and authorities-adopted cryptocurrencies may become permissible.
2. Law No. 4 of 2022: Regulating Virtual Assets in the Emirate of Dubai was enacted to establish regulatory framework governing activities and operations related to virtual assets. The Objective was to regulate and oversee the issuance, offering, and relevant disclosure processes of virtual assets and virtual tokens in Dubai.
3. Cabinet Resolution No. 111/2022: Regulating Virtual Assets and their Service Providers was brought out to regulate virtual assets and their service providers in the UAE, to put in place legislation, to define and ensure the rights and duties of all relevant parties, regulate the virtual asset sector, comply with provisions related to Combating Money Laundering and the Financing of Terrorism and Illegal Organisations.
4. Cabinet Decision No. 112/2022: Was issued to delegate certain competencies related to the regulation of Virtual Assets to the Dubai VARA, to ensure proper implementation of the provisions of Cabinet Decision No. 111/2022 as well as to establish a unified and appropriate work mechanism to regulate the process of supervision and control over VASPs licensed by the Dubai VARA, and the mechanism for sharing fees, commissions, and fines.
5. Administrative Order No.01/2022: issued by the Dubai VARA in January 2022, aimed to regulate marketing, advertising, and promotional activities related to virtual assets within Dubai. This order introduced key definitions and applied to all forms of marketing, promotional, and advertising content connected to virtual assets or virtual asset-related activities. It outlined various compliance requirements for entities involved in such activities and granted VARA the authority to take corrective measures in case of non-compliance. These measures included the right to suspend marketing activities, impose fines, or revoke the licenses of entities that failed to meet the prescribed standards. In 2023, the regulations governing marketing activities were updated and revised as part of VARA’s Marketing and Promotions Rules, expanding the scope of marketing regulations to ensure enhanced transparency and consumer protection. These revised rules will take effect from October 1, 2024.
6. Administrative Order No.02/2022: issued in March 2022, built upon the marketing regulations established under the Dubai Virtual Asset Law, ensuring that marketing and advertising related to virtual assets are conducted in a manner that is non-misleading and compliant with VARA’s standards. The primary objective of this order was to safeguard consumers from deceptive marketing practices while promoting fair advertising in the virtual asset space. The penalties for non-compliance were stringent, allowing VARA to impose fines of up to AED 200,000 for each violation, suspend marketing activities for up to six months, revoke any licenses issued by VARA, and require entities to make public statements acknowledging their violations. These provisions have also been updated in alignment with the broader Virtual Assets and Related Activities Regulations 2023, with the new rules scheduled to be enforced starting October 1, 2024.
7. The Virtual Assets and Related Activities Regulations 2023: were initially issued on February 7, 2023, to establish a comprehensive regulatory framework for VASPs. These regulations were designed to address licensing, compliance, market conduct, and consumer protection in the virtual asset sector. Supervision and enforcement by VARA included oversight, examination, and the authority to investigate and impose fines for non-compliance with anti-money laundering and counter-terrorism financing obligations. It established a compliance framework with clear obligations, marketing regulations, and enforcement measures to maintain market integrity. Information protection was prioritised, extending to safeguarding against unauthorised disclosure or use.
   Since their issuance, these Regulations have undergone several amendments. It includes expanded definitions that now cover a broader range of services, such as advisory roles, decentralised finance (DeFi), and custodial services. In addition, stricter marketing regulations have been introduced, focusing on transparency and consumer protection. These rules require entities to clearly disclose risks associated with virtual assets in all marketing materials, ensuring that consumers are well-informed. Furthermore, new licensing requirements have been established, obliging all entities engaged in virtual asset marketing to obtain specific licenses tailored to their activities. The updated framework also introduces a graduated penalty system, categorising breaches based on severity, with corresponding penalties designed to enforce compliance effectively. These penalties range from fines to more severe measures such as the suspension or revocation of licenses, depending on the nature of the violation. The latest amendments to the VARA Regulations are scheduled for enforcement on October 1, 2024.

Compulsory Rulebooks

1. The Company Rulebook: Governing VASPs licensed by the VARA in Dubai, explains crucial requirements for company operations. The rules state that VASP Boards need qualified individuals overseeing procedures, and Senior Management must be qualified, working under Board direction. Outsourcing deals should cover notice periods, finances, and service standards. Policies addressing conflicts of interest and regular fitness assessments for staff are important. For transactions with related parties, monthly reports to VARA are required, with document submission if requested. VARA can revoke or suspend approvals if fit and proper requirements aren’t met by individuals or VASPs.
2. The Compliance and Risk Management Rulebook: Covers general principles for managing compliance risks, mandates effective compliance systems, and designates duties for the Compliance Officer. In addressing Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT), it requires a Money Laundering Reporting Officer (MLRO) and sets criteria for client due diligence. The Rulebook also prohibits corrupt payments, emphasising strict compliance with anti-bribery and corruption rules.
3. The Technology and Information Rulebook: Is designed to enhance safety for VASPs and protect individuals during virtual asset transactions. It establishes mandatory requirements across three parts: Part I focuses on technology governance and security measures, including cybersecurity policies and virtual asset transaction security; Part II addresses personal data protection, ensuring compliance with relevant laws and regulations; and Part III outlines guidelines for VASPs to use and protect confidential information.
4. The Market Conduct Rulebook: Sets specific guidelines for VASPs to regulate their behavior, focuses on marketing regulations, client agreements, and complaints handling. The Rulebook defines who can invest in virtual assets and requires VASPs to disclose key information publicly. Market transparency is emphasised, prohibiting VASPs from trading virtual assets for their own accounts without authorisation from the VARA.

VA Activity and other Service Rulebooks

1. The Advisory Services Rulebook: For VASPs ensures transparent, client-centric advice and adherence to VARA regulations. It mandates clear risk disclosure, unbiased advice, and the collection of client information for tailored recommendations. The rulebook underscores staff competency, fact-checking for accuracy, and encourages VASPs to assess diverse virtual assets, providing clients with varied investment options.
2. The Broker Dealer Service Rulebook: Establishes specific rules and guidelines, focusing on investor protection, fair treatment, and the prevention of abusive practices. The rulebook sets minimum requirements and regulatory obligations for various areas, including best execution, market conduct, technology, information, compliance, risk management, and capital/prudential requirements. Applicable to all Emirate-based VASPs offering broker-dealer services, irrespective of size, the rulebook covers policies and procedures for detecting and preventing market offenses, ensuring best execution for client orders, and establishing rules for margin trading, including information collection and segregation of client accounts.
3. The Custody Service Rulebook: It is designed to assist VASPs in managing risks associated with custody services. It provides guidelines including a comprehensive framework for the safekeeping of virtual assets, segregation measures to minimise internal failure risks, and operational risk management policies. The Rulebook mandates regular independent internal audits and requires disclosure of client protections, data privacy, client complaints handling, and whistleblowing policies.
4. The Exchange Service Rulebook: This is a vital set of guidelines for VASPs offering Exchange Services in the Emirate of Dubai, impacting crypto traders in the UAE. The rules cover board requirements, internal policies, disclosure of conflicts of interest, client privacy, and complaint handling. They also address Exchange Services rules, including trading venue participants, code of conduct, business continuity, and market surveillance. Specific regulations for margin trading, such as compliance, VARA approval, obligations, prudential requirements, margin agreements, and dispute resolution, are outlined. Overall, these guidelines aim to ensure compliance and risk management in the crypto trading sector in Dubai.
5. The Lending and Borrowing Service Rulebook: Emphasises risk mitigation through liquidity and collateral standards, reinforced by accountability through regular audits. Key requirements include maintaining sufficient virtual assets, regular collateral monitoring, and notifying clients about non-withdrawable virtual assets. The rulebook also explains reporting practices, due diligence assessments, and independent third-party audits for risk management. Overall, it sets clear guidelines to ensure transparency, risk mitigation, and regulatory compliance in lending and borrowing services provided by VASPs.
6. The VA Management and Investment Service Rulebook: Provides guidelines on client suitability, ensuring VASPs only serve clients suitable for their services based on experience and financial situation. The rulebook emphasises the importance of written client agreements, covering terms like account termination, asset value fluctuation, and complaint procedures. VASPs are required to disclose all fees transparently to avoid confusion, ensuring they are neither excessive nor unclear. Additionally, the rulebook explains the need for effective risk management, requiring VASPs to monitor and promptly address liquidity and market risks.
7. The VA Transfer and Settlement Service Rulebook: Aims to enhance efficiency and risk awareness in the virtual asset landscape by emphasising policies for rectifying incomplete transfers. Key provisions include addressing non-executed or defectively executed transfers, ensuring client authorisation for all transfers, and maintaining client instruction records for at least eight years. The rulebook also stresses risk disclosure to inform clients about potential issues, such as irreversible transactions and technical difficulties. It emphasises timely execution of transfers and sets clear guidelines for smooth processes, risk awareness, and client protection in virtual asset transfer and settlement services.
8. The VA Asset Issuance Rulebook: Sets rules for creating and using virtual assets. It focuses on how issuers should behave, what information they must share in a whitepaper, and the ongoing rules they must follow after creating virtual assets. The rulebook requires Issuers to get approval and follow specific processes laid down by the VARA. Issuers are not allowed to use virtual assets for illegal activities, and they have to follow rules related to supervision and checks by VARA.
9. The Fiat Referenced Virtual Asset (FRVA) Rulebook: An annexure to the VA Issuance Rulebook, lays out rules for issuing Fiat Referenced Virtual Assets. It covers approval requirements, due diligence, risk management, corporate governance, audits, and reserve assets. The rulebook adds disclosures about reference currency, FRVA creation and redemption policies, and marketing guidelines for transparency. Capital requirements ensure issuer stability, including paid-up capital, net liquid assets, insurance, and VARA-defined needs. Crucially, the rulebook prohibits FRVA issuers from offering incentives for purchasing or holding FRVAs.

Who do such laws and regulations apply to?

The virtual assets laws and regulations in Dubai apply to all Virtual Assets and VA Activities in the Emirate. Here is a list of entities and individuals to whom the virtual assets laws and regulations apply in Dubai, based on the Virtual Assets and Related Activities Regulations 2023 issued by VARA:

1. Any individual or entity conducting Virtual Asset Activities in the Emirate of Dubai, including free zones and special development zones.
2. Any person or entity issuing Virtual Assets in the course of a business within Dubai.
3. Any person or entity that intends to provide Virtual Asset Services in Dubai including an exchange, custodian wallet provider.
4. Any person or entity intending to engage in large proprietary trading in Virtual Assets.
5. Anyone that is required to carry out an AML/CFT risk assessment for its business relating to Virtual Assets in Dubai.

Who are the relevant regulatory authorities in relation to virtual assets in Dubai (UAE)?

1. VARA: The VARA (VARA) enacted under Law No. 4 of 2022, is affiliated with the Dubai World Trade Centre Authority (DWTCA), has a clear mission: overseeing the legal framework for businesses dealing with virtual assets in Dubai. This includes crypto assets, digital assets, and Non-Fungible Tokens (NFTs). VARA is in charge of licensing and regulation across Dubai’s mainland and free zones (excluding Dubai International Financial Centre).
2. Central Bank of the UAE: The Central Bank of the United Arab Emirates plays a role in overseeing financial activities, including aspects related to virtual currencies, across the entire UAE, including Dubai.
3. Securities and Commodities Authority (SCA): The SCA is a UAE-wide regulatory authority overseeing securities and commodities activities, which may include aspects related to virtual currencies.
4. Ministry of Economy: The Ministry of Economy is involved in shaping the overall economic policies of the UAE and may play a role in the broader regulatory landscape.
5. Dubai Multi Commodities Centre (DMCC): The DMCC is a free zone authority that has shown interest in fostering blockchain and crypto-related businesses. While it may not be a regulatory authority, it plays a role in supporting the growth of such businesses within its free zone.

VARA, under DWTCA, takes charge of licensing and overseeing the virtual asset sector in Dubai’s mainland and free zones, excluding the DIFC. Any laws in Dubai or its free zones conflicting with the Virtual Assets Law get canceled out. However, it’s to note that federal laws, especially those from the Central Bank and Securities and Commodities Authority, still apply. Hence, if there’s any overlap with activities related to virtual assets, one must also consider them. An understanding has been established between the SCA and DWTCA since 2021, specifically regarding the offering, regulation, issuance, and trading of virtual assets within the DWTCA’s free zone.

What are the penalties for breaches of virtual asset laws and regulations in Dubai (UAE)?

The Virtual Assets and Related Activities Regulations 2023, alongside the Rulebooks issued by the VARA, detail penalties and fines for non-compliance. VARA has discretionary powers to enforce actions against entities violating laws, regulations, or directives. These actions range from written reprimands to fines, additional supervision, monitoring, or reporting requirements, as determined by VARA. The fine amounts are described in Schedule 3 of The Virtual Assets and Related Activities Regulations 2023, categorising violations from high to low seriousness, based on the nature and severity of violations:

1. Category 1: Violations related to market offenses, compliance, risk management, conduct, or offenses not covered elsewhere. Entities may face fines up to AED 100 million.
2. Category 2: Violations related to Virtual Asset Activities, including unauthorised engagement, KYC obligations, reporting, and (AML/CFT) requirements. Individuals may incur fines up to AED 50 million, while corporate entities may face fines up to AED 100 million.
3. Category 3: Violations not falling under Categories 1 and 2, pertaining to other regulations or directives. Entities may be fined from AED 5 million to AED 15 million.

VARA has emphasised that violators may be required to disgorge profits or avoid losses, with amounts potentially exceeding the previously stated limits, specifically up to 300% of the profits gained or losses avoided.

Regulations specify grounds for fines based on factors like carrying out VA Activities in violation, issuing a Virtual Asset unlawfully, misrepresenting to the public, and breaching Ultimate Beneficial Owner disclosure requirements. VARA considers factors like the nature, seriousness, and impact of the violation, whether it constitutes a market offense, the entity’s conduct post-violation, its disciplinary record, VARA’s published materials, and actions by other regulatory bodies.

Furthermore, VARA can suspend authorisation issuance, suspend or revoke virtual asset service provider activities, and suspend dealings with virtual assets in specific situations. A Board of Directors resolution from the DWTC Authority describes acts constituting a Virtual Assets Law violation and corresponding penalties. VARA has broader authority to suspend or revoke licenses for VASPs for a period exceeding six months in cases of severe non-compliance. Coordination with the relevant commercial licensing authority in Dubai may lead to the cancellation of the entity’s trade license. Violating the Virtual Assets Law carries substantial penalties and broad consequences.

2. Regulation of virtual assets and offerings of virtual assets in Dubai (UAE)

Are virtual assets classified as ‘securities’ or other regulated financial instruments in Dubai (UAE)?

Virtual assets are not classified as securities or regulated financial instruments in Dubai; rather, they are defined as a digital representation of value that is tradeable and their regulation falls under the recently established VARA according to the Law No.4 of 2022 on the Regulation of Virtual Assets.

As per the definition given in Law No.4 of 2022 on the regulation of Virtual Assets, a ‘virtual asset’ is a ‘digital representation of value which can be digitally traded or transferred or used as an exchange or payment tool for investment purposes and does not include digital representation of fiat currencies or financial securities’ and a ‘virtual token’ is a ‘digital representation of a group of rights which can be issued and traded digitally through a virtual asset platform (a platform operated by a virtual asset provider licensed by VARA)’.

Though, according to the Virtual Assets and Related Activities Regulations 2023, the VARA has the power to classify or provide clarification on any Virtual Asset or type of Virtual Asset as being regulated by the Central Bank of UAE or as being prohibited in the Emirate. Therefore, virtual assets may or may not be classified as securities or other regulated financial instruments depending on VARA’s classification or clarification.

Are stablecoins and NFTs regulated in Dubai (UAE)?

Stablecoins: Stablecoins are indeed regulated in Dubai under a framework established by the CBUAE and the VARA:

1. Fiat Referenced Virtual Assets (FRVAs) are not considered legal tender and are not issued or guaranteed by any government or central bank. They differ from virtual assets representing equity claims or central bank digital currencies (CBDCs).
2. The CBUAE has developed a regulatory framework for stablecoins, particularly those pegged to the UAE Dirham (AED). This framework was approved on June 3, 2024, and aims to provide clear guidelines for licensing and oversight of stablecoin arrangements.
3. The reserves backing stablecoins must comply with the regulations set forth by the CBUAE and VARA. These reserves must:
   • Consist primarily of cash, with only a minor portion (up to 10%) allowed in high-quality liquid assets.
   • Be denominated in the reference currency (AED).
   • Be held in segregated accounts with regulated banks or custodians in jurisdictions meeting FATF standards.
   • Always have a value exceeding the total volume of payment tokens in circulation.
4. The regulatory framework outlines requirements for VARA approval, additional disclosures, and marketing rules for VASPs issuing FRVAs.
5. VASPs must demonstrate sufficient technical capability and financial resources to ensure the stable backing of FRVAs.
6. VASPs must adhere to licensing requirements, technology standards, data protection policies, and anti-money laundering regulations.
7. VARA holds the authority to impose additional conditions on FRVA issuance beyond standard requirements.
8. Failure to comply with these regulations can lead to revocation of approval or other regulatory actions.

The CBUAE’s new regulations will only allow businesses in the UAE to accept dirham-backed stablecoins for transactions, restricting the use of foreign stablecoins like Tether or USDC for payments related to goods and services. Foreign payment tokens may still be used for specific virtual asset purchases, fostering a structured environment for crypto transactions while maintaining regulatory compliance.

NFTs: In Dubai, NFTs are regulated under the framework established by the Dubai VARA. Although NFTs are not automatically classified as virtual assets, financial institutions and banks must carefully evaluate their nature, especially when engaging with businesses that deal with them. This is due to the potential for some NFTs, particularly fractionalised ones or those part of larger collections, to be treated similarly to securities.

Under VARA’s regulations, NFTs are recognized as a type of virtual asset. However, in cases where NFTs are fractionalized or part of a larger collection, banks and financial institutions must conduct thorough evaluations to determine whether they should be classified as securities. This requirement ensures that institutions understand the risks and obligations associated with dealing in such assets.

The regulatory framework for NFTs falls under the Virtual Assets and Related Activities Regulations 2023, which were issued by VARA on February 7, 2023. These regulations apply to all VASPs operating in Dubai, including those dealing with NFTs. VASPs are required to obtain a license from VARA, which involves demonstrating sufficient financial resources, adhering to customer due diligence protocols, and establishing risk management policies. For NFTs that may be considered securities, banks and financial institutions are required to obtain legal opinions regarding their classification before entering into agreements with businesses that issue or trade NFTs. This helps ensure that financial institutions fully understand the nature of the assets they are dealing with and comply with the appropriate regulatory standards. Furthermore, VASPs are required to follow strict governance controls and risk management frameworks to mitigate the potential risks associated with NFT transactions.

Additionally, VARA has introduced specific market conduct and transparency rules for the marketing and advertising of NFTs. These regulations are designed to protect consumers by ensuring transparency and preventing misleading marketing practices. Non-compliance with these regulations can result in penalties ranging from AED 20,000 to AED 200,000, highlighting the importance of adhering to regulatory standards.

Are decentralised finance (DeFi) activities (e.g. lending virtual assets) regulated in Dubai (UAE)?

DeFi, short for Decentralised Finance, is a fresh approach to financial services. Instead of relying on traditional banks or intermediaries, it harnesses smart contracts on a special kind of computer network called a public Distributed Ledger Technology (DLT). This network consists of many computers working together without a single owner. In the DeFi system, financial activities like lending, investing, and asset exchange happen without the need for a typical middleman. Smart contracts, which act like digital agreements, automatically manage these transactions.

The provisions for DeFi activities are included in Part III of the Virtual Assets and Related Activities Regulations 2023. Here are some of the highlights of the rules for DeFi activities:

1. DeFi operators are required to obtain a license from the VARA before conducting any DeFi activities in the Emirate.
2. The license application process includes providing information about the planned DeFi activities, financial information, and background checks on individuals associated with the application.
3. The DeFi activities that can be conducted by DeFi operators include, but are not limited to, lending, borrowing, exchanging, and investing.
4. Decentralised exchanges (DEXs) providing DeFi Activities are subject to various regulatory requirements, such as regulations to prevent market manipulation, insider trading, and other illicit activities.
5. DeFi operators must comply with AML/CFT regulations and any other relevant regulations as deemed by VARA.
6. VARA has prohibited the issuance and use of anonymity-enhanced cryptocurrencies within its jurisdiction, reinforcing its commitment to transparency in financial transactions.

VARA will conduct regular inspections and audits of licensed DeFi operators to ensure compliance with regulations.

Are there any restrictions on issuing or publicly offering virtual assets in Dubai (UAE)?

The Virtual Assets and Related Activities Regulations 2023 prescribe certain requirements and restrictions on the issuing or public offering of virtual assets in Dubai:

1. Issuance Rules: Any entity in the Emirate that issues a Virtual Asset in the course of a business must comply with the VA Issuance Rulebook, as may be amended from time to time.
2. Power to classify Virtual Assets: VARA has the sole and absolute discretion to classify any Virtual Asset or type of Virtual Asset as being prohibited in the Emirate, and to provide clarification or opinion on the regulatory treatment of any Virtual Asset or type of Virtual Asset.
3. Prohibited Virtual Assets: Virtual Assets that may facilitate money laundering or terrorism financing are prohibited, as provided under Article 17 of Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai. Furthermore, VARA may prohibit Virtual Assets if they are deemed to pose risks to consumers, investors, or market integrity.
4. Licensing Requirements: Any entity providing Virtual Asset-related activities or services must be licensed by VARA, subject to the fulfillment of certain requirements. In particular, VARA may grant a license if the entity has met the specified criteria, including fitness and propriety or soundness of its financial affairs.
5. Compliance with Directives: VARA may issue directives to any Entity or VASP, requiring them to comply with specific regulatory capital or liquidity requirements, or requiring them to refrain from taking certain actions, in addition to the requirements set out in the Regulations or Rules.
6. Anonymity-Enhanced Cryptocurrencies: The issuance of Anonymity-Enhanced Cryptocurrencies and all Virtual Asset Activity related to them is completely prohibited in Dubai.

Anonymity-enhanced cryptocurrencies are digital currencies designed to provide users with extra privacy. They aim to make transactions and user identities more difficult to trace or link, offering a higher level of confidentiality compared to traditional cryptocurrencies.

Are there any exemptions to the restrictions on issuing or publicly offering of virtual assets in Dubai (UAE)?

There are some exemptions to the restrictions for virtual asset issuances in Dubai under certain conditions. Specifically, an Entity may issue a Virtual Asset in Dubai without first acquiring a VARA License or approval if it is deemed an Exempt Entity according to the Regulations.

An Entity is considered an Exempt Entity if all of the following conditions are met:

1. The consideration received by the Entity in connection with a VA issuance project does not exceed AED 2,000,000 per project or the equivalent amount in fiat currency or Virtual Assets.
2. The aggregate consideration received by the Entity in connection with all its VA issuances does not exceed AED 10,000,000 or the equivalent amount in fiat currency or Virtual Assets.

VAT Exemptions: Recent amendments to the UAE’s VAT regulations have exempted certain activities related to virtual assets from VAT. These include:

1. Transfers and Conversions: The transfer of ownership and conversion of virtual assets, such as cryptocurrencies and NFTs, are exempt from the standard 5% VAT. This exemption applies retroactively from January 1, 2018.
2. Management Services: Management services for investment funds that deal with virtual assets are also exempt from VAT. This includes services related to fund operations and performance monitoring.

The Exempt Entity complies with all other Rules in the VA Issuance Rulebook, including:

1. General Rules that govern the conduct of all business from, or through the Emirates.
2. Whitepapers and public disclosures, including detailed disclosure requirements and risk statements that issuers must provide in whitepapers.
3. Compliance obligations of issuers, including complying with the rules related to technology and security, anti-money laundering and combating the financing of terrorism, marketing regulations, personal data protection, tax reporting and compliance, and books and records.

All transactions for which the Exempt Entity uses an intermediary are handled by Licensed Distributors only. Note that VARA shall have the sole and absolute discretion to decide whether an Entity is an Exempt Entity for the purposes of the Regulations and this VA Issuance Rulebook.

3. Regulation of VASPs in Dubai (UAE)

Are VASPs operating in Dubai (UAE) subject to regulation?

The Virtual Assets and Related Activities Regulations 2023 mentions the VASP as an entity that provides one or more virtual asset services to customers, including but not limited to, buying, selling, transferring, exchanging, safekeeping, and/or administering virtual assets. This broadly includes any person who carries out the business of providing virtual asset services in or from within Dubai, whether as a primary or ancillary activity, involving virtual assets like cryptocurrencies or other digital tokens. Examples of VASPs in Dubai may include cryptocurrency exchange platforms, virtual asset custodians, virtual asset wallet providers, virtual asset brokers, or organisations involved in initial coin offerings (ICOs) or other forms of virtual asset issuances.

VASPs operating in Dubai are subject to regulation by VARA. The VARA was established and authorised by Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai to regulate Virtual Assets and VASPs. VARA has the power to issue Rules, Directives and Guidance, and VASPs providing VA Activities in the Emirate will need to comply with applicable CBUAE federal regulations and/or guidance, including but not limited to as they pertain to specific Virtual Assets CBDCs and AED referenced fiat- referenced Virtual Assets.

VASPs will also be subject to regulations, rules and directives for a period of ten (10) years following the date that it is no longer regulated by VARA.

Are VASPs providing virtual asset services from offshore to persons in Dubai (UAE) subject to regulation in Dubai (UAE)?

VASPs operating from offshore are subject to regulation under Dubai’s Virtual Assets and Related Activities Regulations 2023 if they provide services to individuals in Dubai. Regardless of their location, all VASPs must obtain a license from the Dubai VARA before offering virtual asset services to customers in the Emirate. This mandatory licensing requirement applies uniformly to both domestic and offshore providers. Offshore VASPs must also adhere to the same regulatory standards as those based within the UAE, including compliance with AML/CFT regulations, as well as other relevant laws designed to protect consumers and uphold market integrity.

The scope of services covered by VARA’s regulations is broad and includes advisory services, custody services, trading and exchange services, lending and borrowing, as well as management and investment services. VARA maintains strict oversight of all licensed VASPs, conducting regular inspections and audits to ensure full compliance with applicable regulations. Additionally, the issuance and use of anonymity-enhanced cryptocurrencies are prohibited in Dubai, further reinforcing VARA’s commitment to transparency in financial transactions. Offshore VASPs seeking to operate in Dubai must navigate a structured licensing process, which involves submitting comprehensive documentation about their business operations, financial health, and compliance frameworks. Failure to comply with VARA’s regulations can result in significant penalties, including fines ranging from AED 20,000 to AED 200,000, as well as enforcement actions against non-compliant entities.

What are the main requirements for obtaining licensing / registration as a VASP in Dubai (UAE)?

To secure a license under the Virtual Assets Law, prospective applicants are mandated to establish Dubai as the hub for their operations. Additionally, they are required to obtain a commercial business license from the pertinent licensing authority in Dubai. The detailed procedures for obtaining this license and the accompanying ongoing obligations, such as those pertaining to anti-money laundering, disclosure, transparency, and know-your-client (KYC) processes, are explained in the regulations complementing the Virtual Assets Law.

The licensing regulations of Dubai are a consolidation of provisions derived from three essential sources: Cabinet Decision No. 111/2022, Cabinet Decision No. 112/2022, and the Virtual Assets and Related Activities Regulations 2023.

1. Mandatory licensing requirements: Cabinet Decision No. 111/2022: Mandates that entities engaging in Virtual Asset Activities in Dubai must acquire approval and licenses from the VARA (VARA). No transactions are permitted without proper licensing, except for specific assets designated for payment. Businesses must be based in the UAE and legally formed.
2. Compliance and licensing process: Cabinet Decision No. 111/2022 and Virtual Assets and Related Activities Regulations 2023: Entities seeking licenses are obliged to follow the detailed process as prescribed by VARA. Compliance with regulations, adherence to directives, and meeting licensing conditions set by VARA is an integral part of the licensing process.
3. Exemptions: Virtual Assets and Related Activities Regulations 2023 allows exemptions from licensing regulations for the following:
   1. Lawyers, Accountants, and Business Consultants if their Virtual Assets Activities are incidental to their professional practice.
   2. Government entities in the UAE and their public, non-profit, not-for-profit, and charitable organisations are not required to obtain licenses.
      However, these exempt entities must obtain confirmation from VARA before engaging in any VA Activities.
4. Mandatory registration for large proprietary traders: Virtual Assets and Related Activities Regulations 2023 requires entities investing over $250 million in Virtual Assets within a 30-day period to register with VARA before investing or within three working days from the date of the investment volume. This mandatory registration acts as a regulatory measure for substantial proprietary trading in Virtual Assets.
5. Voluntary registration for other market participants: Virtual Assets and Related Activities Regulations 2023 offers voluntary registration for entities involved in specific business activities. This voluntary registration ensures transparency and compliance with VARA regulations.
6. VARA’s licensing powers: Virtual Assets Service Providers must seek approval from VARA to engage in specific VA activities, with the license detailing the allowed actions and any associated limitations or time constraints. VARA has the authority to modify or revoke licenses, adjusting permitted activities or imposing restrictions based on various factors, including legal violations or financial instability. If a license is suspended, VARA communicates the duration to the VASP, during which the VASP cannot resume VA activities. Additionally, VARA can set extra requirements for entities applying for licenses or modifications, especially if they fail to meet conditions or breach laws.
7. Licensing categories: When applying for a VASP license, applicants must explicitly identify one or more virtual asset activities they intend to offer. These activities are categorised into seven options:
   1. VA Advisory Services,
   2. VA Broker-Dealer Services,
   3. VA Custody Services,
   4. VA Exchange Services,
   5. VA Lending and Borrowing Services,
   6. VA Management and Investment Services, and
   7. VA Transfer and Settlement Services.
8. Obtaining VASP license: Firms intending to provide virtual asset services in or from Dubai must obtain a VASP license from Dubai Economy and Tourism (DET) or any Dubai Free Zone Authority (FZA) in Dubai, excluding the DIFC. This license is mandatory and serves as a prerequisite for conducting virtual asset services in Dubai.
9. Validity and Renewal: Once obtained, a VASP license is valid for a period of one year and must be renewed annually. The application and renewal process include the payment of an annual supervision fee to ensure ongoing compliance with regulatory standards.
10. License Application Process:
    1. For Existing VASPs: Existing VASPs in Dubai were initially required to submit their VASP license applications by the initial deadline of August 31, 2023. However, VARA extended this deadline to November 17, 2023. Failure by existing VASPs to submit their applications before this deadline may trigger regulatory enforcement consequences from VARA.
    2. For New VASPs (Two-Stage Process):
       Stage 1: Initial Approval In this stage, VASPs submit an Initial Disclosure Questionnaire (IDQ) to DET or a relevant FZA. They also provide additional documentation, including a business plan and details of beneficial owners and senior management. Furthermore, the payment of initial fees is required, leading to the receipt of Initial Approval to finalise legal incorporation and complete operational setup.
       Stage 2: VASP License Following the Initial Approval, VASPs proceed to Stage 2 by preparing and submitting documentation as per VARA’s guidance. This stage involves receiving feedback directly from VARA, participating in potential meetings and interviews, paying the remaining portion of application fees, and first-year supervision fees. The result is the issuance of a VASP license, possibly subject to operational conditions.
11. Post-License Obligations: Upon obtaining a VASP license, firms are obligated to continuously meet general licensing conditions and comply with all relevant Regulations, Rules, and Directives that may evolve over time. The specific corporate governance and legal structure requirements for VASPs are set out in the VARA Company Rulebook and depend on the business operations conducted.

Licensing Fees

1. Following the submission of the application, the licensing process typically takes between 4 to 6 months to acquire the license.
2. VASPs that wish to change their VARA license details will be charged an AED 500 fee for each modification request.
3. VASPs intending to cease operations in Dubai and close down their virtual asset activities will face a withdrawal fee of AED 10,000.

Regulatory Requirements

What are the main ongoing requirements for VASPs regulated in Dubai (UAE)?

The Virtual Assets Issuance Rulebook, which governs virtual asset activities in Dubai, explains several ongoing requirements for VASPs regulated in Dubai, apart from licensing requirements. These include:

1. Compliance and risk management obligations: VASPs must have effective systems and processes in place for identifying, assessing, managing, and mitigating risks associated with virtual asset activities, including, but not limited to AML/CFT risks. VASPs must also have a compliance program that ensures adherence to all relevant laws and regulations.
2. Technology and security obligations: VASPs must have effective technology and security measures in place to safeguard against unauthorised access or use of virtual assets and ensure systems are functional and have appropriate disaster recovery processes.
3. AML/CFT obligations: VASPs must have systems and processes in place for identifying, assessing, managing and mitigating AML/CFT risks, including implementing policies and procedures for customer due diligence, screening, and on-going monitoring, reporting suspicious activities to authorities promptly.
4. Marketing and consumer protection obligations: VASPs must ensure that their marketing practices are fair, clear, and not misleading to consumers. All marketing materials should allow consumers to make informed decisions about virtual asset investments. Marketing communications must clearly identify promotional content using terms such as “ad,” “advertisement,” or “sponsored content” prominently to avoid any confusion. Additionally, VASPs are required to provide clear risk statements to customers before engaging in any virtual asset transactions, outlining the potential risks associated with the investment. Any monetary or non-monetary incentives offered must be clearly communicated in a way that does not mislead consumers or create unrealistic expectations about potential returns. For event marketing, entities not licensed by VARA may still engage in marketing activities at physical events held in Dubai, provided they adhere to strict guidelines, including the requirement to include clear disclaimers stating they are not licensed by VARA. Furthermore, all customer complaints should be handled fairly and efficiently to uphold a high standard of consumer protection.
5. Record-Keeping Obligations: VASPs are required to maintain accurate records of all transactions, company books, and other relevant documents for a minimum of five years. These records must be readily accessible for inspection by regulatory authorities to ensure compliance with the regulations. Proper record-keeping is a fundamental obligation for VASPs, allowing for transparency and accountability in their operations.
6. Adherence to Rulebooks: In addition to complying with the main regulatory framework, VASPs are required to adhere to several specific rulebooks issued by VARA. The Company Rulebook governs corporate governance and internal control systems, ensuring that VASPs have sound management structures in place. The Compliance and Risk Management Rulebook outlines the need for effective compliance systems, internal audits, and procedures to manage risk. The Technology and Information Rulebook establishes requirements for technology governance, including cybersecurity measures and data protection compliance, ensuring the secure handling of virtual asset transactions and sensitive information. Additionally, the Market Conduct Rulebook provides guidelines for marketing practices and interactions with consumers, ensuring that VASPs operate ethically and transparently.
7. Regular Audits and Inspections: VARA conducts regular audits and inspections to assess VASPs’ compliance with the ongoing regulatory requirements. These audits are essential for ensuring that VASPs adhere to the established standards and maintain proper operational practices. Non-compliance with the regulations can result in penalties ranging from AED 20,000 to AED 200,000, depending on the severity of the breach. Regular inspections help maintain the integrity of the virtual asset market and protect consumer interests by ensuring that VASPs operate within the regulatory framework.

It is important to note that these requirements may be updated from time to time, and VASPs must always be kept up-to-date with any changes in the regulations and guidelines concerning virtual assets in Dubai.

4. Regulation of other crypto-related activities in Dubai (UAE)