VARA

Established under Dubai Law No. 4 of 2022, VARA is the world’s first independent regulatory authority created exclusively for the governance of virtual assets. It sits outside the traditional financial regulatory architecture and operates with a mandate to regulate, supervise, and develop the virtual asset sector across Dubai’s mainland and free zones, with the DIFC as the sole carve-out.

VARA’s framework is built around a dual-rulebook structure. Four compulsory modules apply universally to every licensed entity: the Company Rulebook, the Compliance and Risk Management Rulebook, the Technology and Information Rulebook, and the Market Conduct Rulebook. Layered on top are eight activity-specific rulebooks, each setting out the precise obligations that apply to a given licence category. This architecture creates consistent baseline standards while allowing the regulatory intensity to track the risk profile of each activity type.

Cabinet Decision No. 111 of 2022 reinforces the statutory foundation, making it a legal requirement to obtain a VASP licence before conducting any virtual asset activity in Dubai. Operating without authorisation carries meaningful civil and criminal exposure, a point that should be factored into any market-entry timeline.

VARA issues licences by activity rather than by entity type. A single entity can hold authorisation for one or more activities, provided it demonstrates the governance, capital, and operational infrastructure required for each. The eight categories are:

VARA is open to local and foreign entities, exchanges, custodians, fund managers, market makers, tokenisation platforms, and Web3 ventures. No nationality restriction applies to ownership, but every applicant must establish a Dubai-incorporated entity or branch. Overseas licences do not passport into the emirate.

Fit-and-proper assessments cover UBOs, directors, and senior management. Two locally resident Responsible Individuals, including a Compliance Officer, must be in place before a licence is issued. Custody Services must always be held in a separate legal entity from other licensed activities.

The VARA licensing process follows two formal stages, each with distinct documentation requirements and typical timelines. A well-prepared submission can compress those timelines materially.