On March 2022, the Virtual Assets Regulatory Authority ("VARA") was established by Law No. 4 of 2022, in the Emirate of Dubai, to regulate all activities related to the virtual assets sector throughout the Emirate, including special development zones and free zones, but excluding the Dubai International Financial Centre (DIFC).
On February 7, 2023, VARA issued its Virtual Assets and Related Activities Regulations 2023 (the "Regulations") applicable to all virtual assets service providers.

VARA is an independent regulator for virtual assets, and regulated virtual assets include cryptocurrencies such as Bitcoin and non-fungible tokens (NFTs).

The Regulations cover seven licensed virtual asset activities, including advisory, broker-dealer, custody, exchange, lending and borrowing, payments and remittance, and virtual assets management and investment services.

All Virtual Asset Service Providers ("VASPs") operating in Dubai must be licensed by VARA. To secure a license from VARA, VASPs must meet a number of requirements including, but not limited to:

  • demonstrating that the VASP has adequate financial resources to operate its business;
  • implementing solid customer due diligence procedures;
  • establishing effective policies and procedures in order to manage potential risks associated with virtual assets;
  • establishing adequate systems in relation to anti-money laundering and terrorist financing;
  • establishing effective governance controls; and
  • ensuring that senior management and employees are fit to carry out their assigned roles.

VASPs operating in Dubai are now subject to increased regulatory requirements as a result of the Regulations. VARA will monitor all VASPs in order to ensure that they comply with the Regulations (and associated Rulebooks, as noted below) requirements. VARA may conduct regular inspections and audits to assess VASP compliance.

The Regulations provide that the issuance of anonymity-enhanced cryptocurrencies and all virtual asset activities related to them are prohibited in Dubai.

In addition to the Regulations, VARA has released a number of rulebooks, including the (i) Company Rulebook; (ii) Compliance and Risk Management Rulebook; (iii) Technology and Information Rulebook; and (iv) Market Conduct Rulebook, (the "Rulebooks"). VASPs licensed by VARA must comply with the provisions of all the Rulebooks.



1. Company Rulebook

The Company Rulebook governs the way a VASP structures and manages its company, board, senior management and staff, and the ongoing maintenance of suitable internal control and management systems. In addition, the Company Rulebook covers corporate governance requirements and environmental/social responsibilities.

2. Compliance & Risk Management ("CRM") Rulebook

The CRM Rulebook sets out the general principles for regulatory compliance and the implementation of a compliance management system including appointing a Compliance Officer and record keeping and audit requirements. The CRM Rulebook also provides that VASPs must, at all times, comply with all tax reporting obligations under all applicable laws, regulations, rules and guidance as well as national, international and industry best practices, including under the United States Foreign Account Tax Compliance Act (FATCA) where applicable.

3. Technology & Information Rulebook

The Technology & Information Rulebook provides for the technology governance, controls and security including cybersecurity (and other legal and regulatory) obligations, in addition to personal data protection compliance requirements and compliance programs.

4. Market Conduct Rulebook

The Market Conduct Rulebook provides guidance on the marketing, advertising and promotion regulations and requirements.

Non-compliance with VARA regulations is subject to fines ranging between AED 20,000 and AED 200,000.

This significant development comes in an effort to enhance the credibility and reputation of the virtual assets industry in Dubai, and to increase public confidence in the market by setting adequate regulatory standards and requirements. Public reports provide that Dubai aims to establish an advanced legal framework in order to protect investors and offer international standards for governance in the virtual asset industry.

If you have any questions on this topic, please contact us.

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe - Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

© Copyright 2020. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.