General information only. CryptoRegHub provides summaries for informational purposes and does not constitute legal or compliance advice. Always verify with official sources and consult qualified legal counsel before making compliance decisions.
CryptoRegHub provides plain-English summaries of crypto regulations for informational purposes only. This does not constitute legal, compliance, or financial advice. Regulations change frequently — always verify information with official sources and consult qualified legal counsel before making any compliance decisions.
The Virtual Assets Regulatory Authority (VARA) was established by Dubai Law No. 4 of 2022 as the world's first dedicated virtual asset regulator. VARA governs all virtual asset activities in Dubai mainland and most UAE free zones (excluding the DIFC). VARA's licensing framework covers seven activity categories and its rulebooks set comprehensive standards for governance, AML/CFT, technology risk, cybersecurity, and market conduct. Rulebook Version 2.0 was published in May 2025 and took effect on 19 June 2025 after a 30-day transition, introducing major updates including a Sponsored VASPs regime, overhauled token issuance framework, and margin trading regulations. A major structural development occurred on 1 January 2026 when two federal decree-laws established the Capital Market Authority (CMA, formerly SCA) with expanded federal jurisdiction over virtual assets. While VARA continues to operate as Dubai's regulator, the CMA now acts as a federal oversight layer — notably requiring that any virtual asset traded in the UAE must be on the CMA's approved list and registered with the CMA.
Who does it apply to?
Applies to any entity operating a virtual asset business in Dubai or targeting Dubai residents, including: (1) Broker-dealers; (2) Custodians; (3) Exchange services operators; (4) Lending and borrowing service providers; (5) Payment and money transmission providers; (6) Management and investment services; (7) VA advisory services. Even DeFi platforms with Dubai users may require VARA approval. The regime applies regardless of whether servers are located in Dubai.
Key requirements
Key requirements: (1) VARA operational licence required for each regulated activity category — "full market product" (FMP) or "minimal viable product" (MVP) licence available. (2) Comprehensive AML/CFT programme aligned with UAE Federal Decree-Law No. 20 of 2018 and FATF standards. (3) Travel Rule: all VASPs must provide full originator and beneficiary information on transfers (Travel Rule fully implemented as of February 2026). (4) Technology and cybersecurity: strict requirements under VARA's Technology and Information Rulebook. (5) Token issuance: Category 1 tokens (stablecoins/FRVAs) require prior VARA approval; Category 2 tokens (utility) must be distributed through licensed distributors. (6) Margin trading: new controls under Rulebook v2.0. (7) Sponsored VASPs: new regime allows entities to operate under a licensed Regulated Sponsor. (8) Fines up to AED 4,000,000 for non-compliance.
Obligation types
Licensing / Authorisation
Requirement to obtain a licence or authorisation before operating
KYC / AML
Know Your Customer and Anti-Money Laundering obligations
Travel Rule compliance
Sharing originator/beneficiary data on transfers
Custody / Segregation
Rules on how customer assets must be held
Capital requirements
Minimum capital or reserve requirements
Market conduct rules
Rules against manipulation, insider dealing etc.
Disclosure / Whitepaper
Mandatory disclosures to users or markets
Regulatory reporting
Ongoing reporting to regulators
Consumer protection
Rules protecting retail customers
Penalties & fines
Civil fine — CMA enforcement
Unlicensed virtual asset activities or breach of federal VASP rules
Max: Up to AED 4,000,000; asset seizure; permanent UAE business ban
Applies to: All VASPs operating in the UAE
Civil fine — VARA enforcement
Breach of VARA licence conditions or rulebook requirements
Max: Fine, licence suspension or revocation
Applies to: VARA-licensed entities
Criminal penalty — CBUAE
DeFi platforms operating without licence under Federal Decree-Law No. 6 of 2025
Max: Up to AED 1,000,000,000 (one billion AED)
Applies to: Unlicensed payment/DeFi platforms
Implementation timeline
Mar 2022
Dubai Law No. 4 of 2022 established VARA
World's first dedicated virtual asset regulator created by Dubai decree.
Feb 2023DEADLINE
VARA Virtual Assets and Related Activities Regulations published
Full regulatory framework came into effect. Seven activity categories established.
Oct 2024
VARA issued stablecoin and real-world asset-backed token regulations
New regulations covering FRVAs (fiat-referenced virtual assets) and RWA-backed tokens.
May 2025
VARA Rulebook Version 2.0 published
Major overhaul including Sponsored VASPs regime, revised token issuance framework, margin trading rules, harmonised AML/CFT requirements.
Jun 2025DEADLINE
Rulebook v2.0 took effect after 30-day transition
Jan 2026
New federal CMA framework entered into force (FDL No. 32 and 33 of 2025)
Capital Market Authority (CMA) established. Federal VASP rulebook introduced. CMA now has de facto veto over which assets can be traded on VARA-licensed platforms.
Feb 2026DEADLINE
Travel Rule fully implemented — all VARA-licensed VASPs compliant
VARA confirmed full implementation of Travel Rule requirements across all licensed entities.
Always refer to official sources to confirm current requirements. CryptoRegHub summaries are for general guidance only.
Updates & news
13 February 2026
CMA Decision No. 4/R.M/2026 issued — new federal VASP law
New federal VASP Decision replaces previous rules entirely. Establishes 8 licence categories, new capital requirements, hard prohibitions on specific asset classes.
1 January 2026
Federal CMA framework entered into force — structural reset of UAE federal crypto regulation
Capital Market Authority (CMA, formerly SCA) established with broad federal jurisdiction. Any VA traded in UAE must now be on CMA approved list. CMA has de facto veto over VARA-licensed platform listings. Unified VASP register launched.
19 June 2025
VARA Rulebook v2.0 entered into force
Major overhaul including Sponsored VASPs regime (operating under a licensed Regulated Sponsor), overhauled VA Issuance Rulebook, margin trading controls, and harmonised AML/CFT standards.
Frequently asked questions
At a glance
JurisdictionUAE
RegulatorVARA, CMA
Official nameDubai Law No. 4 of 2022 on Virtual Assets + VARA Rulebook v2.0 (May 2025)
StatusIn Force
Enacted11 Mar 2022
Effective from7 Feb 2023
Last verified14 Apr 2026
Penalty severity
● High risk
Large fines, licence revocation, or criminal referral risk
This summary is for general informational purposes only and does not constitute legal advice. Always verify with official sources and consult qualified legal counsel.