VARA — Dubai Virtual Assets Regulatory Authority
Executive summary
Dubai's Virtual Assets Regulatory Authority was established by Dubai Law No. 4 of 2022 issued by Sheikh Mohammed bin Rashid Al Maktoum on 9 March 2022, making Dubai the first major jurisdiction with a standalone crypto regulator. VARA's seven-licence-category framework — finalised in February 2023 — covers advisory, broker-dealer, custody, exchange, lending and borrowing, payments and remittances, and investment management activities. The 2024 stablecoin regime added prescriptive reserve and redemption rules. The parallel ADGM FSRA regime in Abu Dhabi covers Abu Dhabi Global Market jurisdiction with its own rules. The UAE's exit from the FATF Grey List in February 2024 marked a transition from rapid-growth to mature-supervision phase. Notable VARA-licensed firms include Binance, OKX, Crypto.com, M2, CoinMENA, and Hex Trust; Bybit holds its principal UAE licence from the federal SCA rather than VARA. By 2026 Dubai is a leading pillar of global crypto regulation alongside the EU and the United States.
Statutory architecture
VARA was established by Dubai Law No. 4 of 2022 issued by Sheikh Mohammed bin Rashid Al Maktoum, Vice President and Prime Minister of the UAE and Ruler of Dubai, on 9 March 2022. The law gave VARA exclusive authority to regulate virtual asset activities in the Emirate of Dubai (with the explicit exception of the Dubai International Financial Centre, which falls under the DFSA's separate jurisdiction). The substantive regulatory framework derives from the VARA Rulebooks issued in February 2023: the Compliance and Risk Management Rulebook, the Company Rulebook, the Custody Services Rulebook, the Market Conduct Rulebook, and four activity-specific rulebooks covering Broker-Dealer Services, Exchange Services, Lending and Borrowing Services, and Virtual Asset Management and Investment Services. A separate Advisory Services Rulebook was added in mid-2023 and the Payments and Remittance Services Rulebook in late 2023. The 2024 Virtual Assets and Related Services Stablecoin Regime — issued as a separate VARA pronouncement — added prescriptive rules for fiat-referenced virtual assets including 1:1 reserve requirements, redemption obligations, audit and disclosure rules, and a category-specific authorisation track. The framework operates alongside three parallel UAE regimes: the Abu Dhabi Global Market Financial Services Regulatory Authority (ADGM FSRA) administers a separate virtual-asset regime within ADGM jurisdiction under the FSRA's Conduct of Business Rules and the Capital Markets Rules; the Dubai International Financial Centre's DFSA administers crypto rules within DIFC; and the federal Securities and Commodities Authority (SCA) administers a federal regime applicable in non-financial-free-zone parts of the UAE. The four-regulator landscape produces operational complexity that operators routinely navigate by holding licences in multiple regimes — VARA for Dubai retail, ADGM FSRA for institutional, DFSA or SCA for specific products.
License tiers and categories
VARA's framework recognises seven activity categories, each requiring a separate licence (though many are commonly granted as a bundle). Category 1 (VASP-Advisory Services) covers provision of advice on virtual asset transactions and portfolio composition; minimum capital is 500,000 dirham (approximately 136,000 US dollars). Category 2 (VASP-Broker-Dealer Services) covers receiving, transmitting, and executing client orders for virtual asset transactions; minimum capital is 1,500,000 dirham (approximately 408,000 US dollars). Category 3 (VASP-Custody Services) covers custody and administration of virtual assets on behalf of clients; minimum capital is 1,500,000 dirham. Category 4 (VASP-Exchange Services) covers operation of a virtual asset trading platform; minimum capital is 1,500,000 dirham, plus an Operational Risk Capital Requirement scaled to monthly trading volume. Category 5 (VASP-Lending and Borrowing Services) covers virtual asset lending, borrowing, repo, and similar credit-related activity; minimum capital is 1,500,000 dirham. Category 6 (VASP-Payments and Remittance Services) covers virtual asset transfer services on behalf of others; minimum capital is 750,000 dirham (approximately 204,000 US dollars). Category 7 (VASP-Virtual Asset Management and Investment Services) covers fund management, discretionary portfolio management, and structured investment products in virtual assets; minimum capital is 1,500,000 dirham. The 2024 stablecoin regime adds two issuer categories: Category Stablecoin Issuance (FRVA Issuer) for fiat-referenced virtual asset issuance, with capital floor of 5,000,000 dirham (approximately 1,360,000 US dollars) and reserve requirements layered on top. Holders of multiple categories pay incremental capital but typically a single supervisory levy.
Capital and operational requirements
Beyond minimum permanent capital, VARA imposes ongoing capital adequacy requirements scaled to firm size and activity. Operational Risk Capital Requirement (ORCR) for exchange-category licensees runs from 0.5 percent to 1.5 percent of trailing-twelve-month notional traded volume, layered on top of base capital. Custody-category licensees must hold ongoing capital of the higher of base capital or 25 percent of average annual operating expenses. Broker-Dealer-category licensees must additionally hold professional indemnity insurance of at least 5,000,000 dirham per claim. Custody operational requirements under the Custody Services Rulebook are prescriptive: client virtual assets must be held in segregated wallets (distinct cold-storage and hot-wallet structures), with comprehensive multi-signature key-management and disaster-recovery arrangements, prohibition on rehypothecation absent explicit written client consent, comprehensive insurance against operational losses with named insurer subject to VARA approval, and quarterly attestations of holdings by an independent auditor. The Compliance and Risk Management Rulebook requires every VASP to maintain a comprehensive risk-management framework covering operational, credit, market, liquidity, and conduct risk, with named CRO reporting to the board. AML/CFT obligations derive from VARA's Compliance and Risk Management Rulebook plus the federal AML regime under UAE Federal Decree Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019; full Travel Rule compliance applies to transfers above 3,500 dirham (approximately 950 US dollars). The 2024 stablecoin regime adds prescriptive reserve requirements for FRVA issuers: 1:1 reserves held in a bankruptcy-remote vehicle with a UAE-licensed bank or trust company, restricted to high-quality liquid assets denominated in the peg currency, no commercial paper, no rehypothecation, weekly reserve attestations, and redemption rights at par within five business days for the issuing currency.
Notable licensees
By 2026 VARA had issued a growing roster of active licences across its categories — 23 VASPs were licensed as of December 2024 and the register has continued to expand — with the full list maintained on the VARA Public Register. Binance FZE holds a VARA VASP licence and runs Binance's regional business from Dubai. OKX received a VARA VASP licence covering its regional retail and institutional business. Crypto.com holds VARA exchange and custody permissions. M2 was granted a multi-category licence as a Dubai-headquartered exchange and custody platform, and CoinMENA was an early VARA licensee with multi-category authorisation including exchange and custody. Institutional custody licensees include Hex Trust. Bybit, by contrast, operates in the UAE primarily under a Virtual Asset Platform Operator licence granted by the federal Securities and Commodities Authority (SCA) in October 2025, having previously held only VARA provisional approval — a reminder that several global exchanges hold their principal UAE authorisation outside VARA. On the stablecoin side, the first fiat-referenced-virtual-asset issuer approvals under the 2024 framework went to AED-pegged issuers such as AE Coin (AED Stablecoin LLC). The parallel ADGM FSRA regime in Abu Dhabi has separately authorised a number of virtual-asset firms.
Enforcement actions to date
VARA's public enforcement has centred on unlicensed operators and marketing breaches rather than the large customer-asset settlements seen in some other jurisdictions. In October 2024 VARA issued fines and cease-and-desist orders to seven entities found operating without the required licences and breaching its Marketing Regulations, with penalties ranging from AED 50,000 to AED 100,000 per firm and instructions to halt all business and promotion. A subsequent enforcement programme extended this to nineteen unlicensed firms, with fines calibrated between roughly AED 100,000 and AED 600,000 and a public warning directing residents not to engage with unlicensed virtual-asset providers. VARA's 2024 Regulations on the Marketing of Virtual Assets set the framework for these actions, requiring prior authorisation and prescribed disclaimers for any promotion of virtual assets to UAE residents, with maximum fines of up to AED 10,000,000 for serious or repeated breaches. The UAE's exit from the FATF Grey List on 23 February 2024 marked a shift in VARA's supervisory posture from rapid onboarding toward mature supervision, and inspection cycles through 2024 and 2025 have been progressively more demanding. The 2024 stablecoin regime was accompanied by guidance directing licensed VASPs to migrate away from non-compliant fiat-referenced tokens. No specific multi-million-dirham customer-asset or lending settlements against named VARA licensees have been publicly documented.
How to apply
VARA applications are filed through the VARA Online Portal under a structured submission process beginning with a pre-application engagement phase (typically two to four months) during which VARA staff scope the proposed activities and identify any threshold issues. The substantive filing comprises a programme of operations describing each activity category sought, a three-year financial projection demonstrating capital adequacy, a comprehensive AML/CFT programme satisfying the Compliance and Risk Management Rulebook, a custody architecture document for any custody-category licensees, biographical and fit-and-proper material on every shareholder, director, and senior management function holder including SMF1 (CEO), SMF2 (CFO), SMF3 (CRO), SMF4 (CCO), and SMF5 (MLRO), a comprehensive technology risk-management framework, a conflicts-of-interest framework, and category-specific operational documentation. VARA fees include an application fee of 100,000 dirham per category at filing, an annual supervisory fee of 200,000 to 1,000,000 dirham depending on activity scope and firm size, and additional fees for material-change applications. The all-in cost of preparation runs 1,000,000 to 5,000,000 dirham (approximately 270,000 to 1,360,000 US dollars) for a single-category application, with multi-category bundles running 5 to 15 million dirham. Decision timelines run from initial pre-application engagement through provisional permission (typically 6 to 9 months), then operational and capital satisfaction, then operational permission (typically 6 to 12 additional months), then full Minimum Viable Product (MVP) and full market product permission tiers. Total time from substantive filing to full operational permission runs 12 to 24 months. The parallel ADGM FSRA regime is filed separately through the ADGM Authority's Licensing portal with its own substantive review and operates independently; some operators hold both VARA and ADGM FSRA permissions for different parts of their business. Common rejection reasons include inadequate substance — Dubai paper headquarters with senior management actually located offshore — gaps in the compliance and risk-management framework, and inability to demonstrate operational readiness for the activity categories sought.
Comparison to peer frameworks
Against MiCA's CASP regime, VARA's seven-category framework is more granular on activity classification but covers a narrower geographic footprint (single emirate versus 27-state EU passport). VARA's stablecoin regime is closer to MiCA's EMT framework on reserve-composition strictness but lacks MiCA's Article 23 transaction-volume cap. Capital floors at the entry tier are higher under VARA than under MiCA Class 1 (500K dirham versus 50K euro), but VARA's category structure allows operators to obtain narrower permissions tailored to their specific activity. Against the GENIUS Act, VARA's stablecoin regime is structurally similar (1:1 reserves, prescriptive composition rules, redemption obligations) but the GENIUS Title V foreign-issuer designation has not yet been formally extended to VARA-licensed FRVA issuers as of Q1 2026; informal Treasury-VARA dialogue is ongoing and a substantial-similarity determination is widely expected within the next 12 months. Against BitLicense, VARA is materially less expensive (1-5M dirham versus USD 150K-1M plus the much higher BitLicense ongoing burden) but VARA's category-specific operational requirements are more demanding than NYDFS's single-tier approach for narrowly-scoped operations. Against MAS PSA, VARA's category structure provides more permission-tailoring than PSA's three-tier approach, but PSA's broader scope (covering payments services beyond crypto) is conceptually different from VARA's exclusively-crypto remit. Against the parallel ADGM FSRA regime in Abu Dhabi, VARA covers retail and institutional activity more broadly while FSRA's regime is more institutional-focused with a more conservative supervisory posture; many operators hold both.
Open questions and pending changes
Three open questions dominate the VARA landscape through 2026 and 2027. First, the operational mechanics of cross-emirate harmonisation between VARA, ADGM FSRA, DIFC DFSA, and the federal SCA remain in active development; a 2025 Memorandum of Understanding between the four regulators committed to harmonised AML, prudential, and conduct standards but the operational implementation continues. Second, the GENIUS Act Title V substantial-similarity determination for VARA-licensed FRVA issuers has not yet been formally granted, and the timing of that determination has material consequences for the ability of Dubai-based stablecoin issuers to access US distribution; informal dialogue between Treasury, OCC, and VARA is ongoing as of Q1 2026 and a determination is widely expected within the next 12 months. Third, VARA's 2024 stablecoin regime's first full year of operation has produced several technical questions on reserve-composition eligibility for AED-denominated reserves versus USD-denominated reserves for USD-pegged tokens, and on the boundary between FRVA-authorised and offshore stablecoins traded on VARA-regulated platforms; a stablecoin framework refresh consultation is expected mid-2026. Operators should also watch the implementation of the cross-emirate regulatory MOU mentioned above, the first major cross-border enforcement action coordinated between VARA and a peer regulator under the post-2024-Grey-List supervisory posture, and the evolution of VARA's Lending and Borrowing Services regime as institutional digital-asset credit markets mature in the MENA region.
Watch points
- Cross-emirate regulatory MOU implementation between VARA, ADGM FSRA, DIFC DFSA, federal SCA
- GENIUS Act Title V substantial-similarity determination for VARA-licensed FRVA issuers
- Stablecoin framework refresh consultation expected mid-2026
- First major cross-border enforcement coordinated with peer regulators
- Evolution of Lending and Borrowing regime as MENA institutional credit markets mature
TL;DR
First major jurisdiction with a standalone crypto regulator — seven-category framework, 2024 stablecoin regime, post-FATF-Grey-List exit shifting to mature-supervision phase; Binance, OKX and Crypto.com hold VARA licences (Bybit is SCA-licensed federally).
Get DeFi Intel research in your inbox
Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.
Sources
- VARA Public Register — vara.ae
- VARA steps up enforcement — 19 unlicensed firms penalised and public warning — vara.ae regulatory notice
- Dubai's VARA fines and cease-and-desist orders against 7 crypto entities (Oct 2024) — coindesk.com
- Bybit UAE Virtual Asset Platform Operator licence from the SCA (Oct 2025) — coindesk.com
Licensee and enforcement claims verified 2026-07-15.