MIRR ASIA · Dubai VARA Licensing

Dubai VARA — Virtual Asset Issuance & Exchange Services

A practical breakdown of the licensing categories, whitepaper and disclosure duties, stablecoin (FRVA) rules, and the board, policy, market-operation, settlement and margin-trading requirements that VARA-licensed VASPs must satisfy in Dubai.

Overview · 01

VARA Licensing in Dubai — Two Rulebooks

Summary

To issue Virtual Assets (VAs) in Dubai, you must obtain either a licence or a prior approval depending on the issuance category. All issuances are subject to common obligations on conduct of business, whitepaper & risk disclosures, and security, AML, data protection, tax, and record-keeping. FRVAs (stablecoins) are subject to additional enhanced requirements including 100% reserves and redemption within one business day.

Rulebook	Basis & scope
Virtual Asset Issuance Rulebook FRVA Issuance Rules	Basis: VARA Virtual Asset Issuance Rulebook (2024-10-01) & FRVA Issuance Rules (2023-09-18). Governs who must be licensed or pre-approved to issue a VA, and what must be disclosed.
Exchange Services Rulebook	Basis: VARA Exchange Services Rulebook, 7 Feb 2023, and the Virtual Assets and Related Activities Regulations 2023. Applies additionally to all VASPs carrying out Exchange Services.

Emirate means the Emirate of Dubai, including special and free zones, but excluding the DIFC. AED-pegged FRVAs fall under the Central Bank of the UAE (CBUAE), not VARA.

Issuance · 02

Issuance Categories & Prohibited Assets

Type	Description	Examples (specific)
Category 1	FRVAs (stablecoins) or VARA-designated VAs → full licence required	• USD-pegged stablecoin issuance (structure similar to USDC) • '1g of gold-pegged' stable VA (included when designated by VARA where not pure fiat)
Category 2	Any issuance where one of the following is met: ① single transaction > 40,000 AED, ② ≥150 investors, ③ consideration > 2,000,000 AED over 12 months → prior approval required	• Public sale of a utility token to 200 holders (including transfers to personal wallets) • One-off token sale of 60,000 AED equivalent
Other	Issuances outside the above do not require licence / prior approval (but must comply with common rules in Parts II–IV)	• Non-transferable / closed-loop reward points (on-platform payments only, no cash-out) • Employee achievement NFT badges (non-transferable, non-redeemable)

Prohibited assets

Privacy-enhancing cryptocurrencies (AECs) are fully prohibited from issuance and related activities.

Privacy coins — transactions are untraceable / obfuscated → extreme AML / CFT risk. Examples: Monero (XMR), Zcash (ZEC, shielded mode), Dash (PrivateSend)
Anonymous transfer features — even non-AECs can be problematic if they offer anonymous transfer structures (AETs). Examples: VA structures integrated with mixers / privacy layers

Issuance · 03

Licensing / Approval Process

Category 1 (licence) — submission package	Description / requirements	Examples
Corporate & governance documents	Ownership & decision-making structure, board charters, internal controls	Board composition chart, audit committee charter
Risk / compliance framework	Policy suite (corporate / risk / compliance / technology / market conduct) and evidence of adherence	Enterprise risk map, internal control manuals
FRVA-specific documents	Proof that reference currency, reserves, redemption, audit and capital requirements are met	Monthly reserve audit engagement, redemption SOP

Category 2 (prior approval) — submission items	Description / requirements	Examples
Purpose & use of issuance	Economic function, use-cases, ecosystem flows	Trading fee discounts, governance voting
Issuer identity & history	Disclosures on the last 10 years — criminal, financial crime, insider trading, money laundering	Officer attestations + background check reports
Financials & use of funds	Financial statements and fundraising use-of-proceeds plan	Audited financials, '60% of proceeds for R&D' etc.
Governance & QC	Role segregation, approval authorities, quality assurance plans	RACI matrix, change-management policy

Material changes (e.g. tokenomics or rights) require renewed approval.

Issuance · 04

Whitepaper & Risk Disclosures

Mandatory whitepaper contents	Description	Examples (wording / data)
Issuer & key persons	Organisation, key personnel, criminal / investigation history	'CIO A, formerly 10 years at XX Bank / no criminal record'
Rights & obligations	Voting rights, rewards (airdrops / incentives), exercise procedures	'Governance proposals: 1 token = 1 vote, 90-day lock-up'
Issuance structure	Total supply, schedule, allocation to team / foundation / community	Total supply 1 billion; team 15% (48-month vesting)
Use of proceeds	Including cash and in-kind contributions, allocation by purpose	50% R&D, 15% security, 20% marketing …
Technical information	Chain, standards (e.g. ERC-20), custody / transfers, audits	'Ethereum L2, ERC-20, smart-contract audit in 2025-07'
Pricing & fees	Initial price, fees, valuation methodology	Issue price USD 0.10, 0.2% sell fee
Legal / regulatory & environmental	Regulatory considerations, environmental impact & climate risks	'PoS consensus, estimated annual emissions X tonnes'

Risk disclosures (separate document)	Description	Example wording
Market / liquidity	Price volatility and lack of depth	'In rapidly changing markets, spreads may widen and redemptions may be delayed.'
Technology / security	Smart-contract bugs, chain congestion	'In case of critical contract errors, temporary freezes may be imposed.'
Legal / regulatory	Jurisdictional changes, licence revocation	'Regulatory tightening may result in restrictions or changes to services.'
Governance	Decision-making delays, concentration of control	'Concentrated holdings may lead to biased governance decisions.'
Operational / financial	Internal control failures, lack of funding	'We target six months of operating cash and conduct quarterly reviews.'

Version control: show last updated date and keep historic versions available in the same location.
Update obligation: reflect changes without delay and notify holders.
No liability disclaimers: you must not include false or misleading statements, and may not use blanket clauses purporting to exclude civil liability.

Issuance · 05

Conduct of Business & Issuer Obligations

Principle	Description	Practical examples
Honesty & fairness	Clear wording, fair treatment, market integrity	Fair disclosure policy, simultaneous release of information (website / notices)
Professionalism & diligence	Skills and care appropriate to the assets	Dedicated product owner / risk owner, training curriculum
Resourcing	Adequate technical, financial and human resources	In-house security / compliance hires, external advisory mandates
Effective disclosure	Sufficient and timely information for decisions	Update via RSS / email alerts, change-logs
Legal & regulatory compliance	Compliance with UAE and other applicable laws	Regulatory mapping matrix, quarterly compliance reports
Environmental responsibility	Minimise environmental impact, disclose climate risks	Energy-usage reporting, assessment of PoS options

Security & technology

Technology governance & risk assessment — monthly security committee meetings; threat-modelling for each release
Smart-contract audits — independent audits by two firms before major releases
VAPT — semi-annual external penetration tests + monthly internal scans
Evidence & logs — test reports and remediation logs retained for VARA inspections

AML / CFT

BRA (business risk assessment) — scoring impact of new products / chains / privacy features
KYC & sanctions — passport + liveness checks; real-time sanctions / PEP screening
Monitoring — on-chain analytics to detect mixers and suspicious patterns
Reporting — STR / SAR filings and responses to regulator queries within 24–48 hours

Marketing, data, tax & records

Marketing — comply with 2024 VARA marketing rules; no exaggeration or misleading claims; explicit 'no deposit / investor protection' wording
Personal data — comply with UAE PDPL; data minimisation, AES-256 at rest, RBAC-based access
Tax — FATCA and other international reporting; collect W-9 from US taxpayers
Books & records — retain records for at least eight years

Distribution by third parties: only *VARA-licensed distributors* may perform distribution; maintain evidence of their selection and due diligence.

Issuance · 06

FRVA (Stablecoin) Specific Requirements

AED-pegged FRVAs fall under the Central Bank of the UAE (CBUAE), not VARA.

Requirement	Description	Examples
100% reserves	High-quality liquid assets equal to the full value of tokens in circulation	Cash, central bank deposits, government bills ≤90 days, short-term MMFs
Legal segregation / no rehypothecation	Reserves legally segregated from issuer assets; no pledging or re-use	Custody agreements prohibiting rehypothecation; segregated accounts
Monthly independent attestations	External verification of circulation, reserve size and composition	Monthly attestations by a top-tier audit firm published online
Redemption rights	Holders entitled to par value redemption, generally within one business day	100 FRVA → 100 USD; T+0 during business hours
Capital requirement	AED 600,000 + 2% of circulating amount	50M AED in circulation → minimum capital 1.6M AED
Incentives prohibited	No interest or holding rewards may be offered	'5% yield on deposits' not allowed; reward points also prohibited

FRVA-specific whitepaper additions	Sample wording
Reference currency & changes	'The default reference currency is 100% USD. Where necessary, EUR may be added up to 20% with 30 days' prior notice.'
Issuance & redemption policy	'Issuance occurs only upon receipt of cash; redemptions are executed concurrently with withdrawals from reserves.'
Custody & access	'Custodian banks A / B; redemption requests submitted before 16:00 on business days are processed on T+0.'
Reserve risks	'We apply limits for credit, market and liquidity risk; individual exposures are capped at 30% of reserves.'

Significant FRVA Issuer: based on size and interconnectedness, additional *governance, capital and reporting* requirements may apply.

Issuance · 07

Exempt Entities, Revocation, Supervision & Enforcement

Condition	Description	Examples
≤ 2,000,000 AED per project	Limit per issuance project	Community points sale of 1.5M AED
Cumulative ≤ 10,000,000 AED	Aggregate limit across all projects	Four offerings of 2M AED each per year
Common rules still apply	Parts II–IV apply equally	Whitepaper, risk, security, AML, records
Intermediation only by licensees	Brokers / exchanges must hold VARA licences	Agreement with a licensed distributor

Grounds for revocation
No issuance within 6 months — *approval obtained but not used*
False or misleading information — *e.g. false financials in the whitepaper*
Breach of conditions / rules (including other jurisdictions) — *e.g. local regulatory breach*
Insolvency, bankruptcy, winding-up or voluntary discontinuation

Supervision & enforcement
Inspections & information requests — *e.g. evidence of security testing*
Suspension of issuance / further issuance, fines, conditional orders
Revocation of approval in cases of serious breaches

Exchange · 08

Exchange Services — Additional Board Requirements

Part I of the Exchange Services Rulebook. Independence is compromised in the following cases: conflict of interest with auditors, holding 10% or more shareholding, tenure exceeding 7 years, representing major shareholders, etc.

Conflict Factor	Practical Example	Recommended Controls
Relationship with Auditors	Candidate's immediate family member is an employee/partner at the current audit firm	Exclude candidate or change auditor, apply a 2-year cooling-off period
Concentrated Shareholding	Candidate and immediate family combined shareholding ≥ 10%	Restrict voting rights or designate separate independent non-executive directors
Long-term Tenure	Serving as a director for more than 8 consecutive years	Set tenure limits (e.g. 6 years) and introduce rotational replacements

Board committees — mandatory

Establish Remuneration, Nomination, and Audit Committees with formal charters, establish board reporting lines, and retain meeting minutes for 8 years.

Authority may be delegated to committees, but ultimate responsibility remains with the Board
Regularly report findings and recommendations to the Board

Committee	Key Agendas (Examples)
Remuneration	Executive compensation policy, VA compensation caps, risk-adjusted bonuses
Nomination	Independence evaluation, key talent succession, director candidate pipeline management
Audit	Internal controls, asset custody reviews, external auditor communications

Board remuneration reporting	Examples
Compensation Type	Base salary AED X, Cash bonus AED Y, Token incentives Z units (24-month vesting)
Compensation Rationale	KPIs such as 20 new listings, 35% reduction in operational risk rate

Annually submit details and rationale for compensation of Board and Committee members (including cash, benefits, and VA-denominated incentives) to VARA. VARA maintains this information confidentially unless required by law.

Exchange · 09

Internal Policies, Procedures & Public Disclosures

Policy Domain	Mandatory Content	Practical Example
Prevention of Market Offences	Prohibition, detection, and sanctioning of Market Offences; internal rules & compliance program	Spoofing/layering detection rules, sanctions matrix (Warning → Restriction → Expulsion)
Withdrawal Accessibility	Guarantee customer VA access and withdrawals even during high volatility	Alternative withdrawal window during DLT delays, backup custody transition SLA
Settlement, Delivery & Clearing	Settlement cycles, failure handling, netting principles	Retry / manual settlement / customer notification within 24h of settlement failure
Price Determination	Ensure integrity and reliability based on market data	VWAP, multi-oracle systems, failover sources

Disclosure Item	Details	Example
Conflicts of Interest	Potential risks and management measures	Disclosure of conflict of interest with MM subsidiaries and independent committee oversight
Policy Summaries	Privacy, whistleblowing, and grievance handling	DPO contact, anonymous reporting line, 15 business days response SLA
Asset-Specific Summaries	Name/symbol, launch date, MC/FDV, circulating supply, audit, max drawdown	'ABC' (ABC), 2022-06-01, MC $500m / FDV $800m, Circulating 62%, Audit 2024-11-05, MDD −78% (2023-08-18)
Custody & Ownership	Deposit and protection mechanisms, respect for customer ownership rights	95% Cold storage, multi-sig, customer-level on-chain tagging
Price Determination	Orderbook pricing calculation, oracles, fallback sources	Major trading pairs VWAP ± spread, 3-tier oracle setup
Others	Officer/Board track record, VARA requests	No history of financial crime convictions (state explicitly if applicable)

Exchange · 10

Exchange Operation Rules

Participant rules (Code of Conduct) & sanctioning powers — Must publish and enforce exchange participant rules, holding the authority to impose sanctions such as warnings, mandatory training, trading restrictions, expulsion, or referral to law enforcement upon violations.

Example Sanction Matrix: First Spoofing Offense → 7-day restriction + mandatory training / Recurrence → 30-day suspension + penalty / Severe Violation → Immediate expulsion + criminal reporting.

Notification Category	Specific Items	Data Collection Example
Positions	Large positions including on-chain, OTC, and spot	Address cluster aggregation, linked derivative & spot exposures
Inventory / Delivery	VA inventory, delivery methods / service types	Custody balance snapshot, wallet routing details
Management Actions	Exercise of powers, limit adjustments, extra margin calls	Risk engine logs, limit change history

Must be capable of notifying VARA regarding large positions, inventories, delivery types, exercise of position management powers, position limit changes, additional margin calls, and other corrective actions when market disruption is suspected. Fee structures must be transparent, fair, and non-discriminatory.

Trading systems continuity (BCP/DR) & settlement

Maintain orderly trading under high volatility/uncertainty (capacity and resilience)
Reject erroneous orders or orders exceeding threshold limits
Complete advance testing and establish backup/DR frameworks — example: quarterly DR drill, matching engine failover, RTO ≤ 15 minutes, RPO = 0
Executed VA transactions must achieve final settlement within 24 hours in principle (except for uncontrollable DLT disruptions or force majeure)

Exchange · 11

Margin Trading Rules

Approval & oversight

Prerequisite — Prior approval from VARA and demonstration of system suitability (including technical reports). Prior approval and technical reporting are also required for material changes.

Record retention

Retain all records related to margin trading for a minimum of 8 years.

Obligations (risk management)

Continuous real-time monitoring of client margin accounts and early warning triggers (prior to reaching Maintenance Margin thresholds)
Liquidation of partial/full VA in the account upon failure to restore funds, restoring levels above Maintenance Margin
Recommended Warning Levels: Caution 80% MM, Warning 100% MM, Forced Liquidation 110% MM (explicitly stated in internal policies)

Item	Rule	Example
Operational Exposure	Capital allocated for margin must be included in Operational Exposure	OE = Cash 10m + Margin Allocation 2m = 12m reflected
Single Client Limit	Single client extension of credit ≤ 1/10 of total allocated margin pool	Total pool 20m → Single client limit ≤ 2m
Permitted Collateral	Target VA, Fiat currency, USD (or AED approved) pegged FRVA (100% reserve in cash/equivalents)	BTC Margin Collateral: BTC + USD Cash + USD FRVA
Special Collateral Rules	Alternative VAs may be permitted if target VA crashes sharply or suspended >7 business days	ABC suspended for 8 business days → ETH collateral permitted

Mandatory margin agreement term	Summary	Sample Wording
Rights & Obligations	Termination, dispute resolution, timing of early warning alerts	'Dual notifications via App & Email when reaching MM threshold'
Cash Withdrawal Rights	Withdrawal / re-hypothecation rights for excess cash above MM	'Cash exceeding MM is withdrawable (may be restricted during volatility)'
Financing Costs	Interest rates, variable benchmarks, notice procedures	'Base rate + x%, 7-day advance notice for changes'
Risk Disclosures	Total loss, additional call obligations, liquidation conditions	'Positions may be liquidated in full if account falls below MM'
IM / MM	Initial and Maintenance Margin levels and adjustment criteria	'BTC/USDT: IM 10%, MM 5% (subject to operational adjustments)'
Fees	Fee types and payment timing	Explicitly list funding, borrowing, and liquidation fees
Cash Repayment Rights	Right to settle remaining balances in cash	'Remaining asset balance can be settled in cash at any time'

Appendix · 12

Key Definitions & Contact

Appendix A — Key definitions (summary)VARA Virtual Asset Issuance Rulebook

Virtual Asset (VA)
Digital representation of value
FRVA
Fiat-Referenced Virtual Asset
Reference Currency
The approved currency an FRVA is linked to
Reserve Assets
FRVA reserves
Licensed Distributor
VARA-licensed VASP distributor
Non-Redeemable & Non-Transferable VA
Platform-only
Redeemable Closed-Loop & Non-Transferable VA
Redeemable within a designated network
Emirate
The Emirate of Dubai, excluding DIFC

Scope, versioning & disclaimer

This guide is an implementation-focused summary based on VARA's *Virtual Asset Issuance Rulebook* (2024-10-01), the *FRVA Issuance Rules* (2023-09-18), and the *Exchange Services Rulebook* (7 Feb 2023) together with the *Virtual Assets and Related Activities Regulations* 2023. In any case of conflict, the latest official texts, supplementary rules and guidance take precedence. Where multiple regimes apply, the stricter standard should be followed.

Contact a MIRR ASIA representative

Free Consultation FormRequest a free consultation

Virtual Asset Regulations by CountryBrowse the country comparison

KakaoTalk ChannelContact via KakaoTalk Channel

Hong Kong OfficeTel: 852-2187-2428

Korea OfficeTel: 02-543-6187