VARA Virtual Assets Regulations
United Arab Emirates
2023
Payments
AML/CFT
Overview
Key Obligations
- Obtain a VARA license for each regulated activity (advisory, custody, exchange, lending, payments, etc.)
- Comply with General Rulebooks (Company, Compliance & Risk, Technology & Information, Market Conduct)
- Follow Activity-Specific Rulebooks tailored to the VASP’s business model
- AML/CFT compliance in line with UAE federal law
- Prohibited activities include issuance of anonymity-enhanced cryptocurrencies
- Marketing must be transparent, risk-disclosed, and records kept for at least 2 years
- Entities with proprietary investments exceeding USD 250m must register as Large Proprietary Traders
- Token issuance (including fiat-referenced/stablecoins) must follow the Issuance Rulebook
Stay ahead of risk with Signzy
Explore tools that help you onboard, monitor, and verify with confidence
Transaction Monitoring
Monitor transactions in real-time and analyse past behaviour to identify suspicious activities and ensure regulatory compliance across the user journey.
AML Screening
Screen users against Politically Exposed Persons (PEP), watchlists, sanctions lists, adverse media, and more through one-time screening and advanced monitoring.
Bank Account Verification
Instantly verify bank account details to confirm account ownership and validity for secure financial transactions.
Related Regulations
FAQ
Who regulates VARA?
The Virtual Assets Regulatory Authority (VARA), which oversees all VASPs in Dubai (excluding DIFC).
Which activities are regulated?
Advisory, broker-dealer, custody, exchange, lending & borrowing, payments/remittance, and investment/management services.
What rulebooks apply?
General Rulebooks (Company, Compliance & Risk, Technology & Information, Market Conduct), Activity-Specific Rulebooks, and the Issuance Rulebook.
Are there marketing rules?
Yes. Promotions must not be misleading, must include risk disclaimers, and marketing records must be retained for 2 years.
What penalties apply for non-compliance?
VARA may impose fines, suspend licenses, restrict activities, or revoke authorization.