Vara Issues Regulations For Dubai Virtual Assets Regime
As of February 7, 2023, new Virtual Asset (VA) regulations and related codes of practice (“VA System”) published by the Virtual Asset Regulatory Authority (“VARA”) came into effect. This VA concept is effective immediately upon publication and automatically applies to all firms providing services in Dubai, except for firms doing business in the Dubai International Financial Centre. The main activities under this structure include Advisory services, Broker-Dealer services, Custody services, Exchange services, Lending and Borrowing services, Payment and Remittances services, Virtual Asset Management, and Investment Services.
The VARA Framework has been a long-awaited development and has created the foundation upon which virtual assets in the Emirate will be managed and regulated. VARA has established a specific virtual asset regime tailored to the operational and technological aspects of virtual assets and virtual asset service providers (“VASPS”). It is significantly different from what other jurisdictions offer. Through this form of regulation, the VARA Framework will help Dubai achieve its ambition to become a global hub for web3 and blockchain-enabled activities rather than focusing on specific regions. The program went into effect immediately after publication. For this reason, anyone intending to conduct VA-related activities in or outside of Dubai should review these changes and their impact on the business at short notice.
VARA
VARA was established to regulate VAs and VASPs operating in Dubai and is the sole competent authority for VAs in Dubai. The VA concept follows Cabinet Decree No. 111/2022 regulating virtual assets and service providers. This regulation prohibits any person from engaging in VA activities in the UAE (excluding ADGM and DIFC) without obtaining approval and license from the UAE Securities and Commodities Authority (“SCA”) or local licensing authority (e.g., VARA). It obliges all companies connected with virtual assets to be licensed.
The concept of VA was detailed in “Act No. (4) of 2022 on the regulation of virtual assets in the Emirate of Dubai”. This law not only established VARA and confirmed that VARA has the authority to regulate virtual assets in Dubai. The Administrative Order was published soon after. It is the only statutory order that correctly holds the basic principles of marketing, promotion, and advertising of virtual assets in Dubai. The concept of VA is essential in regulating the entire perimeter of virtual assets in Dubai and establishing this direction in the future. Further in this article, you will be able to familiarize yourself with the main points of the VA Framework, as well as study the sets of rules for specific activities and territorial coverage.
If you would like to discuss the regulation of your virtual asset business or the publication of the VARA Rules and their impact on your business, please contact us
Overview
of the VA Platform
To begin with, it is worth understanding in more detail how the VA system works. It consists of the Virtual Assets and Related Activities Regulations 2023 and several rules. The VARA Regulations cover the registration and licensing requirements for a VASP.
Additionally, the rules define regulated activity with virtual assets. The rules detail all the requirements for combating money laundering and market offenses. For example, insider trading and market manipulation are prohibited, which fall within the scope. All companies that comply with VARA’s licensing requirements under the VARA Rules will be required to comply with four mandatory sets of rules to maintain a license and permit it to operate concerning digital assets. There are also seven sets of rules for specific activities.
These rules detail the risks associated with providing various activities with virtual assets. All controls are binding if firms have a VARA license to carry out the relevant activities.
Additionally, a set of rules was issued that governs the issuance of all virtual assets and confirms the need to comply with the Administrative Order.
Territorial Coverage
Recent laws confirm that VARA will have jurisdiction throughout Dubai (including free zones), excluding ADGM and DIFC. List of conditions that apply to other ground regulators:
- The UAE Central Bank and VARA may regulate payment tokens and fiat-backed stablecoins.
- The UAECB will regulate central bank digital currencies.
- A company licensed by VARA does not require a separate license request from SCA.
- Any firm holding another commercial cryptocurrency license from the Dubai Free Zone may require a separate VARA license to conduct business with virtual assets.
VARA Rules
The legal acts governing the activities of VARA confirm that VARA has the right to issue instructions, directives, and rules regarding actions with virtual assets. All companies or other entities planning to conduct VA activities in Dubai must obtain a license from VARA before they start providing their services. The VARA Rules, paragraph 1, defines activities related to virtual assets and includes: Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, Payments and Remittances Services, VA Management and Investment Services.
Companies receiving licenses and permits to operate with virtual assets must pay taxes and registration fees. VARA has also secured many licensing exceptions. These exceptions include specific categories of professionals who deal with virtual assets related to their business. There are also many organizations exempt from licensing. The list of such organizations consists of the UAE government or organizations associated with the UAE government. However, even license-exempt organizations must obtain confirmation of non-objection from VARA.
The Virtual Asset Regulations also cover various registration requirements for those organizations that do not comply with licensing requirements. The list of such conditions includes information for proprietary traders of virtual assets. In this case, if their portfolio of virtual assets reaches $250,000,000 during any rolling 30-day period, then the company is subject to regulation and licensing. In addition, VARA rules govern the voluntary registration of entities holding a commercial or free zone license in Dubai. This license covers the provision of technical services related to distributed ledger technology. The license is also available to other businesses that use these technology services or to individual traders with portfolios below the specified amount.
The licensing process is simple but requires care and a responsible approach. The application submission includes a tiered approval structure that provides for the following: Getting a temporary permit, Submission of documents for a preliminary license for a minimum viable product (“MVP”), Obtaining an MVP operating license, Full Product License (“FMP”).
Since the rules on licensing and regulation of virtual assets have recently been changed, only a few companies have received licenses. The transition phase is beginning, and more potential applicants are appearing. Company representatives should be aware that, to date, VARA licenses have only been issued at the first stage (Temporary Permit) or the second (MVP). The VARA management announced that to obtain an appointment in the fourth stage, and one must pass rigorous checks within the established regime. Any VASP that has issued an MVP license must also comply with the terms of the MVP license. Detailed guidance on the four-step licensing process has yet to be published. However, VARA will provide these clarifications, correct application forms, business plan content requirements, and expected timelines shortly.
Also, the VARA Regulation confirms:
- All companies licensed by VARA must comply with the obligations in the VARA Rules. This rule applies to implementing any activity related to virtual assets, even outside of Dubai.
- VASPs must comply with AML/CFT laws.
- VASPs must comply with the Administrative Order.
- Privacy tokens or other forms of anonymous virtual assets are prohibited in Dubai.
- Companies can be charged with wrongdoing if they are involved in insider trading, illegal disclosures, and market manipulation. It contributes to the abuse of position and influences the price of virtual assets traded in Dubai.
- The penalties imposed on a company will depend on many factors. They are usually up to AED 50,000,000 (approximately $13,600,000), which cannot exceed 15% of any VASP’s annual income.
Mandatory
Rulebooks
Part V of the VARA Rules states that all companies doing business with digital assets must comply with four mandatory rules. These rules cover significant business, capital, company structure, and corporate governance changes. The authoritarian nature and detailed regulatory requirements make it clear that VASPs operating in Dubai will be subject to full prudential regulation.
Also, some changes were made concerning responsible persons. The responsibility lies with two authorized persons approved by VARA and has relevant experience. However, these persons must be residents of the UAE or holders of UAE passports. Also, the board of directors or top managers of the company must be residents of the UAE or holders of UAE passports.
The Compliance and Risk Management Code of Practice covers several areas:
General principles of compliance
Management and training of employees
Accounting and auditing
Operational and information risks
Implementation of the management system
Detailed rules regarding customer due diligence, virtual assets, and customer money have also been established. Interestingly, the rules set reconciliation and proof of reserve requirements for VASPs holding virtual customer assets.
The technology and information code of practice confirms that safety is on VARA’s mind. These rules require companies to appoint a Chief Information Security Officer responsible for ensuring that VASPs comply with all parts of the Code of Practice you reviewed above. Companies must have a particular governance structure to comply with cybersecurity policies and algorithms. Firms’ personnel should receive the necessary training or briefing to keep abreast of cybersecurity risks and developments. Protecting customer data is part of the compliance program.
The final, binding set of rules controls compliance with the Administrative Order. Specific requirements apply for own account trading, public disclosure, market transparency, client agreements, complaint handling, investor classification, and general VA standards. Notably, group members based in the Emirates are generally prohibited from trading virtual and other assets on their behalf. It eliminates the risks associated with private trading.
Codes of Practice
for Specific Activities
All seven rules specify that companies must publicly disclose details of any past prosecutions or convictions of senior management or board members.
This rule applies to all employees, whether those convictions or prosecutions originated in the UAE or elsewhere. These rules also govern the client’s investment methodology, background checks, staff competence, and compliance with the client’s requirements.
The Code of Conduct for Brokerage and Dealer Services prescribes detailed requirements for trading and execution rules. Also, there are special rules that control margin trading, transactions as a principal, and the distribution of virtual assets.
The Code of Custody Services establishes strict requirements for the composition of the board of directors and the committee of the board of directors of VASP. Also, additional information relates to separation, control, wallet management, and general customer relationship management.
There is also a set of rules for lending and borrowing. This document confirms that VARA’s activities are potentially more extensive than any other regulatory body in the UAE. Please see the directions above for specific requirements for risk management, reporting, evaluation, and record keeping.
One of the VA Management and Investment Services rulebooks has rules that relate to the management and investment of virtual assets. There are also several strict rules regarding marketing and fair advertising.
Details regarding the Payment and Money Transfer Service rules will be published. All newly issued requirements must be consistent with the needs of the UAECB.
Basic Provisions
Many rules are also available when providing a personal recommendation. The following factors should be considered for each client:
- Knowledge and experience in investing in virtual assets;
- investment objectives, including but not limited to the time frame and locations through which they may purchase virtual assets;
- financial circumstances, including their ability to incur sudden and significant losses or shares of their capital invested in virtual assets.
Broker-Dealer Services means any of the following:
- Processing orders to buy and sell Virtual Assets between two people;
- Requesting or accepting orders for virtual assets and accepting fiat currency or other virtual investments for such orders;
- Facilitating the matching of virtual asset transactions between buyers and sellers;
- Creation of a virtual asset market using client assets.
All VASPs are subject to the Customer Virtual Asset Custody Rules. Only VASPs that separate each client’s assets in separate VA wallets will be eligible for custody. Companies providing “Exchange Services” may offer any of the following:
- Exchange, trade, or conversion between virtual assets and fiat currency;
- Trade, or conversion between one or more Virtual Assets;
- Matching orders between buyers and sellers and exchanging virtual assets.
Issuance
of Virtual Assets
The last set of VARA deals with the rules for issuing virtual assets. The issuance of any virtual assets in Dubai requires prior approval from VARA.
However, this rule does not apply to permitted virtual purchases, considered non-transferable. In addition, all companies must comply with regulations regarding white papers, risk disclosure, and technology and security requirements.
All virtual assets do not require individual and separate permission from VARA to be used in Dubai. In addition, VARA has the right to revoke its consent if the virtual asset is not released within six months of receiving the authorization.
All companies planning to give away their tokens should keep this in mind. If the permit is revoked, it will need to be resubmitted.
to our news & insights
Connect with our experts
Our experts will tell you how to do it as quickly and easily as possible.
By clicking the button, I confirm that I have read the privacy policy and consent to the collection and processing of my personal data in accordance with the GDPR rules.