As of February 7, 2023, new Virtual Asset (VA) regulations and related codes of practice (“VA System”) published by the Virtual Asset Regulatory Authority (“VARA”) came into effect. This VA concept is effective immediately upon publication and automatically applies to all firms providing services in Dubai, except for firms doing business in the Dubai International Financial Centre. The main activities under this structure include Advisory services, Broker-Dealer services, Custody services, Exchange services, Lending and Borrowing services, Payment and Remittances services, Virtual Asset Management, and Investment Services.
Find out more information and the cost of the Vara license
The VARA Framework has been a long-awaited development and has created the foundation upon which virtual assets in the Emirate will be managed and regulated. VARA has established a specific virtual asset regime tailored to the operational and technological aspects of virtual assets and virtual asset service providers (“VASPS”). It is significantly different from what other jurisdictions offer. Through this form of regulation, the VARA Framework will help Dubai achieve its ambition to become a global hub for web3 and blockchain-enabled activities rather than focusing on specific regions. The program went into effect immediately after publication. For this reason, anyone intending to conduct VA-related activities in or outside of Dubai should review these changes and their impact on the business at short notice.
VARA was established to regulate VAs and VASPs operating in Dubai and is the sole competent authority for VAs in Dubai. The VA concept follows Cabinet Decree No. 111/2022 regulating virtual assets and service providers. This regulation prohibits any person from engaging in VA activities in the UAE (excluding ADGM and DIFC) without obtaining approval and license from the UAE Securities and Commodities Authority (“SCA”) or local licensing authority (e.g., VARA). It obliges all companies connected with virtual assets to be licensed.
The concept of VA was detailed in "Act No. (4) of 2022 on the regulation of virtual assets in the Emirate of Dubai". This law not only established VARA and confirmed that VARA has the authority to regulate virtual assets in Dubai. The Administrative Order was published soon after. It is the only statutory order that correctly holds the basic principles of marketing, promotion, and advertising of virtual assets in Dubai. The concept of VA is essential in regulating the entire perimeter of virtual assets in Dubai and establishing this direction in the future. Further in this article, you will be able to familiarize yourself with the main points of the VA Framework, as well as study the sets of rules for specific activities and territorial coverage.
To begin with, it is worth understanding in more detail how the VA system works. It consists of the Virtual Assets and Related Activities Regulations 2023 and several rules. The VARA Regulations cover the registration and licensing requirements for a VASP. Additionally, the rules define regulated activity with virtual assets. The rules detail all the requirements for combating money laundering and market offenses. For example, insider trading and market manipulation are prohibited, which fall within the scope. All companies that comply with VARA's licensing requirements under the VARA Rules will be required to comply with four mandatory sets of rules to maintain a license and permit it to operate concerning digital assets. There are also seven sets of rules for specific activities. These rules detail the risks associated with providing various activities with virtual assets. All controls are binding if firms have a VARA license to carry out the relevant activities. Additionally, a set of rules was issued that governs the issuance of all virtual assets and confirms the need to comply with the Administrative Order.
Recent laws confirm that VARA will have jurisdiction throughout Dubai (including free zones), excluding ADGM and DIFC. List of conditions that apply to other ground regulators:
The legal acts governing the activities of VARA confirm that VARA has the right to issue instructions, directives, and rules regarding actions with virtual assets. All companies or other entities planning to conduct VA activities in Dubai must obtain a license from VARA before they start providing their services. The VARA Rules, paragraph 1, defines activities related to virtual assets and includes:
Companies receiving licenses and permits to operate with virtual assets must pay taxes and registration fees. VARA has also secured many licensing exceptions. These exceptions include specific categories of professionals who deal with virtual assets related to their business. There are also many organizations exempt from licensing. The list of such organizations consists of the UAE government or organizations associated with the UAE government. However, even license-exempt organizations must obtain confirmation of non-objection from VARA.
The Virtual Asset Regulations also cover various registration requirements for those organizations that do not comply with licensing requirements. The list of such conditions includes information for proprietary traders of virtual assets. In this case, if their portfolio of virtual assets reaches $250,000,000 during any rolling 30-day period, then the company is subject to regulation and licensing. In addition, VARA rules govern the voluntary registration of entities holding a commercial or free zone license in Dubai. This license covers the provision of technical services related to distributed ledger technology. The license is also available to other businesses that use these technology services or to individual traders with portfolios below the specified amount.
The licensing process is simple but requires care and a responsible approach. The application submission includes a tiered approval structure that provides for the following:
Since the rules on licensing and regulation of virtual assets have recently been changed, only a few companies have received licenses. The transition phase is beginning, and more potential applicants are appearing. Company representatives should be aware that, to date, VARA licenses have only been issued at the first stage (Temporary Permit) or the second (MVP). The VARA management announced that to obtain an appointment in the fourth stage, and one must pass rigorous checks within the established regime. Any VASP that has issued an MVP license must also comply with the terms of the MVP license. Detailed guidance on the four-step licensing process has yet to be published. However, VARA will provide these clarifications, correct application forms, business plan content requirements, and expected timelines shortly.
Also, the VARA Regulation confirms:
Part V of the VARA Rules states that all companies doing business with digital assets must comply with four mandatory rules. These rules cover significant business, capital, company structure, and corporate governance changes. The authoritarian nature and detailed regulatory requirements make it clear that VASPs operating in Dubai will be subject to full prudential regulation. Also, some changes were made concerning responsible persons. The responsibility lies with two authorized persons approved by VARA and has relevant experience. However, these persons must be residents of the UAE or holders of UAE passports. Also, the board of directors or top managers of the company must be residents of the UAE or holders of UAE passports.
The Compliance and Risk Management Code of Practice covers several areas:
Detailed rules regarding customer due diligence, virtual assets, and customer money have also been established. Interestingly, the rules set reconciliation and proof of reserve requirements for VASPs holding virtual customer assets.
The technology and information code of practice confirms that safety is on VARA's mind. These rules require companies to appoint a Chief Information Security Officer responsible for ensuring that VASPs comply with all parts of the Code of Practice you reviewed above. Companies must have a particular governance structure to comply with cybersecurity policies and algorithms. Firms' personnel should receive the necessary training or briefing to keep abreast of cybersecurity risks and developments. Protecting customer data is part of the compliance program.
The final, binding set of rules controls compliance with the Administrative Order. Specific requirements apply for own account trading, public disclosure, market transparency, client agreements, complaint handling, investor classification, and general VA standards. Notably, group members based in the Emirates are generally prohibited from trading virtual and other assets on their behalf. It eliminates the risks associated with private trading.
All seven rules specify that companies must publicly disclose details of any past prosecutions or convictions of senior management or board members. This rule applies to all employees, whether those convictions or prosecutions originated in the UAE or elsewhere. These rules also govern the client's investment methodology, background checks, staff competence, and compliance with the client's requirements.
The Code of Conduct for Brokerage and Dealer Services prescribes detailed requirements for trading and execution rules. Also, there are special rules that control margin trading, transactions as a principal, and the distribution of virtual assets.
The Code of Custody Services establishes strict requirements for the composition of the board of directors and the committee of the board of directors of VASP. Also, additional information relates to separation, control, wallet management, and general customer relationship management.
There is also a set of rules for lending and borrowing. This document confirms that VARA's activities are potentially more extensive than any other regulatory body in the UAE. Please see the directions above for specific requirements for risk management, reporting, evaluation, and record keeping.
One of the VA Management and Investment Services rulebooks has rules that relate to the management and investment of virtual assets. There are also several strict rules regarding marketing and fair advertising.
Details regarding the Payment and Money Transfer Service rules will be published. All newly issued requirements must be consistent with the needs of the UAECB.
Many rules are also available when providing a personal recommendation. The following factors should be considered for each client:
"Broker-Dealer Services" means any of the following:
All VASPs are subject to the Customer Virtual Asset Custody Rules. Only VASPs that separate each client's assets in separate VA wallets will be eligible for custody. Companies providing "Exchange Services" may offer any of the following:
The last set of VARA deals with the rules for issuing virtual assets. The issuance of any virtual assets in Dubai requires prior approval from VARA. However, this rule does not apply to permitted virtual purchases, considered non-transferable. In addition, all companies must comply with regulations regarding white papers, risk disclosure, and technology and security requirements. All virtual assets do not require individual and separate permission from VARA to be used in Dubai. In addition, VARA has the right to revoke its consent if the virtual asset is not released within six months of receiving the authorization. All companies planning to give away their tokens should keep this in mind. If the permit is revoked, it will need to be resubmitted.