VARA Dubai Issues Virtual Asset Regulations: What VASPs Must Know
Dubai's Virtual Asset Regulatory Authority has published its Virtual Assets and Related Activities Regulations 2023, converting what had been a phased licensing pilot into a full statutory framework. Every firm offering virtual asset services to the Dubai market, whether already holding a provisional licence or entering fresh, now faces a clear compliance runway with binding AML obligations, defined activity categories, and an explicit registration deadline backed by the threat of regulatory action. For accounting firms, auditors, and CFOs supporting UAE-based or UAE-facing clients, the publication changes both the compliance workload and the audit evidence that will be expected going forward.
Why VARA Was Created and What the 2023 Regulations Change
VARA was established in Q1 2022 as the world's only standalone, independent regulator dedicated exclusively to virtual assets. Its remit covers the entire Emirate of Dubai, with the exception of the Dubai International Financial Centre, which operates under its own regulatory perimeter. The authority was conceived as part of Dubai's broader D33 Economic Plan, which targets the emirate's positioning as a hub for metaverse, AI, Web3, and blockchain activity.
Prior to the 2023 Regulations, VARA operated through a Multi-Phase Licence, or MVP, structure that included Provisional and Preparatory stages. The new framework replaces that transitional architecture with a single Full Market Product, or FMP, licensing standard. The shift matters because it removes regulatory ambiguity: firms can no longer operate in a grey zone between provisional approval and full compliance.
From pilot licences to full statutory standing
Existing MVP Operational licence holders, as well as those holding Provisional or Preparatory licences, are given a defined path toward FMP licensing rather than being asked to restart from scratch. That transition route is deliberate: it signals that VARA wants compliant incumbents to remain in the market while simultaneously tightening the bar for all participants. New market entrants follow the same FMP pathway from the outset.
The regulations also formalise VARA's mandate around three pillars the authority has highlighted since launch: economic stability, investor protection, and what it describes as jurisdictional resilience. Those three pillars now carry legal weight, not merely policy weight.
The Seven Licensed Activity Categories
The VA Framework draws a clear perimeter around exactly which activities require a VARA licence. There are seven categories, each treated as a discrete regulated function:
- Advisory services
- Broker-dealer services
- Custodial services
- Exchange services
- Lending and borrowing services
- Payments and remittances services
- VA management and investment services
Beyond those seven operational categories, token issuance is separately regulated under the VARA regime. Treating issuance as a stand-alone regulated activity is significant: it brings prospective token launches within the same supervisory perimeter as ongoing service activities, and it places disclosure and investor-information obligations directly on the issuer at the point a new token enters the Dubai market.
Implications for multi-activity firms
A firm that, for example, operates an exchange, offers custody, and extends lending products is carrying three separately licensed activities under this framework. Accounting firms reviewing such a client's regulatory status need to confirm that each activity line is individually authorised, not just that the entity holds a general VARA licence. The same applies to CFOs conducting group-level regulatory mapping: activity creep, where a desk begins offering a service that sits in a different category, carries direct licensing risk under the new rules.
This granularity also has implications for crypto bookkeeping software configurations. Chart-of-accounts structures and transaction categorisation flows should reflect the activity-level breakdown VARA now requires, because regulatory reporting and audit evidence will need to align with those categories rather than with a generic "crypto revenue" line.
AML and Operator Responsibility Standards
The regulations explicitly require licensed entities to apply what VARA describes as "gold-standard" AML standards. The framing aligns with the UAE's broader posture: the country has worked actively to address FATF concerns about money laundering and terrorist financing risks arising from the use of virtual asset technologies, and the 2023 Regulations represent a codification of that commitment at the emirate level.
What the AML mandate means in practice
For compliance teams and their advisers, VARA's AML requirements are not a separate optional layer, they are baked into the licensing conditions. A firm cannot hold a valid FMP licence while operating below the required AML standard. That coupling of licence status and AML compliance is the mechanism VARA uses to enforce standards: breach the AML requirement and the licence itself is at risk.
The regulations also introduce a concept of defined operator responsibility. The framework is designed to give the market clarity on the expected level of conduct and accountability that a licensed operator must maintain. From an audit perspective, this means boards and senior management carry named responsibility for compliance outcomes, not just compliance functions. Auditors reviewing governance arrangements for VARA-licensed clients should expect to see documented accountability structures that map to this requirement.
For a deeper look at the capabilities that regulators consistently test in AML reviews, see our analysis of AML capabilities that regulators actually look for in virtual asset contexts.
Registration Obligation and the Compliance Deadline
Any VASP that was offering virtual asset services to the Dubai market before the FMP Regulations were published is required to register with VARA and become fully compliant with the final rules. There is no opt-out and no grandfathering exemption that allows continued operation without registration. VARA is explicit that any breach of this condition will be subject to regulatory action.
Who needs to act immediately
Three groups face the most pressing registration and compliance obligations:
- Legacy UAE-based VASPs that were operating before the framework was finalised and have not yet converted to FMP status.
- MVP licence holders in either the Provisional or Preparatory stage, who must now progress to full FMP licensing rather than treating their current status as ongoing authorisation.
- New market entrants who cannot begin offering services without first obtaining an FMP licence.
Accounting firms advising clients in any of these groups should treat the registration obligation as time-critical. The risk is not merely a fine: VARA's stated position is that non-compliant operation constitutes a breach subject to regulatory action, which in practice can include suspension or prohibition from the market.
Accounting and Audit Implications for Firms and CFOs
The 2023 Regulations create several concrete workstreams for finance functions and their advisers.
Licence-status verification in client onboarding
For accounting firms, the first obligation is straightforward: any client or prospective client operating in the Dubai virtual asset space should be verified against the VARA register. Operating without a valid FMP licence is a regulatory breach, and a firm that knowingly provides accounting or audit services to an unlicensed operator carries its own professional risk. Building VARA licence verification into VASP client onboarding procedures is now a baseline expectation. For a structured approach to that process, see our guidance on VASP due diligence and onboarding frameworks.
Activity-level financial reporting
The seven-category activity structure has a direct read-across to financial statement presentation. Revenue recognition, cost allocation, and segment reporting all become more complex when a single entity is licensed across multiple categories. CFOs should review whether their current digital asset accounting software supports activity-level tagging at transaction level, because regulators and auditors will increasingly expect financial records to be reconcilable to the licensed activity perimeter.
Token issuance and issuer obligations
The regulation of token issuance as a standalone activity introduces a category of liability that finance teams may not have fully scoped. If a client has issued, or plans to issue, a token into the Dubai market, that activity now carries regulatory obligations independent of whether the entity also holds an operational service licence. CFOs should ensure that any issuance activity is reflected in both the regulatory register and the financial statements, including disclosure of the associated obligations.
AML controls and audit evidence
VARA's gold-standard AML requirement will translate into audit evidence expectations. Auditors reviewing VARA-licensed clients should anticipate requests for documented customer due diligence procedures, transaction monitoring records, and evidence of senior management sign-off on AML policy. Where a client's crypto accounting software does not produce audit-ready AML records, that gap needs to be addressed before the next review cycle.
Frequently Asked Questions
Does the VARA framework apply to firms based in the DIFC?
No. VARA's jurisdiction covers the Emirate of Dubai with the explicit exclusion of the Dubai International Financial Centre. Firms operating within the DIFC fall under the DFSA's regulatory perimeter rather than VARA's.
What happens to a firm still holding a Provisional MVP licence?
Provisional and Preparatory MVP licence holders are given a defined transition route toward Full Market Product licensing. They cannot continue to rely on the provisional status as an ongoing authorisation: the expectation is progression to FMP compliance within the framework's timeline.
Is token issuance treated the same as running an exchange under VARA's rules?
No. Issuance is regulated as a separate activity category, distinct from the seven operational service licences. A firm that issues tokens into the Dubai market carries issuer-specific obligations, including consumer information requirements, regardless of whether it also holds an exchange or other service licence.
How should CFOs reflect VARA licence costs in financial statements?
Licence fees and ongoing regulatory compliance costs should be assessed under the entity's applicable accounting standard, typically IFRS as adopted in the UAE. Whether initial licence fees meet the criteria for intangible asset capitalisation or should be expensed as incurred will depend on the specific nature and terms of the fee. Firms should document their accounting policy choice and apply it consistently.
What does "regulatory action" mean under the VARA framework for non-compliant VASPs?
VARA has stated that any breach of the registration and compliance requirement will be subject to regulatory action. While the specific enforcement measures are set out in VARA's broader rulebook, this can include warnings, fines, suspension of operations, or revocation of licence status. Non-registration is treated as a breach in its own right, not merely a procedural oversight.