The United Arab Emirates (“UAE”) has long been at the forefront of embracing technological and financial innovation.  For example, Dubai has emerged as a global hub for virtual assets (“VAs”) and cryptocurrencies.  Earlier this year, the Dubai Virtual Assets Regulatory Authority (“VARA”) adopted its first Virtual Assets and Related Activities Regulations 2023 (the “Regulations”), along with four compulsory rulebooks, seven activity-specific rulebooks, and a virtual asset issuance rulebook (the “Rulebooks”).[1]  The Regulations provide much-anticipated regulatory certainty and offer financial security to investors in Dubai.[2]

In a recent development, VARA announced a fine of AED 10 million (approximately USD 2.7 million) against new digital asset exchange OPNX, and individual penalties of AED 200,000 (almost USD 55,000) against its co-founders Su Zhu and Kyle Davies for failing to abide by the Regulations.[3]  These significant penalties demonstrate Dubai’s strict application of the Regulations, they contribute to and help exhibit the overall effectiveness of the UAE’s anti-financial crimes compliance framework, and they represent another significant step towards the UAE’s removal from the Financial Action Task Force (“FATF”) ‘grey list.’

In this article, we set out the structure of the Regulations and the rulebooks, highlight new amendments to the Regulations, and discuss the consequences of non-compliance.

The Supreme Legislation Committee in the Emirate of Dubai issued the Regulations in accordance with Law No (4) of 2022 Regulating Virtual Assets in Dubai, which established VARA as the Emirate of Dubai’s virtual assets regulator.[1]  The Regulations prohibit any entities or persons from engaging in virtual asset activities (“VA Activities”) in the UAE (excluding the Abu Dhabi Global Market (ADGM) and Dubai International Financial Centre (DIFC)) without obtaining an approval and a license from VARA.[2]  In addition to the Regulations, VARA also issued a range of rulebooks, including:[3]

• The Compulsory Rulebooks:four compulsory rulebooks consisting of the: (i) Company Rulebook; (ii) Compliance & Risk Management Rulebook; (iii) Technology & Information Rulebook; and (iv) Market Conduct Rulebook.  These rulebooks set out the mandatory obligations for digital asset entities, known as Virtual Asset Service Providers (“VASPs”), who satisfy VARA’s licensing requirements.[4]

• The Activity-Specific Rulebooks:seven activity-specific rulebooks designed for each VA Activity.  All VASPs must comply with the activity-specific Rulebook relevant to their VA Activity.[5]

• The VA Issuance Rulebook: rulebook setting out the guidelines for issuing VAs.[6]

The Regulations and Rulebooks are additional to the Marketing Guidelines previously issued by VARA in 2022.

VA Activities and Licenses

As discussed above, the Regulations require new and existing entities to obtain an approval and a license from VARA before carrying out any of the following VA Activities:[1]

• Advisory services: offering, providing, or agreeing to provide advisory services to persons regarding actions or transactions relating to VAs.[2]

• Broker-dealer services: arranging orders, soliciting or accepting orders, facilitating the matching of transactions, entering into transactions as a dealer, market making, providing placement or distribution, or other issuance-related services to clients issuing VAs.[3]

• Custody services: safekeeping VAs for or on behalf of another person and acting only on verified instructions from or on behalf of that person.[4]

• Exchange services: (i) conducting exchanges, trades, or conversions between VAs and fiat currency; (ii) conducting exchanges, trades, or conversations between one or more VAs; (iii) matching relevant orders between buyers and sellers; and (iv) maintaining an order book to further (i)-(iii) above.[5]

• Lending and borrowing services: carrying out a contract under which one or more parties shall transfer a VA or lend it to another party, and such other party shall commit to returning the VA any time during or at the end of the period agreed upon.[6]

• Payment and remittance services: receiving VAs for transmission or transfer from one party to another party or another VA wallet, address, or location.[7]

• VA management and investment services: acting on behalf of a party as agent, fiduciary, or taking responsibility for managing administrating, or disposing of an entity’s VAs.[8]

Notably, even if an entity does not fall into any of the VA Activity categories above, companies that actively invest their own portfolios in VAs can voluntarily register with VARA.[9]

Ultimately, VARA has sole discretion when issuing licenses.  VARA can limit a license by time and scope, vary the terms of a license after its issuance (e.g., amend its scope), and/or revoke or suspend a license, in full or in part, on several grounds, including material violations of applicable laws.[10]

Recently, in June 2023, VARA published a revised fee schedule for modifying or withdrawing licenses.  The revisions include: (i) VASPs wishing to amend details of their VARA licenses will be charged a license update fee of AED 500 (approximately USD 1,840) per request and; (ii) VASPs seeking to withdraw from Dubai and wind down their VA operations will be charged a license withdrawal fee of AED 10,000 (approximately USD 36,725).[11]

Exempt Entities and Professions

Entities cannot carry out, promote, or offer any VA Activity unless it is: (i) licensed by VARA; (ii) an employee carrying on or otherwise facilitating such activity on behalf of its VARA-licensed employer; or (iii) an exempt entity (“Exempt Entities”).[1]

Exempt Entities are not subject to VARA licensing requirements and do not need to comply with the Regulations and Rulebooks.  Examples of Exempt Entities include: (i) any UAE government entity; (ii) non-profit organizations; and (iii) charitable organizations.[2]  Exempt Entities must notify VARA of their VA Activities and obtain non-objection certificates.[3]  It is important that Exempt Entities receive confirmation of their ‘Exempt Entity’ status before undertaking a VA Activity in Dubai.

The Regulations also state that registered lawyers, accountants, and other professionally licensed business consultants carrying out VA Activities are exempt from obtaining a VARA license, provided such professionals are authorized by their respective professional bodies.[4]

Market Offenses

Violating the Regulations, the Compliance and Risk Management Rulebook, Market Conduct Rulebook, or other related market offences can attract severe penalties.[5]  Part VIII of the Regulations lists the following types of market offences:[6]

• Insider dealing: using inside information (non-publicly available information that would affect a reasonable investor’s decision regarding whether to acquire VAs) to carry out, cancel, amend, recommend, counsel, procure, or facilitate a transaction with VAs, or by recommending or attempting such behavior.[7]

• Unlawful disclosure: engaging in or attempting disclosures of inside information to third parties outside of the regular exercise of duties.[8]

• Market manipulation: entering into transactions or placing orders giving false or misleading signals regarding supply, demand, or price of specific VAs, securing abnormal or artificial effect on pricing, transmitting false or misleading information, or input, including through media, regarding supply, demand, or price of specific VAs, benchmarks, and other fraudulent activities, including with the use of fictitious devices.[9]

Importantly, VARA has the sole and absolute discretion to classify other behaviors as market offenses.  Therefore, it is imperative that VASPs comply with reporting requirements, record keeping, internal arrangements, and procedures, limiting access to insider information.[10]

Fines and Penalties

Violation of the Regulations, rules in the Compliance and Risk Management Rulebook, Market Conduct Rulebook, or Directives related to Market Offences can attract one or more of the following penalties (which are per violation):[11]

• For market offences: disgorgement of gained profits or avoided losses, up to AED 20 million for individuals, up to AED 50 million or 15% of the annual revenue of VASPs, or 300% of gained profits or avoided losses (if greater than the above values).[12]

• For violations of the rules in all other Rulebooks: up to AED 8,000,000 for an individual, up to AED 20,000,000 or 5% annual revenue for a VASP, or 200% of the profits gained or losses avoided (if greater than the above values).[1]

• For violations of the Federal Anti-Money Laundering (“AML”) law, the penalties will be those required under that law.[2]

UAE Regulators

Until this year, there was a perceived lack of clarity concerning VAs between the regulatory scope of the Central Bank of the UAE (“CBUAE”), the Securities and Commodities Authority (“SCA”), and that of VARA.  The Regulations help to clarify the uncertainty and the overlap between the regulators.  It is clear that the overall federal authority rests with SCA, which can delegate authority to VARA.  For example, entities that obtain a license from VARA will not be required to obtain a further license from SCA.[3]

Additionally, entities still need to comply with any applicable CBUAE regulations, as well as the AML law.  For example, it is important that VASPs report suspicious transactions or activities that may relate to money laundering to the UAE Financial Intelligence Unit (“FIU”).[4]    We have written extensively on the UAE’s dynamic AML regime, including analyzing in detail the AML law, here.[5]

Additional Considerations

Overall, the Regulations are a significant step towards developing efficient regulations that will effectively restrict illegal practices and materially protect investors.  VARA has yet to publish detailed guidance on its licensing, application, and registration processes, but we expect that in the near future.

VARA’s recent action against OPNX, including a public Notice of Written Reprimand and public Notice of Fine, for carrying out VA exchange services and marketing, promoting and advertising OPNX’s services and its native token without the necessary permits from VARA, represents another significant step forward for Dubai.[6]  Interestingly, OPNX’s Chief Executive Officer, Leslie Lamb, has confirmed that OPNX was cooperating with VARA’s investigation but did not believe that OPNX violated any rules.[7]  To date, the fine against OPNX remains unpaid.[8]  We are yet to see whether VARA will impose additional fines, penalties, and/or take other actions.

We recommend that all Dubai VASPs immediately perform gap analyses assessing whether they possess the approvals and licenses that their business activities necessitate.  However, it is critical to remember not to just obtain those approvals and licenses and to comply with the Regulations, but also to strictly adhere to the UAE’s AML law.  CBUAE has just issued new AML guidance for financial institutions when dealing with virtual assets, such as cryptocurrencies and non-fungible tokens, and ensuring the booming VA industry is not abused by bad actors is a key component of safeguarding the overall soundness and stability of the UAE’s financial and monetary system, in line with FATF standards.

[1] Virtual Assets Regulatory Authority, Virtual Assets and Related Activities Regulations 2023 (February 7, 2023) https://www.vara.ae/en/#varaGuidlinesDownloads_7

[2] Id.

[3] National Business, Dubai’s Vara fines digital asset exchange OPNX and Three Arrows founders (August 16, 2023), https://www.thenationalnews.com/business/cryptocurrencies/2023/08/17/dubai-vara-fine-opnx-three-arrows/

[4] Law No.  (4) of 2022, Regulating Virtual Assets in the Emirate of Dubai (February 22, 2022), https://dlp.dubai.gov.ae/Legislation%20Reference/2022/Law%20No.%20(4)%20of%202022%20Regulating%20Virtual%20Assets.html

[5] Virtual Assets Regulatory Authority, Virtual Assets and Related Activities Regulations 2023 (February 7, 2023), https://www.vara.ae/en/#varaGuidlinesDownloads_7

[6] Id.

[7] Id.

[8] In August 2023, VARA published a revised version of an activity-specific rulebook, the Custody Services Rulebook, introducing enhanced security measures, risk management protocols, and reporting requirements for custody service providers. 

[9] Virtual Assets Regulatory Authority, Virtual Assets and Related Activities Regulations 2023 (February 7, 2023) https://www.vara.ae/en/#varaGuidlinesDownloads_7

[10] Id.  VA Activities are set out in Schedule 1 of the Regulations.  

[11] Id.

[12] Id.

[13] Id.

[14] Id.

[15] Id.

[16] Id.

[17] Id.

[18] Id.

[19] Id.

[20] Virtual Assets Regulatory Authority, VARA Publishes Clarification and Further Information on Fees (June 22, 2023), https://www.vara.ae/en/vara-news/vara-publishes-clarification-and-further-information-on-fees/

[21] Virtual Assets Regulatory Authority, Virtual Assets and Related Activities Regulations 2023 (February 7, 2023) https://www.vara.ae/en/#varaGuidlinesDownloads_7

[22] Id.

[23] Id.

[24] Id.

[25] Id.

[26] Id.

[27] Id.

[28] Id.

[29] Id.

[30] Id.

[31] Id.

[32] Id.