The new regime specifies licensing and reporting requirements for a range of activities related to virtual assets in the Emirate of Dubai.

By Brian A. Meenagh, Matthew Rodwell, and Ksenia Koroleva

On February 7, 2023, the Dubai Virtual Assets Regulation Authority (VARA) adopted the Virtual Assets and Related Activities Regulations 2023 (the Regulations) together with four compulsory and seven activity-specific rulebooks.

VARA adopted these Regulations further to Dubai Law No. 4 of March 11, 2022 on the Regulation of Virtual Assets in the Emirate of Dubai (the Law) (for more information, see Latham’s blog post).

The Law granted VARA powers to regulate activities relating to virtual assets in the Emirate of Dubai (excluding the Dubai International Financial Center (DIFC); DIFC has its own regime regulating virtual assets — see Latham’s blog post).

The Law laid down key definitions (such as the definitions of virtual assets (VAs) and distributed ledger technology (DLT)), and provided a broad list of activities requiring a license. The Law entitled VARA to adopt regulations for all relevant activities and VAs.

In Which Territory Do the Regulations Apply?

The territorial scope encompasses all VAs and VA Activities (defined below) in Dubai, including all special development zones and free zones other than the DIFC. Part III of the Regulations generally prohibits any entity operating or promoting any VA Activity by way of business in Dubai unless VARA has authorised or licensed the VA Activity, there is an exemption covering a specific VA Activity or the entity holds Exempt Entity status (see below).

VARA retains sole and absolute discretion to determine whether an entity carries out a VA Activity by way of business in Dubai (whose assessment takes into account, inter alia, relevant operations’ regularity, scale, and continuity). Even in circumstances in which VARA deems a VASP to not be carrying out VA Activities by way of business in Dubai (which may be the case with an offshore provider of VA Activities), any marketing by such offshore providers of VA Activities to residents of Dubai would nevertheless need to comply with VARA’s Marketing Regulations. The Regulations require such offshore providers to obtain VARA’s approval prior to marketing and to demonstrate that they hold all licenses to provide the relevant VA Activity in their home jurisdiction.

Which VA Activities Require VARA Licenses?

VARA specified the following activities as licensable (the VA Activities) under the Regulations:

  • Advisory services: offering, providing, or agreeing to provide personal recommendations to clients, upon their request or on the relevant entity’s initiative, in respect of actions or transactions with VAs;
  • Broker-dealer services: arranging orders for sale and purchase of VAs between entities, soliciting or accepting orders for Vas and accepting fiat currency or VAs for such orders, facilitating the matching of transactions in VAs between buyers and sellers, entering into VA transactions as dealers, making a market in VAs using client assets, and providing issuance-related services to clients issuing VAs;
  • Custody services: VAs’ safekeeping for or on behalf of another entity acting on instructions of such other entity;
  • Exchange services: conducting exchange, trade, or conversion between VAs or VAs and fiat currency, matching relevant orders between buyers and sellers, and maintaining an order book;
  • Lending and borrowing services: carrying out a contract under which a party (parties) shall transfer a VA or lend it to another party (parties) and such other party shall commit to return the VA;
  • Payment and remittances services: receiving VAs for transmission/transfer from one party to another party or another wallet, address, or location; and
  • VA management and investment services: acting on behalf of a party as agent, fiduciary, or otherwise taking responsibility for management, administration, or disposal of a party’s VAs.

The Regulations determine the amount of license application fees (up to AED100,000), license extension fees (50% of the application fee), and annual supervision fees (up to AED200,000) depending on the type of VA Activities for which licenses are issued. Fees apply to each licensed VA Activity, and VARA may impose further fees at its discretion.

VARA acknowledges that licensees (Virtual Asset Service Providers, or VASPs) may conduct VA Activities in a jurisdiction outside of Dubai subject to applicable rules in such jurisdiction.

What Discretion Does VARA Have When Issuing Licenses?

VARA holds considerable discretion when issuing licenses and can, inter alia, limit the license by time or determine the scope of specific licensed VA Activities (including by reducing or broadening the scope set forth in a VASP’s licensing application).

Furthermore, VARA holds absolute discretion to vary licenses after their issuance (including in terms of scope) and may revoke or suspend the license, in full or in part, on a number of grounds, including material violations of applicable law or insolvency.

What Are Exempt Entities and Which VA Activities Are Exempt?

The Regulations contain certain exemptions from the licensing requirement:

  • UAE government entities and their public, non-profit, not-for-profit and charitable organizations are Exempt Entities and do not need to obtain licenses (such entities shall notify VARA of their activities and obtain non-objection confirmations); and
  • certain specific VA Activities are exempt, such as provision, by way of advisory services, of legal, accounting, and other professional advice wholly incidental to professional practice subject to certain conditions (including the exempted person being duly licensed in Dubai).

Who Else Needs to Register With VARA?

The Regulations further mandate registration with VARA of entities investing own portfolios in VAs for an amount over US$250 million during any rolling 30-day-period. They allow certain other market participants to register, such as entities investing own portfolios in VAs below US$250 million and providers of technology services to or utilizing DLT.

Which Offenses Can VARA Take Enforcement Action Against?

VASPs may receive punishment for a number of market offenses affecting a VA’s price (Market Offenses), including:

  • Insider dealing by using inside information (not publicly available information which would affect reasonable investor decision to acquire VAs or not) to carry out, cancel, amend, recommend, counsel, procure, or facilitate a transaction with VAs, or by recommending or attempting such behavior;
  • Unlawful disclosure by engaging or attempting disclosure of inside information to third parties outside of normal exercise of duties; and
  • Market manipulation by entering into transactions or placing orders giving false or misleading signals regarding supply, demand, or price of specific VAs, securing abnormal or artificial effect on pricing, transmitting false or misleading information, or input, including through media, regarding supply, demand, or price of specific VAs, benchmarks, and other fraudulent activities, including with the use of fictitious devices.

VARA may classify other behavior as a Market Offense and set out accepted practices which should not qualify as Market Offenses.

To prevent Market Offenses, VASPs need to comply with requirements on reporting, record keeping, and adequate and effective internal arrangements and procedures limiting access to insider information. The Regulations also require VASPs to submit detailed reports to the United Arab Emirates Financial Intelligence Unit (FIU) and VARA regarding any reasonable suspicious in terms of conduct of Market Offenses.

How Do the Regulations Interplay With the UAE Central Bank Rules Regarding Virtual Assets?

VARA confirms that certain types of VAs may fall under the Central Bank of the United Arab Emirates’ jurisdiction (the CBUAE), in particular activities relating to Central Bank Digital Currencies (CBDC), and that VASPs will need to comply with any applicable CBUAE regulations on VAs as well as UAE federal anti-money laundering rules and regulations (the Federal AML Rules).

What Fines and Penalties May VARA Impose?

VARA may impose various penalties on any entity violating the Regulations, including on violations of any Federal AML Rules and the Law.

Enforcement actions require consideration of several factors, including the violation’s nature, seriousness, and impact, and can include:

  • written reprimands;
  • enforcement notices requiring rectification of violations;
  • suspension, revocation, or amendment of scope of licenses issued;
  • requests to suspend or cease specific activities;
  • fines and civil penalties;
  • additional supervision; and
  • any other enforcement actions VARA determines.

The Regulations specify fines for certain Rulebook violations such as disgorgement of gained profits or avoided losses, up to AED20 million for individuals, up to AED50 million or 15% of annual revenue of VASPs, or 300% of gained profits or avoided losses.

The Regulations prohibit entities to issue anonymity-enhanced cryptocurrencies in Dubai and allow VARA to prohibit any other VA or type of VA in Dubai.

Next Steps

The new regime represents a significant step in the regulation of VA Activities in the region (and arguably globally).

Latham & Watkins will continue to monitor developments related to virtual assets in the Middle East, including the forthcoming additional rules and regulations.