Short answer
- No permit, no operation. Article 16 of Dubai Law No. 4 of 2022 bars any virtual asset activity in Dubai without a VARA permit. There is no grace period and no de minimis threshold.
- A free zone trade licence or a foreign VASP licence does not authorise operation in Dubai. VARA covers Dubai mainland and all free zones except the DIFC.
- Fines reach up to AED 50 million, or 15% of revenue, or 300% of gains, with founders and managers separately exposed up to AED 20 million.
- Marketing into Dubai is a separate breach. It catches firms with no Dubai operation at all, including through airdrops, educational content, and influencer posts.
- Unlicensed activity also triggers federal AML criminal exposure under Federal Decree-Law No. 10 of 2025, on top of any VARA fine.
Who this applies to
This applies to any business carrying out a virtual asset activity that touches Dubai: exchanges, custodians, broker-dealers, lending and borrowing platforms, advisory firms, virtual asset managers, and payments and remittances services. It applies whether the firm is incorporated on the Dubai mainland, in a free zone, or abroad. A free zone entity is inside VARA's perimeter, not outside it. For technology lawyers in Dubai advising firms entering this market, confirming the licence position is the first question to close, because enforcement now lands within months.
It does not apply to firms operating wholly within the DIFC, which runs its own regime under the DFSA. It also does not change the position for a firm that only markets into Dubai without operating there: that firm escapes the licensing rule but stays fully inside VARA's Marketing Regulations.
Which activities need a licence
VARA regulates seven virtual asset activities, and each one needs its own authorisation. A firm licensed for custody is not licensed for exchange. Operating outside the scope of a permit you hold is treated as unlicensed activity for that part of the business.
VARA also decides, at its own discretion, whether a firm is carrying out a virtual asset activity "by way of business" in Dubai. It looks at the regularity, scale, and continuity of the operation. A foreign firm with no Dubai entity can still be pulled into scope if its activity reaches Dubai users with enough regularity. The recurring and expensive mistake is assuming that incorporation elsewhere, or a licence held elsewhere, puts the firm outside VARA's reach.
The fines and how they are calculated
Two penalty layers apply. VARA's rulebooks set fines reaching up to AED 50 million, or 15% of a VASP's annual revenue, or 300% of the profits gained or losses avoided, depending on the violation. Individuals are exposed separately, up to AED 20 million. The Marketing Regulations carry their own schedule, with fines up to AED 10 million. Any fine can be doubled for a repeat violation within one year.
VARA enforces this actively. Between August 2024 and August 2025 it issued enforcement notices against 36 firms. In a single October 2025 action it penalised 19 firms for unlicensed activity and marketing breaches, with fines from AED 100,000 to AED 600,000 each plus cease-and-desist orders. The earlier action against the OPNX exchange produced a AED 10 million fine against the company and AED 200,000 each against two individual co-founders, for running exchange services and marketing a token without a permit. The OPNX numbers show two things: VARA fines the people behind the firm, not only the firm, and cooperating with an investigation does not erase the penalty.
Marketing into Dubai is a separate breach
A firm can stay out of Dubai entirely and still breach VARA's rules by marketing into it. The Marketing Regulations apply to every entity, domestic or foreign, licensed or not, and they cover any marketing of virtual assets or virtual asset activities in or targeting the UAE. VARA treats marketing aimed at the UAE as aimed at Dubai by default.
The definition of marketing is wide. It includes airdrops and educational content such as articles, papers, and presentations. VARA weighs factors like the language of a campaign, the currency it references, and the use of UAE cultural cues to decide whether it is in scope. Promoting an unlicensed firm is a breach even through a referral link, a giveaway, or a paid post, and there is no general influencer exemption. The October 2025 round penalised firms for how they presented themselves, not only for the services they ran, with several penalties triggered by token announcements or non-compliant websites. A foreign firm with no Dubai entity that runs an AED-referencing campaign to a UAE audience has created marketing exposure regardless of where it operates.
Anonymity-enhanced cryptocurrencies cannot be licensed at all
One category sits outside the licensing system entirely. VARA's regulations prohibit issuing anonymity-enhanced cryptocurrencies and all virtual asset activities related to them in Dubai, and the Marketing Regulations extend that prohibition to marketing them in or targeting the UAE. A firm dealing in privacy coins is not simply unlicensed and able to apply. It is conducting a prohibited activity, which changes both its options and its criminal-law exposure.
The federal AML layer
A VARA fine is not the whole exposure. Unlicensed virtual asset activity also carries exposure under the UAE's federal anti-money laundering framework, now consolidated in Federal Decree-Law No. 10 of 2025. Operating outside the regulated perimeter means operating without the customer due diligence, transaction monitoring, sanctions screening, and suspicious-transaction reporting that licensed VASPs must run, and the federal regime treats those failures as criminal matters, not just administrative ones.
This is also why the UAE published joint guidance on combating the use of unlicensed virtual asset providers, addressed to banks and other financial institutions. The practical result is that UAE banks are guided to identify and avoid unlicensed operators, which can shut a firm out of the banking system independently of any VARA action. For deeper detail on how the federal rules bite, see our analysis of tightened UAE anti-money laundering rules.
What virtual asset firms should do next
The first step is a perimeter assessment: a clear answer to whether the firm's specific activities, and its specific reach into Dubai users, need a VARA permit, need a different authorisation, or fall outside scope. A firm that already holds a permit needs the same assessment against the limits of what that permit actually authorises, because operating outside scope counts as unlicensed activity.
A firm that is already in scope and unlicensed should treat the question as urgent. The choice is to remediate and approach VARA, or to wait and be approached. Given that enforcement now reaches founders personally and is published, waiting is the weaker position.
Legal advice helps confirm how Dubai Law No. 4 of 2022 and VARA's rulebooks apply to a specific business model before it operates or markets in the emirate, and helps structure a response if an enforcement notice has already arrived.
Related: Understanding VARA licence requirements and costs in Dubai · DIFC fintech licence AML requirements and goAML essentials · UAE tightens anti-money laundering rules for financial companies
Your success starts with the right guidance.
Whether it’s business or personal, our team provides the insight and guidance you need to succeed.
