What Does VARA’s Company Rulebook Require and How Are Virtual Asset Activities Licensed?

What Is the VARA Company Rulebook and Why Does It Matter?

The Virtual Assets Regulatory Authority (VARA) is the sole authority regulating virtual asset activities across Dubai’s free zones and mainland, excluding the Dubai International Financial Centre. VARA was established under Law No. 4 of 2022, and its licensing framework has since been built out through a series of compulsory and activity-specific rulebooks that set the operational, governance, and compliance standards a virtual asset service provider (VASP) must meet.

The Company Rulebook is one of four mandatory rulebooks that apply to every licensed VASP regardless of the specific virtual asset activity being carried out. It sets out the corporate governance and legal structure requirements a VASP must satisfy, covering matters such as ownership structure, management fitness, and internal governance arrangements.

What Are VARA’s Mandatory Rulebooks?

Every VASP licensed by VARA must comply with four mandatory rulebooks, regardless of which specific virtual asset activity it is licensed to carry out.

• Company Rulebook: Sets governance, ownership, and corporate structure requirements applicable to all licensed VASPs
• Compliance and Risk Management Rulebook: Sets out the compliance function, risk management framework, and internal control requirements a VASP must maintain
• Technology and Information Rulebook: Sets standards for technology governance, cybersecurity, and information management
• Market Conduct Rulebook: Sets standards of conduct expected of VASPs and their staff in relation to market activity

These four rulebooks apply in addition to whichever activity-specific rulebook governs the particular virtual asset activity a VASP is licensed to conduct.

What Are VARA’s Activity-Specific Rulebooks and Licensed Activities?

Beyond the four mandatory rulebooks, VARA maintains activity-specific rulebooks tied to seven categories of licensed virtual asset activity. Applicants must explicitly identify which activity or activities they intend to carry out, since each is treated as a discrete license category with its own specific requirements:

• Advisory services, covering guidance on virtual asset transactions or holdings
• Broker-dealer services, covering executing trades, soliciting orders, and market-making
• Custody services, covering safeguarding virtual assets on behalf of a third party
• Exchange services, covering virtual-asset-to-fiat and virtual-asset-to-virtual-asset trading, including order matching
• Lending and borrowing services, covering arrangements where virtual assets are transferred or lent
• Payment and remittance services, covering the transfer of virtual assets between parties
• Virtual asset management and investment services, covering managing client virtual assets in an agency or trustee capacity

A VASP applying for a license must meet the requirements of both the four mandatory rulebooks and the activity-specific rulebook or rulebooks relevant to its intended business.

How Does the VA Issuance Rulebook Work?

Entities issuing a virtual asset in Dubai fall under the VA Issuance Rulebook, which distinguishes between Category 1 and Category 2 issuances, alongside a newer Exempt VA category introduced in VARA’s May 2025 rulebook updates. Category 1 VA issuances are always treated as carried out in the course of business, and a licensed VASP must obtain VARA approval before issuing this type of asset.

Category 2 VA issuances cover any issuance that does not fall under Category 1 or the Exempt VA category. No VARA license or prior issuer approval is required for a Category 2 issuance, but the placement or distribution of the asset must go through a VARA-licensed distributor, who is then responsible for ensuring the issuer complies with the VA Issuance Rulebook. Most VA issuers, aside from Exempt VA issuers, are required to publish both a whitepaper and a risk disclosure statement, with more detailed disclosure requirements applying to Category 1 issuances.

Who Is Exempt From VARA Licensing?

UAE government bodies, along with public, non-profit, and charitable organizations connected to government entities, are not required to obtain a VARA license, though they must notify VARA of their activities and obtain a no-objection confirmation before proceeding.

Professionals such as registered lawyers, accountants, and business consultants are also exempt from VARA licensing where their virtual asset activity is incidental to their normal professional practice, provided they are authorized by a competent professional body and maintain professional indemnity insurance covering that activity. VARA retains sole discretion over granting exempt status and confirmations, and exempt entities remain subject to notification and ongoing compliance obligations even without holding a full VASP license.

What Is the Mandatory Registration Threshold for Large Proprietary Traders?

Entities based in Dubai that trade virtual assets using their own capital, rather than on behalf of clients, are not automatically required to hold a VASP license, but a mandatory registration threshold applies once trading activity becomes large enough. An entity whose proprietary virtual asset trading exceeds USD 250 million within any 30-day period must register with VARA within three working days of crossing that threshold.

This registration requirement exists specifically to give VARA regulatory visibility over large-scale proprietary trading activity that would otherwise sit outside the standard VASP licensing categories, since no virtual asset activity in Dubai is treated as entirely outside VARA’s regulatory oversight.

Frequently Asked Questions (FAQs)

How Farahat & Co. Can Help

Farahat & Co. assists virtual asset businesses with VARA license applications, Company Rulebook compliance, and ongoing regulatory obligations across VARA’s mandatory and activity-specific rulebooks.

Contact Farahat & Co. today to discuss your VARA licensing and compliance requirements.