VARA Company Rulebook | Types, Regulations and Licensing

VARA regulations in Dubai have been introduced by Law No. (4) in 2022. The regulations provide that persons shall only carry out virtual asset activities in accordance with the Virtual Assets Regulations and with the permission and a license granted by VARA.

This article analyzes the structure of these regulations, the recent changes in the regulation and the impact of noncompliance to these regulations.

Also read: Guide to VARA Audit in Dubai

Types of Rulebooks

VARA introduced various rulebooks, including:

• Mandatory Rulebooks: Four rulebooks setting out some of the elementary obligations of the digital asset companies under VARA. These rulebooks are the Company Rulebook together with the Compliance and Risk Management Rulebook, and Technology and Information Rulebook as well as the Market Conduct Rulebook.
• Activity-Specific Rulebooks: Seven rulebooks on specific activities to various virtual assets in order to facilitate the application of particular rules on VASPs.
• VA Issuance Rulebook: The rulebook provides the issuance system of virtual assets. Both these rulebooks are based upon the marketing guidelines that VARA put up from the year 2022.

Virtual Asset Activities and Licensing of the Same

Virtual Asset activities and requirements for licensing include;

As identified, all new and existing entities are to receive approval and be licensed by VARA before undertaking any of the listed virtual asset activities, including the following:

1. Advisory services: Providing guidance on undertakings or dealing concerning virtual properties.
2. Broker-dealer services: Working on providing precise trades, seeking orders, offering market making solutions to help others issue virtual assets.
3. Custody services: The safeguarding of computerized property of someone who is not the user of that particular property.
4. Exchange services: Virtual asset to fiat virtual currency and virtual-asset-to-another-virtual asset trading, and including the execution of trading via order matching.
5. Lending and borrowing services: Arranging transactions in which a person transfers, or lends, virtual assets.
6. Payment and remittance services: Providing the function of virtual asset transfer among parties.
7. Virtual asset management and investment services: Managing investors’ virtual assets, including acting on behalf of their clients in agency or as Trustees.

Entities not involved in these highlighted virtual assets activities but also invest actively in virtual assets may file a voluntary registration with VARA. Licenses under VARA would be issued at its complete discretion and can be time-limited or scope-limited, with possible revocation due to serious legal infringements.

Also read: How to Audit Your Virtual Asset Holdings As per VARA in Dubai

Exemptions From Licensing

Certain entities, with the exclusion of UAE government bodies, non-profit organizations, and charities, are not required to seek licenses from VARA. They will be required to provide prior notification to VARA of their activities and obtain a no objection certificate from VARA before undertaking virtual asset activities.

Persons who practice an advocacy profession, a registered accountancy profession, and a business consultancy profession, insofar as their practice is duly licensed by the competent licensing authority, shall be exempt from obtaining a license with VARA provided such virtual asset services are conducted in the normal course of such professional business.

Market Offenses

The breach of the provision in the Compliance and Risk Management Rulebook, the provision in the Market Conduct Rulebook, or any market offense shall attract significant penalties. Part VIII of the Regulations outlines various market offenses including:

• Insider dealing: In possession of confidential and non-public information that may affect an investor’s decision to trade a virtual asset, and by reason of being in possession of such information executes or cancels a trade or amends an order or advises another person to do so.
• Disclosure of insider information: Making or seeking to make a disclosure of insider information to a third party in a manner other than in the course of performing the functions, duties, or activities of the person making the disclosure.
• Market manipulation: Engaging in transactions or other activities which may have or are likely to have a tendency to give a false or misleading impression of the presence or absence of supply, demand, or, or price of virtual assets; spreading false or misleading information through the media, including social media; and using any fictitious device or scheme or any other form of deception or fraud in a transaction.

VARA may decide, based on policy grounds, that other behaviors constitute a market offense. VASPs must comply with reporting obligations, record-keeping obligations, internal controls, and insider information access control.

Fines and Penalties

In the event of default of the Regulations, Rulebook, or Market Offense Directives, the following fines and penalties could be exercised:

• Market offenses: Fines for the gains/profits or loss could be regarded as forfeited. The fines could amount to AED 20 million for Individuals and AED 50 million or 15% of Annual Revenue for VASPS. There is another option—to impose fines at 300% of the consideration of gains/loss, whichever is considered higher.
• Other contravening the rulebook: For natural persons, fines may reach AED 8 million; for the VASPs it may be up to AED 20 million or 5% of annual revenue, or 200% of the profits or losses if exceeding prescribed limits.
• Contravention of Anti-Money Laundering law: The sanctions for contraventions of the Federal AML law are given by that law itself.

UAE Regulators

There are two main regulators that oversee virtual assets, this includes:

• The Central Bank of the UAE (CBUAE),
• The Securities and Commodities Authority (SCA).

The new VARA regulations clarify that SCA retains overall federal jurisdiction but can delegate certain powers to VARA. Entities licensed by VARA do not need additional licenses from SCA. However, these entities must still comply with CBUAE regulations and UAE AML laws. VASPs are required to report suspicious transactions or activities linked to money laundering to the UAE’s Financial Intelligence Unit (FIU).

In conclusion, it is essential for all VASPs operating in Dubai to conduct a thorough gap analysis to ensure they possess the necessary approvals and licenses for their business activities. Compliance with regulations and adherence to the UAE’s AML laws are paramount.

Recently, the Central Bank of the UAE (CBUAE) issued updated AML guidelines for institutions involved in virtual assets, including cryptocurrencies and NFTs. Preventing misuse of this sector is critical to maintaining the stability and integrity of the UAE’s financial systems, which are already aligned with FATF standards.