Dubai's VARA publishes Full Market Product Regulations

On 7 February 2023, the Dubai Virtual Assets Regulatory Authority (VARA) published its Full Market Product Regulations (FMP Regulations). The FMP Regulations contain VARA’s virtual asset licencing regulations and took immediate effect in the Emirate of Dubai (Dubai), including all of its free zones, with the exception of the Dubai International Financial Centre (the DIFC).

A huge spotlight has been cast on virtual asset regulation in the post-FTX world, and the increasingly difficult task of balancing consumer protection and the need to enable innovation falls on regulators such as VARA. VARA was established in February 2022 as the world’s first independent virtual asset regulator, and the FMP Regulations represent the culmination of a year’s work, and a unique and tailored approach to virtual asset regulation.

1. Structure of the FMP Regulations

The FMP Regulations consist of the Virtual Assets and Related Activities Regulations 2023 (the VARA Regulation) and a number of separate rulebooks. The VARA Regulation is the foundation of the FMP Regulations and sets out VARA’s regulatory powers, its licencing and registration requirements, regulated virtual asset activities (VA Activities) as well as anti-money laundering requirements and market offences (such as insider trading and market manipulation).

The various rulebooks in the FMP Regulations have been issued pursuant to the VARA Regulation, and each rulebook falls within one of three distinct categories:

1. The Compulsory Rulebooks

The four Compulsory Rulebooks consist of the Company Rulebook, Compliance & Risk Management Rulebook, Technology & Information Rulebook and Market Conduct Rulebook. They apply to all entities licenced by VARA to carry out one or more VA Activities (VASPs) and contain detailed requirements pertaining to a range of issues, including corporate governance, regulatory capital, financial crime and technology security.

2. The Activity-specific Rulebooks

Each VA Activity has a corresponding Activity-specific Rulebook, and VASPs are required to comply with every Activity-specific Rulebook that corresponds to a VA Activity it is licenced to carry out. These Rulebooks generally contain conduct of business requirements, though some also contain corporate governance requirements. Certain Activity-specific Rulebooks also contain margin trading restrictions. VARA has yet to publish its Activity-specific Rulebook for Payments and Remittances Services.

3. The VA Issuance Rulebook

The VA Issuance Rulebook applies to those who issue Virtual Assets (as defined below) in Dubai, and contains requirements covering, inter alia, notification/approval requirements and whitepaper content requirements.

VARA’s regulations with respect to the marketing of virtual assets and virtual asset activities are set out in Administrative Order No. 01/2022 (the VARA Marketing Regulation), which has been in effect since last year and has not been amended by the FMP Regulations. Together, the FMP Regulations and VARA Marketing Regulation constitute VARA’s current regulatory framework, and both are accessible on VARA’s website.

2. Overview of the FMP Regulations

Jurisdiction

The FMP Regulations confirm that VARA’s jurisdiction extends throughout Dubai, including all of its free zones (such as the Dubai World Trade Centre (DWTC) and the Dubai Multi Commodities Centre, inclusive of the Crypto Hub (DMCC)), with the notable exception of the DIFC. Certain free zones in Dubai, such as the DWTC and DMCC, currently issue crypto-related commercial licences, and entities with such licences should note that they may also require a VARA licence if they carry out VA Activities (as defined below).

Both the Securities & Commodities Authority (the SCA) and the UAE Central Bank (the UAE CB) as federal regulators have jurisdiction in Onshore UAE (that is, the UAE excluding the DIFC and the Abu Dhabi Global Market (the ADGM)) and both have their own virtual asset-related regulatory regimes. There has been some uncertainty surrounding the potential overlap between the jurisdictions of VARA, the SCA and the UAE CB. Following the publication of the FMP Regulations and recent federal legislation, it appears that within Dubai:

1. a licence from VARA and not the SCA is generally required to carry out VA Activities;
2. central bank digital currencies are regulated by the UAE CB and not VARA; and
3. fiat-backed stablecoins may be regulated by both VARA and the UAE CB.

Furthermore, we note that under the VARA Regulation, VASPs may be required to comply with VARA’s regulations as a minimum standard with respect to their activities outside Dubai. This requirement appears to apply even to VASPs based outside Dubai, which suggests that the FMP Regulations may have an extra-territorial scope.

VARA generally has jurisdiction over the use of Virtual Assets in Dubai, a term that is broadly defined as a "digital representation of value that may be digitally traded, transferred, or used as an exchange or payment tool, or for investment purposes".

Licencing requirements

Under the VARA Regulation, entities wishing to carry out one or more VA Activities in Dubai are generally required to obtain a licence from VARA (the General Prohibition). These VA Activities are set out in Schedule 1 of the VARA Regulation and consist of:

1. Advisory Services;
2. Broker-Dealer Services;
3. Custody Services;
4. Exchange Services;
5. Lending and Borrowing Services;
6. Payments and Remittances Services; and
7. VA Management and Investment Services.

These VA Activities are expansively defined – Broker-Dealer Services, for example, include providing placement, distribution or other issuance related services to Virtual Asset issuers. Furthermore, the inclusion of Lending and Borrowing Services and Payments and Remittances Services means this list of VA Activities is potentially broader and more comprehensive than those of other UAE Virtual Asset regulators such as the SCA.

Additionally, the VARA Regulation contains exemptions to the General Prohibition. These exemptions are generally limited to professionals (ie, lawyers, accountants and business consultants) and Exempt Entities, which are effectively UAE-government linked entities.

VARA does not appear to have implemented a Virtual Asset whitelist, meaning Virtual Assets do not need to be individually and separately approved by VARA for use in Dubai. Nevertheless, VASPs are generally required to draft Virtual Asset Standards and carry out VA Activities only in relation to those Virtual Assets that meet such standards. VARA reserves the right to require the suspension of a VA Activity in respect of any Virtual Asset upon reasonable grounds.

Neither the issuance of Virtual Assets nor the proprietary trading of Virtual Assets appears to constitute a VA Activity that triggers a VARA licencing requirement. However, the proprietary trading of Virtual Assets may be subject to registration requirements and the issuance of Virtual Assets would require prior notification to or approval from VARA, as explained in further detail below.

Registration requirements

Certain other activities related to Virtual Assets that do not constitute VA Activities are subject to registration requirements rather than licencing requirements. In particular, proprietary traders of Virtual Assets are required to register with VARA if their portfolio of Virtual Assets reaches USD 250,000,000 in equivalent value during any rolling 30 day period.

Proprietary traders who fall below that threshold have the option to voluntarily register with VARA, as do entities that have a commercial or free zone licence in Dubai to provide technology services relating to or utilising distributed ledger technology to other businesses.

Issuance requirements

In general, the issuance of a Virtual Asset in Dubai requires prior approval from VARA. An exception is made for Virtual Assets that are non-transferable, which are known as Permitted VAs. Issuers of Permitted VAs are instead required to register the whitepaper of the Permitted VA prior to its publication.

Issuers of both Permitted VAs and non-Permitted VAs are required to comply with the various requirements set out in the VA Issuance Rulebook, which include detailed requirements on the contents of whitepapers, risk disclosures and technology and security requirements.

Other notable requirements and restrictions

The FMP Regulations contain various other notable requirements and restrictions, and we would flag the following in particular:

1. Privacy tokens are generally prohibited within Dubai.
2. Exempt Entities are required to notify VARA and obtain a no-objection confirmation from VARA, even though they are exempt from the General Prohibition.
3. A VASP or Issuer will remain subject to VARA’s regulations for a period of 10 years following the date it is no longer regulated by VARA.
4. VASPs are generally required to publicly disclose details of any past prosecutions or convictions of any members of their senior management or board, regardless of whether such prosecutions/convictions occurred in the UAE or elsewhere.
5. VASPs may be subject to detailed mandatory ESG disclosure requirements, which is an innovative approach within the UAE signalling VARA’s commitment to a sustainable ecosystem. VASPs which mine or stake Virtual Assets are required to publicly disclose the use of renewable energy in the course of their mining or staking activities and initiatives relating to decarbonisation and emission reduction.
6. VASPs are required to maintain reserve assets equivalent to 100% of the liabilities owed to clients with respect to all VA Activities. This is in addition to paid-up capital and liquidity requirements.
7. VASPs are required to submit a balance sheet, income statement and statement of profit and loss on a monthly basis to VARA.
8. VASPs and their group members in Dubai are generally prohibited from trading on their own account (this includes trading in both Virtual Assets and other assets).

3. Licencing, registration and approval processes

Entities intending to obtain a licence from VARA are currently required to undergo a four-stage process. This involves obtaining, in order, a:

1. Provisional permit;
2. Preparatory Minimum Viable Product (MVP) licence;
3. Operating MVP licence; and
4. Full Market Product (FMP) licence.

VARA has yet to publish detailed guidance on its four-stage licencing process (such as the application form(s) to be used, the content requirements of regulatory business plans and expected timeframes). However, it is clear that VA Activities cannot be carried out in Dubai until at least an Operating MVP licence has been obtained, and cannot be carried out in relation to retail investors until an FMP licence is obtained. VARA currently maintains that it has not yet granted any VASP an Operating MVP licence.

Furthermore, VARA has yet to set out its registration process for large proprietary traders or issuers of Permitted VAs, nor has it set out the approval process for issuers of non-Permitted VAs in detail.

We expect VARA to publish further information on these processes in the near future.

4. Key themes and takeaways

This regulatory regime constitutes a unique approach to the regulation of Virtual Assets and VA Activities in Dubai. VARA has tailored a regime specifically for Virtual Assets, with crypto-specific issues such as staking and blockchain-based payment systems clearly addressed. Many provisions within the FMP Regulations evidence a strong understanding by VARA of the operation of Virtual Assets and VASPs in general.

While VARA has not implemented a Virtual Asset whitelist, the FMP Regulations are cautious in several respects, particularly in relation to corporate governance, regulatory reporting and public disclosure, reflecting VARA’s commitment to market integrity, consumer protection and regulatory resilience. The FMP Regulations are also remarkably detailed, particularly with respect to the conduct of business rules that VASPs must comply with.

Due to the complexity and novelty of the FMP Regulations, any person intending to carry out activities related to Virtual Assets in Dubai should first seek legal guidance. If you have any questions about the FMP Regulations or the regulation of Virtual Assets in the UAE, please contact Muneer Khan.