VARA was established under Law No. 4 of 2022 and is the primary regulatory authority for virtual assets and related activities across all zones in Dubai, including free zones, except for the Dubai International Financial Centre (DIFC), which is governed by the Dubai Financial Services Authority (DFSA).

VARA’s mandate covers all virtual asset service providers operating in or from Dubai, requiring them to obtain a license, regardless of whether they are based in the mainland or a free zone, and ensuring unified control over virtual asset activities in Dubai, excluding the DIFC.

Cabinet Resolution No. 111 of 2022 designates the Securities and Commodities Authority (SCA) as the federal authority with broad supervisory and enforcement powers over virtual assets and service providers (VASPs) across the UAE.
As a result, VASPs operating in Dubai previously faced dual licensing obligations from both VARA and SCA, creating regulatory complexity and duplicative compliance burdens.

To resolve this, SCA and VARA executed a cooperation agreement introducing a unified licensing and oversight framework. Under this arrangement, VASPs operating within or from Dubai need only obtain a VARA license, which automatically registers the entity with SCA and authorizes the provision of virtual asset services throughout the UAE. This eliminates dual licensing, reduces fragmentation, and enhances regulatory certainty.

The agreement establishes coordinated supervisory mechanisms, including:

- Joint monitoring, inspection, and enforcement procedures;

- Mutual recognition of licenses enabling UAE-wide operations; Real-time information exchange to ensure transparency and consistency;

- A Coordinating Committee for Legislative Review, chaired by SCA, to align regulatory updates with international standards.

For applicants, the practical effect is this: a VARA license confers nationwide authorization, removing the need for separate SCA applications or parallel compliance structures.

The DIFC operates under the independent authority of the DFSA and remains outside VARA’s jurisdiction. To enhance regulatory alignment within Dubai, DFSA and VARA signed a Memorandum of Understanding (MoU) on October 15, 2025, establishing a framework for cooperation across financial and virtual asset sectors.

The MoU provides for:

- Coordination on licensing, supervision, and enforcement activities;

- Strengthened controls against money laundering, terrorism financing, and proliferation financing;

- Formalized information-sharing mechanisms to promote integrity, transparency, and market confidence;

- Procedures for coordinated regulatory action where virtual asset activities span DIFC and non-DIFC jurisdictions.

However, unlike SCA, the MoU with DIFC does not introduce license passporting or mutual recognition. Entities seeking to operate in both DIFC and the wider Dubai market must obtain separate licenses from DFSA and VARA respectively, and must therefore establish separate entities located in DIFC and mainland Dubai respectively.

VARA administers virtual asset licensing in coordination with Dubai’s free zone authorities (DMCC, DWTC, etc.) and the Department of Economy and Tourism (DET) through an integrated framework. Applicants submit Initial Disclosure Questionnaires via the relevant licensing authority (DET for mainland entities or the respective free zone authority) which conducts preliminary screening before transferring applications to VARA for regulatory assessment. VARA’s regulatory requirements remain consistent regardless of the chosen establishment pathway. Free zone authorities and DET act as administrative interfaces, while VARA retains regulatory oversight.

Therefore, it’s important for VARA applicants to note that accurate and complete submissions to the relevant jurisdiction authority are essential to avoid delays in VARA’s review.

All VASPs in the UAE, including those licensed by VARA, are subject to the unified federal framework for anti-money laundering (AML) and countering the financing of terrorism (CFT) under Federal Decree-Law No. 20 of 2018 and its Executive Regulation. VARA acts as the supervisory authority for Dubai, overseeing compliance with federal AML/CFT laws by VARA-licensed entities.

VARA-licensed VASPs must implement effective AML/CFT policies aligned with federal law, Financial Action Task Force (FATF) recommendations, UAE Executive Office guidance, and VARA-specific requirements. For example, VARA enforces the Travel Rule, requiring VASPs to collect, verify, and transmit originator and beneficiary information for virtual asset transfers exceeding AED 3,500, consistent with FATF standards.

Where VARA suspects money laundering, it must promptly report to the competent federal authority, ensuring formal channels for cross-regulatory information sharing. VASPs are also required to report suspicious transactions to both the UAE Financial Intelligence Unit (FIU) and VARA, creating a layered reporting structure that supports coordinated detection and investigation of illicit financial activity.

The Central Bank of the UAE (CB UAE) maintains regulatory authority over payment tokens (stablecoins backed by UAE dirhams or CB UAE-approved fiat currencies) and central bank digital currencies, establishing a distinct supervisory relationship with VARA. Where a VARA-licensed VASP deals with payment tokens, it must comply simultaneously with the CB UAE regulations related to payment token services, in addition to VARA's virtual asset requirements. The CB UAE's framework imposes strict requirements in addition to those imposed by VARA. This dual regulatory engagement creates distinct compliance obligations, with VARA regulating general virtual asset activities and CB UAE regulating payment token-specific functions.

Virtual asset activities conducted in or from jurisdictions outside Dubai’s mainland and free zones, fall outside VARA’s regulatory licensing and supervision and are regulated by SCA or other competent authorities. Similarly, activities within the DIFC are subject to DFSA jurisdiction and remain outside VARA’s scope.

Entities establishing operations exclusively outside VARA’s geographic jurisdiction are not subject to the SCA-VARA coordination framework. Instead, they must obtain:

- Licensing from DFSA for operations within DIFC;

- Licensing directly from SCA for operations across the UAE (excluding Dubai); or

- Licensing from other relevant authorities (when applicable).

The UAE’s virtual asset regulatory framework is built on cooperation between VARA and other authorities to ensure clarity and consistency. While VARA is the primary regulator for Dubai, its coordination with SCA, DFSA, DET, free zone authorities, and CB UAE creates an integrated system that reduces duplication and strengthens oversight. Entities must understand jurisdictional boundaries and comply with both federal and emirate-level requirements, particularly in areas such as AML/CFT and payment token regulation. Careful navigation of these frameworks is essential for efficient licensing and ongoing compliance.