This is our published view
The bench stands behind it
For your facts, in confidence, put the question to the firm.
The bench stands behind it
The position
A VARA licence is a Dubai licence standing on United Arab Emirates federal law, and the framework says so in terms.
A VARA licence is a Dubai licence standing on United Arab Emirates federal law, and the framework says so in terms. Every VASP must comply with all Federal AML-CFT Laws at all times, alongside VARA’s own rules (Virtual Assets and Related Activities Regulations 2023, Regulation VI.B.1, current as at 1 July 2026), and VARA is designated as the Supervisory Authority for VASPs in the Emirate for the purposes of those federal laws (Regulation VI.A.3). The federal layer is not background. It is an express, continuing licence obligation, supervised by VARA itself.
What makes the question live is that the federal layer moved, and recently. The federal AML law in force today is Federal Decree-Law No. 10 of 2025, issued on 30 September 2025 and in force since 14 October 2025, which repealed and replaced the 2018 law the VARA texts name. Its Executive Regulations followed as Cabinet Resolution No. 134 of 2025, effective 14 December 2025, replacing the 2019 implementing decision and its 2022 amendment. The VARA rulebooks themselves did not change. The floor beneath them did, twice over, inside three months.
The framework absorbs that movement by its own drafting. The Regulations define the Federal AML-CFT Laws as all UAE federal legislation relating to AML/CFT “as may be in force from time to time”, including all executive regulations and cabinet decisions relating to the same, with the 2018 law and 2019 decision named only as examples, introduced by the words “including but not limited to” (Schedule 4, definition of Federal AML-CFT Laws). The named list has gone stale; the obligation has not. A VASP’s duty attaches to whatever federal AML legislation is currently in force, which today means the 2025 law and its 2025 Executive Regulations, and no amendment to any VARA instrument was needed to make that so.
The 2025 change is substantive for this sector, not a renumbering. The new law reaches virtual assets expressly: its offence provisions name accounts held with a virtual asset service provider alongside those held with financial institutions, and proliferation financing joins money laundering and terrorist financing as a core offence (Federal Decree-Law No. 10 of 2025, loaded from the official register). The penalty architecture is of a different order from anything in the VARA layer. A legal person whose representatives commit money laundering, terrorist financing or proliferation financing faces a fine of no less than AED 5,000,000 and up to AED 100,000,000, or the value of the criminal property involved, whichever is greater, with dissolution mandatory on a company’s conviction for terrorist financing or proliferation financing and discretionary for money laundering, and deportation mandatory for a foreign individual given a custodial sentence for money laundering or a felony under the law. Set against the AED 10,000,000 ceiling of VARA’s heaviest marketing fine, the heaviest consequences in the whole stack sit in the federal layer, and VARA’s own fines schedule acknowledges it: for AML/CFT violations, VARA’s fine amounts are determined in accordance with applicable local and federal laws rather than a fixed VARA tariff (Regulations, Schedule 3).
One practical caution belongs in the short answer. As at the date of this article, VARA’s consolidated reference page for the Federal AML/CFT Laws lists the 2025 base law but continues to list the revoked 2019 executive-regulation instruments, and the illustrative list inside the Regulations still names the 2018 and 2019 instruments. None of this changes the obligation, because the definition is ambulatory. But it means a firm that reads VARA’s pages alone can be led to a repealed instrument. The federal register governs, and the current instruments are the 2025 law and the 2025 Executive Regulations.
The rest of this article works through that layer. It sets out how the VARA framework hooks into federal law, what the 2025 AML law actually requires and punishes, what its Executive Regulations demand of a VASP’s compliance build, the data-protection layer and its still-pending mechanics, the advertising and consumer-protection instruments the marketing rules point to without naming, and finally what is settled, what is open, and what must be watched.
The hook is not a single clause. It is a structure with four parts, recognition, designation, obligation and enforcement, and the drafting of one definition is what keeps the whole structure current when the federal layer moves.
Recognition and designation come first. The Regulations are made in recognition of the federal AML legislation, naming the 2018 AML law and the 2014 counter-terrorism law and extending to any other federal legislation on money laundering, terrorist financing, unlawful-organisation financing or sanctions non-compliance, as amended from time to time, under the defined term Federal AML-CFT Laws (Virtual Assets and Related Activities Regulations 2023, Regulation VI.A.1, current as at 1 July 2026). For the purposes of those laws, VARA is designated as the Supervisory Authority for the Emirate in respect of all VASPs and VA activities, is responsible for money-laundering regulation in the Emirate, and has the power to supervise VASPs’ compliance with the federal laws themselves (Regulation VI.A.3). The design is explicit about its own limits: nothing in the Regulations limits any function of another body under the federal laws (Regulation VI.A.4), and where VARA itself detects suspected money laundering, it must promptly report its suspicion to the relevant federal authority (Regulation VI.A.5). In Dubai, the federal AML system runs through VARA, and it does not stop with VARA.
The obligation is then stated in one sentence with a long reach. VASPs must comply with all Federal AML-CFT Laws, and with all other AML/CFT legislation, regulatory requirements, Regulations, Rules and Directives that apply to their activities, businesses or operations in any jurisdiction, at all times, including FATF recommendations as VARA incorporates them (Regulation VI.B.1). The words “in any jurisdiction” mean a Dubai licence carries the firm’s AML obligations wherever its operations run, not only inside the Emirate.
The definition is where the currency problem is solved, and it repays structural reading. Schedule 4 defines the Federal AML-CFT Laws in two movements: a head, all UAE federal legislation relating to AML/CFT, unlawful-organisation financing or sanctions non-compliance as may be in force from time to time, together with all executive regulations, cabinet resolutions and cabinet decisions relating to the same; and a tail, a list of named instruments, the 2018 law, its 2021 amendment, the 2019 executive-regulation decision, its 2022 amendment and the 2020 terrorism-lists decision, introduced by the words “including but not limited to”. The head governs and the tail illustrates. So when Federal Decree-Law No. 10 of 2025 replaced the 2018 law and Cabinet Resolution No. 134 of 2025 replaced the 2019 decision, the obligation attached to the new instruments automatically, because the duty was always drawn to whatever is in force, not to the names on the list. The named list has aged; the definition has not. One adjacent definition shows the same forward drafting: VARA’s term “AML/CFT” itself includes counter proliferation financing and financial sanctions compliance, so the 2025 law’s elevation of proliferation financing to a core offence, examined in Section III, arrived inside a VARA vocabulary already built to receive it, an observation drawn from reading the two definitions together.
Two pieces of stale surface sit on top of that current structure, and neither changes the law. VARA’s consolidated reference page for the Federal AML/CFT Laws, as it stands at the date of this article, lists the 2025 law as the base instrument while continuing to list the 2019 executive-regulation decision and its 2022 amendment, both since revoked, and does not list Cabinet Resolution No. 134 of 2025. And Schedule 4 defines the term Supervisory Authority by reference to the 2018 law specifically; reading that role as continuing under the corresponding provisions of the 2025 law is an interpretive step, a natural one, but a step, and it is marked as such here. In both cases the ambulatory definition carries the substance; the surface simply has not caught up. The practical rule for a firm is the one Section I gave: the federal register, not any consolidated summary page, is where the current instrument is found.
Below the Regulations, the obligation becomes an operating spine. Part III of the Compliance and Risk Management Rulebook builds the VASP’s AML function in ten parts: the appointment and duties of a Money Laundering Reporting Officer, policies and procedures, AML/CFT controls, risk assessments, client due diligence, suspicious transaction monitoring and reporting, the FATF Travel Rule, compliance with targeted financial sanctions, record keeping, and enforcement (Compliance and Risk Management Rulebook, Part III, Parts A to J, current as at 1 July 2026). The controls part shows the sector-specific texture: VASPs are expected to run distributed-ledger analytics with documented reviews of the tools’ capabilities and weaknesses, and to build their transaction-monitoring scenarios around the FATF’s virtual-asset red-flag indicators, including subsequent versions of that publication as they appear (Part III, Rules C.1 to C.4). The federal duty arrives at the firm as systems, officers and records, and VARA examines all of it.
Enforcement closes the loop, and it closes it from both directions. VARA may take enforcement action against any entity for violation of any law, expressly including the Federal AML-CFT Laws, not only for breaches of VARA’s own rules (Regulation IX.C.1.a). And when it comes to fining an AML violation, VARA’s fines schedule sets no VARA tariff at all: the amount is “in accordance with applicable local and federal laws” (Schedule 3, row 1), the schedule’s preamble pointing among others to the federal cabinet resolution on administrative penalties for virtual-asset violations. The hook therefore runs through the penalty as well as the duty. A VASP’s AML exposure is federal in its source, VARA-supervised in its enforcement, and federal again in its measure.
So the framework recognises the federal laws, is designated under them, obliges compliance with whatever version of them is in force, operationalises that obligation through the compliance rulebook, and enforces it with federal-law-measured consequences. Everything therefore turns on what the current federal instruments actually say. Section III opens the first of them: Federal Decree-Law No. 10 of 2025.
Federal Decree-Law No. 10 of 2025 is the base criminal statute beneath every VARA licence, issued 30 September 2025 and in force since 14 October 2025 by operation of its own entry-into-force clause (Federal Decree-Law No. 10 of 2025, Article 42, current as at 1 July 2026). It repealed the 2018 law outright (Article 41(1)). What distinguishes it, for this sector, is that virtual assets are not an afterthought bolted onto a banking statute. They are drafted into its foundations.
The definitions do the absorbing. A virtual asset service provider is any person who, as a commercial activity, conducts virtual-asset activities specified in the Executive Regulations for or on behalf of another (Article 1), and from that point the statute names VASPs alongside financial institutions at every operational provision: the reporting duty, the preventive duties, the supervisory powers, the freezing powers, the international-cooperation machinery. The term Funds expressly includes electronic, digital and cryptographic assets, and the money-laundering and terrorist-financing offences are each defined to include commission through digital systems, virtual assets or cryptographic technologies (Article 1; Article 3(1)). A crypto business cannot read this law as someone else’s statute. It is written into the text at the level of definition.
The offences turn on a knowledge standard that compliance officers should read twice. A person commits money laundering where they know, or where sufficient indications or evidence exist to believe, that funds derive from a predicate offence, and they deal with those funds in the ways the article lists (Article 2(1)). Three reinforcements then remove the traditional escape routes: money laundering is an independent crime, so the launderer is punishable whether or not the predicate offender is (Article 2(2)); no conviction for the predicate offence is required, and knowledge of its specific type is not required either, since knowledge “may be inferred from the factual and objective circumstances” (Article 2(3)); and the same inferred-knowledge standard applies to terrorist financing and proliferation financing (Article 3(4)). Reading that standard against a compliance function’s daily reality, a firm that ignores its own red flags is building the factual and objective circumstances from which knowledge can later be inferred, an escalation this article draws as a consequence of the standard rather than a stated rule. Proliferation financing itself joins the statute as a core offence, the financing of weapons-of-mass-destruction activity including dual-use technologies (Article 3(3)), which is the expansion VARA’s own vocabulary was already shaped to receive, as Section II noted.
Two provisions speak directly to this sector’s perimeter. First, no person may engage in financial, designated non-financial or virtual-asset-service activities without a licence, registration or enrolment from the competent or supervisory authority (Article 20), on pain of imprisonment and a fine of AED 200,000 up to AED 10,000,000 (Article 32). The licensing question examined in the companion article “Which VARA rulebooks apply to your business?” therefore has a federal criminal backstop: operating unlicensed is not only a VARA enforcement matter but a federal offence. Second, whoever promotes, sells, provides services in or deals with virtual assets characterised by total anonymity, or that prevent or obstruct the authorities’ ability to trace a transaction or its parties, or unlicensed accounts or technologies allowing such concealment, commits an offence punishable by at least three months’ imprisonment and a fine of at least AED 50,000, with confiscation mandatory on conviction (Articles 30(2), 30(3) and 31). The flat marketing ban examined in the companion article “Who must follow VARA’s marketing rules, and what do they require?” thus has a federal criminal counterpart: the privacy coin is not merely unmarketable in Dubai, dealing in it is a crime under federal law.
The law also imposes duties directly, ahead of anything in the Executive Regulations. A VASP that suspects, or has reasonable grounds to suspect, that a transaction or funds represent proceeds or relate to the Crime must notify the Financial Intelligence Unit without delay and directly, whatever the amount, and confidentiality provisions are no shield (Article 18(1)); a deliberate or grossly negligent failure carries imprisonment and a fine of AED 100,000 to 1,000,000, or either (Article 28). Tipping off a customer that a report or inquiry is underway is itself an offence (Article 29(1)). Article 19 then sets the preventive floor: documented and continuously updated risk assessment on a risk-based approach, customer due diligence with ongoing monitoring, an absolute bar on anonymous, fictitious or numbered accounts, senior-management-approved internal policies applied across majority-owned subsidiaries, immediate implementation of targeted financial sanctions instructions, and records available to the authorities on demand (Article 19(1)(a) to (g)). Good-faith reporting is protected: no criminal, civil or administrative liability attaches to a firm or its people for disclosures made in good faith, even where no crime ultimately occurred (Article 37(1)).
The state’s reach into a VASP’s books is immediate and pre-judicial. The head of the Financial Intelligence Unit may, without prior notice, suspend a suspicious transaction for up to ten working days, and freeze funds held with a VASP for up to thirty days, extendable by the Attorney General (Articles 5(1) and 5(2)). The Public Prosecution and courts may order tracing, seizure, freezing and travel bans without notice (Article 6(1)), and any contract whose purpose was to defeat a seizure, freezing or confiscation is void by operation of law, subject to bona fide third-party rights (Article 6(3)). For a firm whose business is holding and moving client assets, these powers sit directly on top of the client-asset questions examined in the companion article “What can a VASP do with client virtual assets?”: a freezing order under this law reaches the assets wherever the regulatory framework has placed them.
The penalty architecture then runs in tiers, and the tiers climb fast. An individual convicted of money laundering faces one to ten years’ imprisonment and a fine of AED 100,000 to 5,000,000 or the value of the criminal property, whichever is greater (Article 26(1)); the range hardens to temporary imprisonment and AED 1,000,000 to 10,000,000 or twice the property’s value where, among other circumstances, the offender exploited their position or professional activity, acted through an organised group, or reoffended (Article 26(2)). Terrorist financing carries life imprisonment or at least ten years; proliferation financing carries temporary imprisonment; both with fines to AED 10,000,000 or twice the property’s value (Articles 26(3) and 26(4)). Attempt is punished as the completed crime (Article 26(5)). A legal person whose representatives, directors or agents committed the core offences in its name faces AED 5,000,000 up to AED 100,000,000 or the value of the criminal property, whichever is greater (Article 27(1)), with dissolution mandatory on conviction for terrorist or proliferation financing and discretionary for money laundering (Articles 27(3) and 27(4)), and the person actually managing the firm is personally punishable where aware and in breach of their duties (Article 27(5)). A convicted foreign individual given a custodial sentence for money laundering or a felony under the law must be deported (Article 36(1)). And none of it ages out: the criminal case, the penalties and the connected civil actions are all exempt from prescription (Article 37(2)).
Beneath the criminal tier sits the administrative one, and this is where VARA, as the designated Supervisory Authority, operates day to day. For any violation of the law, its Executive Regulations or connected decisions, the supervisory authority may issue a warning, impose a fine of AED 10,000 up to AED 5,000,000 per violation, bar the violator from the sector, restrict or suspend responsible board members and managers, appoint a temporary supervisor, suspend or restrict the activity, or revoke the licence, with escalating fines for repetition within a year and publication of the penalty at the authority’s option (Article 17). The working ladder for a VARA-licensed firm is therefore administrative first, criminal above it, and personal throughout, and the distance between the rungs is one inferred-knowledge finding.
One transitional provision completes the picture and opens the next section. The executive regulations of the repealed 2018 law survived the repeal only provisionally, remaining effective insofar as consistent, until superseded (Article 41(3)). They have since been superseded. The instrument that did it, Cabinet Resolution No. 134 of 2025, is where the operational detail of a VASP’s obligations now lives, and Section IV reads it.
Cabinet Resolution No. 134 of 2025, the Executive Regulations of the 2025 AML law, is where the federal layer stops describing offences and starts prescribing operations. Issued 29 October 2025 and effective 14 December 2025 (Cabinet Resolution No. 134 of 2025, official register, current as at 1 July 2026), it replaced the 2019 implementing decision that the VARA commentaries once cited for concepts like the politically exposed person. Its defining feature, for this sector, is that virtual asset service providers are a named regulated population in almost every operative article, alongside financial institutions and the designated non-financial businesses, not an afterthought in an annex.
The federal perimeter is drawn in Article 4. Virtual-asset activities are five families: exchange between virtual assets and fiat currencies, exchange between virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets or of instruments enabling control over them, and financial services relating to an issuer’s offer or sale of a virtual asset, with the Supervisory Authority able to add more in coordination with the National Committee (Article 4). A VASP is anyone conducting these as a commercial activity for or on behalf of another (Article 1). The federal list is drawn at a higher level of generality than the licence categories examined in the companion article “Which VARA rulebooks apply to your business?”, an observation about drafting level rather than a stated mapping, and the practical consequence is that any VARA-licensable business will find itself inside at least one of the five federal families.
The compliance build starts with risk. Every VASP must identify, assess, manage and document its crime risks in proportion to its nature and size, taking in customer, geographic, product, transaction and delivery-channel factors and the National Risk Assessment, keep the study updated, and produce it on request (Article 5(1)). Mitigation must be built as senior-management-approved policies and controls (Article 5(2)), with an enhanced-due-diligence toolkit the article itself itemises: more identity and occupation information, source of funds and wealth, more frequent refresh, closer monitoring, first payment through an account in the customer’s name at an equivalently regulated institution, and senior management approval to start or continue the relationship. Simplified due diligence exists, but only where low risk is identified, only in coordination with the Supervisory Authority, never where there is suspicion, and never in a way that dilutes targeted financial sanctions (Article 5(3)). Where proliferation-financing risk runs high, the firm owes enhanced controls aimed specifically at detecting sanctions circumvention, documented and periodically reviewed (Article 5(4)).
Customer due diligence then arrives with a threshold that repays attention. Every firm applies it at the start of a business relationship, on suspicion, and on doubts about existing data (Article 7(1)). For occasional transactions, a financial institution’s general trigger is AED 55,000, but its wire-transfer trigger is AED 3,500, and a VASP’s trigger for any occasional transaction, single or linked, is that same AED 3,500 (Articles 7(2) and 7(3)). Reading the three clauses together, the drafting treats every crypto transaction like a funds transfer rather than like general banking business, which is a structural observation about the table of thresholds rather than a stated rule, and it sets the operational floor for walk-in business low. What the diligence collects is prescribed: identity from original documents or reliable independent sources for natural persons, constitutive documents, registered office and senior-management names for legal persons (Article 9), and a beneficial-ownership cascade that runs from any natural person at twenty-five percent or more, to control by any other means, to the senior managing official where no one else can be identified (Article 10), with a listed-company relief where market disclosure already delivers transparency (Article 11). Verification can be deferred briefly in low-risk cases, on conditions (Article 6(2)). And the regime has a hard stop: where a firm cannot complete due diligence, it is prohibited from starting or continuing the relationship or executing the transaction, and must consider filing a suspicious transaction report; where completing the diligence would itself tip the customer off, the firm may skip the diligence and must file the report (Article 14). Shell banks and anonymous or obviously fictitious accounts are barred outright (Article 15), and the existing customer book must be brought up to standard on a materiality-and-risk timetable (Article 13).
The politically-exposed-person regime, whose 2019 source the earlier VARA commentaries relied on, now lives here, and it is asymmetric by design. The definition covers persons entrusted, now or previously, with prominent public functions at home or abroad, and expressly extends to immediate family and known close associates, including joint beneficial owners and persons fronting structures established for a PEP’s benefit (Article 1). For foreign PEPs the full package is mandatory: risk systems to detect them, senior management approval to start or continue, reasonable measures on source of funds and wealth, and enhanced ongoing monitoring. For domestic PEPs and persons prominent in international organisations, the duty is to detect, with the full package applying where the relationship is high-risk (Article 16(1)). The distinction is the instrument’s own, and a firm’s onboarding logic has to encode it rather than flatten it.
The reporting spine and the officer who runs it are prescribed in matching detail. Firms must maintain and continuously update suspicion indicators in line with Supervisory Authority instructions (Article 17), report suspicion to the Financial Intelligence Unit immediately, whatever the value, with banking and professional secrecy expressly unavailable as shields (Article 18(1)), and say nothing to the customer, the tipping-off prohibition reaching directors, officers and employees alike (Article 19(1)). The Compliance Officer must sit at management level, decide independently whether to report or retain with reasons, review and grade the firm’s systems, report directly to senior management with copies to the Supervisory Authority on request, train the staff, and cooperate with the authorities (Article 22). Two provisions give that office its practical weight: senior management is defined functionally, anyone with authority over strategy, risk or compliance policy, board members and chief executives included (Article 1), and the Supervisory Authority must keep an updated list of compliance officers and require its prior approval before a firm appoints one (Article 49(18)). The officer a VARA firm calls its MLRO is, in federal terms, an approved appointment, not an internal one.
The virtual-asset transfer rules are the part of this instrument the sector knows as the Travel Rule, and the drafting runs in two layers. The empowerment layer is Article 35: the Supervisory Authority of VASPs may set the scope, limits and form of virtual-asset transfers, verification obligations by risk, record-keeping and technical standards, and must actively hunt unlicensed operators, including by scanning open sources and coordinating with the Unit (Articles 35(1) and 35(2)). The obligation layer is Article 36: conducting VASP activity from within the State requires licensing or registration (Article 36(1)); an originating VASP must obtain, hold and transmit “immediately and securely” to the beneficiary institution accurate originator and beneficiary information, at minimum the originator’s name, account number or wallet address, and residential or business address, and the beneficiary’s name and account or wallet address, with the beneficiary VASP obtaining and holding the same (Article 36(2)); VASPs carry all the targeted-financial-sanctions obligations of financial institutions (Article 36(3)); and a financial institution moving virtual assets for a customer is caught by the same requirements (Article 36(4)). The correspondent-banking, wire-transfer, group-programme and foreign-branch rules of Articles 26 to 33 apply to VASPs proportionately. Records across all of it are kept at least five years, organised so individual transactions can be reconstructed as evidence (Article 25), a federal floor above which the Dubai instruments build further, the eight-year marketing record examined in the companion article “Who must follow VARA’s marketing rules, and what do they require?” being the clearest example.
The provisional-measures machinery, whose statutory basis Section III set out, is given its mechanics here, and one of them does not translate cleanly to this sector. The Unit’s chief may suspend a suspicious transaction for up to ten working days and freeze funds held with a VASP for thirty days without notice, extendable by the Attorney General (Article 51); the firm holding frozen funds must notify the owner, request documents proving the transaction’s integrity and the source of funds, and route them to the Unit (Article 51(7)). Frozen funds may not be disposed of for any purpose, including prior obligations, without authorisation through the Supervisory Authority (Article 54(5)), though administrative fines imposed before the order can still be carved out and enforced (Article 54(6)). And then the provision that reads strangely against a crypto balance sheet: firms, VASPs expressly included, must transfer frozen funds into interest-bearing or profit-generating deposit accounts at prevailing market rates, with the accrued return following the funds into confiscation or back to the owner (Articles 54(2) to 54(4)). How a firm places a frozen virtual asset into an interest-bearing deposit account is not answered by the instrument; whether the duty contemplates conversion, a yield arrangement, or applies only to fiat balances is genuinely unresolved on the text, and a firm holding frozen virtual assets should raise the mechanics with the Supervisory Authority rather than improvise them.
So the Executive Regulations hand a VARA firm its federal compliance build in full: a documented risk assessment, a low occasional-transaction threshold, a beneficial-ownership cascade, an asymmetric PEP regime, an approved compliance officer, an immediate reporting duty, a travel rule with named minimum fields, and freezing mechanics with one unresolved seam. What the federal layer demands next is not about crime at all. It is about data, and Section V turns to it.
The second federal floor under a VARA licence is data protection, and the framework names it rather than implying it. VASPs must comply with all applicable data-protection and data-privacy requirements: within the UAE, “including the PDPL” and any sectoral or free-zone laws that apply, and any data-protection laws outside the UAE that reach the VASP’s activities wherever conducted, with compliance expressly extending to where data is stored and how it is transferred (Technology and Information Rulebook, Rules II.A.1 and II.A.2, current as at 1 July 2026). The shape mirrors the AML obligation of Section II: worldwide in reach, attached to the licence, supervised by VARA.
The federal instrument pair dates from a single day. The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, was issued on 20 September 2021 and came into force on 2 January 2022 by its own commencement clause (Federal Decree-Law No. 45 of 2021, Article 31, current as at 1 July 2026). Its regulator was created alongside it: the law’s own definitions route the “Office” to the UAE Data Office established under Federal Decree-Law No. 44 of 2021 (Article 1), the federal authority to which breaches are reported, records are produced and complaints are made. Practitioner coverage through 2026 describes that office as established but exercising limited enforcement to date, a secondary characterisation flagged as such.
Whether the law reaches a VARA firm is answered by its scope article, subject to two readings worth making explicit. The law applies to controllers and processors in the UAE processing anyone’s data, and to those outside the UAE processing the data of persons inside it (Article 2(1)), so its reach is extraterritorial in the same way the marketing perimeter was. Its exclusions include free-zone companies subject to their own data-protection legislation and banking and credit data governed by its own regime (Articles 2(2)(f) and (g)). Reading those exclusions against a VARA firm’s position: a VASP in Dubai outside the DIFC sits in no free zone with its own data law, so the free-zone carve-out does not lift it out, and a VASP’s client data is not obviously the banking and credit data the credit-information regime governs, so the financial-data carve-out should not be assumed to apply either. Both are inferences from the exclusions’ wording to this sector’s facts, and the conservative operating position they support is that the PDPL applies to a VARA firm’s client data in full.
What binds today is the law’s own text, and it is substantial without any regulations beneath it. Processing rests on consent unless one of ten exceptions applies (Article 4), and two of those exceptions carry a VASP’s daily operations: processing necessary to perform a contract with the data subject, and processing necessary to meet obligations under other laws in force, which is the gateway through which the AML diligence Section IV described is processed lawfully. Consent, where relied on, must be provable, clear, simple and as easy to withdraw as to give (Article 6). Processing must observe the fairness, purpose-limitation, minimisation, accuracy, security and retention controls of Article 5; the controller must keep a processing record and produce it to the Office on request (Article 7(4)); processors carry mirrored duties (Article 8); security must meet best international practice, with encryption and pseudonymisation named (Article 20); and a documented impact assessment is required before high-risk processing with modern technologies, including systematic profiling and large-scale sensitive data (Article 21), a trigger that onboarding analytics and ledger-based profiling can plausibly meet, which is stated here as a reading of the trigger rather than a stated rule for this sector.
The rights chapter reaches straight into a VASP’s client-facing operations. Data subjects can demand the information held and its purposes (Article 13), portability (Article 14), correction and erasure (Article 15), and restriction (Article 16); they can object to decisions produced by automated processing and require a human in the review (Article 18); and they have an unconditional right to stop processing intended for “direct marketing, including profiling related to direct marketing” (Article 17(1)). That last right closes a loop this series has traced twice: the consent that the marketing rules require for targeting, examined in the companion article “Who must follow VARA’s marketing rules, and what do they require?”, is consent the data subject can withdraw here, and the marketing stops with it.
The data protection officer completes the in-force architecture, in two articles that are easily conflated. Appointment is Article 10: a controller or processor must appoint a DPO where processing involves high risk through new technologies or data volume, systematic and comprehensive assessment of sensitive data including profiling and automated processing, or large volumes of sensitive data, and the officer may sit inside or outside the UAE, with contact details notified to the Office (Articles 10(1) to 10(3)). The officer’s roles are Article 11: verifying procedures, receiving complaints, advising on and documenting periodic evaluations, and acting as the link to the Office. The employer must resource the officer, involve them in all data-protection matters, and may not dismiss or discipline them for doing the job (Article 12). Whether a given VASP’s processing crosses the appointment thresholds is a facts question, but the criteria for data volume are themselves deferred to the Executive Regulations (Article 10(4)), which is where this section’s real finding begins.
Because the honest description of this layer is a law in force above machinery that is not finished beneath. The breach-notification duty is mandatory, but the period for notifying the Office is whatever the Executive Regulations set (Article 9(1)); no seventy-two-hour rule exists in the law itself, whatever compliance folklore says. The penalty tariff is whatever a Cabinet decision issues on the Office’s proposal (Article 26); none is located on the official sources. The cross-border regime runs on Office-approved adequacy or the fallback routes of contract, explicit consent and necessity (Articles 22 and 23), with the governing controls again deferred (Article 23(2)). Small-processor exemptions are deferred (Article 3). The compliance grace period is six months from the day the Executive Regulations issue (Article 29), and the regulations themselves were due within six months of the law’s promulgation (Article 28). As at 1 July 2026, the position on the official sources is that they are not confirmed issued: the official federal platform lists none, and the leading 2026 practitioner references state they remain unissued, while a scattering of commercial pages claims issuance under instrument numbers that contradict one another and should not be relied on. What is known: the law binds and has bound since January 2022. What is deferred: the deadlines, the tariff, the exemptions and the transfer controls. What that requires: verification against the official register at the point of reliance, every time, because the day the regulations issue, a six-month compliance clock starts.
For a VARA firm the operating posture follows directly. The obligations in the law’s own text are licence obligations now, carried in through the rulebook’s blanket rule; consent, records, security, rights-handling and the DPO analysis cannot wait for regulations. What can and should wait is any process built around a specific number, a notification deadline, a fine exposure, a volume threshold, that only the Executive Regulations will fix. The issuance of those regulations is the single largest refresh trigger in this article. One generic pointer from the marketing rules now remains unresolved: the federal law on advertising and consumer protection, and Section VI names it.
The marketing rules oblige every in-scope campaign to comply with federal law on advertising and consumer protection without naming an instrument, and this section’s work is the naming. The consumer field resolves to one law and its regulations: Federal Law No. 15 of 2020 on Consumer Protection, in force since the day after its November 2020 publication (Federal Law No. 15 of 2020, Article 38, current as at 1 July 2026), amended in 2023 by Federal Decree-Law No. 5 of 2023, whose content is outside this article’s verified reading, with Executive Regulations issued as Cabinet Decision No. 66 of 2023, listed on the Ministry of Economy’s official legislation page and reported effective 14 October 2023. The advertising field resolves to the media law: Federal Decree-Law No. 55 of 2023 Concerning Media Regulation, issued 2 October 2023 and in force since 1 December 2023 by its own commencement clause (Federal Decree-Law No. 55 of 2023, Article 31), with a subordinate layer set out below. Two adjacent regimes sit on the same official page and are named here for completeness without a verified reading: the telemarketing regulations, Cabinet Resolution No. 56 of 2024 with a penalties resolution alongside, and the e-commerce law, Federal Decree-Law No. 14 of 2023.
The consumer law’s reach is wider than a crypto firm might assume, on the face of its own definitions. It applies to all commodities and services inside the State, expressly including the free zones, and to the related operations of every provider, advertiser and commercial agent, including registered e-commerce (Article 3). A service is everything offered to the consumer, for or without charge, and a consumer is any natural or legal person obtaining one (Article 1). Nothing in the operative text carves out financial services or virtual assets; reading those definitions onto a VASP’s client offering, the conservative position is that the law applies to it, an application drawn from the definitions rather than stated by the law for this sector.
Four of its provisions bear directly on the marketing this series has examined. Misleading advertising is defined to include omission, advertising built on misleading information or the leaving out of fundamental information that induced the contract, with fake prizes and discounts deemed misleading (Article 1), and the advertiser, provider and agent are flatly prohibited from it (Article 17). Promotions carry their own licence: no provider may promote, discount or advertise promotions without a prior licence from the competent authority (Article 18), a federal-and-local permission layer that sits beneath the VARA-side incentive confirmation examined in the companion article “Who must follow VARA’s marketing rules, and what do they require?”. Consumer data is protected at the level of a consumer right, including “not using these for the purposes of promotion and marketing” (Article 4(5)), the consumer-law expression of the same principle Section V traced through the data law. And the language duty is absolute in form: data, advertising and contracts related to the consumer must be in Arabic, with other languages permitted alongside (Article 26), a requirement any English-only crypto campaign into the UAE should read twice.
Its penalties are criminal, and they layer on top of everything else. Misleading advertising and harmful contract terms, among others, carry imprisonment up to two years and a fine of AED 10,000 up to 2,000,000, doubled on re-offence (Article 29); promoting without the licence, monopolistic practice and the Arabic-language breaches carry up to six months and AED 3,000 to 200,000, likewise doubled (Article 30); and a convicting court may order confiscation, closure of the premises for up to three months, and publication of the judgment at the convict’s expense (Article 31). The law states its own stacking rule: its penalties apply without prejudice to any severer penalty in any other law (Article 28). A misleading crypto promotion into the UAE is therefore exposed twice over, to VARA’s administrative ceiling and to a federal criminal fine, and the two do not offset.
The media law is the advertising instrument proper, and its definitions decide who is inside it. An advertisement is any visual, audio or printed content shown to the public by any means for the purpose of marketing a product or service, “for or without compensation” (Article 1), the same unpaid-promotion reach the VARA definition has, so the free post is caught federally just as it is caught in Dubai. The law applies to every person, establishment, institution, outlet and media free zone practising media activities in the State (Article 2), and electronic and digital media activity is a media activity in terms (Article 8(1)(F)). Its advertising article then does three things: it prohibits publishing any advertisement that violates the media content standards or harms the public interest, it obliges every advertiser to mark advertising material explicitly and clearly as advertising, and it hands the detailed advertising standards to the Executive Regulation (Articles 20(1), 20(2) and 20(4)). The disclosure duty runs parallel to the remunerated-content disclosure the VARA conduct standard requires, so a compliant crypto promotion carries the marking twice over, once for each regime. Behind it stand the sixteen media content standards of Article 17, universal for anyone practising in the field, among them the prohibitions on false news, on rumours and misleading news, and, notably for this sector, on publishing anything that might harm the national currency or the economic situation of the State (Articles 17(13) to 17(15) and 17(14)).
The permit architecture is where the federal layer reaches the individual influencer. The competent authority licenses electronic and digital media activity providing news or promotion and advertising on social media, paid or not; the Council issues permits to the natural person who provides advertising or media content, for or without compensation, on social media; every such activity is subject to the content standards; and the person responsible for the activity bears responsibility for what is published whether the activity is permitted or not (Articles 12(1), 12(2), 12(4) and 12(6)). On that statutory base sits the subordinate layer, stated here on secondary sources and flagged as such: the law’s Executive Regulation, reported in effect since 31 October 2024; the violations-and-penalties resolution, Cabinet Resolution No. 42 of 2025; and the Advertiser Permit, mandatory from 1 February 2026 for any individual publishing advertising content online from within the UAE, paid or unpaid, under a 2025 decision of the Council’s chairman. Institutionally, current practitioner reporting records the UAE Media Council’s replacement by a National Media Authority under a 2025 decree-law in force from January 2026, with references to the Council now read as references to the Authority; that succession is secondary here and does not alter the duties above. The law’s own sanctions run to an administrative fine of AED 1,000 up to 1,000,000, doubled on repetition to a ceiling of 2,000,000, closure up to six months, permanent closure of unlicensed institutions, and cancellation of licences, all without prejudice to other legislation’s penalties (Article 23).
Stack the layers and the position of the crypto influencer, the figure the VARA regime already singles out, becomes the clearest illustration in this article. The companion article “Who must follow VARA’s marketing rules, and what do they require?” found that a key opinion leader promoting a virtual asset into the UAE is always marketing and needs to act as the approved agent of a licensed VASP. This section adds the federal floor beneath that finding: the same post is an advertisement under the media law whether or not anyone paid for it, it must be marked as advertising, it must clear the media content standards, its author needs the federal permit, and if it misleads, the consumer law’s criminal penalties are in reach. The media law itself states the principle that makes all of this cumulative rather than alternative: a licence or permit under it does not substitute for the approvals other authorities require (Article 7). No single permission clears a crypto promotion into the UAE. Each layer must be cleared on its own terms.
That completes the identification the marketing rules left open, and with it the last of the federal references this series had parked. What remains is to draw the whole federal layer together: what is settled, what is moving, and what the movement itself demands of a firm that built its compliance on instruments that keep being replaced. Section VII closes there.
Most of the federal layer is settled, and it is settled in an unusually durable way. The hook is settled: the framework recognises the federal AML laws, designates VARA as the Supervisory Authority, obliges compliance with whatever versions are in force through an ambulatory definition, and enforces the federal duty with federal-law-measured consequences (Section II). The criminal base is settled: the 2025 AML law writes virtual assets and their service providers into its definitions and offences, lowers the knowledge threshold to what the circumstances support, elevates proliferation financing, criminalises unlicensed activity and anonymity-built assets, and carries a penalty architecture that runs to AED 100,000,000 or the value of the criminal property for a convicted firm, with no prescription period (Section III). The operational build is settled: the 2025 Executive Regulations fix the risk assessment, the AED 3,500 occasional-transaction threshold, the beneficial-ownership cascade, the asymmetric politically-exposed-person regime, the approved compliance officer, the immediate reporting duty, the travel rule and the freezing mechanics (Section IV). The data obligations in force are settled, carried into the licence by the rulebook’s blanket rule (Section V). And the advertising and consumer instruments are identified and anchored, with their criminal and administrative penalties stacking on VARA’s own (Section VI).
What is open falls into three kinds, and they should not be run together. The first is deferred machinery: the data law’s Executive Regulations are not confirmed issued on the official sources, so the breach-notification deadline, the penalty tariff, the volume thresholds and the transfer controls remain unfixed, and their issuance will start a six-month compliance clock the day it happens (Section V). The second is unresolved seams in instruments that are otherwise in force: how a firm places a frozen virtual asset into an interest-bearing deposit account, as the freezing mechanics require of fiat (Section IV); whether the consumer law’s definitions, which contain no financial-services carve-out, apply to virtual-asset services in the way their words suggest, a reading this article makes conservatively but no authority has yet tested (Section VI); and how far the media content standard protecting the national currency and the economic situation reaches into crypto promotion and commentary (Section VI). The third is surface lag with no legal effect but real practical risk: VARA’s consolidated federal-laws page still listing revoked executive-regulation instruments, and the illustrative lists inside the Regulations still naming the 2018 and 2019 laws (Section II). A firm that treats the third kind as if it were the first will anchor its compliance to a repealed instrument; the register governs, every time.
What is moving is the layer itself, and the movement is the finding this article closes on. Since the VARA framework was enacted, the federal floor beneath it has been rebuilt almost end to end: a new AML law and new executive regulations in 2025, a new media law in 2023 with its executive regulation in 2024, its penalties resolution in 2025 and a permit regime and successor authority in 2026, consumer executive regulations in 2023 with a 2023 amendment to the law itself, a telemarketing regime in 2024 and an e-commerce law in 2023. Across the same period the VARA rulebooks changed once. The lesson is structural rather than rhetorical: a compliance build anchored to instrument names goes stale within a year in this jurisdiction, while one anchored to the duty the framework actually drafted, compliance with whatever is in force from time to time, does not. The framework’s own definition teaches the discipline its licensees need.
The refresh architecture follows from that. The single largest trigger is the issuance of the data law’s Executive Regulations, which converts an open machinery question into a running six-month deadline. Any successor to, or amendment of, the 2025 AML law or its Executive Regulations re-anchors Sections III and IV on the day it takes effect. The items this article carries at identification level, the telemarketing regulations, the e-commerce law, the media executive regulation and its penalties resolution, the 2023 consumer-law amendment, and the succession of the media authority, each require a provision-level read against the register before any operation relies on their content. And VARA’s own federal-laws page updating is worth watching not because it changes the law but because it marks when the surface catches up with it.
This analysis rests on the Virtual Assets and Related Activities Regulations 2023 and the Compliance and Risk Management and Technology and Information Rulebooks as they stand on VARA’s live rulebook; on Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025, in force 14 October and 14 December 2025 respectively; on Federal Decree-Law No. 45 of 2021 and Federal Decree-Law No. 44 of 2021, in force since January 2022; on Federal Law No. 15 of 2020 as amended and its 2023 Executive Regulations; and on Federal Decree-Law No. 55 of 2023, in force since 1 December 2023, each loaded from the official register or the live rulebook. Each is live and, on this article’s own showing, the federal ones move. The answer to the question in the title is therefore deliberately shaped: the federal laws that stand behind a VARA licence are the ones in force today, by the framework’s own drafting, and today that means the instruments named above, read at the point of reliance against the register that holds them.
For your facts, in confidence, put the question to the firm.
The bench stands behind it