What counts as market abuse in Dubai’s virtual-asset market?

The short answer

Dubai’s virtual-asset market has a complete market-abuse regime, and its reach is wider than most participants assume. Three offences, Insider Dealing, Unlawful Disclosure and Market Manipulation, are defined in the Regulations themselves, and they bind any Entity, a term the framework defines as any legal entity or individual, licensed or not. The offences are caught not only when conducted in the Emirate but whenever conduct anywhere is “having an effect on the price of a Virtual Asset traded in the Emirate”, whether by one Entity alone or by several acting jointly or in concert (Virtual Assets and Related Activities Regulations 2023, Regulation VIII.A.1, current as at 1 July 2026). And the penalty tier attached to them is the steepest in the framework: for an individual, a fine of up to the higher of AED 20,000,000 or two hundred percent of the profits gained or losses avoided; for a corporate entity, up to the higher of AED 50,000,000, fifteen percent of annual revenue, or three hundred percent of the profits gained or losses avoided where that is greater (Schedule 3, row 2).

The offences themselves are drawn with modern market-abuse architecture. Inside Information is information of a precise nature, not public, which would reasonably be expected to affect a virtual asset’s price or the investment judgment of a reasonable individual (Regulation VIII.B.1). Insider Dealing is using it, by transacting directly or indirectly, for one’s own account or another’s, and, in a rule that surprises traders, by cancelling or amending an order that was placed before the information arrived (Regulations VIII.C.1 and VIII.C.2); recommending, procuring, facilitating or inducing another to deal is caught alongside (Regulation VIII.C.3). Unlawful Disclosure is passing the information to anyone outside the normal exercise of employment, profession or duties (Regulation VIII.D.1). Market Manipulation runs to ten heads (Regulation VIII.H.1), and attempts are prohibited as fully as completed conduct (Regulations VIII.E.1 and VIII.I.1). The list is not closed: VARA may classify further behaviour as a Market Offence at its discretion (Regulation VIII.A.3).

Three reach provisions decide who should read this article. The Entity definition means the regime is not a licensee code; it binds the anonymous large holder, the offshore promoter and the unlicensed trader on the definitions’ face, which is the marked practical consequence of the breadth rather than a stated example in the text. Where the offender is a legal entity, the manipulation prohibition applies also to the individuals who participated in the decision to act for it (Regulation VIII.H.2). And the routes to possessing inside information expressly include acquiring it through illegal or criminal activities (Regulation VIII.B.3.d), so the hacker who trades on stolen information is inside the offence, not beside it.

The regime distinguishes rather than blankets, and every path it opens carries paperwork. Accepted Practices are excepted from the offences, including lending, borrowing and repo for legitimate trading purposes, collateral transactions, transactions discharging prior legal obligations, and algorithmic or high-frequency strategies not designed to disrupt and implemented so as not to (Regulations VIII.A.4 and VIII.H.3). Legitimate-behaviour rules protect the firm whose information barriers genuinely separated the decision-maker from the information, the market maker acting in the normal course, the broker executing a client’s order, and the party discharging an obligation that predated the information (Regulation VIII.F). And Market Sounding, gauging investor interest before an announced transaction, is a lawful channel wrapped in compliance: a written assessment of whether inside information is involved before every disclosure, updated weekly; the recipient’s consent and three prescribed warnings before anything is said; records of every disclosure, every recipient, every date and time, kept for eight years; and a cleansing notice when the information stops being inside (Regulation VIII.G).

The machinery that polices all of this starts inside the licensed firms. Every VASP must establish and maintain effective arrangements, systems and procedures aimed at preventing and detecting Market Offences or attempts (Regulation VIII.J.1), and must report to the UAE Financial Intelligence Unit and to VARA on reasonable suspicion that any transaction, order or activity, on or off a trading venue, could constitute a Market Offence, an attempt, or any other unfair practice detrimental to the market’s fair and orderly functioning, with the report’s contents specified down to the asset, the entities, the dates and times and the reasons (Regulations VIII.J.2 and VIII.J.3). The Market Conduct Rulebook, current in the version effective 19 June 2025, then builds the operating layer this article works through: a Market Transparency part requiring insider lists and governing Board and staff positions, a Trading Own Account part imposing a general prohibition with group-entity provisions, and a VA Standards part making every firm a gatekeeper of the tokens it services. Enforcement, when it comes, can be taken directly against a firm’s Responsible Individuals (Regulation IX.C.3), and whether conduct amounts to a Market Offence is itself a factor VARA weighs in setting any fine (Regulation IX.C.4.b).

So the short answer is that market abuse in Dubai’s virtual-asset market is defined, prohibited and priced: three offences with effects-based reach over anyone, safe harbours that are real but administratively demanding, a surveillance duty that makes every licensed firm the market’s first policeman, and fines that scale to three hundred percent of the gain. The rest of this article works through that regime: the information offences and their harbours, the ten heads of manipulation and the crypto-native conduct they catch, the prevention-and-detection duty, the insider lists and the own-account bar, the token-gatekeeping standards, and finally what it all costs and what remains open.

The information offences: inside information, dealing, disclosure and their harbours

Everything in this half of the regime turns on one definition, and the definition turns on two qualities: precision and effect. Inside Information is information of a precise nature, not made public, which if public would reasonably be expected to affect the price of a virtual asset, or would affect the investment judgment of a reasonable individual in respect of a transaction in it (Virtual Assets and Related Activities Regulations 2023, Regulation VIII.B.1, current as at 1 July 2026). The definition then answers the two objections traders always raise. To the objection that the information alone would not have driven the trade, it says the information need not be the determining factor behind the transaction, only of material impact on a reasonable investor’s decision (Regulation VIII.B.1). To the objection that nothing had happened yet, it says information is precise where it indicates circumstances or an event that exists or has occurred, or may reasonably be expected to come into existence or occur, specific enough for a conclusion to be drawn about the possible price effect (Regulation VIII.B.2). Applying that forward limb to this sector’s facts, the listing still under discussion, the exploit not yet announced, the treasury decision still in draft are each capable of being inside information before anything is public, an application of the definition’s words rather than an example the text gives.

Who counts as possessing it is drawn wider than the traditional insider, and two of the routes are unmistakably written for this market. An Entity may possess Inside Information through membership of the administrative, management or supervisory bodies of any VASP or Issuer; through being an investor in any VASP or Issuer; through access gained in any employment, profession, volunteering, contribution or duties; through involvement in illegal or criminal activities; or in any circumstances where it knows or should reasonably have known the information was inside (Regulation VIII.B.3). The investor route and the volunteering-and-contribution route are the sector-specific ones: in a market run on token holders, community contributors and open-source developers, the people most likely to see material information early are named as possession routes in terms, an observation about the drafting rather than a stated purpose. And the closing catch-all means the route ultimately does not matter; knowing, or being in a position where one should have known, is enough.

Insider Dealing is the use of that information, and the definition closes the quiet exits. Dealing arises where an Entity possesses inside information and uses it by carrying out a transaction, for its own account or a third party’s, directly or indirectly, in a virtual asset to which the information relates (Regulation VIII.C.1). Using the information by cancelling or amending an order that was placed before the information arrived is also dealing (Regulation VIII.C.2), so the trader who quietly pulls a resting order on hearing bad news has dealt as surely as one who trades on good news. And the offence does not require trading at all: recommending, counselling, procuring or otherwise facilitating another to deal, or inducing them to deal or to cancel or amend, on the basis of the information, is itself within the regime (Regulation VIII.C.3). The tipper who never touches the market is inside the offence through the recommendation limb.

Unlawful Disclosure is the simpler offence with the narrower door. Disclosing inside information to any other Entity is the offence, except where the disclosure is made “in the normal exercise of an employment, a profession or duties” (Regulation VIII.D.1), and the onward passing of a recommendation or inducement is itself unlawful disclosure where the discloser knew or ought to have known it was based on inside information (Regulation VIII.D.2). Applying those two clauses to the sector’s daily habits, the tip dropped in a private group and the forwarded “trust me, buy this” are both within the offence on the definitions’ face, the first as disclosure outside any normal exercise of duties, the second as onward disclosure of an inducement, an application of the provisions rather than an illustration they contain. The prohibition then binds everything above in one clause: no Entity shall engage or attempt to engage in insider dealing, recommend, induce or facilitate another’s dealing, or engage or attempt to engage in unlawful disclosure (Regulation VIII.E.1).

The framework then does what serious market-abuse regimes do: it protects the conduct that merely looks like dealing, and every protection it offers is evidence-shaped. For a legal entity, possession by the organisation is not dealing where two limbs hold together: the firm had established, implemented and maintained adequate and effective arrangements limiting access to the information, such that neither the individual who decided to transact nor anyone who influenced that decision possessed it, and the firm did not encourage, recommend to, induce or otherwise influence the decision-maker (Regulation VIII.F.1). The defence is conjunctive, and its practical meaning, drawn here from its structure, is that a firm which cannot demonstrate its information barriers actually held has no defence to demonstrate. Beyond the barrier defence, mere possession is not use where the Entity is a market maker or authorised counterparty transacting legitimately in the normal course of that function, or is executing another’s order legitimately in the normal course of its duties (Regulation VIII.F.2), or where the transaction discharges, in good faith and not to circumvent the prohibition, an obligation that arose before the information did, whether from an order placed, an agreement concluded, or a legal or regulatory requirement (Regulation VIII.F.3).

Market Sounding is the framework’s lawful channel for the disclosure that deal-making genuinely requires, and it is lawful only as a procedure. Sounding is the communication of information, before a transaction is announced, to gauge potential investors’ interest in it and its conditions, by an Issuer, by a secondary offeror whose sale is distinct from ordinary trading in size and method, or by a VASP or third party acting for either (Regulation VIII.G.1). The choreography is prescribed. Before sounding, the discloser specifically considers whether inside information will be involved and records the conclusion and reasons in writing, for each disclosure, throughout the sounding, updated in any event weekly (Regulation VIII.G.2). Before any disclosure, the discloser obtains the recipient’s consent and delivers three notices: that the recipient may not use the information by acquiring or disposing, may not use it by cancelling or amending orders already placed, and is bound to keep it confidential (Regulation VIII.G.3). A record is kept of everything given, to whom, and the date and time of each disclosure, available to VARA on request (Regulation VIII.G.4). When the information ceases, in the discloser’s assessment, to be inside, the discloser tells the recipient as soon as possible (Regulation VIII.G.5), but the recipient must assess for itself whether it possesses inside information and when it stops possessing it (Regulation VIII.G.6), so the cleansing notice does not discharge the recipient’s own judgment, a reading of the two clauses side by side. The records are kept for at least eight years (Regulation VIII.G.7). The consequence, drawn from the design rather than stated in it, is that a sounding conducted without the paperwork is indistinguishable after the fact from unlawful disclosure; the procedure is not administration around the safe harbour, it is the safe harbour.

So the information offences run on one definition with a forward reach, possession routes drawn for this market’s actual insiders, a dealing offence that catches the cancelled order and the mere recommendation, a disclosure offence with a single narrow door, and harbours that protect only what can be proven. What the information offences protect is the market’s knowledge. What the second half of the regime protects is the market’s price, and Section III turns to the ten heads of manipulation.

Market manipulation: ten heads, drawn for this market

Market Manipulation is defined in ten heads, and the striking thing about them is how little translation the crypto-native typologies require. The definitions were drawn with modern market conduct in view, order books, algorithms, media access, benchmarks, and the sector’s familiar abuses sit inside their words rather than beside them. The exception architecture sits inside the definition too: every head operates with the exception of any Accepted Practice, taken up at this section’s close (Virtual Assets and Related Activities Regulations 2023, Regulation VIII.H.1, current as at 1 July 2026).

The first two heads govern signals and devices, and their framing is the section’s first structural point. Entering into a transaction, placing an order, or any other behaviour which gives, or is likely to give, false or misleading signals as to the supply of, demand for or price of a virtual asset, or which secures, or is likely to secure, the price at an abnormal or artificial level, is manipulation (Regulation VIII.H.1.a); so is any transaction, order or behaviour affecting price which employs a fictitious device or any other form of deception or contrivance (Regulation VIII.H.1.b). The first head contains no express intent element in its words; its trigger is the signal or the likelihood of one, so the conduct is judged by its effect on what the market sees. Applying those words to the sector’s most familiar abuse, trades passed between commonly controlled accounts give a false signal of demand on the head’s own terms, which is where wash trading sits, an application of the definition rather than an example the text names.

The next two heads govern information. Disseminating information through the media which gives or is likely to give false or misleading signals, or is likely to secure an abnormal or artificial price, is manipulation, expressly including the dissemination of rumours where the disseminator knew or ought to have known the information was false or misleading (Regulation VIII.H.1.c). Reading social channels as the media takes only their ordinary meaning, a characterisation marked as such, and on that reading the coordinated hype thread and the seeded rumour are inside the head, with the knew-or-ought standard closing the deniability of the enthusiastic reposter who should have known better. The benchmark head then reaches the market’s reference points: transmitting false or misleading information or inputs in relation to a benchmark, knowing or where one ought to have known, or any other behaviour which manipulates the calculation of a benchmark (Regulation VIII.H.1.d). Whether a given decentralised price oracle is a benchmark within that head is a characterisation the text does not settle; what the text does settle is that wherever a benchmark exists, both false inputs and any other calculation-manipulating behaviour are caught.

Two heads govern position and time. Conduct by an Entity, or Entities acting in collaboration, to inflate a virtual asset’s price by securing a dominant position over its supply or demand is manipulation (Regulation VIII.H.1.e), the cornering head, and its collaboration limb reaches the coordinated group as readily as the single whale. And buying or selling at a particular point in time in the trading or settlement cycle so as to mislead investors acting on the displayed prices is manipulation (Regulation VIII.H.1.f). A market that never closes still has particular points in its cycles, the funding-rate snapshot, the expiry print, the reference-time price on which products strike, and trading into those moments to shape the displayed price is where this head lands in crypto, an application of the head’s words to the sector’s clock.

The order-book head is the one written for the machines. Placing orders on a trading venue operated by an exchange VASP or other organised market, including any cancellation or modification, by any means including electronic, is manipulation where it has any of three effects: disrupting or delaying the venue’s trading system or being likely to; making it more difficult for others to identify genuine orders, including by orders that overload or destabilise the order book; or creating, or being likely to create, a false or misleading signal, in particular by “entering orders to initiate or exacerbate a trend” (Regulation VIII.H.1.g). Spoofing and layering sit inside those three effects on the words themselves, orders placed to be seen rather than filled obscure the genuine book and manufacture a trend, and the head’s express inclusion of cancellations and modifications means the withdrawal of the orders is part of the conduct, not its erasure, an application of the head to the named typologies rather than a gloss the text provides.

Three heads have no real prominence in traditional regimes, and each speaks to this sector directly. The scalping head: taking advantage of occasional or regular access to traditional or electronic media by voicing an opinion about a virtual asset, or indirectly its issuer, having previously taken positions in it, and profiting subsequently from the opinion’s impact on the price, without having simultaneously disclosed that conflict of interest to the public in a proper and effective way (Regulation VIII.H.1.h). This is the influencer’s head, and it completes a regulatory pincer this series has already built one side of: the companion article “Who must follow VARA’s marketing rules, and what do they require?” found that a key opinion leader’s promotion is always regulated marketing; this head makes the undisclosed-position trade behind the promotion a Market Offence. The omission head: omission or failure to take any action which would correct any of the activities in the earlier heads is itself manipulation (Regulation VIII.H.1.i), so on the head’s words the party that discovers manipulative activity within its reach and lets it run has joined it, an application with obvious force for venue operators, and one that pairs with the detection duty of the next section. And the tool head: distributing, maintaining or otherwise making available any software, algorithm or other computer programme designed to carry out any of the earlier activities (Regulation VIII.H.1.j). The bot’s author, distributor and hoster are inside the regime without ever placing an order; the limit sits in the qualifier, designed to, so general-purpose trading software falls outside unless design for the manipulative effects can be shown, a reading of the qualifier rather than a stated carve-out.

The reach provisions then close the exits Section I previewed. Where the manipulator is a legal entity, the head applies also to the individuals who participate in the decision to carry out the activities for its account (Regulation VIII.H.2), so the trading desk’s decision-makers are personally inside the offence their employer commits. No Entity may engage in or attempt to engage in Market Manipulation in the Emirate (Regulation VIII.I.1), attempts standing equal to completions, and the whole regime travels on the effects jurisdiction of Section I, conduct anywhere that affects the price of a virtual asset traded in the Emirate.

What does not amount to manipulation is specified with the same care, and every acceptance is conditional. Accepted Practices include lending, borrowing, repurchase and reverse-repurchase transactions in a virtual asset for legitimate trading purposes which do not disrupt the fair and orderly functioning of any market and without any intention to do so; collateral transactions not designed to have the order-book head’s effects; transactions satisfying a prior legal or regulatory obligation, on the same no-disruption and no-intention conditions where the commitment was contractual; and the use of an algorithmic or high-frequency trading strategy that is not designed to have the order-book head’s effects and which has been designed and implemented in such a way as not to disrupt the fair and orderly functioning of any market, and without any intention to do so (Regulation VIII.H.3). The algorithmic acceptance deserves its qualifiers read slowly: it is not a class exemption for algorithmic trading but a conjunctive engineering standard, the strategy must not be designed for the effects and must be built and implemented not to disrupt, so the firm running it carries the burden of showing both limbs, a structural reading of the conditions. VARA may specify further Accepted Practices in its discretion, for any period (Regulation VIII.A.4), so the boundary is administered, not fixed.

Ten heads, personal reach, attempts included, and conditional acceptances: the offence side of the regime is complete. What converts it from a code into a policed market is the duty the framework places on the licensed firms standing in the order flow, to prevent what they can and report what they see, and Section IV turns to it.

The prevention-and-detection duty: the firm as the market’s first policeman

The offences of Sections II and III bind everyone. The policing of them starts with the licensed firms, and it starts by rule. Regulation VIII.J runs to four rules only, but they convert every VASP standing in the order flow into the market’s first line of surveillance, and the reporting trigger they carry is wider than the offences themselves.

The duty comes first, and its verbs deserve separate attention. VASPs shall establish and maintain effective arrangements, systems and procedures aimed at preventing and detecting Market Offences or attempted Market Offences (Virtual Assets and Related Activities Regulations 2023, Regulation VIII.J.1, current as at 1 July 2026). Prevention and detection are different systems: prevention is the control architecture, the information barriers, dealing rules and access restrictions the next section works through, while detection is surveillance, the monitoring that finds in the order flow what the controls did not stop. The duty’s standard is effectiveness and its object is systems aimed at the outcome, so on the rule’s words a firm is measured by whether its arrangements are effective and genuinely aimed at prevention and detection, rather than made strictly liable for every offence that evades them, a reading of the verbs marked as such, and one that cuts both ways: the firm that missed an offence its systems should have caught has no shelter in the word “aimed.”

The reporting trigger is the Part’s widest drafting. A VASP must report transactions, orders or activities to the UAE Financial Intelligence Unit and to VARA where it has a reasonable suspicion that they could constitute a Market Offence, an attempted Market Offence, or “any other unfair practice detrimental to the fair and orderly functioning” of any market involving virtual assets, whether placed or executed on or outside a trading venue (Regulation VIII.J.2). Three features of that sentence set the obligation’s real size. The third limb reaches past Part VIII altogether: conduct that is not an offence but is unfair and detrimental to the market’s functioning is reportable on the same footing, so the firm’s surveillance cannot be calibrated to the offence definitions alone. The routing is dual, the Financial Intelligence Unit and VARA together. And the venue qualifier means the duty follows the firm’s visibility, not its platform: suspicious activity seen off-venue is as reportable as activity on the firm’s own order book.

What the report must contain presupposes what the surveillance must capture. Every report includes the name of the virtual asset affected, the identity of any Entities involved, the specific dates and times of the suspicious transactions, orders or activities, an explanation of the reasons for believing a Market Offence or other unfair practice has been committed, everything else the Financial Intelligence Unit requires, and all additional information VARA or the Unit reasonably requests for an accurate assessment, with all relevant data in the firm’s possession available to VARA for inspection on request (Regulations VIII.J.3 and VIII.J.4). The consequence, drawn from the list rather than stated in it, is that the report is investigative-grade: a firm cannot produce entity identities, timestamps and reasoned explanations unless its surveillance captures order-level data with time precision and its analysts record why an alert became a suspicion, so the report specification quietly writes the surveillance specification.

How this regime sits beside the firm’s AML reporting is a question every compliance build must answer once, and the answer is two triggers on one infrastructure. The suspicious-transaction machinery examined in the companion article “What does VARA expect your compliance function to produce?” runs on a criminal-proceeds trigger, has no value floor, and routes through the GoAML platform on the MLRO’s clocks. This Part’s duty runs on a market-integrity trigger, offences, attempts and unfair practices, and routes to the Unit and VARA together. The two overlap wherever manipulation generates proceeds, and a single monitoring infrastructure will serve both, but the triggers must be encoded separately, because conduct can be reportable here without any suspicion of criminal proceeds, wash trading between funded accounts being the obvious case, and reportable there without any market-integrity dimension, a reading of how the two regimes sit together rather than a stated scheme in either.

The Part’s four rules close a loop that Section III already hinted has no neutral position. A firm whose systems fail to detect answers under this Part for the failure of its arrangements. A firm that detects and reports has discharged both duties. And a firm that detects and does nothing is not merely in breach of the reporting rule: as Section III set out, the omission or failure to take action that would correct manipulative activity is itself within the definition of Market Manipulation, on that head’s own words. Prevention, detection, reporting and correction are therefore one continuous obligation for the firms in the flow, and the only stable position inside it is the one the framework designed: see, record, report. What the firms must also police is themselves, their own insiders and their own book, and Section V turns to the insider lists, the position rules and the own-account bar.

The insider machinery and the own-account bar

Section IV made the licensed firms the market’s police. These two Parts make them police themselves, in three movements: the firm must know at every moment who inside its orbit holds inside information, must govern what those people do with their own money, and must accept a prohibition on what the firm itself does with its own book. Together they resolve the pointer that the companion articles “Who is personally accountable when a VASP breaks the rules?” and “What does VARA expect your compliance function to produce?” both carried forward to this piece.

The insider list is the knowledge register, and its population is wider than the firm. VASPs must maintain complete and up-to-date lists of all Entities that have or may have access to Inside Information in the course of the business or their roles, expressly including the Board, the Staff, the Group, advisors, accountants and other third-party agents and service providers, and those of the Group as well, updated for as long as the information remains inside (Market Conduct Rulebook, Rule VI.A.1, current as at 1 July 2026). The words “may have access” put potential access on the register alongside actual access, so the list is drawn to the perimeter of exposure, not to confirmed knowledge. Each list is retained for at least eight years after it is drawn up or updated, and goes to VARA on request (Rule VI.A.2).

The mechanics are built for evidential precision. Every entry records the identity, the reason for inclusion, the date and time at which access was obtained, and the date the list was drawn up (Rule VI.A.3); every update, triggered by a changed reason, a new person with access, or a person ceasing to have access, is made promptly and specifies the date and time of the change that triggered it (Rule VI.A.4). And the list doubles as a warning system: the firm must take all reasonable steps to ensure every listed Entity acknowledges in writing the legal and regulatory duties entailed and is aware of the sanctions applicable to Insider Dealing and unlawful disclosure (Rule VI.A.5). The consequence, drawn from the design rather than stated in it, is that the possession routes of Section II become a managed register inside every licensed firm: at any moment the firm can say exactly who is inside on what, each of them on written notice of the consequences, which is also exactly the evidence an investigation will ask for first.

The position rules then govern the insiders’ own money, and they begin before employment does. Every VASP must implement policies governing and monitoring the transactions and positions of Board members and Staff, specifying at minimum the virtual assets they cannot transact, hold positions or economic interests in, the legal entities in which they cannot hold shares or directorships, and the forms for approvals and notifications (Rule VI.B.1), with the obligations notified to every Board member and staff member in writing before their employment starts (Rule VI.B.5). Prior written approval from the firm is required before any action reasonably likely to cause an actual or potential conflict: opening, modifying or closing any virtual-asset position held directly or indirectly on their own account, increasing or decreasing a shareholding in another entity, taking an outside directorship, or anything further the policy adds (Rule VI.B.2). That the closing of a position needs approval as much as the opening mirrors the logic Section II found in the dealing offence, where cancelling an order on inside information is dealing; in both places the exit is regulated as tightly as the entry, an observation about the two provisions rather than a stated link.

Disclosure and correction complete the personal-dealing regime. At least every six months, Board members and staff must notify the firm of all virtual-asset positions held directly or indirectly on their own account, down to the identifier, the size, the nature of the transactions and the relevant history, and of all outside shareholdings and directorships, down to the entity’s name and place, the purpose, the percentage and the full remuneration of any directorship (Rule VI.B.3). And where the firm has information or reason to believe any of its people is likely to cause or has caused a conflict, the duty is not to note it but to remove it, taking all necessary actions including procuring the divestment of the positions or shareholding, or the resignation from the other board (Rule VI.B.4). The Company Rulebook’s requirement that the Board implement rules monitoring its own members’ transactions, met in the accountability companion, lands here in operational form.

The firm’s own book is then dealt with in a single prohibition whose width surprises. VASPs are prohibited from “actively investing their own, or their Group’s, portfolio of Virtual Assets or any other assets” (Rule VII.A.1), and the closing words carry the load: the bar is not crypto-specific, it reaches active investment of the firm’s portfolio in anything. What survives is stewardship, not speculation: transactions for the prudent management of the Net Liquid Assets the firm must hold, or of its treasury and balance sheet, are permitted, provided full records of every such transaction are kept for at least eight years (Rule VII.A.2). Whether any given trading amounts to the prohibited active investing is VARA’s determination, in its sole and absolute discretion, weighing the frequency of the transactions, the assets involved, the volume, the nature and duration, and the nature of any profits generated and their significance in relation to the firm’s financial condition (Rule VII.A.3). The fifth factor deserves its own sentence, because it is self-referential on its face: the more the trading profits matter to the firm’s financial condition, the more the activity resembles what is prohibited, so success at the activity is itself evidence against its permissibility, a structural reading of the factor rather than a stated rule. The design consequence, drawn from the prohibition, is that a VARA licence is a fee business by construction: the framework separates the firms that run the market’s plumbing from the capital that trades through it.

The Group provisions close the Part by managing what the prohibition cannot reach. Entities in the Emirate within a VASP’s Group must comply with Regulation IV.A.7 where applicable (Rule VII.B.1), the mandatory registration rule for large proprietary traders, under which any Entity in the Emirate that actively invests its own portfolio in virtual assets at or above USD 250,000,000 in equivalent value during any rolling thirty-day period must register with VARA before doing so or within three working days after, with the registration expressly not amounting to a licence and the entity’s own-portfolio investing not permitting it to accept or trade any assets belonging to anyone else (Virtual Assets and Related Activities Regulations 2023, Regulations IV.A.7.a to c). And irrespective of that, the VASP must comply with the compliance rulebook’s reporting requirements in respect of every Group entity that actively invests its own or the Group’s portfolio (Rule VII.B.2), which is the monthly group-investing report, complete with transaction records, examined in the companion article “What does VARA expect your compliance function to produce?”. The bar, the registration and the report interlock: what the licensed firm cannot do itself, its group may only do registered and in full monthly view of the regulator. What remains of the firm’s market-integrity duties is the one it owes about the assets themselves, the standards that decide what it will list and service at all, and Section VI turns to the token gatekeeping regime.

Token gatekeeping: the VA Standards regime

The last of the firm’s market-integrity duties is about the assets themselves. Every VASP must establish standards for the virtual assets it services, apply them before anything is listed and continuously afterwards, and publish them, which converts the listing decision from a commercial choice into a documented compliance judgment made against criteria the whole market can read.

The requirement has three limbs and a gate that never closes. VASPs shall establish VA Standards for the virtual assets they provide activities in relation to; shall take all reasonable steps, including relevant due diligence, to ensure every such asset meets those standards “prior to, and at all times during” the provision of any VA activity in relation to it; and shall disclose the standards on their website (Market Conduct Rulebook, Rules VIII.A.1 to VIII.A.3, current as at 1 July 2026). Two consequences follow from the drafting, each marked as such. Publication makes the standards a public commitment, so clients, counterparties and VARA alike can hold the firm to its own published criteria, and a listing that fails them is measured against the firm’s own words. And the continuous gate means listing is never finished: an asset that passed at admission and fails later is a live compliance event, which is what the suspension machinery below exists for.

What the standards must weigh is set in a fourteen-item framework, applied to the extent relevant to the activity and expressly non-exhaustive (Rule VIII.A.4). The market-quality factor opens it: market capitalisation, fully diluted value and liquidity, and whether those metrics have trended downwards over time, so decline is a consideration in its own right. The design factor follows with a qualifier that carries the sector’s reality: the asset’s design, features and use cases, whether or not intended by the Issuer or relevant developers, so the token is judged by what it actually does in the world, not by what its documentation says it was for, a reading of the qualifier’s words. Then come the three hardest-edged factors, the compliance trio: whether the asset has features materially affecting the firm’s compliance with applicable law, AML, sanctions, securities and intellectual property named; its regulatory treatment by VARA and other appropriate authorities including those outside the Emirate, in particular whether its issuance received approvals; and whether it is prohibited by VARA or any other authority, inside or outside the UAE, in any jurisdiction where the firm will service it (Rules VIII.A.4.c to e). The consequence, drawn from the trio rather than stated in it, is that the firm must take and document a view on each token’s legal character, is it a security somewhere, is it sanctioned, is it banned anywhere the firm operates, before the first client trades it.

The remaining factors reach into everything this article has covered. The security and immutability of the underlying DLT protocol, and the asset’s roadmap as its issuer and developers communicate it, are technical and forward considerations (Rules VIII.A.4.f and g). Susceptibility to price manipulation for any reason, together with the mitigations the firm itself will implement, makes the microstructure of Section III a listing question before it is an enforcement one: the thin float and concentrated holding that make a token cornerable are reasons to condition or refuse the listing, an application of the factor to that section’s heads (Rule VIII.A.4.h). Potential or actual conflicts of interest should the firm service the asset, with mitigations, brings Section V’s discipline to the asset level (Rule VIII.A.4.i). The issuer’s background counts, including relevant sector experience and whether it has been subject to any investigations or claims in relation to fraud or deceit, and the word claims does the work: allegations are a consideration without any finding (Rule VIII.A.4.j). Where the asset represents rights to any other assets, the enforceability of those rights must be weighed, which is the same legal-title question the companion article “How are stablecoins regulated, and what falls to the Central Bank instead?” examined for asset-referenced coins, generalised here to every token that claims to carry anything (Rule VIII.A.4.k). And the sufficiency of assets available to satisfy obligations in respect of the activities closes the considerations proper (Rule VIII.A.4.l).

Two items inside the list are not considerations but duties, and the page states them as what they are. Where an asset has an existing underlying physical market, the firm shall ensure the asset’s terms and conditions reflect, to the extent possible, that market’s operation and avoid adverse impacts to it, and should review the terms periodically for appropriate correlation with the physical market’s standards and practices (Rules VIII.A.4.m and n). For commodity-referenced and similar tokens, the firm therefore owes the physical market itself a duty of non-disruption, monitored over time, an obligation drafted into the considerations list but operative on its own verbs.

The implementation rules then make the gate mechanical. The firm assesses relevant information regularly and on an ongoing basis to ensure every serviced asset continues to meet the standards, and keeps all assessment records for eight years, available for VARA’s inspection on request (Rules VIII.B.1 and B.2). Delisting is engineered in advance rather than improvised: the firm shall set the conditions under which activities in an asset may be suspended, including where it no longer meets the standards, and shall have and implement all necessary operational procedures and controls for the event those conditions are met (Rule VIII.B.3), a consequence of the drafting being that a firm without a pre-built suspension playbook is in breach before any token ever fails. When a firm becomes aware an asset no longer meets its standards, it notifies VARA as soon as possible and takes such steps as VARA may direct to minimise adverse impact on clients (Rule VIII.B.4). And the gatekeeping is shared at its top: VARA holds the right to require the suspension of a VA activity in respect of any virtual asset upon reasonable grounds it deems appropriate (Rule VIII.B.5), the override that means the firm’s standards operate under the regulator’s.

With the assets themselves gated, the market-integrity loop this article has traced is closed: the market’s knowledge is protected by the information offences, its price by the manipulation heads, its policing by the prevention-and-detection duty, the firms’ own people and book by the insider machinery and the own-account bar, and its admitted assets by the standards regime. What remains is the price of breaking any of it, and what the regime leaves open. Section VII closes there.

What it costs, and what remains open

The price of a Market Offence is set in the framework’s steepest fine row, and its architecture rewards a slow read. For violations of the Market Conduct Rulebook by any Entity, or of the Regulations and Directives related to Market Offences by any Entity, the indicative fine per violation runs, for an individual, up to the higher of AED 20,000,000 or two hundred percent of the profits gained or losses avoided, and, for a corporate Entity, up to the higher of AED 50,000,000, fifteen percent of the corporate Entity’s annual revenue, or three hundred percent of the profits gained or losses avoided where that is greater (Virtual Assets and Related Activities Regulations 2023, Schedule 3, row 2, current as at 1 July 2026). Three features frame those figures. They are indicative amounts within VARA’s sole and absolute discretion, determined in accordance with applicable local and federal laws (Schedule 3, paragraphs 1 and 2). They are exclusive of any fines, penalties or damages other competent authorities, including courts, may impose (Schedule 3, paragraph 2). And an unpaid fine grows at one percent per month, compounding, rounded up to the nearest full month, with VARA free to pursue recovery through further enforcement or referral to law enforcement and the courts (Schedule 3, row 5 and paragraph 5). The schedule itself is provisional in the way this series has met before: VARA may amend the grounds and amounts, or add categories, by amendment or by Directive at any time (Schedule 3, paragraph 3).

The enforcement architecture around the fines reaches conduct, reputation and people. Enforcement lies for violation of any law, the Dubai VA Law and the Federal AML-CFT Laws named, of the Regulations, Rules and Directives, on any ground on which a licence could be refused, for Good Cause, and on any ground VARA deems to impact the reputation of the UAE, the Emirate or VARA itself (Regulation IX.C.1). The menu runs from written reprimands and rectification notices through cease-and-desist, licence limitation, suspension and revocation, to two reputational instruments with no soft analogue: requiring an Entity to issue a public statement admitting its violation, and requiring it to announce the suspension of the offending activities publicly with non-compliance stated as the reason in the body of the announcement (Regulations IX.C.2.h and i). Fines may be imposed directly on a VASP’s Responsible Individuals (Regulation IX.C.3), and when VARA weighs a fine against an individual, its stated factors include the materiality of the violation, the individual’s management of their own responsibilities under the rulebooks, whether they acted with wilful negligence, and whether the individual acted reasonably in accordance with the VASP’s internal policies (Schedule 3, paragraph 4), the last of which is the internal-policy defence in terms: the person who followed the firm’s own written procedures has a stated factor in their favour, which is the record thesis of the companion article “Who is personally accountable when a VASP breaks the rules?” arriving in the fine calculus. Continued violation attracts periodic penalties on top (Regulation IX.C.5), a grievance body may be established to hear complaints against enforcement (Regulation IX.C.6), and one absence in the factors deserves naming: the first-offence leniency VARA reserves, the right to consider remedial action instead of an immediate fine, is expressly confined to first-time violations under rows 3 and 4 of the fines table, and the market-offence row is not among them (Regulation IX.C.4.d), so on the provision’s face a first Market Offence carries no stated remediation-instead-of-fine path.

Most of the regime is settled, and settled with unusual completeness for a market this young. The three offences are defined with effects-based reach over any Entity anywhere whose conduct touches a Dubai-traded price (Section I). The information offences run on a forward-reaching definition, possession routes drawn for this market’s actual insiders, and harbours that protect only what can be evidenced (Section II). Manipulation is defined in ten heads that catch the sector’s native typologies on their own words, with three heads, media scalping, omission to correct, and manipulation software, that reach the influencer, the bystander platform and the tool-maker (Section III). The licensed firms carry a prevention-and-detection duty whose reporting trigger extends past the offences to unfair practices generally (Section IV). Their insiders are registered, their people’s dealing is pre-cleared and disclosed, and their own book is barred from active investment in anything (Section V). And the assets they service are gated by published standards under VARA’s override (Section VI).

What remains open sits at the characterisation edges and in the administered boundary. Whether a given decentralised price oracle is a benchmark within the manipulation head is not settled by the text (Section III). Reading social channels as the media takes ordinary meaning, but it is a characterisation, not a stated rule (Section III). What amounts to prohibited active investing of a firm’s own book rests in VARA’s sole discretion, with a factor that makes the trading’s very profitability evidence against it (Section V). The boundary of the offences themselves is administered rather than fixed, since VARA may classify additional behaviour as a Market Offence and specify additional Accepted Practices, in its discretion, for any period (Regulations VIII.A.3 and A.4), which means the perimeter can move by decision without any new version of any instrument. And as at the date of this article, the sources loaded for this analysis include no published VARA enforcement decision applying the market-offence provisions, so the regime’s application remains untested in the public record as far as this article’s loads reach, a statement about these sources rather than about the world.

This analysis rests on the Virtual Assets and Related Activities Regulations 2023 as they stand on VARA’s live rulebook, and on the Market Conduct Rulebook in the version effective 19 June 2025, each loaded from the live rulebook, with the federal instrument named in the fines schedule, Cabinet Resolution No. 99 of 2024, carried at identification level pending a loaded reading. Each is live. A new version of either instrument, any VARA classification of additional Market Offences or Accepted Practices, which can move the perimeter by decision alone, or any Directive touching the fines schedule would each be a reason to read this analysis again against the source. The question in the title, on that basis, has a deliberately shaped answer: market abuse in Dubai’s virtual-asset market is insider dealing, unlawful disclosure and market manipulation as their definitions draw them, committed by anyone, anywhere, whose conduct reaches a Dubai-traded price, policed first by the licensed firms standing in the flow, and priced, for a corporate offender, at up to three times the gain.