Introduction

2022 was one of the most tumultuous years ever in the short history of blockchain and virtual assets. High-profile and costly failures caused huge amounts of harm to consumers and brought with them negative publicity to an already polarising industry. However, for many of those that remain engaged in this nascent sector, such failures only served to strengthen the need for appropriate regulations to be put in place, for the full potential of these emerging technologies and exciting ideas to be realised.

Heading into 2023, the attention of the industry is focused firmly on what those regulations should look like, with very different approaches forming across the globe.

Against that backdrop, the Emirate of Dubai has taken the lead by establishing an independent regulator for virtual assets, the Dubai Virtual Assets Regulatory Authority (VARA). Within a year of being established, VARA published its Virtual Asset and Related Activities Regulations 2023 on 7 February 2023 (the “VARA Regulations”). The VARA Regulations are the world’s first virtual assets specific regulatory framework.

This article provides an overview of the VARA Regulations, highlighting some of their key and unique features which make VARA a regulatory trendsetter.

What is VARA?

VARA was created in early 2022 under Dubai Law No 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai (the “Dubai VA Law”). Established as the competent authority in the Emirate of Dubai in charge of regulating, supervising and overseeing virtual assets, VARA has the legal personality, financial and administrative autonomy, and legal capacity required to undertake all acts that ensure the achievement of its objectives and functions.

VARA’s Objectives and Functions

Articles 5 and 6 of the Dubai VA Law list VARA’s objectives and functions in full. As well as developing regulations and rules for the protection of investors and those dealing in virtual assets (the definition of which is contained in the Dubai VA Law and discussed further below), with one particular focus being the prevention of money laundering through compliance with the Financial Action Task Force (FATF), VARA’s objectives also include promoting Dubai as a regional and international hub for virtual assets and related services, attracting investments and encouraging companies to base their business in Dubai, and developing the digital economy in the Emirate, including greater financial participation and services for the unbanked.

As the competent regulator, VARA will determine when authorisation (in the form of a licence or otherwise) is required for virtual asset businesses to operate in Dubai. VARA will issue such licences subject to an application process as it deems appropriate and supervise licence holders to ensure compliance.

VARA also has powers of enforcement, including the ability to suspend any activities and to issue fines.

VARA’s Jurisdiction

The Dubai VA Law applies in all zones across the Emirate of Dubai, including special development zones and free zones, but excluding the Dubai International Financial Centre. As such, VARA’s jurisdiction extends to the same areas.

In addition, Cabinet Decision No 111 of 2022 On the Regulation of Virtual Assets and Their Service Providers and Cabinet Decision No 112 of 2022 On Delegating Certain Competencies Related to the Regulation of Virtual Assets together further established VARA as the exclusive competent regulator in the Emirate by virtue of its delegation to exercise the competencies and powers of the Securities and Commodities Authority, as prescribed in those decisions.

What Do the VARA Regulations Cover?

In addition to defining seven regulated “VA Activities” which require a licence from VARA before they can be carried out in Dubai (which are explained in more detail below), the VARA Regulations also contain rules in other areas relating to virtual assets. These include rules relating to the issuance of virtual assets by entities in Dubai, as well as defining virtual asset specific market offences, such as market abuse and insider dealing, and rules regarding investing in virtual assets.

The VARA Regulations also refer, and apply in addition, to Administrative Order No 1 of 2022 Relating to the Regulation of Marketing, Advertising and Promotions Related to Virtual Assets. This order was published by VARA in 2022 and establishes rules relating to the marketing and advertising of virtual assets and related services.

What Is a “Virtual Asset”?

The definition of a “virtual asset” (or VA) used in the VARA Regulations is set out in the Dubai VA Law as “[a] digital representation of value that may be digitally traded, transferred or used as an exchange or payment tool, or for investment purposes. This includes virtual tokens, and any digital representation of any other value as determined by VARA.”

The term “virtual tokens” referred to in the definition of virtual assets is defined as “[a] digital representation of a set of rights that can be digitally offered and traded through a virtual asset platform.”

As a result, the definition of virtual assets can be read to apply very broadly, and would include cryptocurrencies such as Bitcoin and Ether, as well as non-fungible tokens (NFTs) and many other types of tokens and crypto-assets.

Application of the VARA Regulations to All Virtual Assets

A unique feature of the VARA regulatory regime, when compared to other efforts and proposals to regulate virtual assets globally, is that the rules apply to all virtual assets. Unlike other regimes which require the classification of each asset before determining what rules apply (and in some jurisdictions, which authority is the competent regulator), the VARA Regulations apply in the same way to all virtual assets.

The VARA Regulations are “activity-focused”, centering on the activities carried out in respect of virtual assets and addressing the risks associated with such activities. This approach is already recognised by many industry participants as removing the significant regulatory uncertainty experienced in other jurisdictions, and which so far has proved to be a major stumbling block to appropriate regulation being applied to the industry.

The Regulated VA Activities

No entity may carry out any of the VA Activities defined in Schedule 1 of the VARA Regulations by way of business in the Emirate, or promote, offer or purport to do so, without being licensed by VARA.

The VA Activities defined in the VARA Regulations are:

• advisory services;
• broker-dealer services;
• custody services;
• exchange services;
• lending and borrowing services;
• payment and remittance services; and
• VA management and investment services.

In determining whether an entity is carrying out such activities by way of business, VARA may consider, amongst other factors:

• whether the entity holds itself out as conducting the activity by way of business;
• the regularity, scale and continuity of the activity; and
• whether there is any commercial element.

An entity that is licensed by VARA to carry out one or more VA Activities is called a “virtual asset service provider” (or VASP) under the VARA Regulations, borrowing a term used by the FATF, and which is beginning to be used consistently in regulations internationally.

The Rulebooks VASPs Must Comply With

VARA’s novel approach to how it structured its regulations to apply proportionality and flexibility has received broad acclaim. This is achieved through the use of Rulebooks.

There are four “compulsory” Rulebooks which apply to all VASPs, regardless of which VA Activities they are licensed to carry out. These Rulebooks contain baseline requirements in areas such as good corporate governance practices, compliance management and use of technology, and are titled as follows:

• Company Rulebook;
• Compliance and Risk Management Rulebook;
• Technology and Information Rulebook; and
• Market Conduct Rulebook.

In addition, there is a specific Rulebook for each VA Activity (listed above). These Rulebooks include rules which are incremental to the requirements in the four compulsory Rulebooks. Each VASP must therefore also comply with all rules set out in the Rulebooks for each VA Activity for which it is licensed. At the date of writing, the Payments and Remittance Services Rulebook is yet to be published.

The Basic Requirements for Obtaining a Licence From VARA

Similar to requirements seen in most financial services regulations, the VARA Regulations contain basic requirements for VASPs to have physical presence in Dubai. These include:

• establishing a recognised legal entity;
• maintaining capital adequacy requirements (the level of which will depend on the VA Activities being carried out); and
• a minimum number of “responsible individuals” resident in the UAE.

Prospective VASPs are required to register with VARA prior to establishing a legal entity in Dubai.

How Are Customers’ Virtual Assets Protected?

Companies failing to adequately safeguard their customers’ assets has unfortunately been a recurring theme in catastrophic failures seen in the last year. Whilst this issue is by no means unique to the blockchain industry, the protection of customers’ assets is undoubtedly fundamental for the sound operation and growth of the industry going forward.

Recognising this, the VARA Regulations subject all VASPs to rules regarding the custody of their clients’ virtual assets – which are titled “Client Virtual Assets Rules” – and are contained in the compulsory Rulebooks. These rules include that client virtual assets must be held in separate wallets from those of the VASP.

In addition, the VARA Regulations include rules requiring VASPs to maintain reserve assets in respect of the liabilities owed to clients, which must be maintained in the same type of virtual asset as those liabilities that are owed, and to submit audited reports of such assets. These are likely to achieve the same objectives as the “proof of reserves” movement which gained traction in late 2022.

The Role of Custody Service Providers

As discussed above, custody services is one of the VA Activities regulated by VARA and for which a VASP may obtain a licence. Only VASPs which segregate each client’s assets in separate VA Wallets and act on instruction will qualify for a custody services licence.

VASPs licensed by VARA to carry out custody services are subject to additional requirements relating to the safekeeping of virtual assets – contained in the Custody Services Rulebook – and cannot carry out any other VA Activity within the same legal entity. These rules are designed to validate the legitimacy and robustness of VARA-licensed custody service providers.

The regulation of custody service providers also seeks to ensure that the highest levels of protection of client virtual assets is a service available in the ecosystem, for both consumers and VASPs alike. VASPs are therefore incentivised, through reductions in capital maintenance requirements, to use licensed custody service providers.

Rules That Apply When Issuing Virtual Assets

A further unique feature of the VARA Regulations is the approach to the issuance of virtual assets, which is covered by its own separate Rulebook titled the VA Issuance Rulebook.

As a general rule, any entity in Dubai that wishes to issue a virtual asset in the course of a business must seek approval from VARA prior to issuance. Through assessing such application, VARA will determine the ongoing regulatory requirement that will apply to the issuer and the virtual asset being issued. 

The VA Issuance Rulebook does, however, allow for “permitted VAs” (as defined in that Rulebook) to be issued without prior approval from VARA. Broadly, permitted VAs are non-transferable and are not sold. Issuers of permitted VAs must still register their issuance with VARA, through the submission of a “white paper”, and comply with the baseline requirements set out in the VA Issuance Rulebook, which include rules relating to anti-money laundering as well as technology and information security. 

Rules That Apply to “Privacy Coins” Under the VARA Regulations

The use of technologies which can censor or obfuscate transaction records or the identification of ownership of a virtual asset is a topic of much debate in the blockchain industry, particularly regarding their regulatory treatment and concerns that such technologies may facilitate the use of virtual assets for illegal purposes.

The term “privacy coins” is often used to refer to virtual assets which allow for such censorship or obfuscation; however, as is often the case with such rapidly evolving technologies, there are many different types offering differing degrees of censorship or obfuscation, either in whole or in part.

As stated in the fundamental principles of the VARA Regulations, VARA is committed to ensuring the highest standards are met in relation to the prevention of criminal activity, including anti-money laundering and combating the financing of terrorism and full FATF compliance.

The VARA Regulations do include a prohibition on the issuance of “anonymity-enhanced cryptocurrencies” (or AECs) and all VA Activities related to them. However, in what is another area where the VARA Regulations provide a progressive approach to virtual asset regulation, AECs are defined as “a type of virtual asset which prevents the tracing of transactions or record of ownership through distributed public ledgers and for which the VASP has no mitigating technologies or mechanisms to allow traceability or identification of ownership.”

Therefore, there is no blanket prohibition on AECs in the VARA Regulations, and the permissibility of relevant activities must be assessed on a case-by-case basis.

Are Proprietary Traders of Virtual Assets Regulated by VARA?

To ensure full oversight of the virtual asset market in Dubai, the VARA Regulations include a mandatory registration requirement for any entity in Dubai that actively invests its own portfolio in virtual assets above a specified threshold. That threshold stands at or above USD250 million equivalent value of virtual assets during any rolling 30-day period.

Any entity in Dubai that actively invests its own portfolio in virtual assets below that threshold, and that is seeking to obtain a commercial or free zone licence to carry out such activity, may voluntarily register with VARA to help facilitate their application. However, as stated above, should they then trigger that threshold, the requirement to register with VARA becomes mandatory. 

What Is Next for VARA and the Dubai Virtual Assets Ecosystem?

The introduction of clear and proportionate rules, provided by the VARA Regulations, has been welcomed by the industry. A number of notable global organisations and businesses have publicly stated support for the VARA Regulations and/or are considering establishing a presence in Dubai. That, paired with the clarity offered to new market entrants not currently offered by other jurisdictions, suggests VARA is well on track to deliver on its objectives of attracting investments and encouraging companies to base their business in Dubai.

In terms of the regulations themselves, VARA has stressed that they remain a “living document” and will continue to be developed over time to stay relevant and address the risks presented by new innovations in this rapidly evolving sector. The VARA Regulations as already published provide a solid foundation to continue breaking further ground in the development of industry-leading regulations.