Q. When designing an activity-based virtual asset framework, how do you decide what should sit in binding rules, supervisory guidance or case-by-case engagement? How do market feedback and experience from licensing and supervision inform subsequent revisions?

A. The starting point for any effective regulatory framework is a clear understanding of the risks it is intended to address, rather than the technology through which a financial activity is delivered. At VARA, our approach is deliberately activity-based and technology-agnostic. We regulate the economic substance of an activity, the risks it creates and the responsibilities of the entities performing it. This provides a consistent regulatory foundation while allowing different business models and technologies to develop.

There is an important distinction between regulation, guidance and supervisory engagement. Binding regulations and rulebooks establish the obligations that apply across the market. These include requirements relating to governance, capital, financial crime prevention, custody, market conduct and consumer protection. They provide the legal certainty and minimum standards against which firms are assessed. Guidance serves a different purpose. It explains how regulatory requirements may be interpreted or applied in practice, particularly where emerging technologies or business structures create questions that are not immediately apparent from the rules themselves. Guidance does not replace or override binding obligations.

Individual supervisory engagement then allows VARA to examine the particular characteristics of a business model, assess its risk profile and determine whether additional controls, permissions or conditions are appropriate within the applicable framework. Importantly, regulation cannot remain theoretical. Licensing and supervision provide direct evidence of how rules operate under real market conditions. Where we identify recurring implementation challenges, emerging risks or opportunities to improve clarity, that experience can inform subsequent regulatory refinements.

The evolution of VARA's framework, including its activity rulebooks, issuance requirements and derivatives provisions, reflects this approach. The objective is not regulation that changes with every technological development. It is a framework sufficiently robust to provide certainty, while remaining capable of responding to evidence and market evolution.

Q. What should an international business establish first when assessing whether its proposed activities fall within VARA's remit? In particular, how should it approach Dubai's mainland and free zones, the DIFC exclusion, and activities that may also engage other UAE authorities, such as payment tokens or tokenised financial instruments?

A. The first question an international business should ask is not where its technology is hosted or where its parent company is incorporated. It is what activity the business intends to perform, where that activity is performed or offered from, and which legal rights and obligations arise from it. Under Dubai Law No. 4 of 2022, VARA is responsible for regulating Virtual Asset activities in and from the Emirate of Dubai, including the mainland, free zones and special development zones, with the express exclusion of the Dubai International Financial Centre (DIFC). The DIFC operates under its own financial regulatory framework, administered by the Dubai Financial Services Authority (DFSA).

A commercial licence issued by Dubai's Department of Economy and Tourism or a relevant free-zone authority should not be confused with authorisation to conduct regulated Virtual Asset activities. These are distinct legal requirements. Equally, firms must consider the wider UAE regulatory architecture. Depending on the nature of the asset and activity, other competent authorities may have jurisdiction. The Central Bank of the UAE (CBUAE) regulates payment services and payment tokens within its statutory remit, while the federal Capital Market Authority (CMA), formerly the Securities and Commodities Authority, has responsibilities relating to capital markets and regulated financial instruments.

A token representing rights in a financial security, for example, cannot simply be treated as falling exclusively within the Virtual Asset perimeter because it has been issued using distributed ledger technology. Certain structures may therefore require engagement with more than one authority. Our advice is to begin with a documented regulatory-perimeter assessment identifying the asset's legal characteristics, the activities performed, the contracting entities, the location of operations and the intended customers. The principle is straightforward: technology does not determine jurisdiction in isolation. Legal substance and regulated activity do.

Q. How should firms and their advisers distinguish an Approval to Incorporate, an In-Principle Approval and a full VASP licence, including any operational conditions? What should customers verify in the Public Register about a firm's status and authorised activities, and what should they avoid inferring from an approval or licence?

A. One of the most important distinctions in the licensing process is between permission to establish a business and authorisation to conduct regulated activities. For new applicants, VARA's published licensing process begins with an Approval to Incorporate (ATI). This allows the applicant to progress its legal establishment and operational preparations, including matters such as premises, personnel and organisational infrastructure. It does not authorise the firm to provide regulated Virtual Asset services.

An In-Principle Approval (IPA) is likewise not an operating licence. It is a conditional regulatory milestone indicating that the applicant may progress towards full authorisation, subject to satisfying outstanding requirements. An IPA holder cannot commence regulated Virtual Asset activities or service clients on the strength of that approval. A full VASP licence authorises the entity to undertake the specific Virtual Asset activities identified in its licence, subject to the applicable rules and any conditions or restrictions attached to that authorisation.

It is not a blanket permission to undertake every Virtual Asset activity, introduce any new product or provide services to every category of customer. Certain activities, including Exchange Traded Derivative Services, require additional express authorisation. For consumers and counterparties, VARA's Public Register is an essential verification tool. They should confirm the precise legal entity, its regulatory status, authorised activities and any relevant limitations or changes.

It is equally important to understand what a licence does not represent. Regulatory authorisation is confirmation that an entity has been permitted to undertake specified activities within a supervisory framework. It is not a guarantee of financial performance, the safety of every individual product or the absence of investment risk. Nor should authorisation be represented as an endorsement by VARA of the commercial merits of a particular offering. Licensing establishes the basis for regulated operation. Maintaining compliance is a continuing obligation.

Q. What evidence best demonstrates that a firm can put its policies into practice across governance, compliance, financial resources, technology and outsourcing? Without discussing individual applicants, where do you see the greatest gaps between a well-written submission and a business ready to operate safely?

A. There is a fundamental difference between demonstrating an understanding of regulatory requirements and demonstrating the capacity to comply with them consistently. A well-prepared application is necessary, but documentation alone cannot establish operational readiness. VARA's assessment examines whether the proposed governance, compliance, financial and technological arrangements are appropriate for the actual business being conducted. That requires evidence beyond written policies.

For example, a firm should be able to demonstrate how its board exercises oversight, how senior management identifies and escalates material risks, how financial resources are maintained, and how compliance functions operate with appropriate authority and independence. Similarly, anti-money laundering and counter-terrorist financing controls must be capable of operating in practice. Customer due diligence, transaction monitoring, sanctions screening, suspicious activity escalation and applicable transfer-information requirements should be reflected in functioning systems and procedures.

Technology and outsourcing arrangements require equivalent scrutiny. A firm must understand its dependencies, maintain adequate cybersecurity and business-continuity arrangements, and retain sufficient oversight of critical third-party providers. Where client assets are involved, the evidence must extend to custody arrangements, reconciliation, access controls, safeguarding and incident management. The recurring challenge is often not the absence of a policy, but the absence of a sufficiently clear connection between that policy, the people responsible for implementing it and the systems through which it operates.

An applicant should be able to explain what happens when something goes wrong: who identifies the issue, who has authority to act, how clients are protected and how the matter is escalated. For us, operational readiness means that regulatory responsibilities are embedded in the business rather than treated as a separate compliance exercise. The real test is not whether a firm can describe its controls, but whether those controls can operate reliably, including under stress.

Q. For real-world asset tokenisation, what should be analysed separately about the underlying legal rights, token issuance, distribution, custody and secondary trading? Drawing on publicly available lessons from the real estate tokenisation initiative, how can firms distinguish a controlled pilot or specific permission from authorisation for a wider commercial offering?

A. Tokenisation changes the mechanism through which an asset or a right may be represented and transferred. It does not, by itself, change the underlying legal nature of that asset or right. This distinction is particularly important for real-world asset tokenisation. The starting point must be the underlying legal arrangement. What does the token holder actually own? Is there direct ownership of an asset, a beneficial interest, a contractual claim against an issuer, a right to income or some other form of entitlement? Those rights must be legally identifiable, enforceable and consistent with the representations made to investors.

Once that foundation is established, the different components of the transaction should be assessed independently. Issuance, distribution, custody, brokerage, exchange activity and secondary-market trading may each raise distinct regulatory questions. The classification of the token under VARA's issuance framework is also important, including whether it constitutes a Category 1 Asset-Referenced Virtual Asset or another category of issuance. Where the underlying rights constitute securities or other regulated financial instruments, the requirements of the relevant financial regulator must also be considered.

Dubai's real-estate tokenisation initiative provides a practical illustration. Developed through collaboration between the Dubai Land Department (DLD), VARA and other participants, the initiative has allowed the legal, technological and operational components of tokenised property ownership to be evaluated within a controlled regulatory environment. Following the initial phase, DLD announced a second phase in February 2026 involving controlled secondary-market resale functionality. That development is significant, but it should not be interpreted as general authorisation for any entity to issue, distribute or trade tokenised real estate products.

Participation in a pilot, approval of a specific activity and permission to offer a wider commercial product are legally distinct matters. Each depends on the scope and conditions of the relevant authorisations. Our approach is to support innovation through controlled implementation, with expansion informed by evidence rather than assumption. Ultimately, tokenisation must deliver more than technological efficiency. It must preserve legal certainty, enforceable rights and effective investor protection.

Q. Under the Exchange Traded Derivative Services framework, what additional authorisation and safeguards should firms consider beyond a spot exchange business? Which design choices matter most for client suitability, leverage and margin, liquidation, account segregation and the management of extreme market conditions, including perpetual products?

A. The introduction of derivatives fundamentally changes the risk profile of an exchange business. A spot transaction generally involves the purchase or sale of an asset. Derivatives introduce additional considerations relating to leverage, margin, counterparty exposure, liquidation and the potential for losses to exceed amounts initially committed. Accordingly, VARA's Exchange Traded Derivative Services framework requires a VASP to hold an Exchange Services licence and obtain explicit authorisation to provide derivative services. A standard exchange authorisation is not sufficient.

The additional requirements extend across several areas. First, client suitability is critical. Firms must assess whether prospective clients understand the products and associated risks, and whether they have the financial capacity to meet their obligations. Retail participation requires particular attention to investment experience, financial circumstances and the ability to withstand substantial losses.

Second, leverage and margin arrangements must be supported by appropriate risk management. This includes suitable leverage limits, collateral eligibility and valuation, ongoing monitoring of exposures, and clear procedures for margin calls and liquidations. Third, the regulatory framework requires segregation of derivatives trading accounts from other client trading accounts, with specific protections governing when assets outside those accounts may be used to meet derivatives liabilities.

Fourth, firms must establish effective arrangements for managing extreme market conditions. The rules address insurance funds, close-out procedures, negative account balances and the circumstances in which losses may ultimately be mutualised. Perpetual derivatives create further operational considerations because they do not have a fixed maturity date. Funding-rate calculations, price feeds and disclosures must therefore be designed to address ongoing exposure and the potential accumulation of liabilities.

These are not simply additional disclosure requirements. They are fundamental aspects of product design, operational infrastructure and financial resilience. A regulator must be satisfied not only that the product can function in ordinary market conditions, but also that its risk-management arrangements are credible when liquidity deteriorates or volatility increases sharply.

Q. What should clients understand about who controls their assets, how collateral is held and valued, whether assets may be used or transferred, and what happens on default or insolvency? How does VARA's approach translate these risks into governance, operational controls and meaningful disclosures?

A. Custody and lending illustrate why apparently similar uses of Virtual Assets can create very different legal and financial risks. For custody, the fundamental questions concern ownership, control and safeguarding. Clients should understand which legal entity holds their assets, who controls the relevant wallets or cryptographic keys, what segregation arrangements apply and under what circumstances assets may be moved.

VARA's Custody Services Rulebook establishes specific protections, including client-asset segregation, control requirements and a prohibition on rehypothecating assets held under Custody Services, even where a client might otherwise be willing to consent. The framework also provides for specifically authorised arrangements, such as Collateral Wallet Services, which are subject to separate requirements and disclosures. These arrangements should not be confused with ordinary custody.

Lending and borrowing involve a different allocation of risk. A client must understand whether assets are being lent or pledged, who may use them, what rights other parties acquire, how collateral is valued and maintained, and how defaults or shortfalls are addressed. The contractual arrangements must make these matters clear, including withdrawal rights, collateral rights and the circumstances in which client assets may be exposed to counterparty risk.

VARA's Lending and Borrowing Services Rulebook addresses liquidity, collateral management, counterparty due diligence, governance and disclosure, including periodic reporting of lending and borrowing assets and liabilities. In both cases, insolvency considerations require particular attention. The fact that an asset is recorded on a blockchain does not independently determine its legal treatment if a service provider becomes insolvent. The enforceability of ownership rights, contractual arrangements, security interests and applicable insolvency law remains critical.

A meaningful disclosure should therefore explain what the client is entitled to, what can happen to the assets and which risks the client ultimately bears. Transparency is not achieved by providing more information alone. It is achieved when the information enables clients to understand the legal and economic consequences of the arrangement.

Q. Where a business combines decentralised protocols or smart contracts with a commercial operator, interface or service provider, how should it assess the activities being performed and who remains accountable? Which facts should it bring to an early regulatory discussion rather than relying on labels such as 'DeFi', 'non-custodial' or 'technology provider'?

A. The regulatory assessment of decentralised finance must begin with economic activity and accountability, rather than terminology. Terms such as "DeFi", "non-custodial", "permissionless" or "technology provider" can describe important technical characteristics. They do not, however, determine whether a regulated activity is being performed.

The relevant questions are more practical. Who develops and maintains the protocol? Who controls administrative keys or can upgrade smart contracts? Who determines fees, asset eligibility or governance parameters? Who operates the user interface, receives commercial benefits or exercises the ability to intervene when something goes wrong? Equally, how are clients onboarded, how are their assets transferred, and which entities are responsible for the financial services being provided?

These questions help identify whether a commercial operator, intermediary or other accountable entity exists within an apparently decentralised arrangement. A genuinely decentralised protocol with no identifiable service provider may raise a different legal assessment from a business operating a commercial interface and exercising material control over financial activities. The distinction must be established through the facts.

A non-custodial structure may reduce certain custody risks, but it can create other risks involving smart-contract vulnerabilities, governance concentration, oracle dependencies and operational resilience. Those risks do not disappear because assets are controlled through code. For firms approaching VARA, early engagement is most productive when supported by a clear description of the entire operating model, including legal entities, governance rights, transaction flows, sources of revenue, third-party dependencies and proposed safeguards.

Where a model also involves payments, credit or other financial activities within the remit of another UAE authority, that perimeter must be considered separately. The objective is not to force every decentralised structure into a conventional intermediary model. It is to determine where regulated functions are performed, where meaningful control exists and how accountability can be maintained. Innovation in market architecture should not result in uncertainty over responsibility.

Q. What questions should an overseas firm ask before serving clients or undertaking virtual asset activities in or from Dubai? How should it assess the relevance of an overseas licence, local authorisation and cooperation between regulators, without assuming that permission in one jurisdiction automatically extends to another?

A. Virtual Asset markets operate across borders, but regulatory permissions remain grounded in law and jurisdiction. An overseas firm considering activity connected to Dubai should first establish whether its proposed services involve regulated Virtual Asset activities in or from the Emirate, and whether the business is marketing or otherwise directing services towards relevant customers.

The analysis should consider the substance of the activities, the role of any Dubai entity, contractual arrangements, client onboarding, operational decision-making and the channels through which services are offered. The absence of a physical office does not, by itself, resolve every question of regulatory applicability. Likewise, an international group should not assume that a licence held by one affiliate automatically authorises another entity to provide services in Dubai.
Overseas authorisation can be relevant. It may demonstrate experience operating within an established regulatory framework and provide useful information concerning governance, compliance and supervisory history. However, an overseas licence is not a regulatory passport into Dubai. Nor should firms assume that international cooperation arrangements between regulators create automatic mutual recognition of licensing permissions. Cooperation is important because it supports supervisory information-sharing, financial-crime prevention and greater consistency in regulatory outcomes. It does not eliminate the obligation to obtain the authorisations required by applicable local law.

Firms should also be cautious about treating concepts such as reverse solicitation as automatic exemptions without undertaking a proper assessment of the relevant legal framework and underlying facts. The practical approach is to map the relevant activities and jurisdictions before launching a service or acquiring clients, rather than attempting to resolve licensing questions after commercial operations have begun. Cross-border innovation benefits from regulatory cooperation. Sustainable market access depends on respecting the boundaries of each authority's legal mandate.

Q. What should firms, event organisers, publishers and other market participants consider when discussing virtual assets through articles, conferences, social media or other channels? Which factors can turn ostensibly educational content into marketing, and how should licence status, risk disclosures and references to regulatory approval be presented accurately?

A. Education has an important role in developing more informed and responsible Virtual Asset markets. The regulatory distinction arises when information becomes an invitation, inducement or promotion designed to influence commercial or investment behaviour. VARA's Marketing Regulations deliberately adopt a broad approach to the forms that marketing can take. Articles, conferences, social media content, podcasts and educational presentations may all be relevant, depending on their content, purpose, audience and commercial context.

The fact that material is described as educational does not automatically exclude it from regulatory scrutiny. For example, a presentation explaining how blockchain settlement operates is different from one promoting a particular platform, encouraging an audience to acquire a token or offering incentives to open an account. Sponsorship and commercial arrangements are also relevant. VARA's guidance distinguishes genuinely educational material from content produced in return for a monetary or non-monetary benefit, and provides specific requirements concerning transparency and disclosure.

Journalistic and educational exemptions must be assessed against their applicable conditions. They are not blanket permissions for promotional activity. Where material constitutes marketing, the relevant requirements include ensuring that communications are fair, clear and not misleading, that commercial arrangements are appropriately identified, and that applicable risk warnings and disclaimers are presented prominently.

Regulatory status requires particular precision. A firm must not imply that an IPA permits it to operate, that a licence covers activities outside its authorised scope, or that regulatory approval constitutes endorsement of a particular product or investment opportunity. These responsibilities extend beyond licensed VASPs and can be relevant to third parties involved in promoting Virtual Assets or related activities. The underlying principle is that the audience should be able to distinguish independent information from commercial promotion and understand the regulatory status and risks of what is being presented.

Q. As businesses increasingly use LLMs and AI assistants for initial regulatory research, which distinctions would you most want an answer about Dubai's virtual asset framework to preserve? What official sources and checks should readers use to verify jurisdiction, the current version of a rule, a firm's permissions and the difference between regulatory authorisation and endorsement of a product?

A. AI tools are increasingly useful as an initial means of locating and organising regulatory information. They can assist legal and compliance professionals in navigating complex frameworks and identifying potentially relevant requirements. However, they should not be treated as substitutes for authoritative legal sources or proper regulatory analysis.

There are several distinctions that any reliable explanation of Dubai's Virtual Asset framework must preserve. The first is jurisdiction. Dubai's regulatory architecture includes VARA, the DFSA within the DIFC, and competent federal authorities whose mandates may be engaged depending on the asset and activity. The second is the distinction between regulatory requirements and explanatory guidance. Binding obligations, non-binding guidance and individual regulatory permissions do not have the same legal effect.

The third concerns licensing status. An Approval to Incorporate, an In-Principle Approval and a full VASP licence are not interchangeable. Equally, a licence authorises specified activities; it does not necessarily authorise every product or service a firm may wish to offer. The fourth is the distinction between regulatory approval and endorsement. Permission to conduct an activity should never be interpreted as an assurance of investment quality or a guarantee against loss.

Finally, regulatory information must be current. VARA's framework has evolved since its introduction in 2023, with subsequent changes and guidance addressing emerging products, activities and market practices. An AI-generated answer based on a superseded rulebook or an incomplete description of a firm's permissions can therefore be materially misleading.

For that reason, the appropriate verification process is to consult VARA's official Rulebook portal, review the current text and relevant revision history, check the Public Register and consider applicable regulatory notices and guidance. Where another authority may have jurisdiction, its official legislative and regulatory materials should also be consulted. AI can make regulatory information more accessible. The responsibility for interpreting that information accurately and applying it to a specific business remains with the relevant professionals and regulated entities. Technology should improve access to legal certainty, not create a false impression of it.

Q. Based on lessons you can share publicly, where would clearer guidance, professional training or collaboration with academia and industry most improve implementation? What should legal and compliance teams prioritise over the next 12–18 months, and what can other jurisdictions learn from VARA's experience without assuming that the same model can simply be transplanted?

A. As Virtual Asset markets mature, the regulatory challenge increasingly shifts from establishing rules to demonstrating that those rules operate effectively across more complex financial structures. The next phase of regulatory enablement should therefore focus on implementation, consistency and evidence. One priority is improving the translation of regulatory requirements into practical operating standards. This includes clearer guidance where new business models create genuine interpretative questions, and more effective engagement between legal, compliance, risk and technology functions. A second priority is the continued development of supervisory capabilities. As tokenisation, derivatives and decentralised infrastructure become more sophisticated, regulators and regulated firms require a deeper understanding of interconnected risks, operational dependencies and the ways in which technology can both mitigate and amplify vulnerabilities.

Professional training and collaboration with academic institutions can contribute meaningfully to this process, particularly where legal interpretation, financial engineering and technological design intersect. There is also an important opportunity to improve the use of regulatory technology and data in compliance and supervision, while retaining clear accountability for decisions and outcomes.

For legal and compliance teams, the priorities over the next 12–18 months should include reassessing regulatory perimeter assumptions, testing operational resilience, strengthening governance of third-party and technology dependencies, and ensuring that new products remain within the firm's authorised activities. Particular attention should be given to client-asset protection, financial crime controls, cross-border arrangements and the legal enforceability of tokenised structures. An effective compliance framework should anticipate how a business will evolve, not simply document how it operated when it first received authorisation.

VARA's experience also demonstrates the value of regulatory engagement informed by actual market activity. Controlled initiatives and ongoing supervision can produce evidence that allows frameworks to develop proportionately without compromising fundamental protections. There are lessons here for other jurisdictions, although regulatory models cannot be transplanted without considering local legal systems, institutional responsibilities and market characteristics. What can be shared are the underlying principles: clarity of mandate, proportionality, accountability, meaningful supervision and a willingness to refine the framework as evidence develops.

Ultimately, regulatory enablement is not about reducing regulatory expectations. It is about ensuring that those expectations are sufficiently clear, practical and credible to support responsible innovation at scale. The measure of a successful framework is not simply how many businesses it licenses, but whether those businesses can operate safely, maintain market confidence and meet their obligations as the market evolves.