Dubai set a full licensing framework for virtual-asset businesses

Dubai’s Virtual Assets Regulatory Authority issued the Virtual Assets and Related Activities Regulations 2023 on February 7, 2023, turning the emirate’s earlier licensing initiative into a detailed operating framework for crypto businesses. The central change was straightforward: an entity could not carry on, promote or offer a regulated virtual-asset activity as a business in Dubai without VARA authorization and a licence for that activity, unless a specified exemption applied.

The framework mattered because Dubai was competing to host exchanges, custodians and other digital-asset companies while regulators worldwide were reassessing crypto supervision after the institutional failures of 2022. VARA’s publication supplied a formal rulebook rather than a general policy signal. It also drew a jurisdictional boundary: the rules covered Dubai’s mainland, special development zones and free zones, but excluded the Dubai International Financial Centre, which had its own regulator.

One perimeter for seven activities

VARA identified seven licensed categories: advisory; broker-dealer; custody; exchange; lending and borrowing; payments and remittances; and virtual-asset management and investment services. Issuance was regulated separately through an issuance rulebook. The categories were activity-based, so the relevant question for a company was what service it performed, not merely what label it placed on a token or product.

That design reached across much of the commercial stack. Exchange services included conversion between virtual assets and fiat currency, conversion among virtual assets, order matching and order-book operation. Custody meant safeguarding assets for another entity and acting on verified instructions. Management and investment services explicitly included taking responsibility for staking assets to earn validator or node-operator payments.

The February 7, 2023 text also imposed common controls through company, compliance and risk-management, technology and information, and market-conduct rulebooks, with additional requirements tied to each licensed activity. It prohibited insider dealing, unlawful disclosure and market manipulation, and required service providers to maintain systems for detecting market offences and report suspicious activity to the UAE Financial Intelligence Unit and VARA.

Permission came with hard limits

The regime was not simply an invitation to set up in Dubai. It prohibited the issuance of “Anonymity-Enhanced Cryptocurrencies” and all virtual-asset activities related to them in the emirate. The legal definition focused on assets that prevent tracing transactions or ownership through distributed public ledgers where the service provider lacks mitigating technology or mechanisms to permit traceability or identification.

VARA also reserved broad powers to interpret, waive, modify and enforce the framework. Each business needed authorization before conducting a covered activity and had to maintain a licence for every activity it performed. Large proprietary traders faced a separate registration trigger: an entity investing its own portfolio at or above the equivalent of $250 million in virtual assets during any rolling 30-calendar-day period had to register with VARA. Registration did not itself authorize client-facing business.

What the rules established — and what they did not

The verified development on February 7, 2023 was the issuance of a comprehensive regulatory framework, not proof that every applicant had completed full licensing or that the rules had already produced safer markets. VARA’s own announcement described a route for existing minimum-viable-product applicants, legacy operators and new entrants toward full licensing; it did not supply an event-day count of fully licensed firms.

The significance was institutional. Dubai paired an expansion strategy for virtual-asset businesses with licensing, anti-money-laundering duties, market-abuse rules, supervision and enforcement. That offered operators a clearer compliance map, while leaving consequential questions—how quickly firms would qualify, how exemptions would be applied and how aggressively the regulator would enforce the new perimeter—to later implementation. No event-specific price conclusion is supportable from the regulatory records alone, so this reconstruction makes no claim about bitcoin, ether or token performance on February 7, 2023.