Region

Jurisdiction

Regulator

2025-06-19

Virtual Assets and Related Activities Regulations 2023

The Dubai Virtual Assets Regulatory Authority (VARA) has enacted a comprehensive framework governing virtual assets and related activities across all Dubai zones. The regulations mandate that virtual asset service providers obtain VARA licensing, comply with anti-money laundering and counter-terrorist financing obligations, and adhere to strict marketing, market conduct, and confidentiality standards. It establishes a principles-based regime that prohibits anonymity-enhanced cryptocurrencies while granting VARA broad supervisory, enforcement, and rule-making powers to ensure market integrity and consumer protection.

United Arab Emirates

Virtual Assets Regulatory Authority

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 2 Contents INTRODUCTION....................................................................................................................................................................4 FUNDAMENTAL PRINCIPLES AND GOALS..............................................................................................................5 I. PART I – THE REGULATOR ..............................................................................................................................6 A. Establishment of VARA.........................................................................................................................................................6 B. Rules, Directives and Guidance..........................................................................................................................................6 II. PART II – ISSUING VIRTUAL ASSETS..........................................................................................................9 A. Issuance Rules.............................................................................................................................................................................9 B. Power to classify Virtual Assets .......................................................................................................................................9 C. Prohibited Virtual Assets .....................................................................................................................................................9 III. PART III – REGULATED VA ACTIVITIES ...................................................................................................10 A. General prohibition and exemptions ...........................................................................................................................10 IV. PART IV – LICENSING.......................................................................................................................................12 A. Licensing requirements ......................................................................................................................................................12 B. VARA’s Licensing and authorisation powers..........................................................................................................15 V. PART V – VA ACTIVITY RULEBOOKS .......................................................................................................18 VI. PART VI – ANTI-MONEY LAUNDERING AND COMBATING THE FINANCING OF TERRORISM...........................................................................................................................................................19 A. VARA’s Supervisory Authority .......................................................................................................................................19 B. AML/CFT obligations of VASPs....................................................................................................................................19 VII. PART VII – MARKETING, ADVERTISING OR PROMOTION..............................................................21 A. Marketing Regulations........................................................................................................................................................21 VIII. PART VIII – MARKET OFFENCES.................................................................................................................22 A. Market Offences and VARA’s power to stipulate Market Offences and Accepted Practices ......22 B. Inside Information .................................................................................................................................................................22

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 3 C. Insider Dealing.........................................................................................................................................................................23 D. Unlawful Disclosure..............................................................................................................................................................24 E. Prohibition of Insider Dealing and of Unlawful Disclosure..............................................................................24 F. Legitimate behaviour of treating Inside Information.........................................................................................24 G. Market Sounding....................................................................................................................................................................25 H. Market Manipulation ...........................................................................................................................................................27 I. Prohibition of Market Manipulation............................................................................................................................29 J. Prevention and detection of Market Offences ......................................................................................................29 IX. PART IX – SUPERVISION, EXAMINATION AND ENFORCEMENT.................................................31 A. Investigation or examination by VARA......................................................................................................................31 B. Examination ..............................................................................................................................................................................31 C. Enforcement, fines and penalties..................................................................................................................................32 X. PART X – CONFIDENTIALITY........................................................................................................................35 A. Duty of confidentiality ........................................................................................................................................................35 SCHEDULE 1 – VA ACTIVITIES ....................................................................................................................................36 SCHEDULE 2 – SUPERVISION AND AUTHORISATION FEES.........................................................................39 SCHEDULE 3 – FINES .......................................................................................................................................................41 SCHEDULE 4 – DEFINITIONS........................................................................................................................................45

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 4 Introduction The Dubai Virtual Assets Regulatory Authority ("VARA") was established and authorised by Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai ("Dubai VA Law") to regulate Virtual Assets and Virtual Asset Service Providers ("VASPs"). VARA is affiliated to the Dubai World Trade Centre Authority ("DWTCA") and is the competent entity in charge of regulating, supervising, and overseeing Virtual Assets and VA Activities in all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre ("Emirate"). As set out in Article 5 of the Dubai VA Law, VARA has the following objectives:

to promote the Emirate as a regional and international hub for Virtual Assets and related services; to boost the competitive edge of the Emirate at the local and international levels; and to develop the digital economy in the Emirate;
to increase awareness on investment in the Virtual Asset services and products sector, and encourage innovation in this sector;
to contribute to attracting investments and encourage companies operating in the field of Virtual Assets to base their business in the Emirate;
to develop the regulations required for the protection of investors and dealers in Virtual Assets, and to endeavour to curb illegal practices in coordination with the concerned entities; and
to develop the regulations, rules and standards required for regulating, supervising, and overseeing Virtual Asset platforms, VASPs, and all other matters related to Virtual Assets. The Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time ( "Regulations"), have been enacted with a view to advance the above objectives. These Regulations set out the regulatory framework governing Virtual Assets and all related activities in the Emirate, including the general and specific supervision and enforcement powers of VARA. VARA may, from time to time, amend these Regulations in its sole and absolute discretion to address emerging risks and continually evolving developments in the global Virtual Asset sector. The most updated version of these Regulations will be made available on VARA’s website. Capitalised terms in these Regulations have meanings defined herein or as defined in Schedule 4.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 5 Fundamental Principles and Goals These Regulations are guided by the following fundamental principles for effective regulation of Virtual Assets and VA Activities—

Market integrity and stability: the market should be fair, orderly, transparent, and prevent fraud and other criminal activity. The market should be systemically safe with consideration given to prudential risks. The market can be volatile whilst still being considered to be fair and orderly. The regime should be fully FATF compliant.
Consumer protection: the regime seeks to prevent harms arising from misinformation, abuse and/or poor operational practices. Market participants are free to engage with risk, so long as they give 'informed consent' about their investments and VASPs have provided them with all information necessary for such consent in accordance with all applicable laws and regulations.
Technology neutrality and supportive of innovation: the regime must not discriminate against technology, but instead against illicit or harmful activities. If an activity is not illicit, it should be possible and desirable to regulate it without banning it entirely. VARA does not regulate products or protocols as the starting point for achieving its policy goals (except in special cases). VARA does not decide which innovations are subjectively valuable or not.
Regulatory resilience: the regime must not become quickly outdated with loopholes, given the fast-paced nature of the industry. The regime is principles-driven and VARA is mindful when it makes prescriptive carve-outs.
Regulatory efficiency and proportionality: enforce a regime that is not only effective (i.e. achieves the policy intent), but does so in the least burdensome way possible for both VARA and VASPs. Any burden imposed is justified relative to the potential harm that is being mitigated. Underpinning these fundamental principles are VARA’s two primary policy goals, which are to—
promote the Emirate, and ultimately the UAE, as a safe and progressive jurisdiction worthy of attracting meaningful Virtual Asset growth and innovation, substantively complementing related UAE government programmes; and
position VARA (and consequently, both Dubai and the UAE) as trusted and respected in the realm of international law, particularly with respect to (a) enabling FATF principles, and (b) structuring a principles-based rather than product-based framework designed to establish a point of convergence – both aspects naturally lending themselves to interoperability and passportability.

VARA jurisdiction. a. The Dubai VA Law and these Regulations apply to all Virtual Assets and VA Activities in the Emirate. b. VARA has sole and absolute discretion to interpret, waive, modify or otherwise adapt these Regulations in exercising its powers and in furtherance of its functions and objectives under the Dubai VA Law.
VARA powers and functions. a. VARA has such functions, powers and objectives as are conferred on it by, or under, the Dubai VA Law and any amendments thereto. b. VARA may do whatever it considers necessary for or in connection with, or reasonably incidental to, exercising its powers, performing its functions and fulfilling its objectives under the Dubai VA Law.
Power to amend Regulations. VARA may, from time to time, amend these Regulations in its sole and absolute discretion. B. Rules, Directives and Guidance
General power to issue Rules, Directives and Guidance. VARA may from time to time issue Rules, Directives and Guidance for the purposes of these Regulations or exercising its powers, performing its functions and fulfilling its objectives under the Dubai VA Law.
Rules. a. VARA may issue Rules which have binding effect. b. All Rules, as may be amended from time to time, shall be— i. contained in these Regulations, any Rulebooks or any other Rule-making instruments; and ii. published by VARA on its website.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 7 3. Directives. a. VARA may from time to time, direct any Entity or VASP, or a specified class of Entities or VASPs, to take or refrain from taking such other action as is specified, and in addition to the requirements set out in these Regulations or Rules, including but not limited to— i. comply with specific regulatory capital or liquidity requirements; ii. apply a specific provisioning policy or treatment of specified Virtual Assets; iii. comply with specified limits on material risk exposures; iv. comply with specified limits on exposures to related parties; v. meet additional or more frequent and timely reporting and/or notification requirements; or vi. take or refrain from taking any other actions deemed not prudent, or that which may otherwise affect the ability of an Entity or a VASP to comply with applicable laws and regulations, or have an adverse effect on the Virtual Asset market in the UAE, as determined by VARA in its sole and absolute discretion. b. Directives shall be— i. communicated in writing by VARA to any Entity or VASP to which they relate; and/or ii. published on VARA’s website. c. Unless otherwise specified or permitted by VARA, no Entity or VASP shall publish or otherwise publicise details (in whole or in part) of any Directives not already made public by VARA, or prior to being published on VARA’s website. d. VARA may issue Directives that waive or otherwise modify the applicability, or application, of any Regulations or Rules. e. VARA may at any time amend or revoke a Directive. 4. Guidance. a. VARA may issue Guidance which is indicative and non-binding, and which may comprise any information as further elaboration or explanation on the application of these Regulations, or any Rules or Directives.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 8 b. Guidance may be incorporated into Rulebooks and/or Directives or be separately issued in another form by VARA. c. All Guidance, as may be amended from time to time, shall be identified by VARA as being indicative and non-binding. 5. Modification or waiver of Regulations, Rules, Directives and/or Guidance. VARA may at any time interpret, waive, modify or otherwise adapt any Regulations, Rules, Directives or Guidance by— a. publishing revised or new versions on its website; b. expressly announcing and/or publicising the details of such interpretation, waiver, modification or adaptation; or c. communicating the details of such interpretation, waiver, modification or adaptation specifically to any VASPs or Entities to which it applies. 6. General powers. Regulations, Rules, Directives and/or Guidance made by VARA may include some or similar contexts as below— a. make different provisions for different cases and may, in particular, make different provisions in respect of different descriptions of Virtual Assets, VA Activities or VASPs; b. make provision by reference to other Regulations, Rules, Directives or Guidance issued by VARA, as in effect from time to time; c. make provision by reference to other laws, regulations or rules made by other competent authorities, as in effect from time to time; and d. contain such incidental, supplemental, consequential and transitional provisions as may be deemed appropriate from time to time.

General requirement. Any Entity in the Emirate that issues a Virtual Asset in the course of a business, must comply with the VA Issuance Rulebook, as may be amended from time to time. B. Power to classify Virtual Assets
VARA may, in its sole and absolute discretion, classify, or otherwise provide clarification or opinion, by public notice either generally or in a specific case, on— a. any Virtual Asset, or type of Virtual Asset, as being prohibited in the Emirate; b. any Virtual Asset, or type of Virtual Asset, as being regulated by the CBUAE; or c. VARA’s interpretation, classification or regulatory treatment of any Virtual Asset or type of Virtual Asset.
Virtual Assets can be objects or rights for the purposes of the application of Federal Law No. (5) of 1985 On the Civil Transactions Law of the United Arab Emirates, as may be amended from time to time, in the Emirate. C. Prohibited Virtual Assets
The issuance of Anonymity-Enhanced Cryptocurrencies and all VA Activity(ies) related to them are prohibited in the Emirate.

General prohibition. No Entity may carry out any VA Activity by way of business, or purport to do so, in the Emirate, unless it is— a. authorised and Licensed by VARA for the VA Activity; b. an employee carrying out or otherwise facilitating a VA Activity on behalf of its employer that is Licensed by VARA; or c. an Exempt Entity.
"By way of business" requirement. For the purposes of Regulation III.A.1, VARA shall have sole and absolute discretion in determining whether an Entity carries out a VA Activity by way of business, and shall have regard to the following factors when making such determination— a. whether the Entity holds itself out as conducting a VA Activity by way of business; b. the regularity, scale and continuity of the VA Activity carried out by the Entity; and c. whether there is any commercial element in how the VA Activity is being conducted, such as whether the Entity receives remuneration or other commercial benefits or value in kind for carrying out the VA Activity.
False claims of VASP or Exempt Entity status. An Entity which, in relation to the VA Activity in question, is neither Licensed by VARA to carry out the VA Activity nor an Exempt Entity— a. must not describe itself in whatever terms as— i. a VASP or otherwise authorised or Licensed by VARA; or ii. an Exempt Entity; b. behave, or otherwise hold itself out, in a manner which indicates, or which is reasonably likely to be understood as indicating, that it is— i. a VASP or otherwise authorised or Licensed by VARA; or ii. an Exempt Entity.
UAE Central Bank. a. All VA Activities relating to UAE-CBDCs shall remain under the sole and exclusive regulatory purview of the CBUAE.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 11 b. VASPs providing VA Activities in the Emirate will need to comply with applicable CBUAE federal regulations and/or guidance, including but not limited to as they pertain to specific Virtual Assets (e.g. CBDCs and/or payment token services).

Requirement to hold a Licence. a. All Entities wishing to carry out one or more VA Activities in the Emirate must seek authorisation from VARA prior to conducting any VA Activity. b. All Entities shall apply for, obtain and maintain a Licence issued by VARA in order to be permitted to carry out each VA Activity that it will conduct in the Emirate.
Licensing process. All Entities seeking a Licence from VARA shall adhere to the licensing process as prescribed by VARA from time to time when applying for the Licence.
Requirement to meet licensing conditions. VASPs shall comply with any and all licensing conditions as communicated by VARA in its Licence or otherwise from time to time, which shall include but not be limited to compliance with all Regulations, Rules and Directives.
Activities outside of the Emirate. If a VASP carries out any VA Activity for which it is Licensed by VARA to carry out in the Emirate in any jurisdiction outside of the Emirate, it shall comply with all Regulations, Rules and Directives in respect of such VA Activity carried out in such other jurisdiction as a minimum standard. For the avoidance of doubt, VASPs are obligated to meet the higher of the two regulatory standards at all times.
Professional Exemption. a. Duly registered (i) practising lawyers; (ii) accountants; and/or (iii) other professionally licensed business consultants that carry out any VA Activity in a manner that is wholly incidental to their professional practice do not need a Licence, provided that they— i. remain at all times appropriately authorised by a competent professional body to operate in the Emirate; and ii. maintain professional indemnity insurance as applicable to their profession. ("Professional Exemption"). b. VARA has sole and absolute discretion at any time to decide whether an Entity has appropriately relied on this Professional Exemption in respect of any VA Activities it has carried out.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 13 6. Exempt Entities. a. Exempt Entities shall not be subject to the requirements in Regulations IV.A.1-4, provided that such Exempt Entities must— i. notify VARA and obtain confirmation of its Exempt Entity status; ii. in such instance, obtain a no-objection confirmation from VARA prior to carrying out any VA Activities in the Emirate; and iii. comply with all requirements of these Regulations, Rules, Directives and other conditions notified to it by VARA as a condition of providing such no-objection confirmation. b. VARA has sole and absolute discretion at any time in deciding whether an Entity is an Exempt Entity and/or granting any no-objection confirmation under Regulation IV.A.6.a above. 7. Mandatory registration for large proprietary traders. a. Any Entity in the Emirate that actively invests its own portfolio in Virtual Assets at or above USD 250,000,000 equivalent value of Virtual Assets during any rolling thirty (30) calendar days period, must register with VARA, in accordance with the registration process prescribed by VARA from time to time, prior to investing at, or in no event later than three (3) Working Days of having invested, such volume. b. Registration under Regulation IV.A.7.a does not permit any Entity to carry out any VA Activity(ies) in the Emirate and/or constitute any authorisation or Licence from VARA for any business or activities that Entity carries out and Regulations III and IV.A.1 shall apply at all times. c. An Entity investing its own portfolio does not permit accepting or trading any assets belonging to another Entity.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 14 8. Voluntary registration for other market participants. a. Any Entity seeking to obtain a commercial or free zone licence in the Emirate to carry out the following business activities may voluntarily register with VARA in accordance with the registration process prescribed by VARA from time to time— i. providers of technology services relating to or utilising Distributed Ledger Technology to other businesses; or ii. Entities that actively invest their own portfolio in Virtual Assets. b. Registration under Regulation IV.A.8.a does not permit any Entity to carry out any VA Activity(ies) in the Emirate and/or constitute any authorisation or Licence from VARA for any business activities that Entity carries out and Regulations III, IV.A.1 and IV.A.7.a shall apply at all times. 9. Critical and systemically important service providers. VARA may determine any Entity providing any services to VASPs, or other market participants in the Emirate, as critical or systemically important to the integrity and/or stability of the Virtual Assets market in the Emirate ("Critical Service Provider"). 10. For the purposes of Regulation III.A.1IV.A.9, VARA shall have the sole and absolute discretion in determining whether an Entity is a Critical Service Provider. When making such determination, VARA may consider, but is not limited to, the following factors— a. the systemic nature of the services provided by the Entity, and any likely impact on the integrity and/or stability of the Virtual Assets market in the Emirate in the event that the Entity is no longer able to provide such services; b. the systemic character or importance of the VASPs that rely on the services provided by such Entity, including but not limited to— i. the number of VASPs to whom the Entity provides services; ii. the total value of assets held or controlled by the VASPs to whom the Entity provides services; and iii. the number of clients of the VASPs to whom the Entity provides services; and c. the reliance of VASPs on the services provided by such Entity and the degree of substitutability of such services, including but not limited to, the—

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 15 i. availability of alternatives; ii. technical complexity, proprietary nature or specific features of the services; and iii. ability to fully migrate the relevant services to an available alternative. 11. Any Entity designated by VARA as a Critical Service Provider shall be subject to the direct supervision, examination and/or enforcement powers of VARA, as VARA may require, and shall be notified to such Entities, from time to time. B. VARA’s Licensing and authorisation powers

Granting of Licences. a. VARA may, in its sole and absolute discretion, grant a Licence for a VASP to carry out one or more VA Activities to which a licensing application relates, having regard to the information provided during the licensing process along with any other information VARA deems relevant. b. In respect of each granted Licence, VARA shall specify the permitted VA Activities, described in such a manner as VARA considers appropriate. c. VARA may— i. incorporate in the Licence such limitations and stipulations as it considers appropriate, for example, circumstances in which a VA Activity may, or may not, be carried out; ii. specify a narrower or wider description of a VA Activity than that to which a licensing application relates; and/or iii. grant a Licence for carrying out a VA Activity only for a specified time. d. In determining whether or not to grant a Licence, VARA may have regard to any judgment, opinion, or actions taken by any other regulator or authority, inside or outside of the Emirate, which VARA deems to be relevant to such licensing application.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 16 2. Variation, suspension or revocation of Licences. a. Power to vary, suspend or revoke Licences. VARA may, in its sole and absolute discretion— i. vary a Licence in any way, including but not limited to, by adding a VA Activity, removing a VA Activity or varying the description of a VA Activity, or by varying any limitations which apply to such Licence; ii. revoke or suspend all, or any part, of a Licence—

on any ground on which it may refuse to issue a Licence;
for a material violation of any law, Regulation, Rule or Directive;
for Good Cause;
if the VASP is Insolvent or subject to Insolvency Proceedings; or
for failure of the VASP to pay a judgment, made by any court, within or outside the UAE, within thirty (30) calendar days after the judgment becomes final or otherwise payable by the VASP. b. Suspension. In the event VARA suspends a Licence under Regulation IV.B.2.a.ii, it shall prescribe the period for which such Licence is suspended, and in turn, this shall be communicated to the VASP. Such VASP may not re-commence any VA Activity(ies) subject to such suspension without prior approval from VARA to do so, regardless of whether the period communicated has expired, unless the suspension notice from VARA explicitly provides for resumption by default upon completion of the stipulated period. c. Preservation of powers. Nothing in these Regulations shall be construed as limiting any power granted to VARA under any other provision of the Dubai VA Law, including any power to investigate possible violations of laws, Regulations, Rules or Directives, or to impose penalties, or take any other action, against any Entity for violation of such laws, Regulations, Rules or Directives.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 17 3. Imposition of further requirements by VARA. a. Where an Entity has applied to VARA for a Licence, or a variation of a Licence, VARA may impose on such Entity additional requirements as it considers appropriate including, but not limited to, in the following circumstances— i. the Entity is failing, or is likely to fail, to satisfy the licensing conditions; ii. the Entity has contravened any applicable laws, Regulations, Rules or Directives; or iii. it is desirable for VARA to exercise its power to further one or more of its objectives. 4. Authorisation and supervision fees. a. VARA may charge an Entity seeking to apply for a Licence, or any other authorisation from VARA, a fee for processing such application. If an application is denied or withdrawn, no fees shall be refunded and/or refundable. Such application fees will be applicable per application. b. Any Entity who has been granted a Licence, any other approval or is otherwise subject to supervision by VARA, will be charged applicable fees by VARA for such supervision. c. The fees set out in Schedule 2 of these Regulations, as may be amended from time to time, shall apply to all VASPs.

Rulebooks. VASPs must comply at all times with the following Rulebooks, as may be amended from time to time— a. Company Rulebook; b. Compliance and Risk Management Rulebook; c. Technology and Information Rulebook; and d. Market Conduct Rulebook.
VA Activity specific Rulebooks. In addition to the Rulebooks in Regulation V.1 above, VASPs must comply at all times with each of the following Rulebooks that correspond to the VA Activity(ies) it is Licensed to carry out, as may be amended from time to time— a. Advisory Services Rulebook; b. Broker-Dealer Services Rulebook; c. Custody Services Rulebook; d. Exchange Services Rulebook; e. Lending and Borrowing Services Rulebook; f. VA Issuance Rulebook; g. VA Management and Investment Services Rulebook; and h. VA Transfer and Settlement Services Rulebook.

These Regulations are made in recognition of Federal Decree-Law No. (20) of 2018 on Anti Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations, Federal Law No. (7) of 2014 on Combating Terrorism Offences and any other federal legislation relating to money laundering, terrorist financing, the financing of unlawful organisations or sanctions non-compliance as may be amended from time to time ("Federal AML-CFT Laws").
A reference in these Regulations to money laundering is taken to include the financing of terrorism and all other unlawful organisations, and sanctions non-compliance.
For the purposes of the Federal AML-CFT Laws, by virtue of the Dubai VA Law, VARA— a. is designated as a Supervisory Authority for the Emirate in respect of all VASPs and VA Activities; b. is responsible for regulation in relation to money laundering in the Emirate in respect of all VASPs and VA Activities; and c. has the power to supervise compliance with relevant Federal AML-CFT Laws by VASPs in the Emirate.
Nothing in these Regulations is intended to limit any function or power conferred on another body or authority under the Federal AML-CFT Laws.
Where VARA detects conduct that it suspects may relate to money laundering, it shall promptly report its suspicions to the relevant authority exercising powers and performing functions under the relevant Federal AML-CFT Laws. B. AML/CFT obligations of VASPs
VASPs must comply with all Federal AML-CFT Laws as well as all other legislation, regulatory requirements, these Regulations, Rules and Directives in respect of AML/CFT as may apply to its VA Activities, businesses or operations in any jurisdiction at all times, including but not limited

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 20 to those contained in Rulebooks and FATF recommendations as may be incorporated by VARA into its regulatory framework from time to time.

All Entities must comply with the Regulations on the Marketing of Virtual Assets and Related Activities 2024, issued by VARA, and as may be amended from time to time ("Marketing Regulations"), at all times.

For the purposes of these Regulations, Market Offences are any of the offences listed in Regulation VIII.A.2, with the exception of any Accepted Practice, when conducted in the Emirate or having an effect on the price of a Virtual Asset traded in the Emirate, whether conducted by one Entity alone or by two or more Entities jointly or in concert.
The following are Market Offences— a. Insider Dealing; b. Unlawful Disclosure; and c. Market Manipulation.
VARA may, in its sole and absolute discretion, prescribe or otherwise classify any other behaviour as being a Market Offence in addition to those listed in Regulation VIII.A.1 above from time to time and/or for any specified period of time.
By way of exception to Regulations VIII.A.1-3 above, any behaviour that has been specified as an Accepted Practice either under any of Regulations VIII.B-H or by VARA specifying such behaviour as an Accepted Practice in its sole and absolute discretion for any specified period of time, shall not amount to a Market Offence. B. Inside Information
Inside Information means information of a precise nature, which has not been made public, and which, if it were made public, would reasonably be expected to affect the price of a Virtual Asset or would affect the investment judgment of a reasonable individual in respect of a transaction involving that Virtual Asset. The information need not be the determining factor behind any given transaction, but should have a material impact on the decision of any reasonable investor as to whether to carry out such transaction ("Inside Information").
For the purposes of Regulation VIII.B.1, information shall be deemed to be of a precise nature if it indicates a set of circumstances which exists or which may reasonably be expected to come into existence, or an event which has occurred or which may reasonably be expected to occur,

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 23 where it is specific enough to enable a conclusion to be drawn as to the possible effect of that set of circumstances or event on the price of a Virtual Asset. 3. An Entity may possess Inside Information as a result of, but not limited to— a. being a member of the administrative, management or supervisory bodies of any VASP or Issuer; b. being an investor in any VASP or Issuer; c. having access to the Inside Information through any employment, profession, volunteering, contribution or duties; d. being involved in illegal or criminal activities; or e. any circumstances where the Entity knows or should reasonably have known that any information is Inside Information. C. Insider Dealing

Insider Dealing arises where an Entity possesses Inside Information and uses that information by carrying out a transaction, for its own account or for the account of a third party, directly or indirectly, in relation to a Virtual Asset to which the Inside Information relates ("Insider Dealing").
The use of Inside Information by cancelling or amending a transaction or order concerning a Virtual Asset to which the Inside Information relates, where the transaction or order was started or placed before the Entity concerned possessed the Inside Information, shall also be Insider Dealing.
Recommending, counselling, procuring or otherwise facilitating another Entity to engage in Insider Dealing, or inducing another Entity to engage in Insider Dealing arises where the Entity possesses Inside Information and it recommends, counsels or procures on the basis of that Inside Information, that another Entity— a. carry out a transaction in relation to the Virtual Asset to which that Inside Information relates, or induces that Entity to carry out such a transaction; or b. cancel or amend a transaction or order concerning a Virtual Asset to which that Inside Information relates, or induces that Entity to make such a cancellation or amendment.

Unlawful disclosure of Inside Information arises where an Entity possesses Inside Information and discloses that Inside Information to any other Entity, except where the disclosure is made in the normal exercise of an employment, a profession or duties ("Unlawful Disclosure").
For the purposes of these Regulations, the onward disclosure of recommendations or inducements amounts to Unlawful Disclosure where the Entity disclosing the recommendation or inducement knew or ought to have known that it was based on Inside Information. E. Prohibition of Insider Dealing and of Unlawful Disclosure
No Entity shall— a. engage or attempt to engage in Insider Dealing; b. recommend that another Entity engage in Insider Dealing or induce or otherwise facilitate another Entity to engage in Insider Dealing; or c. engage or attempt to engage in Unlawful Disclosure. F. Legitimate behaviour of treating Inside Information
For the purposes of Regulation VIII.E.1, where an Entity is a legal entity and not an individual, such Entity has not engaged in Insider Dealing on the basis of possessing Inside Information where that Entity— a. has established, implemented and maintained adequate and effective internal arrangements and procedures to limit access to Inside Information and prevent Insider Dealing to effectively ensure that neither the individual who made the decision on the VASP’s behalf to carry out a transaction in relation to a Virtual Asset to which the Inside Information relates, nor another individual who may have had an influence on that decision, was in possession of the Inside Information; and b. has not encouraged, made a recommendation to, induced or otherwise influenced the individual who made the decision on its behalf to carry out a transaction in relation to a Virtual Asset to which the information relates.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 25 2. For the purposes of Regulation VIII.E.1, it shall not be deemed from the mere fact that an Entity is in possession of Inside Information that such Entity has used that Inside Information and has engaged in Insider Dealing on the basis of a transaction where that Entity— a. for the Virtual Asset to which that Inside Information relates, is a market maker or an Entity authorised to act as a counterparty, and the transaction in relation to the Virtual Asset to which the Inside Information relates is made legitimately in the normal course of the exercise of its function as a market maker or as a counterparty for that Virtual Asset; or b. is authorised to execute orders on behalf of third parties, and the transaction in relation to the Virtual Assets to which the order relates, is made to carry out such an order legitimately in the normal course of the exercise of that Entity’s employment, profession or duties. 3. For the purposes of Regulation VIII.E.1, it shall not be deemed from the mere fact that an Entity is in possession of Inside Information that such Entity has engaged in Insider Dealing on the basis of a transaction where that Entity conducts a transaction and that transaction is carried out in the discharge of an obligation that has become due in good faith and not to circumvent the prohibition against Insider Dealing and— a. that obligation results from an order placed or an agreement concluded before the Entity concerned possessed Inside Information; or b. that transaction is carried out to satisfy a legal or regulatory obligation that arose before the Entity concerned possessed Inside Information. G. Market Sounding

Market Sounding comprises the communication of information, prior to the announcement of a transaction in Virtual Assets, in order to gauge the interest of potential investors in a possible transaction in Virtual Assets and the conditions relating to it such as its potential size or pricing, to one or more potential investors in those Virtual Assets by— a. an Issuer;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 26 b. a secondary offeror of a Virtual Asset, in such quantity or value that the transaction is distinct from ordinary trading and involves a selling method based on the prior assessment of potential interest from potential investors; or c. a VASP or other third party acting on behalf or on the account of an Entity referred to in Regulation VIII.G.1.a or b ("Market Sounding"). 2. A disclosing Entity shall, prior to conducting the Market Sounding, specifically consider whether the Market Sounding will involve the disclosure of Inside Information. The disclosing Entity shall make a written record of its conclusion and the relevant reasons. It shall provide such written records to VARA upon request. This obligation shall apply to each disclosure of information throughout the course of the Market Sounding. The disclosing Entity shall keep the written records referred to in this Regulation VIII.G.2 up-to-date and in any event update them weekly. 3. A disclosing Entity shall, before making the disclosure— a. obtain the consent of the Entity receiving the Market Sounding to receive the information; b. inform the Entity receiving the Market Sounding that it is prohibited from using that information, or attempting to use that information, by acquiring or disposing of, for its own account or for the account of a third party, directly or indirectly, Virtual Assets relating to that information; c. inform the Entity receiving the Market Sounding that it is prohibited from using that information, or attempting to use that information, by cancelling or amending an order which has already been placed concerning a Virtual Asset to which the information relates; and d. inform the Entity receiving the Market Sounding that by agreeing to receive the information it is obliged to keep the information confidential. 4. The disclosing Entity shall make and maintain a record of all information given to Entities receiving the Market Sounding, including the information given in accordance with Regulation VIII.G.3, and the identity of the potential investors to whom the information has been disclosed, including but not limited to the Entity and the date and time of each disclosure. The disclosing Entity shall provide such record to VARA upon request.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 27 5. Where information that has been disclosed in the course of a Market Sounding ceases to be Inside Information according to the assessment of the disclosing Entity, the disclosing Entity shall inform the recipient accordingly, as soon as possible. 6. Any Entity receiving a Market Sounding shall assess for itself whether it is in possession of Inside Information or when it ceases to be in possession of Inside Information. 7. The disclosing Entity shall keep the records referred to in this Regulation VIII.G for a period of at least eight (8) years. H. Market Manipulation

Market Manipulation shall comprise the following activities, with the exception of any Accepted Practice— a. entering into a transaction, placing an order to trade or any other behaviour which— i. gives, or is likely to give, false or misleading signals as to the supply of, demand for or price of a Virtual Asset; or ii. secures, or is likely to secure, the price of one or several Virtual Assets at an abnormal or artificial level; b. entering into a transaction, placing an order to trade or any other activity or behaviour which affects or is likely to affect the price of one or several Virtual Assets, which employs a fictitious device or any other form of deception or contrivance; c. disseminating information through the media, which gives, or is likely to give, false or misleading signals as to the supply of, demand for, or price of a Virtual Asset, or is likely to secure the price of one or several Virtual Assets at an abnormal or artificial level, including the dissemination of rumours where the Entity who made the dissemination knew, or ought to have known, that the information was false or misleading; d. transmitting false or misleading information or providing false or misleading inputs in relation to a benchmark where the Entity who made the transmission or provided the input knew or ought to have known that it was false or misleading, or any other behaviour which manipulates the calculation of a benchmark;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 28 e. the conduct by an Entity, or Entities acting in collaboration, to inflate the price of a Virtual Asset by securing a dominant position over the supply of or demand for a Virtual Asset; f. the buying or selling of Virtual Assets at a particular point in time in the trading or settlement cycle of any given Virtual Asset so as to have the effect of misleading investors acting on the basis of the prices displayed; g. the placing of orders on a trading venue operated by a VASP providing Exchange Services or other organised market for Virtual Assets, including any cancellation or modification thereof, by any available means of trading, including by electronic means, which has one of the effects referred to in this Regulation VIII.H.1— i. disrupting or delaying the functioning of the trading system of the trading venue or being likely to do so; ii. making it more difficult for other Entities to identify genuine orders on the trading system of the trading venue or being likely to do so, including by entering orders which result in the overloading or destabilisation of the order book; or iii. creating or being likely to create a false or misleading signal about the supply of, or demand for, or price of, a Virtual Asset, in particular by entering orders to initiate or exacerbate a trend; h. taking advantage of occasional or regular access to the traditional or electronic media by voicing an opinion about a Virtual Asset (or indirectly about its Issuer) whilst having previously taken positions on that Virtual Asset and profiting subsequently from the impact of the opinions voiced on the price of that Virtual Asset without having simultaneously disclosed that conflict of interest to the public in a proper and effective way; i. omission or failure to take any action which would correct any activities listed in Regulations VIII.H.1.a-h; and j. distributing, maintaining, or otherwise making available to others any software, algorithm, or other computer programme designed to carry out any of the activities

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 29 listed in Regulations VIII.H.1.a-h with the exception of any Accepted Practice ("Market Manipulation"). 2. Where the Entity referred to in Regulation VIII.H.1 is a legal entity, the Regulation shall also apply to the individual(s) who participate in the decision to carry out activities for the account of the legal entity concerned. 3. By way of exception to Regulation VIII.H.1, Accepted Practices shall include, but not be limited to, the following, which shall not amount to Market Manipulation— a. entering into a lending, borrowing, repurchase or reverse repurchase transaction in respect of a Virtual Asset for legitimate trading purposes which does not disrupt the fair and orderly functioning of any market involving Virtual Assets and without any intention to do so; b. entering into a transaction involving the provision of a Virtual Asset as collateral that is not designed to have any of the effects described in Regulation VIII.H.1.g; c. entering into a transaction in a Virtual Asset for the purposes of satisfying a prior legal or regulatory obligation, provided that (where that commitment was created under contract) the obligation entered into does not disrupt the fair and orderly functioning of any market involving Virtual Assets and without any intention to do so; and d. use of an algorithmic or high-frequency trading strategy that is not designed to have any of the effects described in Regulation VIII.H.1.g and which has been designed and implemented in such a way as to not disrupt the fair and orderly functioning of any market involving Virtual Assets and without any intention to do so. I. Prohibition of Market Manipulation

No Entity shall engage in or attempt to engage in Market Manipulation in the Emirate. J. Prevention and detection of Market Offences
VASPs shall establish and maintain effective arrangements, systems and procedures aimed at preventing and detecting Market Offences or attempted Market Offences.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 30 2. VASPs shall report transactions, orders or activities to the UAE FIU and to VARA where the VASP has a reasonable suspicion that such transactions, orders or activities in any Virtual Asset, whether placed or executed on or outside a trading venue operated by a VASP providing Exchange Services, or other organised market for Virtual Assets, could constitute a Market Offence, an attempted Market Offence or any other unfair practice detrimental to the fair and orderly functioning of any market involving Virtual Assets. 3. When reporting suspicious transactions, orders or activities, VASPs shall include— a. the name of the Virtual Asset that may be impacted by suspicious transactions, orders or activities; b. the identity of any Entities involved; c. specific dates and times of the suspicious transactions, orders or activities; d. an explanation of reasons for believing that a Market Offence or any other unfair practice has been committed; e. all other information required by the UAE FIU; and f. all additional information reasonably requested by VARA, or the UAE FIU, in order to make an accurate assessment. 4. VASPs shall make all relevant data in their possession available to VARA for inspection on request.

All Entities are subject to investigation and/or examination by VARA at any time or in any way deemed necessary by VARA for the purposes of exercising its powers, performing its functions, or fulfilling its objectives under the Dubai VA Law.
All Entities shall co-operate with VARA during any investigation and/or examination and must provide VARA with all books and records requested by VARA to facilitate any investigation and/or examination.
VASPs and Issuers remain subject to Regulations, Marketing Regulations, Rules and Directives for a period of ten (10) years following the date that it is no longer regulated by VARA. B. Examination
All Entities shall allow and assist VARA to examine the Entity whenever in VARA’s judgment such examination is necessary or advisable for the purposes of exercising its powers, performing its functions or fulfilling its objectives under the Dubai VA Law.
VASPs and Issuers shall ensure, without limitation, that VARA is able to determine— a. the financial condition of the VASP or Issuer; b. the safety and soundness of the conduct of its business, VA Activities or Virtual Asset; c. all management and/or operational policies of the VASP or Issuer; d. whether the VASP or Issuer has complied with the requirements of all applicable laws, Regulations, Marketing Regulations, Rules and Directives; and e. such other matters as determined by VARA which may affect a VASP’s conduct of VA Activities and/or compliance with its licensing conditions.
VASPs and Issuers shall allow and assist VARA in any investigations as it shall deem necessary to determine whether a VASP or Issuer has violated any applicable laws, Regulations, Marketing Regulations, Rules or Directives and, to the extent necessary, shall allow and assist VARA to examine all relevant data, facilities, books, records, accounts, documents and other information.
VASPs and Issuers shall ensure they have all necessary consent of their clients to report information for transactions over which VARA has jurisdiction.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 32 5. For the purpose of determining the financial condition of the VASP or Issuer, its safety and soundness practices, or whether it has complied with the requirements of all applicable laws, Regulations, Marketing Regulations, Rules and Directives, VASPs and Issuers shall assist VARA, when in VARA’s judgment it is necessary or advisable, to examine an affiliate of the VASP or Issuer. 6. VASPs and Issuers shall provide or produce information or documents requested by VARA— a. before the end of such period as may be specified in the relevant notice issued by VARA, unless the VASP or Issuer demonstrates to VARA’s satisfaction that such period is unreasonable; and b. through such means as may be specified in the notice. 7. VARA may require any information or documents provided by a VASP or Issuer to be verified or authenticated in such manner as VARA requires. C. Enforcement, fines and penalties

VARA may, in its sole and absolute discretion, take enforcement actions against any Entity in the event of any of the following— a. for violation of any law (including the Dubai VA Law and Federal AML-CFT Laws); b. for any violation of these Regulations, Marketing Regulations, Rules or Directives; c. on any ground on which VARA might refuse to issue a Licence under these Regulations; d. for Good Cause; e. on any ground which VARA deems to have a negative impact on the reputation of the UAE, the Emirate or VARA's reputation as a competent regulator; and f. other grounds determined by VARA in exercising its powers, performing its functions or fulfilling its objectives under the Dubai VA Law.
Such enforcement actions may include but are not limited to— a. issuing written reprimands; b. issuing enforcement notices requiring non-compliance to be rectified within a specified period of time;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 33 c. issuing a notification to cease and desist from undertaking or continuing any and all activities associated with the violation of these Regulations, Marketing Regulations, Rules or Directives; d. limiting or revising the scope of any Virtual Assets or VA Activities under a Licence; e. suspending or revoking a Licence and/or VARA approvals, or any commercial trade licence(s) in coordination with the competent authority; f. requiring a VASP or Entity to immediately cease or suspend any VA Activity, Marketing or other business activity, either for a specified or indefinite period of time; g. requiring any Entity to stop or refrain from doing or continuing to do any acts and seek a preliminary injunction or other legal means when necessary to restrain such Entity, when deemed by VARA to be in the public interest; h. requiring any Entity to issue a public statement admitting that it has violated any Regulations, Marketing Regulations, Rules or Directives; i. requiring any Entity to announce the suspension of any and all activities associated with the violation of these Regulations, Marketing Regulations, Rules or Directives to the public as soon as practicable, and clearly stating non-compliance with these Regulations, Marketing Regulations, Rules or Directives as the reason for such suspension in the body of the announcement; j. imposing fines or other civil penalties in accordance with Schedule 3 of these Regulations and/or Schedule 1 of the Marketing Regulations, or otherwise published by VARA from time to time; k. undertaking additional supervision, monitoring or reporting requirements; and l. any other enforcement action determined by VARA. 3. VARA may impose fines, civil penalties or other enforcement actions directly against the Responsible Individuals of a VASP. 4. VARA will consider the full circumstances of each case when determining whether or not to issue a fine and the amount thereof. VARA may do this either in conjunction with, or independently

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 34 of, any other type of enforcement action as set out in Regulation IX.C.2. The types of factors which will be evaluated include— a. the nature, seriousness and impact of the violation; b. whether any action constitutes a violation of a Market Offence; c. the conduct of the Entity after the violation and throughout any investigation or examination by VARA; d. the previous disciplinary record and compliance history of the Entity or relevant individual(s), and in particular whether the case involves a first-time violation under No. 3 or No. 4 of Schedule 3 of these Regulations (in which case VARA reserves the right to consider not issuing an immediate fine, and instead mandate effective remedial action to address the impact of the violation); e. the interpretation and application of VARA published materials including Guidance, industry codes and other such materials as may be published from time to time; and f. any action taken by VARA or by other domestic or international regulatory bodies in similar cases. 5. In the event of an Entity's continued violation of these Regulations, Marketing Regulations, Rules, Directives and/or Licence conditions, VARA may, in its sole and absolute discretion, impose periodic penalties on the Entity in addition to any fine and/or any other enforcement action(s) imposed in respect of such violation. The amount and frequency of such periodic penalties shall be determined by VARA, with reference to the full circumstances of each case and its assessment of all factors which VARA may consider to be relevant, including but not limited to factors set out in Regulation IX.C.4. 6. Grievances. VARA may establish a committee or other body to hear grievances or complaints in respect of any enforcement action it has taken, the details of which shall be published by VARA from time to time.

All Entities must keep confidential all information relating to the operations, business or other affairs of VARA, including but not limited to all communication and correspondence with VARA and any investigations, enforcement or other actions by VARA, unless or until— a. such information is released into the public domain either by— i. VARA; or ii. an Entity without being in contravention of this Regulation X.A.1 or any other duty of confidentiality howsoever established; or b. VARA has given explicit written consent to the disclosure of such information.
All Entities must ensure that any Entity, including any employees, contractors, service providers or any other individuals howsoever engaged, who has access to such information are subject to the same or stricter obligations of confidentiality as specified in Regulation X.A.1.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 36 Schedule 1 – VA Activities VA Activity Definition "Advisory Services" means offering, providing or agreeing to provide a personal recommendation* to a client, either upon its request, or on the initiative of the Entity providing the recommendation, in respect of one or more actions or transactions relating to any Virtual Assets. *When providing a personal recommendation, the Entity providing the recommendation shall consider the following factors at a minimum in respect of each client— (a) knowledge and experience in investing in Virtual Assets; (b) investment objectives including, but not limited to, risk tolerance, time horizon and venues through which they can acquire Virtual Assets; and (c) financial circumstances including, but not limited to, their ability to bear sudden and significant losses or proportion of their net worth invested in Virtual Assets. "Broker-Dealer Services" means any of the following— (a) arranging orders for the purchase and sale of Virtual Assets between two Entities; (b) soliciting or accepting orders for Virtual Assets and accepting fiat currency, or other Virtual Assets, for such orders; (c) facilitating the matching of transactions in Virtual Assets between buyers and sellers; (d) entering into Virtual Asset transactions as a dealer on behalf of the Entity for its own account; (e) making a market in Virtual Assets using client assets; or

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 37 VA Activity Definition (f) providing placement, distribution or other issuance* related services to clients issuing Virtual Assets. As per Regulation II, any Entity in the Emirate that issues a Virtual Asset in the course of a business, must comply with the VA Issuance Rulebook, as may be amended from time to time. "Category 1 VA Issuance" has the meaning ascribed to it in the VA Issuance Rulebook. "Custody Services" means safekeeping Virtual Assets for or on behalf of another Entity and acting only on verified instructions from or on behalf of such Entity. *All VASPs shall be subject to Rules regarding the storage and custody of clients’ Virtual Assets. Only VASPs which segregate each client’s assets in separate VA Wallets will qualify for a Custody Services Licence, or as otherwise permitted in the Custody Services Rulebook. "Exchange Services" means any of the following— (a) conducting an exchange, trade or conversion between Virtual Assets and fiat currency; (b) conducting an exchange, trade or conversion between one or more Virtual Assets; (c) matching orders between buyers and sellers and conducting an exchange, trade or conversion between (i) Virtual Assets and fiat currency or (ii) one or more Virtual Assets; or (d) maintaining an order book in furtherance of (a), (b) or (c) above. "Lending and Borrowing Services" means carrying out a contract under which a Virtual Asset shall be transferred or lent from one or more parties (the "Lender(s)") to one or more other parties (the "Borrower(s)") where the

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 38 VA Activity Definition Borrower(s) shall commit to return the same, at the request of the Lender(s), at any time either during or at the end of the period agreed upon. "VA Management and Investment Services" means acting on behalf of an Entity as an agent, or fiduciary, or otherwise taking responsibility for the management, administration or disposition of that Entity’s Virtual Assets. Examples may include, but shall not be limited to— (a) investment management services or otherwise managing Virtual Assets; and (b) taking responsibility for the staking of Virtual Assets for the purposes of earning fees or other amounts paid to validators and/or node operators of a proof-of-stake Distributed Ledger Technology. "VA Transfer and Settlement Services" means the transmission or transfer, and/or settlement of Virtual Assets from one Entity to another Entity or from one Entity to another VA Wallet, address or location.

The fees set out in the table below are applicable to all Licence applications and VASPs: VA Activity Licence Application Fee (for one regulated VA Activity only) Licence Extension Fee (for each additional regulated VA Activity) Annual Supervision Fee (for each regulated VA Activity) Advisory Services AED 40,000 50% of lower Licence Application Fee(s) AED 80,000 Broker-Dealer Services AED 100,000 AED 200,000 Category 1 VA Issuance AED 100,000 AED 200,000 Custody Services AED 100,000 AED 200,000 Exchange Services AED 100,000 AED 200,000 Lending and Borrowing Services AED 100,000 AED 200,000 VA Management and Investment Services AED 100,000 AED 200,000 VA Transfer and Settlement Services AED 40,000 AED 80,000
The Licence Application Fee is payable for all Licence applications for any regulated VA Activity. Where an Entity is applying for a Licence for more than one regulated VA Activity, the Licence

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 40 Extension Fee is payable for each additional VA Activity. These fees are only due at the time of submission of the Licence application. The application will not be processed until the payment of these fees is received. 3. VASPs must pay an Annual Supervision Fee for each VA Activity Licensed, in advance of conducting VA Activity(ies). 4. VARA may, in its sole and absolute discretion, impose additional supervision fees, or otherwise modify supervision and authorisation fees, based upon a VASP's risk profile, which may include, but not be limited to, consideration by VARA of the following— a. a VASP's market share; b. a VASP's target market and/or client base; c. the complexity of a VASP's business model and/or products; d. a VASP's history of compliance and regulatory track record; and e. circumstances where VARA considers it necessary to allocate additional resources for regulatory oversight or supervision or in response to complaints made to VARA about a VASP. 5. Any fees charged by VARA are separate from, and independent of, any fees which may be charged by any other competent authority, either in or outside of the UAE. 6. VARA may, in its sole and absolute discretion, impose a fee for applications by prospective Issuers for approval to issue a Virtual Asset and/or for VASPs Licensed for Category 1 VA Issuance submitting Whitepapers to VARA.

In accordance with Regulation IX.C, VARA has the sole and absolute discretion to issue fines against any Entity and determine the amounts thereof.
The following table, and Schedule 1 of the Marketing Regulations, set out the nature and indicative amounts of fines that VARA may impose on any Entity for violations of these Regulations, Marketing Regulations, Rules, Directives or Licence conditions (as may be applicable), but which shall be determined by VARA in accordance with applicable local and federal laws (including but not limited to Cabinet Resolution No. (99) of 2024 Concerning the List of Violations and Administrative Penalties for Acts Violating the Provisions of Cabinet Resolution No. (111) of 2022 Regulating Virtual Assets and its Service Providers) and by reference to its assessment of all relevant factors, including those set out in Regulation IX.C. Fines issued by VARA are exclusive of any fines, penalties or damages which may be imposed by other competent authorities including competent courts.
VARA may amend the grounds for issuance and/or amount of the indicative fines set out in this Schedule 3 and/or Schedule 1 of the Marketing Regulations, including adding new categories of fines, by amendment to these Regulations, the Marketing Regulations, or by Directive at any time. No. Nature of Violation / Ground(s) for Issuance of Fine Indicative Fine Amount per Violation (AED)
Violation of AML/CFT and "know your customer" requirements (including, but not limited to, CDD) in— (a) Regulations and/or Directives by any Entity (including, but not limited to, VASPs); or (b) Rules (including, but not limited to, Part III of the Compliance and Risk Rulebook) by any VASP. To be determined in accordance with applicable local and federal laws.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 42 No. Nature of Violation / Ground(s) for Issuance of Fine Indicative Fine Amount per Violation (AED) 2. Violation of— (a) Rules in the Compliance and Risk Management Rulebook (not covered in No. 1 above) or Market Conduct Rulebook by any Entity; or (b) Regulations and/or Directives related to Market Offences by any Entity (including, but not limited to, VASPs). Any of the following— (a) for any individual, up to the higher of (i) AED 20,000,000, or (ii) 200% of the profits gained or losses avoided; or (b) for any corporate Entity, up to the higher of (i) AED 50,000,000, (ii) 15% annual revenue of the corporate Entity, or (iii) 300% of the profits gained or losses avoided (if greater than (b)(i) or (b)(ii)). 3. Violation of Regulations, Rules or Directives not covered in No. 1 or No. 2 above by any Entity. 4. Issuance of a fine against any Entity pursuant to Regulations IX.C.1 and IX.C.2 on the basis of any of the following non-exhaustive grounds— (a) any Entity carrying out VA Activity(ies) in violation of Regulation III.A.1 (e.g. without being authorised and Licensed by VARA); (b) any Entity issuing a Virtual Asset in violation of Regulation II.A.1; (c) any Entity in violation of the mandatory registration requirement in Regulation IV.A.7;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 43 No. Nature of Violation / Ground(s) for Issuance of Fine Indicative Fine Amount per Violation (AED) (d) any Entity misrepresenting to any member of the public (i) any relationship or engagement with VARA, or (ii) such Entity’s ability to unduly influence or accelerate the licensing process (including, but not limited to, any violation of Regulation X); and/or (e) any Entity in violation of any Ultimate Beneficial Owner (UBO) disclosure requirements in Regulations, Rules and/or Directives. 5. Non-payment of fine within any timeframe specified by VARA. Further fine to be issued, the amount of which shall accrue from when a fine is due at 1% per month (rounded up to the nearest full month) for any unpaid amounts of the fine on a compounding basis, until the initial fine and the further fine are paid in full. 4. In assessing whether to issue a fine against an individual, VARA shall, in its sole and absolute discretion, consider the following— a. the materiality and severity of the violation (including, but not limited to, violation of a Regulation, Marketing Regulation, Rule and/or Directive by an Entity which the individual is employed by); b. the materiality and severity of the individual’s failure to adequately manage responsibilities, obligations and/or functions relevant to their roles as stipulated in the Rulebooks;

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 44 c. whether the individual acted reasonably in accordance with the VASP’s internal policies; d. whether the individual acted with wilful negligence of their and/or the VASP’s responsibilities under any Regulation, Marketing Regulation, Rule and/or Directive; e. to the extent applicable, factors set out in Regulation IX.C.4; and f. all other factors which VARA may consider to be relevant. 5. Notwithstanding No. 5 in the above table of this Schedule 3, if a fine issued pursuant to these Regulations is not paid by an Entity within the timeframe specified by VARA, VARA may, in its sole and absolute discretion, take any further action necessary to recover payment including, but not limited to, taking further enforcement action(s) and/or referring the matter to any law enforcement agencies and competent courts.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 45 Schedule 4 – Definitions Term Definition "Accepted Practice" means any behaviour that does not amount to a Market Offence as a result of being specified as an accepted practice either under any of Regulations VIII.B-H or by VARA acting in its sole and absolute discretion under Regulation VIII.A. "AML/CFT" means anti-money laundering, combating the financing of terrorism, counter proliferation financing and financial sanctions compliance. "Anonymity-Enhanced Cryptocurrencies" means a type of Virtual Asset which prevents the tracing of transactions or record of ownership through distributed public ledgers and for which the VASP has no mitigating technologies or mechanisms to allow traceability or identification of ownership. "CBDC" means a central bank digital currency. "CBUAE" means the Central Bank of the United Arab Emirates. "CDD" has the meaning ascribed to it in the Compliance and Risk Management Rulebook. "Company Rulebook" means the Company Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "Compliance and Risk Management Rulebook" means the Compliance and Risk Management Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "Critical Service Provider" has the meaning ascribed to it in Regulation IV.A.9. "Directive" means a directive issued by VARA under these Regulations which shall have binding effect and shall, if required, attach a penalty determined and imposed by VARA in its sole discretion. "Distributed Ledger Technology" or "DLT" has the meaning ascribed to the term "Distributed Ledger Technology" in the Dubai VA Law.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 46 Term Definition "Dubai VA Law" means Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai, as may be amended from time to time. "DWTCA" means the Dubai World Trade Centre Authority. "Emirate" means all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre. "Entity" means any legal entity or individual. "Exempt Entity" means— (a) an Entity of the federal government of the UAE and/or the government of Dubai; and (b) all public, non-profit, not-for-profit and charitable Entities of any Entity described in (a) above. "FATF" means the Financial Action Task Force. "Federal AML-CFT Laws" means all UAE federal government legislation relating to AML/CFT, the financing of unlawful organisations or sanctions non-compliance as may be in force from time to time, including all executive regulations, cabinet resolutions or cabinet decisions relating to the same, as may be amended from time to time, including but not limited to— (a) Cabinet Resolution No. (24) of 2022 Amending certain Provisions of Cabinet Resolution No. (10) of 2019 Issuing the Executive Regulations of Federal Decree-Law No. (20) of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations; (b) Cabinet Resolution No. (10) of 2019 Issuing the Executive Regulations of Federal Decree-Law No. (20) of 2018 on

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 47 Term Definition Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations; (c) Federal Decree-Law No. (26) of 2021 Amending Some Provisions of Federal Decree-Law No. (20) of 2018 on AntiMoney Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations; (d) Federal Decree-Law No. (20) of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations and its executive regulations, as may be amended from time to time; and (e) Cabinet Decision No. (74) of 2020 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions on the Suppression and Combating of Terrorism, Terrorist Financing, Countering the Proliferation of Weapons of Mass Destruction and its Financing and Relevant Resolutions. "Good Cause" means, in VARA’s sole and absolute discretion, where an Entity has defaulted or is likely to default in performing its obligations or financial engagements, or engages in unlawful, dishonest, wrongful or inequitable conduct, or practices that may cause harm to the public. "Guidance" means any Guidance issued by VARA under these Regulations which is indicative and does not have binding effect. "Inside Information" has the meaning ascribed to it in Regulation VIII.B.1. "Insider Dealing" has the meaning ascribed to it in Regulation VIII.C.1. "Insolvency Proceedings" means any legal proceedings or other procedure taken in relation to—

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 48 Term Definition (a) the suspension of payments, a moratorium of any indebtedness, winding up, receivership, bankruptcy, dissolution, administration or reorganisation (by way of voluntary arrangement, scheme of arrangement or otherwise); (b) the appointment of a liquidator, receiver, administrator, compulsory manager, trustee or similar officer in respect of an Entity and/or its assets; (c) enforcement of any security over any asset of an Entity; or (d) any analogous procedure or step is taken in any jurisdiction. Except that, the above shall not apply to any winding up petition which is frivolous or vexatious and is discharged or stayed or dismissed with fourteen (14) calendar days of commencement. "Insolvent" means— (a) the Entity— i. is unable to pay debts as they fall due; ii. is deemed to, or is declared to, be unable to pay its debts under applicable law; iii. suspends or threatens to suspend making payments on any of its debts; or iv. by reason of actual or anticipated financial difficulties, commences negotiations with one or more creditors with a view to rescheduling its indebtedness; (b) the value of the assets of the Entity is less than its liabilities taking into account contingent and prospective liabilities; or

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 49 Term Definition (c) a moratorium is declared in respect of the indebtedness of an Entity. "Issuer" means the Entity responsible for the issuance of a Virtual Asset. "Licence" means a licence granted by VARA to an Entity under which VARA explicitly authorises such Entity to carry out one or more VA Activity(ies) in the Emirate. "Licensed" means having a valid Licence. "Market Conduct Rulebook" means the Market Conduct Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "Market Manipulation" has the meaning ascribed to it in Regulation VIII.H.1. "Market Offences" has the meaning ascribed to it in Regulation VIII.A.1. "Market Sounding" has the meaning ascribed to it in Regulation VIII.G.1. "Marketing" has the meaning ascribed to it in Marketing Regulation I.A.1. "Marketing Regulations" has the meaning ascribed to it in Regulation VII.A.1. "Professional Exemption" has the meaning ascribed to it in Regulation IV.A.5. "Regulations" means these Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time. "Responsible Individuals" has the meaning ascribed to it in the Company Rulebook. "Rule" means a rule issued by VARA under these Regulations which have binding effect. "Rulebook" means a rulebook issued by VARA containing Rules and/or Guidance, as may be amended from time to time. "Supervisory Authority" has the meaning ascribed to it in the Federal Decree-Law No. (20) of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations. "Technology and Information Rulebook" means the Technology and Information Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time.

ae.vara@varaconnectصندوق بريد: 9292 دبي، اإلمارات العربية المتحدة - سُلطة تنظيم األصول االفتراضية varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 50 Term Definition "UAE" means the United Arab Emirates. "UAE-CBDC" means any digital currency issued by the CBUAE. "UAE FIU" means the UAE Financial Intelligence Unit. "Ultimate Beneficial Owner" or "UBO" has the meaning ascribed to it in the Company Rulebook. "Unlawful Disclosure" has the meaning ascribed to it in Regulation VIII.D.1. "VA Activity" means the activities listed in Schedule 1 of these Regulations, as may be amended from time to time. "VA Issuance Rulebook" means the Virtual Asset Issuance Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "VARA" means the Dubai Virtual Assets Regulatory Authority. "VASP" means an Entity Licensed by VARA to carry out VA Activity(ies) in the Emirate. "Virtual Asset" or "VA" has the meaning ascribed to it in the Dubai VA Law. "VA Wallet" has the meaning ascribed to the term "Virtual Asset Wallet" in the Dubai VA Law. "Whitepaper" has the meaning ascribed to it in the VA Issuance Rulebook. "Working Day" means any day which is not a weekend or public holiday in the Emirate.