- Home
- VARA compliance (Dubai)
Jurisdiction · Dubai, UAE
VARA compliance in Dubai: regulation, rulebooks and where a legal opinion fits
Dubai's Virtual Assets Regulatory Authority licenses virtual-asset activity under a per-activity rulebook regime, and it is the jurisdiction LEXI's V0 covers on Base Sepolia (testnet). This page sets out how VARA regulation is built, what the Virtual Asset Issuance Rulebook asks of each issuance track, and where a licensed lawyer's legal opinion appears. LEXI is not licensed or endorsed by VARA.
LEXI is not a law firm. A credential is not a licence, a registration, or an approval by any regulator. This page is general information, checked at source on 16 October 2026, not legal advice.
Page last reviewed:
VARA regulation
One regulator, eight activities, licensed activity by activity.
VARA, the Virtual Assets Regulatory Authority, is Dubai's virtual-asset regulator. In its own words it is the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of Dubai International Financial Centre (DIFC)
. It licenses virtual asset service providers per activity under a rulebook regime, and its Virtual Asset Issuance Rulebook (19 May 2025 edition) sorts token issuances into Category 1, Category 2 and Exempt tracks. On LEXI, a licensed lawyer's co-signed legal opinion on a VARA question becomes a dated, scope-bound credential on Base; V0 runs on Base Sepolia (testnet), mainnet is targeted post-audit, Q4 2026, and a credential is not a licence, a registration, or an approval by VARA.
VARA's Virtual Assets and Related Activities Regulations 2023 were first issued on 7 February 2023; the current 19 May 2025 edition is effective from 19 June 2025 per the rulebook site. VARA's licensing page says a VASP must apply for and receive a licence from VARA before undertaking VA activities in Dubai
, and that a VASP may be licensed for several activities and aggregate them under a single overarching licence, Custody Services excepted. The eight VA Activities are Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, Management and Investment Services, Transfer and Settlement Services, and VA Issuance (Category 1). A custodian must be a distinct legal entity with a standalone licence.
Each licensed activity carries its own activity rulebook, and every VASP is bound by the compulsory rulebooks (Company, Compliance and Risk Management, Technology and Information, Market Conduct). The Exchange Services Rulebook was re-issued effective 31 March 2026, with a Part V on exchange-traded derivative services. VARA keeps a public revision feed for every rulebook, which is why a legal opinion on a VARA question speaks as of a date: the text it read may change after it is signed. The as-of date is one of the fields a LEXI credential carries on-chain.
Marketing is regulated separately. VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024 (current version 1 October 2024) apply to Marketing in or targeting the UAE
(Regulation I.B.1, as VARA's own marketing guidance reads it), whether or not the marketer is licensed by VARA.
Fig. 01 VARA's regime as read at vara.ae and rulebooks.vara.ae on 16 October 2026. The register changes; every citation on this page is dated.
The Issuance Rulebook
Three issuance tracks, and where a legal opinion appears.
The Virtual Asset Issuance Rulebook (19 May 2025 edition; the rulebook site shows it effective from 19 June 2025) sorts every issuance by an entity in the Emirate into one of three tracks under Rule I.C.1. Only one of them, and only one annex of it, asks for a legal opinion at all.
| Track | What it covers | Prior requirement | Where a legal opinion appears |
|---|---|---|---|
| Category 1 | Fiat-Referenced Virtual Assets (FRVAs), Asset-Referenced Virtual Assets (ARVAs), and other virtual assets VARA may determine. | A VARA licence for Category 1 VA Issuance (Rule I.D.1), plus VARA's prior approval of each FRVA or ARVA it issues (Annex 1 Rule I.B.2; Annex 2 Part I). | Annex 2 (ARVAs): a legal opinion may be required (Rule III.B.2) and shall be required from issuers holding Reserve Assets (Rule III.C.4). Annex 1 (FRVAs): no legal-opinion rule. |
| Category 2 | Any virtual asset that is neither a Category 1 issuance nor an Exempt VA. | No VARA licence and no VARA approval, provided all placement and distribution is carried out by a Licensed Distributor (Rule I.E.1). | None prescribed by the rulebook. The Licensed Distributor's due-diligence duty is open-ended, so a scoped opinion can sit in its file. |
| Exempt VAs | Non-Transferable Virtual Assets, Redeemable Closed-Loop Virtual Assets, and others VARA may determine. | No requirements prior to issuance. | None prescribed. |
Fig. 02 Rule I.C.1 of the Virtual Asset Issuance Rulebook, read at rulebooks.vara.ae on 16 October 2026. Which track an asset falls into is a question for counsel, not a conclusion this page gives.
Category 1: licence, Whitepaper approval, and for ARVAs a legal opinion
A Category 1 issuer holds a VARA licence for the activity of VA Issuance and obtains VARA's prior approval of each asset before issuing it (Annex 1 Rule I.B.2). Annex 1 adds rules for FRVAs; its assurance tools are independent audits and attestations, not legal opinions. Annex 2 adds rules for ARVAs, and this is where the rulebook names a signer: VASPs licensed to issue ARVAs may be required to provide VARA with a legal opinion (Rule III.B.2), and shall be required to provide one confirming compliance with the Reserve Asset segregation and protection rule, Rule III.C.3, where they hold Reserve Assets (Rule III.C.4).
VARA's Guidance on the Virtual Asset Issuance Rulebook (9 April 2026) says a legal opinion given to VARA on an asset-referenced virtual asset issuance must be prepared and signed by a duly registered practising lawyer, not the issuer's in-house counsel. The guidance also asks for that opinion to be dated, signed and issued on the firm's letterhead, and for a revised or supplemental opinion on any material change. The guidance describes itself as indicative and not a substitute for the Regulations, Rulebooks, Directives or independent legal advice
. A LEXI credential is not a filing with VARA and is not designed to satisfy Annex 2.
Category 2: no licence, no approval, a Licensed Distributor in between
A Category 2 issuer needs no VARA licence and no VARA approval. It publishes a Whitepaper and a Risk Disclosure Statement itself, and every placement and distribution runs through a Licensed Distributor, which Schedule 2 defines as a VASP Licensed by VARA to carry out Broker-Dealer Services
. The distributor, under Part IV of the Broker-Dealer Services Rulebook, runs due diligence on both the issuer and the asset, then submits the Whitepaper, the Risk Disclosure Statement, its due-diligence reports and a signed declaration to VARA. A fifteen Working Day Submission Period follows, during which nothing may be placed. VARA's silence at the end of it is not an approval, and the distributor's diligence must stay current for as long as it distributes.
Entities in the Emirate may only issue Virtual Assets that fall within Category 2 above provided that, all placement and distribution is carried out by a Licensed Distributor.Virtual Asset Issuance Rulebook, Rule I.E.1, 19 May 2025 edition
No Virtual Asset issued under Category 2 shall be deemed in any way to have been approved by VARA and may not be construed or considered as such. VARA makes no representation and does not provide any warranties regarding any Issuer or Virtual Asset including, but not limited to, their fitness for purpose, suitability or regulatory status in any jurisdiction.Virtual Asset Issuance Rulebook, Rule I.E.5, 19 May 2025 edition
Licensed Distributors are a relier audience on LEXI: the rulebook makes them responsible for assuring and validating that the Issuer complies
, and a credential they can verify is built for that file. How a distributor or an exchange reads one: for exchanges, VASPs and reliers.
The federal layer
Since 1 January 2026, a second level of rulebook: the CMA.
On 1 January 2026 the UAE's Securities and Commodities Authority became the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025, and Federal Decree-Law No. 33 of 2025 brought virtual assets inside the federal capital-market perimeter, listing Activities and services related to Virtual Assets
and Promotion
among its licensable Financial Activities. Decree-Law 33 excludes the Financial Free Zones (Art. 2(4)(d)) and reaches any person targeting clients within the State, even from abroad or from a Financial Free Zone (Art. 2(1)(d)); for an entity in Dubai outside the DIFC, VARA stays the virtual-asset regulator, and a legal opinion dated after 1 January 2026 names which of the two perimeters it read.
A team structuring in Dubai now reads two levels of rulebook, not one. Which one an activity sits under, and whether it sits under both, is a scope question for counsel. The events that move that scope are logged, with sources, in the corridor regulation tracker.
Where a legal opinion fits
Three moments in VARA compliance where the artifact is a legal opinion.
Whatever the track, the question a counterparty eventually asks is whether an entity may do what it does in Dubai. The answer that carries weight is a scoped legal opinion from a licensed lawyer. Today it is a PDF in a data room that nobody downstream can verify without emails and calls, and it goes stale silently.
Scoping, before any application
Whether an activity falls inside one of the eight VA Activities at all, and which rulebooks then apply, is a legal question answered on the facts of the structure. The specimen credential on this site carries exactly that scope: whether the activities described in the submitted documentation require a VASP licence under the VARA framework.
Inside a Category 1 file
For an ARVA issuance, Annex 2 lets VARA require a legal opinion, and the April 2026 guidance sets its form: dated, signed, on letterhead, included in the Whitepaper submission package. That opinion is addressed to VARA. A LEXI credential is a separate artifact for the parties it names; it is not that filing.
When a counterparty asks
Licensed Distributors, exchanges, banks and integration partners ask for evidence before they act. Some listing teams require an opinion in writing; others run an internal legal review and keep a file. A credential gives that file a status, two hashes and a reliance list they can check on-chain.
What LEXI records for a VARA question
A protocol submits its documentation once and picks VARA (Dubai) as the jurisdiction. The LEXI engine, in development on a proprietary corpus of real regulatory work, runs the first pass: a checklist, a document review, a risk read, measured against the VARA rulebooks as published. That first pass is work product, not an opinion, and no AI signs anything. A licensed lawyer then takes over, runs their own diligence against the current rulebook text and co-signs the legal opinion with a stake behind the signature. In LEXI's vocabulary that is clearing the jurisdiction: obtaining a co-signed legal opinion covering it. One credential equals one cleared jurisdiction.
The opinion then becomes a LEXI credential. On-chain, anyone can read the firm ID, the signatory, the jurisdiction (AE · VARA (Dubai)), the as-of date, the expiry, the status (Live, Expired or Revoked), the reliance mode, the governing law, and the scope and opinion hashes. The opinion body stays off-chain, encrypted, open only to the reliers the credential names. A Licensed Distributor or an exchange verifies it in three steps, and reading the public metadata is free. The full flow, step by step: how it works.
Checking a counterparty's licence: VARA's public register (opens in a new tab) lists every licensed VASP and its activities. Checking a signatory's licence: the on-chain signatory and firm ID are public fields, and a relier checks the lawyer with the issuing bar or register.
Questions
Four short answers on VARA and LEXI.
Does a LEXI credential replace a VARA licence?
No. If an activity requires a VARA licence, the entity needs the licence. A LEXI credential records a licensed lawyer's scoped legal opinion, which may cover questions such as whether an activity requires a licence and how a structure maps to the rulebooks. It is not a licence, a registration, or an approval by any regulator, and LEXI is not licensed or endorsed by VARA.
When does VARA coverage go live on LEXI?
V0 is live on Base Sepolia (testnet) now, VARA first. Mainnet is targeted post-audit, Q4 2026, behind hardening and the audit. Nothing is live on mainnet, and this page will say so until it is.
Is a Category 2 issuance in Dubai approved by VARA?
No. Rule I.E.5 of the Virtual Asset Issuance Rulebook says no virtual asset issued under Category 2 shall be deemed in any way to have been approved by VARA. The Licensed Distributor's submission opens a fifteen Working Day Submission Period, and VARA's silence at the end of that period is not an approval. The same applies to a LEXI credential: it is a co-signed legal opinion committed on-chain, not a VARA approval.
Does LEXI's corridor cover teams working between India and Dubai?
Yes. Teams structuring between India and the UAE are the centre of LEXI's corridor. V0 covers VARA (Dubai) and runs on Base Sepolia (testnet). India (FIU-IND) and the EU (MiCA) are V1, next up, so one opinion can then span more than one jurisdiction in the same flow. Until V1 ships, India-side questions sit outside what a V0 credential covers.
What a token legal opinion covers, who writes one and why it goes stale: token and crypto legal opinions. More short answers: the LEXI FAQ.
Sources
Sources, checked at source on 16 October 2026.
- VARA, About VARA (the
sole authority
sentence): vara.ae/en/about-vara (opens in a new tab) - VARA, Licensed activities (the eight VA Activities, one licence per activity, the standalone custodian licence): vara.ae/en/licenses-and-register/licensed-activities (opens in a new tab)
- VARA, Public register (59 results on 16 October 2026): vara.ae/en/licenses-and-register/public-register (opens in a new tab)
- VARA, Virtual Asset Issuance Rulebook, 19 May 2025 edition, effective 19 June 2025 (Rules I.C.1, I.C.3, I.D.1, I.E.1 to I.E.5; Annex 1 Rule I.B.2; Annex 2 Rules III.B.2, III.C.3 and III.C.4; Schedule 2): rulebooks.vara.ae/rulebook/virtual-asset-issuance-rulebook (opens in a new tab), PDF VARA_EN_293_VER20250619.pdf (opens in a new tab)
- VARA, Guidance on the Virtual Asset Issuance Rulebook, 9 April 2026 (Introduction; Items 4, 8, 9, 32 and 34; Example D): rulebooks.vara.ae/rulebook/guidance-virtual-asset-issuance-rulebook (opens in a new tab), PDF VARA_EN_516_VER1.pdf (opens in a new tab)
- VARA, Broker-Dealer Services Rulebook, effective 19 June 2025, Part IV Licensed Distribution Services Rules (Rules IV.B, IV.D.1 to IV.D.3, IV.D.7, IV.E): rulebooks.vara.ae/rulebook/part-iv-licensed-distribution-services-rules (opens in a new tab)
- VARA, Exchange Services Rulebook, effective 31 March 2026: rulebooks.vara.ae/rulebook/exchange-services-rulebook (opens in a new tab)
- VARA, Regulations on the Marketing of Virtual Assets and Related Activities 2024, current version 1 October 2024: rulebooks.vara.ae/rulebook/marketing-regulations-0 (opens in a new tab); the
in or targeting the UAE
reading is in VARA's Guidance on the Marketing Regulations, 31 August 2024, PDF VARA_EN_388_VER1.pdf (opens in a new tab) - UAE Capital Market Authority, Federal Decree-Law No. (32) of 2025 on the Capital Market Authority: uaecma.gov.ae, Decree-Law 32 (English) (opens in a new tab)
- UAE Capital Market Authority, Federal Decree-Law No. (33) of 2025 on the Regulation of the Capital Market (Art. 2(1)(d), Art. 2(4)(d), Art. 3(1), Art. 85): uaecma.gov.ae, Decree-Law 33 (English) (opens in a new tab)
Rule numbers and dates are quoted from the documents above as read on 16 October 2026. VARA's FAQ page is not cited: it still describes the pre-2025 Category 2 approval model. LEXI's own vocabulary for the fields named on this page is in the glossary.
Want more LEXI briefings in Google's Top Stories? Add lexiprotocol.com as a preferred source in your Google settings.
Add LEXI as a preferred source on Google (opens in a new tab)The trust layer for institutional Web3.
If you are building in Dubai, or relying on someone who is, tell us the jurisdictions in play. Replies are one to one, from the founders, and contacting LEXI does not create an attorney-client relationship.