How are VARA's rulebooks structured?

The Virtual Assets Regulatory Authority (VARA) licenses every crypto firm in Dubai, outside the DIFC, under a layered rulebook system rather than a single law. For the wider picture of how VARA's licensing framework works, see our explainer on the regulator itself. Four rulebooks are compulsory for every licensee — Company; Compliance and Risk Management; Technology and Information; and Market Conduct — and a firm then follows the rulebook specific to each activity it holds, such as Broker-Dealer for an OTC desk.

This structure sits under the Virtual Assets and Related Activities Regulations 2023, first issued on 7 February 2023 and revised in June 2023, September 2023, October 2024 and, most recently, with effect from 19 June 2025. Schedule 1 lists seven VA Activities — Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, and VA Transfer and Settlement — plus Category 1 VA Issuance, which VARA added in 2023. On 19 May 2025 VARA published Version 2.0 of the activity rulebooks, with tighter controls on margin trading and token distribution and clearer collateral-wallet definitions, giving licensees a 30-day transition to 19 June 2025. VARA also updates individual rulebook modules between full revisions, so the version in force can move without a headline change to the framework's name.

What does the Compliance and Risk Management rulebook mean for you as a seller?

The Compliance and Risk Management rulebook is the part of VARA's framework you experience directly, even though you will probably never read it. It requires every VARA-licensed firm to run anti-money-laundering checks, screen counterparties against sanctions lists, and apply the travel rule — sending originator and beneficiary information with every in-scope transfer to another VASP, and verifying the beneficiary's identity once a client's transfers reach AED 3,500 in a day — under the UAE Virtual Asset Travel Rule that VARA's circular of 24 February 2026 put into effect for Dubai licensees.

In practice, this is why a licensed desk asks for your passport and proof of address before your first trade, and why it asks fresh questions — source of wallet funds, purpose of the transaction — on a large or unusual one. The rulebook does not single out any one client; it applies the same screening to every counterparty, every time a transfer falls within scope.

Sanctions screening runs against broadly the same lists a UAE bank uses, which is one reason a desk's onboarding can feel bank-like rather than casual. A firm that skips this step is not being efficient — it is operating outside its own licence conditions, a pattern covered in our breakdown of common OTC scam patterns in Dubai.

Why do the Marketing Regulations matter to you?

VARA's Regulations on the Marketing of Virtual Assets and Related Activities have applied to anyone promoting virtual assets in or targeting the UAE since 1 October 2024. The rules cover licensed and unlicensed firms alike — foreign platforms, individual traders and influencers included — and carry fines of up to AED 10 million per violation.

For a seller, the practical lesson is narrow but important: a slick advert, a verified-looking social account or a large following says nothing about whether the firm behind it holds a VARA licence. The Marketing Regulations exist precisely because unlicensed promotion was common enough to need its own rule and penalty scale, not because licensed firms needed reminding to be accurate.

Treat any crypto advertisement in the UAE — licensed or not — as a prompt to check the register yourself, never as the check itself. Verifying a firm's licence in VARA's public register takes under a minute and is the only step that actually confirms status.

How do enforcement actions help you vet a desk?

VARA publishes enforcement outcomes, and reading them is one of the more useful things a seller can do before committing size to a desk. On 7 October 2025, VARA announced penalties against 19 firms in a single enforcement action for unlicensed virtual-asset activity and breaches of its Marketing Regulations, with fines ranging from AED 100,000 to AED 600,000 and cease-and-desist orders attached. In June and July 2026 it published further notices of fines, against offshore exchanges that had marketed to UAE residents without a licence and against licensed firms for supervisory breaches.

An enforcement record does two things for you. It confirms the regulator is active rather than nominal, and checking whether a firm appears in past notices is a legitimate part of due diligence, alongside confirming its licence number and reviewing how it settles trades. A clean record is not proof of quality on its own — some unlicensed operators simply haven't been reached yet.

What has changed in 2026?

The 2026 changes so far are circulars that plug federal law into VARA's rulebooks rather than a new rulebook version. Federal Decree-Law No. 10 of 2025 on AML/CFT took effect on 14 October 2025 and its Executive Regulations on 14 December 2025; VARA's circular of 24 November 2025 required every licensee to run a gap assessment against the new law.

• 24 February 2026 — circular implementing the UAE Virtual Asset Travel Rule: originator and beneficiary data on every in-scope transfer, beneficiary verification from AED 3,500 a day.
• 4 March 2026 — circular on applying the Executive Regulations to virtual-asset activity in Dubai, including proliferation-financing risk.
• 12 June 2026 — AML/CFT Business Risk Assessment Guidance for licensees.

For a seller, none of this changes the documents you bring; it changes how consistently a licensed desk must ask for them, and how much counterparty data travels with your USDT.

How do you check you're dealing under the current rulebook?

VARA periodically updates its rulebooks, and the version in force can change between one large trade and the next. Before you commit to a significant transaction, it is worth confirming which version applies rather than assuming the rules you read about last year still hold exactly as written.

1. STEP 1

   Check the source directly

   Read vara.ae and rulebooks.vara.ae for the current rulebook set and its effective date, rather than relying on a search result or a third-party summary.

2. STEP 2

   Ask the desk which version it operates under

   A licensed firm can state its rulebook version and licensed activities without hesitation. Hesitation, or an answer that avoids the question, is itself useful information.

3. STEP 3

   Confirm the licence number and activities match

   Resolve the firm's licence number in VARA's public register and check the activities listed match what it is offering you — an Exchange licence does not cover Custody, for example.

This matters most on larger tickets, where the compliance file is bigger and the questions go further under the Compliance and Risk Management rulebook covered above. A desk that cannot state its own rulebook version or licensed activities plainly is not one to trust with a large transfer.

The bottom line on VARA's rulebooks

VARA's rulebooks are not static text to memorise — they are the reason your onboarding file, your sanctions screening and the advertising you see look the way they do. The four compulsory rulebooks set the baseline; Compliance and Risk Management is the one you feel directly; the Marketing Regulations mean advertising proves nothing on its own; and enforcement actions are the most honest signal of how seriously the framework is applied.

IWGT operates under VARA licence VL/24/12/002 as a Broker-Dealer, dealing under the current rulebook set above.

This guide is informational and is not legal, tax or investment advice, nor an invitation to buy or sell any virtual asset. Rules and figures are as of September 2026 — re-check the sources before acting. Virtual assets may lose their value in full or in part and are subject to extreme volatility.