VARA is the Virtual Assets Regulatory Authority, Dubai's dedicated regulator for cryptocurrency and virtual asset businesses. Established by Dubai Law No. 4 of 2022, issued on 9 March 2022, it made Dubai the first major jurisdiction anywhere with a standalone regulator built only for virtual assets.
That last point is the one that matters. In most countries, an existing financial regulator's mandate was simply extended to cover crypto. Dubai built a new one from scratch, with its own statutory authority.
What VARA does
Licensing and supervision, across a defined territory.
Throughout Dubai, including the mainland and the free zones, VARA holds exclusive authority over virtual asset activity. One area sits outside it. Falling under the DFSA instead is the Dubai International Financial Centre, which runs a separate crypto regime.
The authority holds legal personality and financial autonomy, and is affiliated to the Dubai World Trade Centre Authority. At federal level, Cabinet Decision No. 111 of 2022 confirmed its recognition.
The seven licence categories
In February 2023, VARA finalised its full framework through the Virtual Assets and Related Activities Regulations. To conduct one of these activities from Dubai, a business needs the matching licence.
| Category | Activity |
|---|---|
| Advisory | Advising on virtual assets |
| Broker-dealer | Dealing or arranging deals in virtual assets |
| Custody | Holding client assets |
| Exchange | Operating a virtual asset trading platform |
| Lending and borrowing | Credit activity involving virtual assets |
| Payments and remittances | Moving value using virtual assets |
| Management and investment | Managing virtual assets on behalf of clients |
Exchange licences carry real capital requirements. For Category 4, the minimum is AED 1.5 million, plus an operational risk capital requirement scaling with monthly trading volume. Larger platforms hold more.
What a VARA licence actually requires
Obligations rather than a certificate.
- AML and CFT programmes, aligned to FATF standards, including transaction monitoring and sanctions screening.
- Market surveillance, to detect manipulation and abusive trading.
- Governance and conflict management, with defined accountability inside the firm.
- Capital adequacy, scaled to activity and volume.
- Client asset protection, including the segregation requirements a crypto exchange must meet.
- Ongoing reporting to the regulator, rather than a one-off approval.
Applications run through a two-stage process. First comes provisional approval, then a full operating licence once conditions are met.
The stablecoin rules
In 2024, VARA added a specific regime for fiat-referenced virtual assets, and the requirements are unusually prescriptive.
Issuers must hold 1:1 reserves in a bankruptcy-remote vehicle at a UAE-licensed bank or trust company. Only high-quality liquid assets denominated in the peg currency qualify. No commercial paper. No rehypothecation. Weekly reserve attestations, and redemption at par within five business days.
Compare that to the reserve controversies that have followed stablecoins elsewhere and the intent is clear.
Why Dubai built it
Three reasons show up in the law's own stated objectives: positioning Dubai as an international hub for virtual assets, improving its competitive position, and protecting investors under prudential regulation.
In one measurable respect the strategy has worked. A large share of the world's regulated virtual asset businesses now hold Dubai licences. By early 2026, the emirate was widely described as the third pillar of global crypto regulation alongside the European Union and the United States.
One further milestone is worth noting. In February 2024 the UAE exited the FATF grey list, shifting the jurisdiction from a rapid-growth phase into mature supervision.
VARA compared with other regimes
| Regulator | Jurisdiction | Structure |
|---|---|---|
| VARA | Dubai mainland and free zones, excluding DIFC | Standalone virtual asset regulator |
| DFSA | Dubai International Financial Centre | Crypto token regime inside an existing financial rulebook |
| FSRA | Abu Dhabi Global Market | Separate framework under ADGM |
| MiCA | European Union | Regulation applied across member states |
| AUSTRAC | Australia | AML and CTF regulator with digital currency exchange registration |
Operating in both Dubai mainland and Abu Dhabi generally requires licences from both. Passporting between them does not exist.
What a licence does not guarantee
Worth being clear about, since regulation gets used as marketing.
A licence means a firm meets defined standards and answers to a supervisor. Beyond that it guarantees nothing: not that the firm cannot fail, not that your assets are insured, not that a token listed on a licensed platform is a good one. Regulation reduces certain risks. Market risk is untouched.
Against breaches, VARA has also shown willingness to act, which is the part that gives a licence meaning. A regulator that never enforces is a logo.
mb.io is regulated and licensed by VARA
mb.io holds a VARA licence in the UAE and is also regulated by AUSTRAC in Australia. On the respective regulators' own registers, both can be checked rather than taken on trust.
mb.io is a regulated crypto spot exchange backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Regulated by VARA in the UAE and AUSTRAC in Australia
- 10/10 security score from Hacken, an independent blockchain security auditor
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- A curated list of assets, so you're not sorting through thousands of tokens to find the ones worth trading
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 customer support, on web and on the iOS and Android apps
Open your account and start trading on mb.io.
Frequently asked questions
What does VARA stand for?
Virtual Assets Regulatory Authority. Created by Dubai Law No. 4 of 2022, it is Dubai's dedicated regulator for cryptocurrency and virtual asset businesses.
When was VARA established?
March 2022, under Dubai Law No. 4 of 2022, issued on 9 March. In February 2023, its full licensing framework followed.
Does VARA cover the whole of Dubai?
Almost. Across Dubai's mainland and free zones VARA has authority, with one exception: the Dubai International Financial Centre, regulated separately by the DFSA.
How many VARA licence categories are there?
Seven: advisory, broker-dealer, custody, exchange, lending and borrowing, payments and remittances, and management and investment services.
What capital does a VARA exchange licence require?
For the exchange category, a minimum of AED 1.5 million, plus an operational risk capital requirement scaling with monthly trading volume.
Is mb.io licensed by VARA?
Yes. mb.io is regulated and licensed by VARA in the UAE, and separately regulated by AUSTRAC in Australia. On the regulators' public registers, both licences are verifiable.
Why does VARA regulation matter when choosing an exchange?
Because it means someone supervises the platform. A licensed crypto exchange faces capital requirements, client asset rules, and reporting obligations, and there is an authority to escalate to. Unlicensed platforms offer none of that.
Is a VARA licence the same as being safe?
No. Through supervision and asset segregation rules it reduces operational and counterparty risk. Market risk stays exactly where it was, and no licence makes a volatile asset less volatile.
