UAE VIRTUAL ASSETS LAW

How to Get a Crypto License in Dubai? New Virtual-Assets Regulation (2023)

Dubai Emirate has recently enacted a new Virtual Assets Regulatory Framework ("VARA") in accordance with Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai.

General Review of a New Virtual Assets Regulatory Framework

Virtual Assets Regulatory Framework (VARA) will support economic stability, investor protection, and jurisdictional resilience related to virtual assets as the authority mandated to conduct virtual assets oversight throughout the Emirate of Dubai (excluding DIFC).

Advising services, Broker-Dealer services, Custodial services, Exchange services, Lending-Borrowing services, Payments and Remittances services, and virtual assets management and investment services are only a few of the seven approved VA activities covered by the new legislation.

To help customers choose new tokens being launched in Dubai more wisely and to clarify the responsibilities of the issuer, issuance is also a regulated activity under the VARA regime.

What is a regulatory framework?

A) Place of business. If you are planning to operate your virtual business in Dubai, excluding Dubai International Finance Centre (DIFC), you should follow VARA Regulations.

B) Rulebooks. There are special issued thirteen rulebooks covered by the new VARA regulatory framework. The following are some important conclusions that every firm considering Dubai as a possible location for its virtual assets business should keep in mind:
· Virtual Assets and Related Activities Regulations 2023
· Company Rulebook
· Compliance & Risk Management Rulebook
· Technology & Information Rulebook
· Market Conduct Rulebook

C) Please keep in mind that any entity in the Dubai Emirate that issues a Virtual Asset in the course of a business, must comply with the VA Issuance Rulebook, as may be amended from time to time. The Rulebook list that the authority shall retain sole and absolute discretion, however will have regard to the following factors—

a. whether the Entity holds itself out as issuing the Virtual Asset in the course of a
business;
b. the regularity, scale and continuity with which the Entity issues Virtual Assets;
c. whether there is any direct or indirect commercial element to the Virtual Asset or how the Virtual Asset is issued, such as whether the Entity receives remuneration or other value in kind, commercial benefit or if it is related to any commercial or business activity in any way;
d. includes not-for-profit, non-profit and charitable organisations, foundations,
associations and activity; and
e. Virtual Assets that are issued for personal, non-commercial use only will not be deemed to be in the course of a business.

There are specific activities covered by the said rulebooks:

· Advisory services: proposing, delivering, or committing to deliver advisory services to individuals about acts or transactions involving virtual assets.

· Broker-dealer services: organizing orders, requesting or accepting orders, assisting in the matching of transactions, engaging in transactions as a dealer, market making, or offering placement, distribution, or other issuance-related services to customers issuing virtual assets.

· Custody services for or on behalf of another person while only acting in accordance with their verified instructions.

· Crypto-exchange: matching orders between buyers and sellers, maintaining an order book in regard to the aforementioned, and conducting exchanges, trades, or other services between virtual assets or between virtual assets and fiat money.

· Lending and borrowing services: Executing a contract whereby virtual assets are lent or transferred from the lender to the borrower, and the borrower agrees to return the same, at the lender's request, at any point during the agreed-upon period.

· Payment and remittance services: Receiving virtual assets in order to transmit or transfer them from one person to another, from one virtual assets wallet, address, or location to another. Payment and remittance services.

· Management and investment services: if your entity is acting on someone else's behalf as an agent or fiduciary, or otherwise taking responsibility for the management, administration or disposition of that person’s virtual asset.


D) Voluntary registration. Companies that offer technology services related to or utilizing digital ledger technology (DLT) to other businesses and companies that actively invest their own portfolio in virtual assets are two examples of the types of businesses that can voluntarily register with VARA, even if they do not fit into any of the aforementioned categories of virtual assets activity.

What types of Virtual Assets a Dubai company may issue?

Issuing Anonymity-Enhanced Cryptocurrencies and all VA Activity[ies] related to them are prohibited in Dubai.

Permitted Virtual Assets: The following Virtual Assets do not require approval from VARA prior to being issued by an Entity in the Emirate, however remain subject to the registration requirement—

· Free & Non-Transferable Virtual Assets: token offered for free that cannot be transferred between virtual assets wallets.

· Non-Redeemable & Non-Transferable Virtual Assets: token that may only be used within platforms operated by the issuer; is not redeemable or exchangeable for real-world goods, services, discounts or purchases and otherwise has no market, use or application outside of the platforms; cannot be converted into, or exchanged or redeemed for fiat currency, value in kind or other virtual assets; cannot be transferred between virtual assets wallets; and is not sold by the issuer for fiat currency, virtual assets or any value in kind.

· Redeemable Closed-Loop & Non-Transferable Virtual Assets: token that can be redeemed or exchanged for goods, services, discounts or purchases with the issuer and/or other merchants designated by the issuer, but cannot be converted into, or exchanged or redeemed for fiat currency; is not otherwise intended by the issuer to be used or accepted as a means of payment outside of the platforms operated by the issuer or designated merchants; cannot be transferred between virtual assets wallets other than for the purpose of redemption from the issuer or designated merchants; and is not sold by the issuer for fiat currency, virtual assets or any value in kind.

The issuer of the said virtual assets need:

(i) to be register the whitepaper of the virtual asset with VARA at least seven 7 days before its publication, accompanied by a declaration signed by the issuer which must be sent to VARA, and
(ii) comply with all requirements in of the VA Issuance Rulebook at all times.

Whitepaper is an educational and informational resource to highlight or promote qualities of issued virtual assets.

Company structure and corporate governance, DAO structures

The rules for business structure that apply to VASPs are laid out in the VARA Company Rulebook. Depending on a careful examination of its unique structure and business operations, a VASP's corporate governance requirements may change, however there are following keystones you should follow to:

· Company structure should be clear and transparent, and should ensure a sound and effective operation of the business of the VASP, including its virtual assets activities, which is conducive to the fair and orderly functioning of any market involving virtual assets.

· Virtual assets service provider shall have and maintain a legal entity in Dubai in one of the legal forms approved by a company registrar or corporate licensing authority in Dubai or one of its free zones (except the DIFC). Since VARA is working and affiliating to the Dubai World Trade Centre (DWTC), we expect that VARA will encourage virtual assets service providers to set up their entities under the DWTC free zone laws. However, there is the Dubai Multi Commodities Centre (DMCC), which has been active in licensing virtual asset businesses.

· Virtual assets service providers need to maintain a company structure with a clear chain of ownership, delegated authority and all associated voting powers such that VARA can clearly identify any controlling entity (or entities) and the ultimate beneficial owners (UBOs).

· If virtual assets service provider adopts a complex company structure (e.g. trusts, nominees), including involvement of DAOs or other structures with decentralized governance, it should disclose such information to VARA: (i) the reasons for the adoption of such complex company structure and/or decentralized governance; (ii) the relationship between the virtual assets service provider and relevant DAOs and/or entities with decentralized governance; (iii) whether the inclusion of DAOs and/or entities with decentralized governance in the group or the virtual assets service provider’s affiliation with such entities may adversely impact the virtual assets service provider’s ability to ensure compliance with the VARA regulations; and (iv) whether the relevant DAOs and/or entities with decentralized governance are registered or otherwise legally recognized as, or have within their structure, an entity in any jurisdiction other than Dubai.

· If virtual assets service provider changes its corporate structure, it must obtain a written approval from VARA prior to any material change to its company structure including controlling entities and UBOs and/or adopting decentralized governance in respect of their operations relating to VA activities.

Environmental, social and governance compliance (ESG)

VARA will determine the ESG disclosure and compliance by virtual assets providers by following:

(i) The number of staff members or other personnel engaged by the VASP;
(ii) Turnover and/or other financial information; and
(iii) Business models and virtual asset activities.
VARA regulations established three levels of ESG disclosure: mandatory, voluntary and compliance.
· Voluntary. In the future, VARA may provide non-binding recommendations outlining "best practice standards" for how specific virtual assets service providers or classes of virtual assets service providers should conduct themselves with regard to ESG problems. Such best practice guidelines can contain sustainability criteria that are in line with the investment management plans and diversity and inclusion policies of such businesses.
· Compliance. In order to increase the openness of their ESG practices, virtual assets service providers that are required to comply with a compliance ESG disclosure level must describe their ESG strategies in the UAE, including but not limited to investment or operational plans relating to virtual assets mining or staking.
· Mandatory. The establishment of practices and procedures to increase public knowledge of ESG-related opportunities and actions, including the posting of pertinent material on websites and/or social media platforms, is required of virtual assets service providers subject to an obligatory ESG disclosure level.
· Mining and stake holding companies. Regardless of the ESG disclosure level, all virtual assets service providers with investments in virtual assets mining or staking operations, including through the sale of equipment, are required to publicly disclose current information about:
(i) the use of renewable and/or waste energy in the course of conducting the virtual assets mining or staking activities; and
(ii) initiatives relating to decarbonisation (e.g., purchase of carbon offsets) and emission reduction of the virtual assets mining or staking activities.

How much does it cost to obtain crypto license in Dubai?
License fees depends on the virtual assets activity and consist of (a) license application fee starting from $11'000 to $27'300, (b) annual supervision fee starting from $21'800 t0 $54'500, and (c) license extension fee which is 50% of lower license application fee (see the table below)
What if the virtual service provider will not follow VARA requirements ?

The VARA developed sanctions and liability table for violators of current laws and regulations. The liability table may be amended by regulations or special directives. Current fines consist of penalty from $5.5M to $13.7M.
License Process

The provision of a VARA license is subject to applicants either;
A) Progressing through a tiered approval gateway to secure a Minimum Viable Product (MVP) license (for existing MVP applicants only); OR
B) Applying for a Full Market Product (FMP) license.

There are 3 categories of applicants in the current Licensing process:
1. Category A - MVP Applicants that are currently in the process of securing a VARA License:
The MVP License is a 3-stage process starting with a (1) Provisional Permit; graduating to a (2) Preparatory License and concluding with an (3) Operating License. Applicants that are already in the MVP process will be advised by VARA to either continue within the MVP licensing process and/or be transitioned to the FMP Licensing process, ensuring a seamless transition with a focus on efficiency.
2. Category B - Existing local (legacy) VASPs that are required to come under VARA Purview:
All operating Virtual Asset Service Provider [VASP] entities in the Emirate of Dubai (excl. DIFC) fall under VARA supervision and as a consequence have the following options:
a) Apply for an FMP Regulated License; OR
b) Apply for an FMP Registration [i.e. is a permissible VA activity subject to general market guidance that (i) may peripherally intersect with regulated VA activities/VAs; but (ii) may not be deemed necessary to warrant full regulatory supervision at the present time; yet (iii) must be registered under VARA in order to be able to freely service the domestic market; noting that (iv) they may also be required to fall under full regulatory supervision at any time in the future at VARA’s sole and absolute discretion]; OR
c) Secure a No Objection Certificate [NOC] to operate and provide services or products that (i) are not VARA regulated activities/ do not fall within VARA’s regulatory remit but are permitted to be undertaken/ offered to the market so long as they are not in breach of other applicable Laws of the State; or (ii) under the disclosed operating parameters are determined to be low/minimal risk at that time, and are hence exempt from VARA regulatory oversight (unless the VASP specifically seeks to be regulated).

License Procedure

All legacy ‘in-market’ VASPs that have not been engaged with VARA through the MVP process thus far, are required to complete the Information Disclosure Questionnaire [IDQ]. These forms can be obtained from the relevant commercial licensing authority – Dubai’s Department of Economy and Tourism [DET] for Dubai Mainland (or) the relevant Free Zone Authority [FZA] for any of the commercial FZs across the Emirate. (excl. DIFC)
Please note that failure to duly complete the IDQ with the underlying self-declaration of VA activities being offered or enabled by an entity based on Dubai, and/or servicing the Dubai market, will be considered as confirmation of intent to not undertake or continue to undertake any activities associated with Virtual Assets (directly or indirectly) in the Emirate of Dubai. Entities that are already providing or enabling access to such VA-linked services must hence ensure that they complete the full winding down of associated business operations no later than 30 June 2023.
Post submission of the IDQ, entities will receive an Application Acknowledgement Notice [AAN] from VARA that will include instructions on whether they are required to be fully Regulated; or Registered; or they are being provided with a NOC in line with the descriptors associated with each in the aforementioned section #2 (a.b.c)
For entities required to apply for a Regulated License or be Registered under VARA, application process must be formally concluded by 31 August 2023.

Deadlines in 2023

Deadline for IDQ (Complete) Submissions: 30 April 2023
Closure of all VA Activities not applied for through IDQ: 30 June 2023 - For avoidance of doubt, from 01 July 2023 no VA related activities will be permitted to be undertaken in, or targeting residents of, the Emirate of Dubai by businesses that are not already fully licensed or duly registered or received a VARA-NOC; (OR) have otherwise received an AAN issued by VARA.
Deadline for all Legacy FMP License Applications or for Registration of Legacy VA Operations: 31 August 2023 noting that this only applies to VASPs for activities and services commenced prior to 07 Feb 2023 – date of publication of Virtual Assets and Related Activities Regulations 2023 – any operations commenced thereafter will fall under Category C below
3. Category C – New applicants seeking a VARA License in order to offer VA services in Dubai [post 07 Feb 2023]:
All applicants that do not fall under Category A or B, and who wish to receive a VARA License for services that were not being offered on or prior to the date of issuance of the Virtual Assets and Related Activities Regulations 2023 can begin the application process through their current or prospective commercial licensor – DET or FZA, or directly through VARA in the instance that they have yet to determine the commercial operating zone in the Emirate.
Step 1 – Completed IDQ to be submitted to VARA through the DET or FZA or directly if new entrant to Dubai. Post submission of the IDQ and a preliminary review of the submission by VARA, qualifying entities will receive an Initial Approval and may be used for the entity to complete all operational set-up and establishment incorporation processes including office space, employee on-boarding etc. For avoidance of doubt, the AAN does not constitute an approval to undertake any VA operations in Dubai, or conduct activities servicing the market from Dubai.
Step 2 – Following receipt of the Initial Approval, and after completing all arrangements with regards to incorporating in Dubai, VASPs can submit a full FMP License application to VARA through the DET or FZA commercial licensor, or in special cases may be directly initiated with VARA until such time as they determine the preferred commercial licensor in the city
Only VASPs that receive a final approval post review from VARA – and receive the FMP License, are in a position to undertake any regulated VA activities, or offer such services to and/or from the Emirate of Dubai.
VARA’s full market regulations specifically focus on securely enabling borderless economic opportunity across the global VA industry, protecting investors and market participants, backed by active enforcement of all regulatory requirements beyond security and cross-border compliance including those pertaining to custody and segregation of client money; prudential requirements (viz. insurance cover and liquidity reserves); FATF considerations (viz. AML-CFT, KYC-CDD, Travel Rule etc.); and market manipulation and/or abuse prevention (viz. UBO, data privacy and information security etc.).

Conclusion
The UAE has declared that it intends to become a major hub for cryptocurrencies, although it has done so in light of recent incidents that have damaged the industry's credibility. VARA is paving the road for Dubai-based VASPs to stand out internationally as highly dependable businesses in the VA sector by allowing them to operate inside a framework that sets high regulatory standards.

Currently, there are several virtual assets service providers in a public registrar, such as Binance FZE, Komainu MEA, HEX Trust MENA, GC Exchange, CRO DAX Middle East (crypto.com).


If you are looking for advise on crypto regulation in Middle East, Dubai region, please contact Randwyck Advisors Middle East Desk.

DISCLAIMER: Due to the general nature of this update, not all scenarios may be applicable to the information presented here, thus you should not act upon it without seeking specialized legal advice based on your unique circumstances.

How can we help?
Our professional legal and tax team advises free zones and local companies in the Middle East and North Africa (MENA) region. If you require any further information, please contact us and ask for advise.