Key takeaways

The new VARA regulatory framework covers 13 separate rulebooks. Some key takeaways which any company looking to explore Dubai as a potential destination for its VA business are set out below:

1. The VARA regulations apply to all virtual asset service providers (VASPs) providing services in Dubai (excluding the DIFC).
2. The framework comprises 13 bespoke regulatory booklets. Five of these are compulsory and apply to all VASPs operating in Dubai, while the remaining eight are additional regulations applicable to VASPs operating specific VA activities set out further below.
3. The five compulsory rulebooks are as follows:
   1. Virtual Assets and Related Activities Regulations 2023
   2. Company Rulebook
   3. Compliance & Risk Management Rulebook
   4. Technology & Information Rulebook
   5. Market Conduct Rulebook
4. The VA activities covered by the remaining rulebooks are activity-specific and cover:
   1. Advisory services: Offering, providing or agreeing to provide advisory services to persons in respect of actions or transactions relating to VAs.
   2. Broker-dealer services: Arranging orders, soliciting or accepting orders, facilitating the matching of transactions, entering into transactions as a dealer, market making, or providing placement, distribution or other issuance-related services to clients issuing VAs.
   3. Custody services: Safekeeping VAs for or on behalf of another person and acting only on verified instructions from or on behalf of that person.
   4. Exchange services: Conducting an exchange, trade or service between VAs, or between VAs and fiat currency, matching orders between buyers and sellers, or maintaining an order book in relation to the above.
   5. Lending and borrowing services: Carrying out a contract under which a VA is transferred or lent from the lender to the borrower, and the borrower commits to return the same, at the request of the lender, at any time either during or at the end of the period agreed upon.
   6. Payment and remittance services: Receiving VAs for the purposes of the transmission or transfer of such VAs from one person to another or from one VA wallet, address or location to another.
   7. Management and investment services: Acting on behalf of a person as an agent or fiduciary, or otherwise taking responsibility for the management, administration or disposition of that person’s VAs (e.g., investment management or asset management, or taking responsibility for staking to earn fees for validators/node operators of a proof-of-stake distributed ledger technology (DLT)).
5. Even if a company does not fall into any of the VA activity categories above, the following kinds of companies can voluntarily register with VARA:
   1. Providers of technology services relating to or utilising DLT to other businesses; and
   2. Companies that actively invest their own portfolio in VAs.

The VARA Rulebooks do not elaborate on why voluntary registration is being offered as an option, and what the advantages of such registration would be. It is likely that this option is being made available in response to the interest in regulating virtual asset businesses more generally and the difficulty that companies with pioneering business models face in fitting into traditional financial services activities categories. We anticipate that this option will be of interest to businesses that are looking to provide investors and counterparties with the comfort that the business they are dealing with, while potentially cutting edge in an ever-evolving industry, is subject to the regulation and supervision of a reputable, specialised virtual assets regulator.

Virtual Asset Issuance Rulebook

The thirteenth and, perhaps, most interesting rulebook issued by VARA is the Virtual Asset Issuance (VAI) Rulebook. Subject to some exemptions and carve-outs to ensure alignment with international standards, any company in Dubai (except the DIFC) that issues a VA “in the course of business” must comply with the VAI Rulebook.

The guiding criteria used by VARA to determine whether a VA issuance is in the course of business are as follows:

1. Whether the company holds itself out as issuing the VA in the course of business;
2. The regularity, scale and continuity with which the entity (including any company, not-for-profit, non-profit or charitable organisation, foundation or association) issues VAs; and
3. Whether there is any direct or indirect commercial element to the VA or how the VA is issued, such as whether the company receives remuneration or other value in kind or commercial benefit, or whether it is related to any commercial or business activity in any way.
4. VAs that are issued for personal, non-commercial use only will not be deemed to be issued in the course of business.

The following VAs do not require approval from VARA prior to being issued, but remain subject to registration:

1. Free and non-transferable VAs: This is a token offered for free that cannot be transferred between VA wallets.
2. Non-redeemable and non-transferable VAs: This token may only be used within platforms operated by the issuer; is not redeemable or exchangeable for real-world goods, services, discounts or purchases and otherwise has no market, use or application outside of the platforms; cannot be converted into, or exchanged or redeemed for fiat currency, value in kind or other VAs; cannot be transferred between VA wallets; and is not sold by the issuer for fiat currency, VAs or any value in kind.
3. Redeemable closed-loop and non-transferable VAs: This is a token that can be redeemed or exchanged for goods, services, discounts or purchases with the issuer and/or other merchants designated by the issuer, but cannot be converted into, or exchanged or redeemed for fiat currency; is not otherwise intended by the issuer to be used or accepted as a means of payment outside of the platforms operated by the issuer or designated merchants; cannot be transferred between VA wallets other than for the purpose of redemption from the issuer or designated merchants; and is not sold by the issuer for fiat currency, VAs or any value in kind, (collectively, the Permitted VAs).

The registration requirements for a Permitted VA are that:

1. The issuer must register the whitepaper of the VA with VARA at least seven working days before its publication; and
2. The issuer must comply with all requirements in the other parts of the VAI Rulebook at all times.

VASP company structures and DAOs

VARA’s Company Rulebook sets out the requirements on company structure applicable to VASPs. The corporate governance needs of a VASP may vary depending upon a thorough analysis of its particular structure and business operations:

1. A VASP is expected to maintain a company structure which is clear and transparent for the purposes of effective oversight by VARA; and ensures a sound and effective operation of the business of the VASP, including its VA activities, which is conducive to the fair and orderly functioning of any market involving VAs.
2. VASPs must also have and maintain a legal entity in Dubai in one of the legal forms approved by a company registrar or corporate licensing authority in Dubai or one of its free zones (except the DIFC). Since VARA is affiliated to the Dubai World Trade Centre (DWTC) Authority, the expectation is that VARA will encourage VA businesses to set up their entities under the umbrella of the DWTC free zone. However, other free zones seem to be positioning themselves as viable alternatives – one example being the Dubai Multi Commodities Centre (DMCC), which has been active in welcoming virtual asset businesses and already hosts a number of VASPs.
3. VASPs are to maintain a company structure with a clear chain of ownership, delegated authority and all associated voting powers such that VARA can clearly identify any controlling entity (or entities) and the ultimate beneficial owners (UBOs).
4. If a VASP adopts a complex company structure, including but not limited to trusts and nominee arrangements, and/or structures involving DAOs or other organisational forms with decentralised governance, it must furnish information to VARA relating to the following as part of the licensing process:
   1. The reasons for the adoption of such complex company structure and/or decentralised governance;
   2. The relationship between the VASP and relevant DAOs and/or entities with decentralised governance;
   3. Whether the inclusion of DAOs and/or entities with decentralised governance in the group or the VASP’s affiliation with such entities may adversely impact the VASP’s ability to ensure compliance with the VARA regulations; and
   4. Whether the relevant DAOs and/or entities with decentralised governance are registered or otherwise legally recognised as, or have within their structure, an entity in any jurisdiction other than Dubai.
5. Lastly, VASPs are expected to obtain VARA’s written approval prior to any material change to their company structure including controlling entities and UBOs and/or adopting decentralised governance in respect of their operations relating to VA activities.

It is notable that VARA recognises that VA businesses may use complex legal structures that extend beyond the geographical limits of the UAE and/or may employ legal forms or arrangements that go beyond what the UAE legal system makes available currently, such as Web3 companies which have a decentralised model of governance with control vested in some form of operating DAO that exists outside of the UAE.

Consistent with its promise to be a forward-thinking and sector-focused regulator and as discussed in this section, VARA has tried to accommodate companies that have a DAO governing structure, while providing for obligations on such companies to supply adequate information to VARA in relation to such structure to enable it to efficiently regulate their operations in Dubai.

ESG

VARA acknowledges the importance of regulating and managing the environmental, social and governance (ESG) impact of VASPs, VAs and VA activities. Accordingly, VARA will continue to monitor appropriate ways to regulate such impact and will issue further guidance where required. VASPs must satisfy ESG disclosure requirements.

During the licensing process, VARA will determine the ESG disclosure level required of each VASP, which will be communicated to the VASP by VARA and form a condition of the VASP’s licence.

In making such a determination, VARA may consider the following:

1. The number of staff members or other personnel engaged by the VASP;
2. Turnover and/or other financial information; and
3. Business models and VA activities.

VARA has three levels of ESG disclosure: voluntary, compliance and mandatory.

Voluntary

VARA may issue non-binding guidance in the future setting out “best practice standards” regarding the conduct of specified VASPs or classes of VASPs in respect of ESG issues. Such best practice standards could include considerations of sustainability that are consistent with such entities’ investment management strategies and diversity and inclusion practices.

Compliance

VASPs required to comply with a compliance ESG disclosure level will need to explain their ESG strategies in the UAE, including but not limited to investment or operational strategies relating to VA mining or staking, or otherwise provide relevant information for the purpose of increasing the transparency of their ESG practices.

Mandatory

VASPs required to comply with a mandatory ESG disclosure level must establish practices and procedures to raise awareness of ESG-related activities and opportunities, including providing relevant information on their websites and/or social media sites.

Mining and staking businesses

Notwithstanding the ESG disclosure level, all VASPs which have investments in VA mining or staking businesses, including by way of selling equipment, must make publicly available in a prominent place on their website, up-to-date information related to:

1. The use of renewable and/or waste energy in the course of conducting the VA mining or staking activities; and
2. Initiatives relating to decarbonisation (e.g., purchase of carbon offsets) and emission reduction of the VA mining or staking activities.

Concluding comments

Since its inception in 2022, VARA has signalled that its goal is to create an inclusive, sector-friendly but ethical and responsible framework for the operation of VASPs and VA activities in Dubai. With the introduction of this framework of regulations, VARA is demonstrating that it will regulate not just traditional areas of financial services, which now are beginning to incorporate VAs into their operations, but also making room for sector-specific requirements that are unique to VAs. The focus therefore is not limited to Web3 companies, but to any company that wishes to incorporate an element of VA activity into an existing or future business.

In particular, the formal recognition of DAOs in a VASP’s company structure is a novel and welcome inclusion given the thriving and growing Web3 community in the UAE. The VAI Rulebook seeks to curb the influence of VASPs issuing unreliable tokens that tend to become the centre of pump-and-dump schemes. Lastly, the ESG requirements show the UAE’s commitment to a greener future and stand as evidence of a long-standing push from the government to see ESG incorporated into all aspects of law, governance and policy.

While the UAE has announced its intention to be a global crypto hub, it has done so bearing in mind the events that have recently tarnished the sector’s reputation. By allowing VASPs in Dubai to operate within a framework that imposes stringent regulatory standards, VARA is paving the way for Dubai-based VASPs to stand out globally as highly reliable companies in the VA sector.

In-depth 2023-052