VARA regulates virtual asset activity conducted in or from Dubai, and the VA Issuance Rulebook applies to issuance from Dubai regardless of where the issuing company is incorporated. A BVI issuer whose management, marketing and treasury genuinely operate from Dubai can be pulled inside the Dubai perimeter. The structure that holds pairs the BVI issuer with a UAE operating company for the team, genuine issuer governance, and a written perimeter analysis completed before the token generation event.
The test that actually applies
Dubai Law No. 4 of 2022 gives VARA authority over virtual asset activity carried on in or from the Emirate (outside the DIFC), and Article 17 makes conducting regulated activity without a licence an offence. Nothing in that formulation turns on where a company is incorporated: the perimeter follows the activity. VARA's VA Issuance Rulebook operates the same way for token issuance. A BVI company is a real legal person with real advantages, but it does not relocate conduct: if the offer is built, decided and run from Dubai, the activity is happening from Dubai.
How the structure collapses
The failure pattern is consistent. The BVI company holds nothing but a registered agent. Both founders are UAE residents. Tokenomics decisions, exchange negotiations, marketing approvals and treasury transactions all happen from Dubai, on Dubai devices, by Dubai residents. In that fact pattern three things fail at once: the VARA perimeter captures the activity; the offshore substance story fails because nothing happens offshore; and the UAE tax analysis deteriorates, since a foreign company managed and controlled from the UAE invites UAE corporate tax residence questions. The BVI wrapper is left doing decorative work while every risk it was bought for lands anyway.
The structure that holds
The durable answer has three parts, none exotic. First, a UAE operating company, free zone or mainland as the model dictates, employing the team and providing development, marketing and advisory services to the BVI issuer under real intercompany agreements, invoiced and paid. Secondly, genuine issuer governance: a board that actually decides the issuer's affairs, minutes that record it, and treasury controls that are not one founder's hardware wallet in JLT. Thirdly, a written perimeter analysis concluding, on the actual facts, which functions sit where and why no VARA-regulated activity is conducted from Dubai without a licence, or, where the model genuinely needs one, which licence and when. Where the project's ambitions include regulated activity in Dubai, the same analysis becomes the first document of the VARA application rather than a defence file.
Issuance itself, and the FRVA boundary
One boundary deserves its own sentence: a fiat-referenced token aimed at the UAE market belongs inside the UAE regimes, VARA's FRVA category with its capital and reserve requirements, or the CBUAE's Payment Token Services Regulation for dirham-referenced tokens, and no offshore issuer changes that. For ordinary utility and network tokens, the offshore issuance route remains legitimate and standard, provided the conduct analysis above is real. The wider issuance framework is covered in our Issuance Rulebook guide.
Timing is the whole game
Before the token generation event, everything above is planning: cheap, quiet and fully available. After the TGE, the same work is remediation, conducted with a live token, a public community and VARA's penalties framework in the background (for entities, up to the higher of AED 50 million, 15 percent of revenue or 300 percent of gains). In Neo Legal's experience the voluntary, early conversation is consistently the inexpensive one: see the penalties guide. We run the BVI and Dubai analyses together, as one engagement, because they are one problem.
This article is general information as at September 2026 and is not legal advice. BVI regulatory positions are described as at the review date; classification outcomes turn on specific token features and require advice on the actual tokenomics.
