Received an email from VARA? What to do in the first 72 hours.

Over the last two years VARA has made unlicensed activity and unlicensed marketing a visible enforcement priority. In October 2024 it announced cease and desist orders and fines against seven entities for operating without licences and breaching marketing rules. In October 2025 it announced penalties against 19 firms for unlicensed activity and Marketing Regulations breaches, with fines from AED 100,000 to AED 600,000, and directed all of them to cease operations. Behind each of those announcements sits a sequence of letters. If one has landed in your inbox, this is how to handle it.

First, check it is really from VARA

Regulators are impersonated, and a fake regulator email asking for documents or a payment is a known fraud. Check the sender domain is vara.ae, check that any reference and named officer are consistent, and if in doubt contact VARA through the details on its own website rather than replying to the email. Never pay a fine through a link in an email you have not verified.

What kind of letter is it?

Part IX of the VARA Regulations 2023 gives VARA a broad enforcement toolkit, and the letter will usually be one of three things.

An information request

VARA asks what you do, for whom, through which entity and with what volumes, often with a list of documents. Every entity is subject to VARA investigation and must cooperate and provide the books and records requested. Article 23 of Dubai Law No. (4) of 2022 imposes the same duty on all persons and lets VARA go to court to seize information or documents if someone refuses. An information request is not a finding against you, but your answer will shape whether one follows.

An enforcement notice

A notice requiring non-compliance to be rectified within a set period. It usually identifies the activity or marketing VARA considers in breach and what it expects to happen.

A cease and desist direction

A direction to stop all activity associated with the violation, which can include stopping all marketing and announcing the suspension publicly. VARA's 2024 and 2025 actions both used this tool. A cease direction is not optional pending discussion: compliance comes first, argument second.

The first 72 hours

The deadline in the letter governs. These are the steps we take for clients in the first three days, whatever that deadline is:

1. Diary the deadline and read the instruction. Identify exactly what is asked for, by when, and whether there is any direction to stop.
2. Preserve everything. Suspend any routine deletion of chats, emails, wallet records and social posts. If marketing has to come down, archive it first: the Marketing Regulations require records of marketing to be kept for eight years.
3. Stop the activity if directed to, and stop new onboarding while the position is assessed even if not. Freeze campaigns, affiliate links and influencer posts too, because a firm remains responsible for marketing done for it by third parties.
4. Appoint one point of contact for VARA, and make sure nobody else in the business engages informally.
5. Build a fact file: which entity does what, where the people sit, which clients are in the UAE, what has been marketed and where, volumes and revenue.
6. Take legal advice before replying, then acknowledge receipt promptly. If the deadline is unrealistic, ask for more time in writing with a reason, before it expires.
7. Check notifications to your board, investors, insurers and, where relevant, any licensed partners.

What not to do

• Do not ignore it. VARA's fining factors expressly include conduct after the violation and during any investigation.
• Do not keep trading after a cease direction. VARA can impose periodic penalties for continued violation on top of any fine.
• Do not delete records or quietly rewrite the website and then describe the new version as the business.
• Do not claim to be licensed, pending or approved. Holding yourself out as a VASP when you are not is a separate breach, and so is misrepresenting a relationship with VARA or an ability to influence licensing.
• Do not move the business offshore overnight. A foreign company run by people in Dubai is still carrying on activity in the Emirate. Restructuring has to be real.
• Do not send a hurried, inconsistent answer. The first response becomes the record. Accurate and complete beats fast and wrong.

Is the activity actually in scope?

A VARA letter is not proof that you need a licence. The response should start with a proper perimeter analysis against Schedule 1 of the Regulations, the geography (VARA covers the Emirate, including free zones but excluding the DIFC), whether the activity is carried on by way of business, and the exemptions, including the Professional Exemption for lawyers, accountants and consultants whose involvement is wholly incidental to their practice. Three fact patterns come up repeatedly.

Crypto vouchers and gift cards

A merchant that sells, for cash or card, a voucher redeemable for bitcoin or another virtual asset is on its face soliciting or accepting orders for virtual assets and accepting fiat for them, which is limb (b) of Broker-Dealer Services. It makes no difference that the voucher is issued by an overseas platform: the sale happens in Dubai. Promoting the voucher is also marketing of a VA Activity. The analysis is different for a merchant that simply accepts crypto as payment for its own goods, which is not a Schedule 1 activity in itself but raises separate federal payments questions.

Unlicensed marketing

Since 1 October 2024, the Marketing Regulations have required all marketing of a VA Activity in or targeting the UAE to be carried out by a VASP licensed for that activity, or on its behalf and with its approval. Marketing is defined widely: social posts, videos, podcasts, events, airdrops and educational content can all qualify. Promoting an offshore exchange to UAE audiences, as an agency, affiliate or influencer, is the classic breach. There are exemptions for genuine journalism, education and private communications, but key opinion leaders cannot rely on them. A firm outside the UAE escapes the Marketing Regulations only if it is not located in Dubai, does no activity there and does not market into the UAE at all.

OTC activity

Buying and selling for other people, through a Telegram group, a shop counter or a WhatsApp list, is Broker-Dealer Services once it has regularity and a commercial element. Trading only your own money is not, although it needs a No Objection Certificate and registration at USD 250 million equivalent in a rolling 30 day period. The distinction is factual and VARA will test it against the records, so the honest answer is the only safe one. Our OTC desk guide covers the line in detail.

The remediation routes

Once the perimeter is settled, there are four ways out, and the right one depends on the business you want to have in a year's time.

• Stop. Cease the activity and the marketing permanently, document the wind-down, return client assets and confirm it to VARA. For a side line, such as a shop that sold vouchers, this is often the cleanest answer.
• Restructure. Redesign the model so it is genuinely outside the perimeter: non-custodial technology, proprietary trading only, or an offshore business that truly has no Dubai operations or UAE marketing. Restructuring that leaves the same people doing the same things from Dubai is not remediation.
• Apply. If the business should be regulated, start the licence process with an Initial Disclosure Questionnaire. Applying does not permit you to operate: even Approval to Incorporate does not allow virtual asset activity, so the activity stops until the licence is granted. The Broker-Dealer route is set out in our Broker-Dealer licence guide.
• Use a licensed partner. Restructure so that a VARA-licensed VASP provides the regulated service to the client, with your business marketing on its behalf with its approval or acting as a pure technology provider. The contracts and the customer journey must make the licensed VASP the real provider, not a name on a page.

The response to VARA should say which route you are taking, what has already been done and by when the rest will be done. A credible plan with evidence is worth far more than a promise.

The penalties context

Article 20 of Dubai Law No. (4) of 2022 provides for fines set by resolution and, for permit holders, suspension for up to six months or revocation together with cancellation of the commercial licence. The Regulations add reprimands, enforcement notices, cease and desist directions, public statements, coordination with licensing authorities over trade licences, and fines against Responsible Individuals personally.

Schedule 3 of the Regulations sets indicative fines. For unlicensed VA Activity, among other grounds, a company faces up to the highest of AED 50 million, 15% of annual revenue or 300% of profits gained or losses avoided, and an individual up to the higher of AED 20 million or 200%. Under the Marketing Regulations, unlicensed marketing of a VA Activity carries up to AED 10 million per violation, doubled for a repeat within a year. Unpaid fines accrue a further 1% a month, compounding. These are ceilings, and the published 2024 and 2025 outcomes were far below them, but they show how much room VARA has.

The same rules also reward the right response. VARA must weigh the seriousness of the violation, the firm's conduct after it and during any investigation, and its compliance history, and for a first violation of these kinds it may require remedial action instead of imposing an immediate fine. Any affected party may also lodge a written grievance with VARA's Director General within 30 days of being notified of a decision, which a committee decides within 15 days, and its decision is final. For the wider picture see our note on VARA penalties and do I need a VARA licence.

Frequently asked questions

What does it mean if VARA emails my company?

Usually that VARA believes your business may be carrying on or marketing virtual asset activity in Dubai without a licence. The email will typically be an information request, an enforcement notice requiring something to be rectified, or a direction to cease and desist. Each is a formal step under VARA's enforcement powers and has a deadline.

Do I have to answer a VARA information request?

Yes. The VARA Regulations require every entity to cooperate with VARA investigations and provide the records requested, and Article 23 of Dubai Law No. (4) of 2022 imposes a duty on all persons to give VARA the information it requires. VARA can apply to court to seize documents where someone refuses. Take advice first, but do respond within the deadline or ask for an extension before it expires.

Can I keep operating while I respond to a VARA cease and desist?

No. A cease and desist direction requires the activity, and usually its marketing, to stop. Continuing exposes the business to periodic penalties on top of any fine, and VARA weighs conduct after the violation when it decides the penalty. Stop first, then make your case.

Is selling crypto vouchers in a Dubai shop regulated by VARA?

On its face, yes. Selling a voucher redeemable for a virtual asset in exchange for cash or card is accepting orders for virtual assets against fiat, which falls within Broker-Dealer Services in Schedule 1 of the VARA Regulations. Promoting it is also marketing of a VA Activity. The merchant needs a licence, a restructure through a licensed VASP, or to stop.

How much can VARA fine a business for unlicensed activity?

Schedule 3 of the VARA Regulations sets indicative fines for unlicensed VA Activity of up to the highest of AED 50 million, 15% of annual revenue or 300% of profits gained or losses avoided for a company, and up to AED 20 million or 200% for an individual. Unlicensed marketing carries up to AED 10 million per violation, doubled for a repeat within a year. Published 2024 and 2025 outcomes were between AED 50,000 and AED 600,000 per firm.

Can I challenge a VARA decision?

Yes. Under Article 22 of Dubai Law No. (4) of 2022, an affected party may submit a written grievance to VARA's Director General within 30 days of being notified of the decision. A committee decides it within 15 days and its decision is final, so the grievance needs to be complete when it is filed.

This article is general information on the position at the date shown and is not legal advice. Token classification and licensing turn on the specific facts of each project; speak to us before relying on it.