The legal framework

Unlicensed virtual-asset activity in Dubai engages three overlapping enforcement regimes.

1. Dubai Law No. 4 of 2022 (the founding statute)

Article 17 prohibits the conduct of any Virtual Asset Service within VARA's perimeter without a licence. Breach is a criminal offence punishable by both administrative penalties and criminal sanctions. VARA is the primary enforcement authority and has powers to investigate, issue stop orders, impose fines, and refer to public prosecution.

2. The VARA Regulations 2023 and Rulebooks

The Compliance and Risk Management Rulebook sets out the supervisory framework, including fitness-and-propriety standards, AML/CFT obligations, and the consequences of operating without compliance. Each of the activity-specific Rulebooks (eight regulated activities, including VA Issuance) contains its own offence triggers.

3. Federal AML/CFT framework

Most unlicensed virtual-asset activity also engages Federal Decree-Law No. 10 of 2025 (which repealed and replaced Federal Decree-Law No. 20 of 2018 from 14 October 2025) (anti-money laundering and counter-terrorism financing) and Cabinet Decision 10 of 2019 (implementing regulations). Federal AML offences carry separate fines (up to AED 50 million) and imprisonment (up to 10 years), and apply to natural persons including directors and key staff.

The penalty tiers in practice

The tiers below reflect Neo Legal's observation of enforcement outcomes since 2023. They are a practice heuristic, not published VARA statistics:

Tier 1 — Administrative penalty (minor or unintentional breach)

  • Fines: AED 20,000 to AED 500,000 per breach.
  • Cease-and-desist order.
  • Public disclosure on VARA's enforcement register.
  • Requirement to apply for licence or wind down within a specified period (a period set in the notice).

Typical fact pattern: a company self-identifies it has crossed into a regulated activity (e.g. its advisory work has grown into a broker-dealer pattern), engages VARA voluntarily, ceases the activity, and applies for the correct licence.

Tier 2 — Substantive enforcement (deliberate or sustained breach)

  • Fines: AED 500,000 to AED 5 million per offence.
  • Permanent ban from holding a VARA licence (for the entity and named individuals).
  • Asset freezes pending investigation.
  • Director and beneficial-owner liability — fitness-and-propriety bars from future authorisation.
  • Public censure with reasons published.

Typical fact pattern: a company has been operating an exchange or custody service for months / years without authorisation, has accumulated meaningful client funds or volumes, and has not engaged with VARA voluntarily.

Tier 3 — Criminal prosecution (egregious or fraud-adjacent breach)

  • Fines: AED 5 million to AED 50 million per offence (each transaction or counterparty potentially a separate offence).
  • Imprisonment of directors and key personnel (federal AML offences carry up to 10 years).
  • Asset confiscation.
  • Referral to UAE Public Prosecution and potential federal-court trial.
  • Travel bans and Interpol notices in egregious cross-border cases.

Typical fact pattern: unlicensed virtual-asset activity combined with misrepresentation to investors, mishandling of client assets, sanctions breaches, or money-laundering indicators. The criminal lane is reserved for the worst conduct, but the threshold is not high once federal AML/CFT engages.

Personal liability of directors and beneficial owners

UAE corporate law generally provides a corporate veil, but enforcement under Law 4/2022 and Federal Decree-Law 20/2018 explicitly extends to natural persons who directed, authorised or knowingly permitted the breach. This includes:

  • Directors (including non-resident directors where they had decisional involvement).
  • Ultimate beneficial owners with effective control.
  • Senior managers and named "approved persons".
  • The MLRO, if the breach involves AML/CFT failure.

The practical consequence: a personal "fit and proper" bar from future VARA, DFSA, FSRA or CBUAE authorisation. For founders building a long-term financial-services career in the UAE, the regulatory bar is often more damaging than the fine.

What VARA enforcement actually looks like

From the cases we have observed:

  1. Tip or detection. VARA learns of unlicensed activity via market intelligence, banking-flow signals (CBUAE coordination), regulator-to-regulator referrals (FSRA, SCA), or whistleblower complaints.
  2. Information request. A formal request under VARA's investigatory powers, typically asking for activity scope, client volumes, capital, AML records and corporate-governance documents. Refusing to respond is a separate offence.
  3. Cease-and-desist. If unlicensed activity is confirmed, VARA issues a stop order pending resolution. Continuing to operate after the order is automatically Tier 2 / 3.
  4. Determination. VARA proposes a penalty tier. The company has a right to representations.
  5. Final order. Penalty imposed; published. Right of appeal exists but is rarely successful when the underlying breach is clear.

The remediation pathway — what to do if you're already operating

If a business is already operating an unlicensed regulated activity, the remediation path is materially better than waiting for enforcement. Steps:

  1. Pause the activity. Voluntarily stop the unlicensed conduct pending resolution. Document the stop.
  2. Engage counsel. Get a perimeter analysis and a remediation plan ready before approaching VARA.
  3. Voluntary disclosure. A pre-emptive approach to VARA, with a credible plan to either (a) wind down cleanly, or (b) apply for the correct licence, materially reduces penalty exposure.
  4. Restructure if needed. If the activity does not fit a VARA category but does need to be properly housed (e.g. true proprietary trading) the entity may need re-establishment in DMCC, IFZA, ADGM, DIFC or an offshore structure.
  5. Submit the IDQ. If pursuing a licence, the Initial Disclosure Questionnaire is the formal route.

In Neo Legal's experience of enforcement outcomes to date, voluntary disclosure cases have tended to resolve at the lowest tier, while detection-led cases have tended to attract materially higher penalties, together with the reputational cost of a public enforcement notice.

What we do

Neo Legal has run perimeter analyses, remediation projects and voluntary-disclosure engagements with VARA since the regime was established. The fastest enforcement-exit route depends on facts: an early conversation costs a fraction of waiting for the cease-and-desist.