Practitioner-focused summary of Cabinet Decision No. 111/2022 on the Regulation of Virtual Assets and Their Service Providers, framed specifically for financial practitioners operating or planning to operate under VARA Dubai.
Source: VARA_EN_339_VER1
This Cabinet Decision establishes the federal regulatory framework for Virtual Assets (VAs) within the UAE (outside Abu Dhabi Global Market and DIFC). For practitioners working in Dubai under VARA (Virtual Assets Regulatory Authority), this Decision represents the overarching legislative foundation under which VARA issues its rulebooks, conducts supervision, and enforces compliance.
Below is a detailed, structured summary oriented toward compliance, licensing, operations, and risk management for financial-sector stakeholders.
1. Regulatory Architecture and Jurisdiction
1.1 Federal-Level Authority (SCA)
The Decision designates the Securities and Commodities Authority (SCA) as the main federal regulator responsible for:
- Supervising virtual asset activities across the UAE, including Free Zones (but excluding the Financial Free Zones: DIFC & ADGM).
- Licensing and supervising Virtual Asset Service Providers (VASPs).
- Implementing AML/CFT controls in line with Federal Decree-Law No. 20/2018.
1.2 Local Licensing Authorities (LLAs) — Including VARA in Dubai
For Emirate-level administration, authorities such as VARA (Dubai) operate as delegated licensing bodies. The Decision gives LLAs jurisdiction to issue local licences and coordinate with SCA.
1.3 Applicability to VARA Dubai
Dubai’s Virtual Asset Regulatory Authority functions under this framework as:
- A local licensing authority, empowered by Dubai Law No. 4 of 2022.
- The primary regulator for VA activities conducted within Emirate of Dubai and its Free Zones (excluding DIFC).
For practitioners, the Cabinet Decision provides:
- The baseline legal definitions and national obligations VARA must enforce.
- The federal-level AML/CFT requirements that apply in addition to VARA rulebooks.
2. Scope of Virtual Asset Regulation
2.1 Activities Covered
The Decision specifies that all Virtual Asset Activities in the UAE—including in Free Zones—require approval. Core regulated activities include:
- Operating VA trading platforms.
- VA exchanges (VA-to-VA or VA-to-other forms).
- VA transfer services.
- VA brokerage services.
- Custody/management of VAs.
- Financial services related to issuance/offering of VAs.
This list is broadly consistent with VARA’s seven regulated activities (Broker-Dealer, Custody, Exchange, Management & Investment, Lending/Borrowing, VA Transfer, Advisory).
2.2 Exemptions
The Decision does NOT apply to:
- Digital securities or digital commodities regulated separately by SCA.
- Payment tokens and stored value facilities regulated by the UAE Central Bank.
- Financial Free Zones (DIFC/ADGM).
This division parallels VARA’s rules:
- Security tokens fall under SCA/DFSA.
- Payment tokens fall under Central Bank and are outside VARA’s remit except when listed for investment purposes with Central Bank approval.
3. Licensing Requirements for VASPs
3.1 Mandatory Licensing
“No Person may engage in Virtual Asset Activities … without obtaining approval and licence from the Authority or the Local Licensing Authority.”
This foundational rule underpins VARA’s strict licensing mandate.
3.2 Local Establishment Requirement
Applicants must:
- Be based in the UAE,
- Have an approved commercial legal form,
- Obtain initial approvals before commercial licensing.
This directly aligns with VARA’s requirement that all VASPs must incorporate a local entity (typically in Dubai mainland or Free Zones like DWTC).
4. Minimum Operational Requirements (Critical for Compliance Teams)
The Decision sets out several minimum conditions that VARA’s rulebooks expand on:
4.1 Fit-and-Proper Requirements
Individuals and partners cannot:
- Be on sanction/terrorist watchlists,
- Be under criminal investigation,
- Have been convicted of money laundering or terrorism financing.
4.2 Technical & Cybersecurity Standards
VASPs must implement:
- International-standard technical systems,
- Adequate cybersecurity,
- Data protection controls compliant with UAE law.
This corresponds to VARA’s Technology & Information Security Rulebook.
4.3 Capital and Guarantee Requirements
Providers must meet:
- Capital adequacy,
- Credit guarantee,
- Security and operational controls established by executive decisions.
VARA elaborates this in its Capital & Prudential Requirements Rulebook.
4.4 Risk Disclosure
VASPs must disclose all risks to investors in a clear, fair and non-misleading manner.
This matches VARA’s Market Conduct and Marketing rulebooks.
4.5 Incident Reporting
Providers must implement:
- Effective mechanisms to notify authorities of cyber risks, breaches, or suspicious behavior.
Under VARA, this forms part of the Information Security and Compliance & Risk Framework obligations.
5. AML/CFT Obligations (High Priority for Financial Institutions)
The Decision reaffirms that:
- All VASPs must comply with Federal Decree-Law No. 20/2018 and its implementing regulations — the UAE’s core AML/CFT legislation.
- FATF standards specifically applicable to VAs must be met.
For VARA practitioners, this translates to:
- Mandatory KYC, CDD, EDD.
- Travel Rule implementation.
- Mandatory suspicious transaction reporting (STRs) via the UAE FIU.
- On-chain analytics and blockchain monitoring (expected practice).
VARA’s Compliance & Risk and AML Rulebooks operationalize these high-level requirements.
6. Supervisory Framework and Enforcement
6.1 Authority Powers
The SCA (and by extension VARA for Dubai) may:
- Oversee activities,
- Issue decisions and regulatory instructions,
- Assess and monitor VASPs,
- Ensure AML/CFT compliance,
- Coordinate with Central Bank and LLAs.
6.2 Penalties (Severe and Multi-Level)
Penalties include:
- Warnings,
- Suspension of listing or trading,
- Suspension of technological tools,
- Closure of platforms,
- Licence suspension or revocation,
- Fines up to AED 10 million,
- Fines equal to illicit proceeds or avoided losses,
- Referral to Public Prosecution.
For VARA practitioners:
VARA enforces a similar — and in some cases stricter — parallel regime with administrative, civil, and criminal referrals.
7. Grandfathering and Transition for VASPs
All VASPs operating prior to the Decision must regularize their status within 3 months from the Decision’s entry into force, extendable by the Authority.
This forms the basis for VARA’s 2023–2024 enforcement drive requiring unlicensed entities to cease operations or seek licensing.
8. Strategic Takeaways for Financial Practitioners in Dubai (VARA Context)
8.1 Federal-Local Alignment
The Cabinet Decision establishes a federal umbrella law, while VARA provides the detailed operational rules.
Financial entities must comply with:
- Cabinet Decision No.111/2022 (federal level),
- Federal AML/CFT laws,
- VARA’s rulebooks (local licensing authority for Dubai),
- UAE Central Bank rules (if payment tokens are involved),
- SCA rules (if the asset is a digital security).
8.2 Cross-Border Operations Require Clear Categorization
VAT or crypto derivatives may fall under different regulator classifications. Legal structuring must consider whether an activity is:
- A VA activity under VARA/SCA,
- A payment activity under the Central Bank,
- A security activity under SCA/DFSA/FSRA.
8.3 Increased Enforcement Risk
The Decision equips regulators with significant enforcement powers. Practitioners should:
- Formalize compliance governance,
- Maintain audit-ready documentation,
- Implement blockchain analytics,
- Establish compliance technology for Travel Rule and AML.
8.4 Pathway to Licensing
Entities must prepare:
- Governance and fit-and-proper documentation,
- Technology and cybersecurity reviews,
- AML programs,
- Risk management frameworks,
- Capital adequacy planning.
These mirror VARA’s application process and FMP/MP authorizations.
Conclusion
Cabinet Decision No. 111/2022 is the legal backbone of the UAE’s virtual asset regime, providing the statutory framework that VARA Dubai builds upon. For financial practitioners operating under VARA, the Decision outlines mandatory high-level obligations around licensing, AML/CFT, investor protection, operational standards, cybersecurity, and supervisory cooperation.
Understanding these federal requirements is critical for:
- Structuring compliant VA operations,
- Preparing licensing submissions,
- Managing regulatory risk,
- Designing compliant financial products,
- Ensuring readiness for inspections or enforcement actions.
