Cabinet Decision No. 112/2022 is a pivotal regulatory milestone for the UAE’s virtual asset regulatory landscape—particularly for Dubai’s Virtual Assets Regulatory Authority (VARA). It formally delegates federal-level competencies to VARA, enabling Dubai to function with a quasi-autonomous framework for supervising and licensing virtual asset activities within the Emirate and its free zones (excluding DIFC).

Below is a structured interpretation of the decision through the lens of financial institutions, virtual asset service providers (VASPs), compliance teams, investment managers, and corporate governance officers.

Original source: VARA_EN_340_VER1

1. Regulatory Context and Objective

The decision builds on:

Cabinet Decision 111/2022: The federal backbone regulating virtual assets and service providers.
Dubai Law No. 4/2022: Establishes VARA as Dubai’s local VA regulator.
Federal AML/CFT law (Federal Decree-Law 20/2018).

Objective:
To empower VARA to act as the operational regulator for virtual assets in Dubai—bridging local oversight with federal policies and AML/CFT standards.

2. Key Delegated Powers to VARA (Article 2)

For financial practitioners, the following powers directly shape market participation, compliance, and risk exposure:

A. Licensing of Virtual Asset Activities

VARA is authorized to:

License virtual asset activities defined in Article 5(1) of Cabinet Decision 111/2022.
Supervise and control all related activities and service providers in Dubai.
Expand regulated activities subject to federal approval.

Implication:
Any VASP operating in Dubai must obtain a VARA license, regardless of whether it is federally registered. VARA is the lead supervisor in Dubai.

B. Regulatory Rule-Making

VARA may issue:

Rules governing virtual asset transactions.
Licensing mechanisms and operational standards for VASPs.

Important Constraint:
Rules must not contradict the Securities & Commodities Authority (SCA) decisions set under federal law.

Implication:
Market participants must monitor both VARA circulars and SCA federal policy, ensuring alignment with both jurisdictions.

C. Data Protection & Cybersecurity Compliance

VARA oversees:

VASP compliance with UAE data protection laws.
Mandatory reporting of cyber incidents, breaches, and cybercrime-related behavior.

Implication:
Financial institutions must implement:

Strong cybersecurity frameworks (ISO 27001 equivalent).
Incident reporting mechanisms compatible with VARA timelines.
Appoint a Data Protection Officer (DPO) if required under UAE PDPL.

D. AML/CFT Monitoring & Enforcement

VARA is delegated authority to:

Evaluate VASP adherence to AML/CFT controls.
Enforce suspicious transaction reporting aligned with Federal Decree-Law 20/2018.

Implications:

Firms must integrate FATF-aligned risk-based frameworks.
On-chain analytics, TRM/Chainalysis compliance tools may be required.
STR/SAR processes must meet UAE federal standards, not only VARA guidelines.

E. Investor Protection Responsibilities

VARA is responsible for:

Investor education and awareness campaigns.

Implication:
VASPs may be required to:

Provide clear disclosures.
Conduct suitability assessments for investors.
Disclose risk statements on trading interfaces.

F. Inspection, Compliance, and Fee Collection

VARA may:

Run compliance inspections.
Impose administrative penalties.
Collect licensing fees and share a portion with the federal government (as per agreement).

Implication:
Firms must prepare for:

Regular inspections.
Proactive compliance reporting.
Cross-regulator oversight (VARA + federal SCA).

3. Grievances and Appeals Handling

VARA may:

Receive and adjudicate appeals against penalties and administrative decisions.

Implication:
A specialized grievance process within VARA ensures:

Procedural fairness.
A structured dispute resolution channel.

4. Obligations and Operating Framework Between VARA and SCA (Article 3)

VARA must coordinate with SCA to ensure:

Unified regulatory consistency.
Unified supervision and fee-sharing mechanisms.

Implication:
Market participants may occasionally face:

Joint regulatory audits.
Overlapping compliance checks between VARA and federal authorities.

VARA can issue its own policies, provided they do not conflict with federal requirements—giving Dubai flexibility in regulatory innovation.

5. Scope of Application (Article 4)

VARA’s delegated powers apply only in Dubai and its free zones, excluding DIFC.
DIFC remains regulated by DFSA with its own Crypto Token Regime.

Implication:
VASP compliance obligations vary depending on location:

Dubai mainland & free zones → VARA
DIFC → DFSA
Rest of UAE → SCA

6. Effective Date (Article 5)

The resolution becomes effective on the same date as Cabinet Decision 111/2022.

Implications for Financial Practitioners

Strategic Impact for VASPs

Firms targeting Dubai must architect compliance around the VARA rulebook.
Dubai becomes a distinct regulatory market with its own licensing framework.
Potential for conflict-of-law scenarios requires sophisticated compliance mapping.

AML/CFT and Risk Governance

Enhanced reporting requirements (AML, sanctions, cyber incidents).
Higher scrutiny from both VARA and federal authorities.
Need for specialized compliance officers and blockchain forensics tools.

Operational Structuring

Financial institutions may need to:

Establish separate Dubai-focused legal entities.
Build segregated compliance processes depending on jurisdiction (VARA vs SCA vs DFSA).

Investor Services and Product Development

Products must align with both federal rules and VARA guidelines.
Marketing and client-risk-profiling rules may be stricter than global norms.

Fee & Penalty Structure

Firms must anticipate:
- Licensing and renewal fees.
- Potential federal sharing arrangements.
- Penalties for VARA violations and federal rule violations.

Conclusion

Cabinet Decision No. 112/2022 firmly positions VARA as the primary operational regulator for virtual assets in Dubai, with federated powers delegated from the SCA. For financial practitioners, this establishes Dubai as a robust, highly structured, and compliance-oriented jurisdiction for crypto markets—requiring strong AML/CFT controls, rigorous licensing, and continual regulatory engagement.

Key points of the “Cabinet Decision No. 112/2022” (UAE VA Framework)