- Dubai — VARA Marketing Regulations 2024
Marketing Crypto Activities in Dubai
One VARA framework governing what you say, how you say it, and where you say it — from ads, influencers, social media, and token promotions to events and cross-border campaigns targeting Dubai or the UAE.
🌐
"Marketing" is defined extremely broadly — any promotion reaching the UAE market may be captured
⚖️
Only a VARA-licensed VASP or an approved third party may market regulated VA Activities
🛡️
7 mandatory risk warnings must appear clearly — "DYOR" alone is not sufficient
👤
Influencers are not journalists — the licensed VASP remains responsible for all third-party content
📋
8-year record retention standard — materials, approvals, disclosures, and influencer arrangements
Scope & Application — Who Must Comply
VARA's Marketing Definition Is Extremely Broad — and It Reaches Foreign Entities Too
Under VARA's 2024 Marketing Regulations, "Marketing" includes any advertisement, invitation, inducement, solicitation, offer, or promotion — regardless of medium or channel. The rules apply to all marketing of or relating to Virtual Assets or VA Activities in or targeting the UAE. The perimeter is not limited to licensed firms in Dubai.
VARA's marketing rules capture both domestic and foreign entities — whether licensed by VARA or not. If your message reaches the UAE market and promotes a VA, a VASP, or a VA Activity, VARA's standards may apply. The central rule is simple: only a VARA-licensed VASP authorised for the relevant activity, or a third party acting on behalf of and approved by that licensed VASP, may market regulated VA Activities in the UAE.
Marketing a regulated VA Activity without the relevant licensing nexus can amount to a regulatory breach. This is especially important for offshore projects targeting UAE users, agencies and affiliates running paid campaigns, token issuers using influencers, and founders who assume "education" falls outside the perimeter.
🔴
Key Principle: If the activity requires VARA licensing, the marketing strategy must be built around the licensing position — not treated as a separate creative exercise. Marketing without a licensing nexus is a regulatory breach.
What "Marketing" Covers Under VARA
- Paid digital advertising — all formats and platforms
- Social media posts — including sponsored content and organic posts with promotional effect
- Influencer campaigns — whether remunerated or through product/access arrangements
- Websites and landing pages promoting VA Activities or virtual assets
- Token promotions and airdrops — including promotional QR codes and giveaways
- Blogs, videos, podcasts, and "educational" content that is promotional in effect
- Roadshows, events, exhibitions, and conference booths in Dubai
- Cross-border campaigns targeting UAE audiences from offshore
🌐
Any Channel
VARA's marketing definition is medium-agnostic — it applies regardless of channel or format
🛡️
7 Warnings
Mandatory risk warnings that must appear prominently in all VA marketing materials
📋
8 Years
Defensible record retention standard for all marketing materials, approvals, and disclosures
⚡
AED Millions
Administrative penalties for serious breaches — financial and reputational exposure is material
Core Marketing Standards & Obligations
The Baseline Standard, Mandatory Risk Warnings & Key Topic Rules
VARA's marketing framework operates across several interconnected obligation areas — from the baseline message standard and mandatory risk warnings through to specific rules for influencers, token promotions, events, and audience gating. Every area must be managed as part of an integrated compliance framework.
R 01
📐
The Baseline Marketing Standard
All marketing in or targeting the UAE must be fair, clear, and not misleading in substance and presentation — clearly identifiable as marketing or promotional in nature — and presented in a way that does not contradict required risk warnings through headlines, layout, visuals, tone, or small print.
What VARA Assesses
- The overall impression created by the content — not just isolated words
- The surrounding publication, website, visuals, and context
- Whether embedded promotional material contradicts the risk disclosures
- Whether the format itself is suitable — some media may be inherently inadequate
⭐
R 02
⚠️
7 Mandatory Risk Warnings
Where marketing relates to VAs, all seven of the following risk messages must be prominently reflected. They must be clear, visible, non-contradictory, and not diluted by the promotional message. A disclaimer like "Not financial advice. DYOR." on its own is typically not sufficient.
- Virtual assets may lose value in full or in part
- They may be extremely volatile
- The investor may lose all money or value invested
- They do not benefit from financial protection schemes
- They may be illiquid
- Transfers may be irreversible
- They may be subject to fraud, manipulation, theft, hacks, and similar risks
R 03
📱
Influencers, Agencies & Third Parties
Where marketing is carried out by influencers, affiliates, brand ambassadors, media agencies, or other third-party promoters, the licensed VASP remains responsible for compliance. Influencers are not journalists and do not benefit from the journalistic exemption under VARA.
Good Practice Includes
- Written approval before any content is published
- Approved scripts and pre-cleared disclosure language
- Contract clauses covering compliance obligations and takedown rights
- Monitoring of posts, comments, and edits after publication
- Clear and prominent disclosure where content is part of a remunerated arrangement
📋
The VASP cannot outsource its compliance responsibility to the influencer or agency
R 04
🚪
Audience Gating & Investor Classification
VARA requires that targeted marketing be undertaken responsibly and that only appropriate products or services be shown to the relevant audience. If a product is only available to a particular investor class, the marketing must be restricted accordingly. Marketing is not just about content — it is also about who sees the content.
Firms Should Implement
- Segmentation by investor type — retail, qualified, institutional
- Access controls on landing pages and campaign entry points
- Product-specific gating for higher-risk or restricted offerings
- Controls to avoid broad retail distribution where restrictions apply
📋
Audience targeting is a compliance obligation — not just a marketing optimisation
R 05
🟡
Token-Level Marketing
Token marketing receives heightened scrutiny under VARA. Content relating to a specific token or VA must include prominent warnings and avoid direct profit-focused messaging. "Buy now" or hype-style token promotion is a high-risk area — and VARA's illustrative examples treat phrases like "#UPONLY" or "will moon" as implying guaranteed returns.
Special Care Required For
- Airdrops — prior consent or expression of interest may be required
- NFT promotions — heightened disclosure expectations apply
- Giveaways and promotional QR codes
- Event-based token distribution
- Any VA transferred as part of a promotional campaign
🔴
“#UPONLY”, “will moon”, and guaranteed-return-style language are treated as non-compliant under VARA’s illustrative examples
R 06
🎪
Events & Exhibitions in Dubai
Unlicensed exhibitors at Dubai events must be very careful not to cross into regulated activity. VARA's rules apply at exhibitions, conferences, roadshows, and panels. If event activity creates a lead funnel, sign-up path, or token-acquisition prompt, VARA is likely to look more closely.
Unlicensed Exhibitors Must
- Avoid onboarding UAE residents at event booths
- Avoid execution or sign-up flows during or after sessions
- Avoid presenting themselves as licensed where they are not
- Use clear disclaimers wherever required
- Keep messaging within permitted informational or educational boundaries
🔴
Event organisers may also need to demonstrate due diligence over exhibitor compliance
R 07
🗂️
Recordkeeping & Retention
VARA expects firms to maintain complete records of all marketing activity — materials, workflows, channels, influencer arrangements, disclosures, and disclaimers. A defensible retention standard is 8 years. VARA can request these records at any time during supervision, examination, or enforcement processes.
What Must Be Retained
- All marketing materials — every version and format used
- Approval workflows — pre-publication sign-off records
- Channels and formats — where and how each campaign ran
- Influencer and agency arrangements — contracts and approvals
- Disclosures and disclaimers — as actually published
📋
8-year defensible retention standard — records must be retrievable on demand during VARA examinations
R 08
📰
Exemptions — But Do Not Over-Rely on Them
VARA recognises limited exemptions for certain journalistic or non-promotional content. However, VARA assesses the overall purpose of the content and the overall environment in which it appears. A genuine news article may be exempt. A promotional article dressed up as news is not.
The Distinction Matters For
- Founder interviews and CEO Q&As
- Blog content and explainer videos
- Event panels and conference presentations
- "Educational" social content that promotes a product or platform in effect
- Sponsored editorial that is promotional in overall impression
⚠️
Prohibited Conduct & Internal Governance
What You Must Not Do — and What "Good" Marketing Governance Looks Like
VARA's Marketing Regulations define a clear list of prohibited practices. Understanding what is explicitly prohibited is as important as understanding what is required — and building internal governance that prevents prohibited content from reaching the market is the foundation of a defensible marketing framework.
Marketing in Dubai Must Never
❌
Imply Safety, Low Risk, or Guaranteed Returns
State or imply that investments are safe, low risk, or that returns are guaranteed — in any format, headline, visual, or overall impression.
❌
Suggest Investment Decisions Are Simple or Trivial
Imply that acquiring or trading virtual assets is an easy, simple, or trivial decision — particularly where retail investors may be exposed.
❌
Use Past Performance to Imply Future Returns
Present historical performance data in a way that implies or suggests that past performance predicts future performance.
❌
Use Urgency, FOMO, or Time-Pressure Tactics
Deploy urgency messaging, fear-of-missing-out mechanics, countdown timers, or similar pressure tactics designed to bypass considered decision-making.
❌
Promote Credit-Funded VA Acquisition Without Licence
Promote acquisition of VAs using credit or interest-accruing facilities unless the relevant entity is specifically licensed by VARA for that activity.
❌
Bury Risk Warnings in Footnotes or Small Print
Conceal important risk warnings in footnotes, fine print, or locations that are obscured by the prominence of promotional content — warnings must be genuinely visible.
❌
Exploit Consumer Inexperience or Lack of Knowledge
Target or design content to exploit the inexperience or limited knowledge of consumers — particularly retail or unsophisticated investors.
What "Good" Internal Marketing Governance Looks Like
✔
Centralised Marketing Approval Workflow
All marketing materials — including social posts, influencer briefs, and campaign copy — go through a defined pre-publication compliance sign-off process before any content goes live.
✔
Standardised Risk Disclosure Library
Pre-approved, version-controlled risk warning language that can be embedded across all formats — digital, print, event, and social — ensuring consistency and non-contradiction throughout.
✔
Influencer & Affiliate Contract Templates
Written agreements with all third-party promoters covering compliance obligations, approved messaging, disclosure requirements, monitoring rights, and immediate takedown procedures.
✔
Distribution Logs & Archive Controls
Complete records of every piece of marketing material — channels used, dates, audience targeting, and the version of disclosures in place at the time — maintained to the 8-year defensible standard.
✔
Periodic Marketing Audits
Regular internal review of live marketing against the current VARA marketing standard — including social media profiles, landing pages, influencer content, and any live campaign materials.
✔
Board or Senior Management Oversight
Marketing governance sits at board or senior management level — with periodic reporting on marketing compliance performance, audit findings, and any escalated issues.
Supervision, Penalties & Compliance Checklist
VARA's Enforcement Powers — and the VARA-Ready Marketing Governance Checklist
VARA has broad supervisory and enforcement powers over marketing conduct. Administrative penalties can reach into the millions of dirhams for serious breaches — and the reputational cost of a marketing enforcement action can exceed the financial penalty by a significant margin.
What VARA Can Do
- Investigate Marketing Practices
- Conduct Examinations
- Impose Administrative Penalties
- Take Further Enforcement Action
🔴
VARA-Ready Marketing Governance Checklist
✔
Centralised marketing approval workflow in place
✔
Pre-publication compliance sign-off process documented
✔
Standardised risk disclosure library — all 7 warnings covered
✔
Influencer and affiliate contract templates in use
✔
Distribution logs and archive controls operational
✔
8-year retention standard applied to all materials
✔
Audience gating and investor segmentation implemented
✔
Periodic marketing audits scheduled and completed
✔
Board or senior management oversight of marketing governance
✔
Token-level marketing review process in place for campaigns
✔
Event participation compliance packs prepared for exhibitions
✔
Cross-border campaign review applied before UAE targeting
How We Help
VARA Marketing Compliance — What We Deliver
We help businesses build marketing strategies that convert without crossing the line — designing end-to-end marketing compliance frameworks that meet VARA's standards across every channel, format, and audience segment.
🏗️
Marketing Compliance Frameworks Tailored to VARA
We design the complete marketing governance framework — approval workflows, pre-publication sign-off processes, audience gating controls, and compliance policies — tailored to the specific activities, audience types, and marketing channels of the VARA-regulated business.
⚠️
Mandatory Disclaimer & Risk-Warning Libraries
We build standardised, version-controlled risk disclosure libraries covering all seven mandatory warnings — formatted for digital, social, print, event, and video channels — ensuring consistency, prominence, and non-contradiction across every marketing format used.
👥
Influencer & Affiliate Governance Toolkits
We design the influencer and affiliate compliance toolkit — including contract templates, approved messaging frameworks, disclosure language, monitoring protocols, and takedown procedures — ensuring the VASP can demonstrate active oversight of all third-party marketing activity.
🟡
Token-Level Marketing Review
We review token-specific marketing content — including campaign copy, social posts, airdrop communications, NFT promotions, and event-based token distribution materials — against VARA's heightened token marketing standards before publication.
🎪
Event Participation Compliance Packs
We prepare event-specific compliance packs for exhibitions, conferences, and roadshows in Dubai — covering permitted messaging boundaries, required disclaimers, onboarding restrictions, booth conduct rules, and the documentation needed to demonstrate due diligence at the event level.
🔍
Campaign Audit & Remediation
We conduct marketing audits against the current VARA standard — reviewing live campaigns, social media profiles, landing pages, influencer content, and historical materials — identifying compliance gaps and producing a prioritised remediation plan to close them efficiently.
🗂️
Regulatory-Ready Archive Systems
We design the recordkeeping and archive system to meet VARA's 8-year defensible retention standard — covering storage, indexing, and retrieval protocols for all marketing materials, approval records, influencer agreements, and disclosure logs in a format that supports rapid production during VARA examinations.
📊
Board-Grade Marketing Governance Design
We design the board-level marketing governance framework — including reporting lines, escalation procedures, periodic audit reporting, and oversight protocols — ensuring that marketing compliance sits at the right level of the organisation and is visible to senior management on an ongoing basis.
End-to-End VARA Marketing Compliance — From Framework Design to Campaign Review
- We design the complete marketing governance framework — approval workflows, risk libraries, influencer controls, and audience gating — before campaigns go live
- We review token-specific marketing content and event participation materials against VARA's heightened standards for those formats
- We conduct campaign audits and produce remediation plans that close compliance gaps efficiently without stopping marketing activity
- We build the archive and recordkeeping system to the 8-year defensible standard — ready for VARA examination at any time
FAQs
Frequently Asked Questions — VARA Marketing Compliance
Yes — but only if the structure, licensing position, disclosures, and messaging comply with VARA’s standards. The campaign must be run by or on behalf of a VARA-licensed VASP authorised for the relevant activity, must include the seven mandatory risk warnings prominently, must not use prohibited messaging such as guaranteed return language or FOMO tactics, and must be correctly targeted at the appropriate investor audience. Campaigns that meet these standards can operate — campaigns that do not create regulatory exposure for both the VASP and any agencies or influencers involved.
Very often, yes — especially where they are promotional in nature. VARA’s definition of “marketing” is broad enough to capture promotional airdrops, giveaways, and event-based token distribution. Where a VA is transferred as part of a promotion, VARA’s illustrative examples indicate that prior consent or a valid expression of interest may be required from recipients, together with appropriate disclaimers. Airdrops designed to acquire users or drive engagement — rather than reward existing participants — are particularly likely to fall within the marketing perimeter and require full compliance treatment.
Yes. VARA’s framework makes clear that influencers are not journalists and do not benefit from the journalistic exemption that may apply to genuine editorial content. More importantly, where an influencer markets a VA Activity, the licensed VASP remains fully responsible for the content — regardless of whether the influencer drafted it independently. This means every piece of influencer content must be pre-approved, must include the required disclosures, must be monitored after publication, and must be covered by contractual arrangements that give the VASP the ability to require takedowns or corrections.
The VARA Marketing Regulations apply to foreign entities too — where the marketing is in or targets the UAE market. The perimeter is not limited to VARA-licensed firms or entities physically present in Dubai. A foreign-based crypto project running social media campaigns, influencer content, or paid advertising that reaches UAE residents is potentially within VARA’s marketing perimeter. This is especially relevant for offshore projects that have not obtained VARA authorisation but are building UAE user bases through digital marketing or influencer activity.
No. VARA’s Marketing Regulations require prominent, clear, and non-contradictory disclosure of all seven mandatory risk warnings — covering potential total loss of value, extreme volatility, illiquidity, irreversibility of transfers, absence of financial protection, and vulnerability to fraud and hacks. A generic “Not financial advice. DYOR.” statement does not meet this standard. Disclosures must be substantive, prominently displayed, and not diluted or contradicted by the surrounding promotional content. Small-print or footnote placement is explicitly treated as non-compliant where the promotional message is significantly more prominent.
Ready to Build a VARA-Compliant Marketing Strategy?
Book a VARA Marketing Strategy Call
Whether you are reviewing an existing campaign, preparing a token launch, or building your marketing governance framework from scratch, VARA compliance must be designed into the strategy — not retrofitted after the fact.