Do Offshore Crypto Companies Need a VARA Licence to Target UAE Users?

This is one of the most common questions in the Dubai market, and it usually comes from a very specific assumption:

“We are offshore, so VARA should not really apply to us.”

That assumption can be dangerous.

Because under the VARA framework, the legal analysis does not start with where the holding company is incorporated. It starts with:

• what activity the business is carrying on,
• where it is being carried on in or from Dubai,
• and whether the business is also marketing in or targeting the UAE. 

VARA’s official licensing page says that any firm seeking to carry on Virtual Asset activities in or from Dubai, excluding DIFC, has a legal obligation to be licensed before commencing operations. VARA’s marketing rules separately apply to all marketing of or relating to any Virtual Asset or VA Activity in or targeting the UAE, including by domestic and foreign entities, whether licensed by VARA or not.

That combination matters enormously.

It means offshore status is not a universal safe answer.

It also means “targeting UAE users” is not a casual marketing question. It is part of the regulatory perimeter analysis.

So if you are asking:

• Do offshore crypto companies need a VARA licence?
• Can an offshore crypto company target UAE users without a VARA licence?
• Can we market into the UAE from abroad?
• Can we operate from Dubai with an offshore parent?
• Does VARA apply to foreign crypto companies?

then this guide is built for you.

The most important thing to understand at the start is this:

Offshore incorporation does not answer the VARA question by itself.
The real questions are:

1. Are you carrying on a regulated VA Activity in or from Dubai?

2. Are you marketing in or targeting the UAE?

Those are the questions that determine exposure.

1) The short answer

The short answer is:

Yes, an offshore crypto company may still need a VARA licence if it is carrying on a regulated VA Activity in or from Dubai, even if the parent or wider group is incorporated abroad. VARA’s public licensing page and FAQ both say that any entity wishing to carry out regulated Virtual Asset activities and services in or from the emirate of Dubai must apply for a VASP Licence.

And separately:

An offshore crypto company can also create regulatory exposure through UAE-targeted marketing even if it is not physically based in Dubai. The Marketing Regulations say they apply to all marketing of or relating to Virtual Assets or VA Activities in or targeting the UAE, including by foreign entities and including entities that are not licensed by VARA.

So the answer is not a simple:

• yes, always,
  or
• no, never.

It depends on:

• where the regulated activity is carried on, and
• how the UAE is being targeted.

That is the real legal structure of the question.

2) Why offshore status is not a complete answer

A lot of founders still ask the question this way:

“We’re offshore — do we still need VARA?”

That phrasing is too narrow.

Why?

Because VARA’s licensing threshold is not written around the place of incorporation alone. It is written around carrying on VA Activities in or from Dubai. VARA’s public licensing page says exactly that, and the FAQ repeats that any entity wishing to carry out regulated Virtual Asset activities and services in or from the emirate of Dubai must apply for a VASP Licence.

That means the right threshold question is not:

“Where is the parent company incorporated?”

It is:

“Where is the regulated VA Activity actually being carried on from?”

If the answer is “from Dubai,” then the offshore label often does much less work than founders think.

This is especially important for businesses that have:

• an offshore holding company,
• a Dubai operating team,
• a Dubai office,
• management or execution in Dubai,
• or a Dubai commercial base serving global clients.

If the regulated activity is being carried on from Dubai, VARA can become directly relevant regardless of offshore structure.

That is why offshore structuring should never be mistaken for a substitute for real perimeter analysis.

3) The two separate legal questions offshore firms must ask

For offshore crypto companies, the VARA analysis usually breaks into two distinct questions.

Question 1: Are we carrying on a regulated VA Activity in or from Dubai?

This is the core licensing-threshold question. VARA says any entity carrying on regulated VA activities in or from Dubai must be licensed.

Question 2: Are we marketing in or targeting the UAE?

This is the separate marketing-perimeter question. The Marketing Regulations apply to all marketing of or relating to any Virtual Asset or VA Activity in or targeting the UAE, including by foreign entities and whether licensed by VARA or not.

Those two questions overlap, but they are not identical.

An offshore business may:

• not be operating from Dubai, yet still be targeting the UAE through marketing; or
• be operating from Dubai even if it says its customer base is international; or
• be doing both.

That is why the licensing analysis and the marketing analysis must both be done.

4) What counts as carrying on a regulated VA Activity?

VARA regulates activities, not branding language. Its public Licensed Activities page identifies the core regulated VA Activities as:

• Advisory Services
• Broker-Dealer Services
• Custody Services
• Exchange Services
• Lending and Borrowing Services
• VA Management and Investment Services
• VA Transfer and Settlement Services
• Category 1 VA Issuance.

So an offshore company may still need a VARA licence if it is carrying on one or more of those activities in or from Dubai.

This can include businesses that are:

• giving personalised VA recommendations,
• arranging or routing VA transactions,
• safeguarding client virtual assets or wallet access,
• operating an exchange or conversion venue,
• lending or borrowing VAs,
• managing VAs for others,
• transferring or settling VAs,
• or issuing Category 1 virtual assets.

This is one reason offshore firms get the Dubai analysis wrong. They often describe themselves in softer commercial language:

• infrastructure,
• platform,
• global exchange,
• DLT business,
• technology layer.

But VARA is interested in the function.
If the function is regulated and carried on in or from Dubai, the threshold can be crossed.

5) If you are operating from Dubai, global customers do not necessarily take you outside VARA

Some offshore-backed businesses take comfort from the fact that they do not plan to serve UAE users specifically.

That may not solve the problem.

VARA’s public licensed-activities page makes clear that licensing applies before firms can begin operations in or from Dubai, and the page also contemplates activities being offered to global customers from Dubai where permissible.

That means a company using Dubai as its operating base should not assume it is outside VARA just because its commercial target is international.

The more practical question is:

“Are we using Dubai as the place from which the regulated activity is conducted?”

If yes, the offshore/group structure and international customer base may not remove the need for licensing.

This is one of the most important points for cross-border crypto groups using Dubai for management, growth, or operational reasons.

6) What if the company is truly offshore and not operating from Dubai?

This is where the answer becomes more nuanced.

If an offshore company is not located in the Emirate, does not conduct any VA Activity in the Emirate, and does not carry out any marketing of or relating to any Virtual Asset or VA Activity in or targeting the UAE, then the VARA marketing rules expressly say the entity is not required to comply with those Marketing Regulations. That carve-out appears in the general prohibitions section of the Marketing Regulations.

That is important because it shows the negative space of the regime:

If the company is genuinely:

• not in Dubai,
• not conducting VA Activities in Dubai,
• and not targeting the UAE,
  then the VARA licensing and marketing regime is much less likely to be triggered.

But that is a narrow position.

The moment any of those assumptions change — for example:

• the company starts using Dubai operationally,
• hires and runs the regulated business from Dubai,
• or starts targeting UAE users

the analysis changes.

So the answer for a truly offshore company can be:
possibly no, but only if the facts really support that conclusion.

7) Targeting UAE users is not just a marketing footnote — it is a regulatory issue

This is the point offshore firms most often underestimate.

VARA’s Marketing Regulations 2024 say:

• they apply to all marketing of or relating to Virtual Assets or VA Activities in or targeting the UAE,
• they are applicable to all Entities, including domestic and/or foreign Entities,
• and they apply whether those entities are licensed by VARA or not.

The Rulebook guidance also says VARA will assess whether marketing is “in or targeting the UAE” in the context of the overall campaign, considering all channels and materials as a whole.

That is extremely important.

It means UAE targeting is not judged only by:

• whether your website has Arabic,
• whether you bought UAE-specific ads,
• or whether you explicitly name Dubai in one headline.

VARA can look at the overall campaign:

• channels used,
• content of the materials,
• how the service is framed,
• and whether the campaign as a whole is directed toward the UAE market.

So for an offshore crypto company, “targeting UAE users” is not a harmless growth tactic. It is part of the regulatory perimeter analysis.

8) Marketing of VA Activities in or targeting the UAE is tightly controlled

This is where things become especially clear.

The Marketing Regulations say that all marketing of or relating to any VA Activity in or targeting the UAE must only be carried out:

• by a VASP Licensed by VARA to carry out that VA Activity; or
• on behalf of, and approved by, a VASP Licensed by VARA to carry out that VA Activity.

That means an offshore crypto company targeting UAE users for a regulated VA Activity cannot safely assume:

• “we are offshore, so VARA marketing rules shouldn’t apply,” or
• “we are not yet licensed, but we can still build demand into the UAE first.”

The rule is much stricter than that.

This is also reinforced by VARA’s rulebook page that says businesses are not permitted to offer regulated virtual asset services or activities in Dubai without receiving VARA approval or a confirmation of no objection.

So if an offshore firm is:

• marketing regulated exchange services into the UAE,
• marketing custody, lending, brokerage, transfer, or other VA Activities into the UAE,
• or using UAE-targeted campaigns to build a client pipeline,

then VARA’s marketing perimeter is highly relevant even if the parent company sits abroad.

9) “We are only building awareness” can still create risk

A lot of offshore firms try to reduce the issue to branding language:

• “we are just raising awareness”
• “we are not onboarding yet”
• “we are just building a waitlist”
• “we are just attending events”

That can still create exposure.

The Marketing Regulations do not only regulate final onboarding moments. They regulate marketing of or relating to virtual assets and VA activities in or targeting the UAE.

And VARA’s guidance says the assessment is based on the overall campaign and whether it is in or targeting the UAE.

That means awareness-building can still be relevant if what is really happening is:

• demand generation for a regulated activity,
• public promotion of a regulated service,
• or market-facing activity directed at the UAE.

So “we’re only marketing” is not a safe shortcut around the regime.

10) What kinds of offshore companies are most at risk of needing a VARA licence?

The offshore firms most likely to need a VARA licence — or at least a serious VARA analysis — are typically those that do one or more of the following:

They operate from Dubai

The company may be offshore at group level, but management, team, or execution of the regulated service sits in Dubai. That can trigger the in or from Dubai analysis.

They target UAE users

The company markets virtual assets or VA Activities into the UAE through websites, campaigns, events, influencers, or UAE-directed customer acquisition. The Marketing Regulations directly address this.

They provide one of the listed VA Activities

If the offshore firm is actually an exchange, broker, custodian, lender, transfer rail, manager, adviser, or Category 1 issuer, the activity analysis becomes serious very quickly.

They rely too heavily on “infrastructure” language

VARA’s public activity page expressly says DLT service providers may still require licensing.

They assume offshore incorporation answers the question by itself

It does not. The real questions are function and nexus to Dubai/UAE.

11) When might an offshore company not need a VARA licence?

There are situations where an offshore company may genuinely sit outside the VARA licensing and marketing threshold.

That is more likely where the company:

• is not located in the Emirate,
• does not conduct VA Activities in the Emirate,
• and does not carry out marketing in or targeting the UAE. The Marketing Regulations expressly use those conditions together in the carve-out mentioned above.

In practical terms, that may mean:

• a foreign company with no Dubai operational presence,
• no carrying on of regulated VA Activity from Dubai,
• and no UAE-targeted virtual-asset marketing.

But this is a narrow factual position.

If the company:

• opens a Dubai office,
• manages the regulated business from Dubai,
• participates in UAE-targeted campaigns,
• or starts acquiring UAE users through crypto-service marketing,

then the analysis can change quickly.

So the safe conclusion is not:

“Offshore companies don’t need VARA.”

It is:

“Some offshore companies may sit outside VARA, but only where the Dubai/UAE nexus is genuinely absent.”

12) UAE targeting is judged holistically, not formally

One of the most important practical points for offshore firms is how VARA assesses targeting.

The Rulebook guidance says VARA will assess whether marketing is “in or targeting the UAE” in the context of the overall campaign, considering channels and content as a whole.

That means the following kinds of things can matter:

• UAE-focused messaging,
• UAE-specific landing pages,
• local partnerships,
• event participation,
• influencer campaigns,
• Arabic-language materials,
• Dubai/UAE references in paid campaigns,
• or any broader pattern showing the service is being promoted into the UAE.

In other words, firms should not expect the analysis to turn on one narrow formal criterion. VARA can look at the substance and direction of the campaign.

This is one reason offshore crypto companies need to be very disciplined before they begin UAE-facing growth.

13) The safest founder question is not “Can we get away with it?”

Founders sometimes ask this question in a very practical but dangerous way:

“Can we get away with targeting UAE users without a VARA licence if we stay offshore?”

That is not the right question.

The better question is:

“What is the actual regulatory nexus between our business and Dubai/UAE, and are we already stepping into VARA’s licensing or marketing perimeter?”

That is the useful legal question.

It forces the company to examine:

• where the activity is conducted from,
• whether any listed VA Activity is involved,
• whether the UAE is being targeted,
• and whether public conduct is getting ahead of regulatory footing.

That is the level of analysis serious crypto businesses should want before they build a Dubai/UAE strategy.

Final takeaway

If you want the cleanest practical answer to:
“Do offshore crypto companies need a VARA licence to target UAE users?”

it is this:

They may — and offshore status does not solve the problem by itself.

If the company is carrying on a regulated VA Activity in or from Dubai, a VARA licence may be required regardless of offshore incorporation. And even where the activity is not carried on from Dubai, marketing of or relating to Virtual Assets or VA Activities in or targeting the UAE is itself regulated by VARA’s Marketing Regulations, including for foreign entities.

So the real questions are:

• Are we carrying on a regulated VA Activity in or from Dubai?
• Are we marketing in or targeting the UAE?

Those are the questions that determine risk.

And for offshore crypto companies, getting them wrong can create avoidable exposure very early.

How CRYPTOVERSE Legal Can Help

At CRYPTOVERSE Legal Consultancy, we help offshore crypto companies assess whether their business model falls inside the VARA licensing perimeter or the UAE-targeted marketing perimeter. Our support includes regulatory nexus analysis, activity classification, Dubai operating-base review, UAE-targeting and campaign assessment, token and service perimeter analysis, and broader VARA licensing strategy.

CTA: If you want tailored guidance on whether your offshore crypto company needs a VARA licence to operate from Dubai or to target UAE users, contact CRYPTOVERSE Legal Consultancy to discuss your regulatory strategy.

FAQs