MARKETING CRYPTO SERVICES IN THE UAE UNDER VARA
One framework for everything you say and where you say it — from ads, social, airdrops and influencers to app stores, events and cross-border campaigns from Dubai.
We design end-to-end marketing compliance for VASPs — message standards, disclaimers, targeting gates, influencer controls, event protocols, platform due-diligence, and 8-year records.
WHO MUST COMPLY —
SCOPE & DEFINITION
Marketing
“Marketing” covers any advertisement, invitation, inducement, solicitation, offer or promotion — across all media and channels, including social posts, blogs, livestreams, podcasts, billboards, sponsored content, branding/merch, airdrops, and “educational” materials that are promotional in effect. (Part I.A.1–2)
Applies to all entities
Applies to all entities (UAE-based or foreign), whether Licensed by VARA or not, whenever Marketing is in or targeting the UAE. (Intro; Part I)
Supersedes
Supersedes the 2022 Administrative Orders (with a 90-day transition from the effective date). (I.A.3–4)
CORE RULE: WHO MAY MARKET
VA ACTIVITIES
|
Marketing of a VA Activity in or targeting the UAE may be done only by (a) a VARA-Licensed VASP for that Activity, or (b) on behalf of and approved by such Licensed VASP. (I.B.3) |
|
Anonymity-Enhanced Cryptocurrencies: Marketing is strictly prohibited (and so are VA Activities involving them) in the Emirate. (I.B.4) |
WHAT YOUR MARKETING MUST (AND MUST NOT) DO — THE BASELINE STANDARD
|
Be fair, clear and not misleading, and clearly identifiable as marketing. |
|
Include prominent, non-contradictory risk messaging — extreme volatility, transfer/irreversibility limits, possibility of total loss, no financial protection, potential illiquidity, and public-DLT traceability. (I.C.2.c.i–v) |
|
Never: claim “safe/low risk/guaranteed returns”; trivialise or gamify decisions; use FOMO/urgency; imply credit-based acquisition unless you’re Licensed to provide it; or contradict risks via fine print. (I.C.2.e–i) |
|
Gate by audience: show only appropriate products to the right investor class (Retail/Qualified/Institutional) and prevent access for others. (I.C.2.j) |
|
Disclose paid promotions: if any third party posts content for remuneration or value in kind, label it clearly and prominently. (I.C.2.k) |
|
Incentives (monetary/non-monetary): must not distract from risks, run for an adequate period (no FOMO), and require VARA compliance confirmation with any conditions. (I.C.2.l) |
EXTRA RULES WHEN YOU MARKET A VIRTUAL ASSET— (TOKEN-LEVEL MARKETING)
|
No call-to-buy or direct “buy/sell now” instructions. |
|
Add explicit, prominent risk lines: volatility; you can lose all your money; no protection scheme. |
|
No unsolicited airdrops — do not send VAs to wallets without prior consent or expressed interest. (I.C.3) |
RECORDS & THIRD PARTIES — LIABILITY AND RETENTION
|
Keep complete records of all marketing and distribution for 8 years; furnish to VARA on request (subject to applicable laws). (I.C.4) |
|
If an agency/influencer markets on your behalf, you remain responsible; the third party must (i) diligence your eligibility, (ii) obtain your approval before publishing, and (iii) may be directly liable for non-compliance with its obligations. (I.C.5) |
LIMITED EXEMPTIONS — AND THE BIG NON-EXEMPTION
|
Journalistic & Educational content may be out of scope only where the overall purpose is not marketing; prominent interest disclaimers are required. (I.D.1–2) |
|
Personal/private communications can be out of scope — at VARA’s discretion. (I.D.3) |
|
Key Opinion Leaders (KOLs/influencers) do not qualify for the journalistic/educational exemptions; they must comply in full. (I.D.4) |
LIPLATFORMS, APP STORES &
TECH CONTROLS
|
Broadcasters, publishers, search engines, social platforms and any Entity that facilitates marketing must take commercially reasonable steps to ensure compliance — and keep 8-year records of their diligence. (I.E.1–2) |
|
App stores/platforms: any searchable/downloadable app in the Emirate that facilitates VA Activities must be owned/controlled by a VARA-Licensed VASP or otherwise approved by VARA, and operators must use geo-blocking/location filters to enforce. (I.E.3–4) |
LIPLATFORMS, APP STORES &
TECH CONTROLS
|
Broadcasters, publishers, search engines, social platforms and any Entity that facilitates marketing must take commercially reasonable steps to ensure compliance — and keep 8-year records of their diligence. (I.E.1–2) |
|
App stores/platforms: any searchable/downloadable app in the Emirate that facilitates VA Activities must be owned/controlled by a VARA-Licensed VASP or otherwise approved by VARA, and operators must use geo-blocking/location filters to enforce. (I.E.3–4) |
EVENTS IN DUBAI — HOW TO EXHIBIT
WITHOUT A LICENCE
a) Unlicensed entities can do limited marketing at physical events if they: don’t conduct VA Activities, don’t onboard UAE residents, comply with all I.C rules, and display a prominent disclaimer that they’re not Licensed or regulated by VARA. Messaging is restricted to name, logo, activity types/fees/commissions, and product education/demos. (I.F.1).
b) Event organisers/venues must vet audiences, keep attendee lists, obtain no-activity undertakings from exhibitors, and suspend/cancel on VARA notice with a public announcement citing non-compliance. (I.F.2)
MARKETING FROM DUBAI TO OTHER
COUNTRIES
If you are in the Emirate, you must also comply with the destination country’s laws when marketing there; VARA may co-operate with foreign authorities on breaches. (I.G.1–2)
SUPERVISION, FINES & REPEAT
VIOLATIONS
VARA may examine/enforce under Part IX of the VA Regulations, and impose fines per Schedule 1 of the Marketing Regulations. (Part II; Schedule 1)
- Fine bands include up to AED 10,000,000 per violation for major breaches (e.g., I.B.3; I.C.2; I.C.3; I.E.1; I.F.1–2; I.G.1), up to AED 2,000,000 for others (e.g., I.C.5; I.E.9), and up to AED 500,000 for platform record-keeping lapses — doubled for repeat violations within 1 year. Unpaid fines accrue a 1% monthly compounding surcharge. (Schedule 1, items 1–16)
What CRYPTOVERSE Legal delivers
Message standards
Message standards (risk statements, “no call-to-buy” controls, disclaimers library) and audience-gating by investor class.
Influencer & agency playbooks
Influencer & agency playbooks (contracts, approval workflows, remuneration disclosures).
Incentives governance
Incentives governance (VARA compliance confirmations; duration & fair-presentation controls).
Event protocols
Event protocols (exhibitor undertakings, “no onboarding” gates, organiser packs).
Platform & app-store diligence
Platform & app-store diligence (geo-blocking specs, store declarations, 8-year evidence packs).
Monitoring & audit
Monitoring & audit (archive of marketing assets, distribution logs, periodic testing and MI).
FAQs
Yes — full-time, UAE-resident/UAE-passport, VARA-approved; changes require approval (with emergency notice allowances)
Yes, but the individual remains accountable to VARA; VARA can require in-house staffing.
NLA ≥ 1.2× monthly opex, plus activity-based PUC, mandated insurance, and reserves = 100% 1:1 same VA.
Anything that could significantly affect the model/operations/VA activities or compliance posture (incl. scope changes, control shifts) — needs prior approval.