Issuing a token in Dubai: referenced tokens need a VARA licence, most others a licensed distributor

Three categories, fixed before the token is minted

VARA's Virtual Asset Issuance Rulebook binds every entity in Dubai that issues a virtual asset in the course of a business (Regulation II.A.1; Rule I.A.1). Dubai means the whole emirate, free zones included, but not the DIFC. The current version has applied since 19 June 2025; VARA's 2026 Guidance explains it but is expressly non-binding (Regulation I.B.4).

"In the course of a business" is read widely: VARA weighs how the issuer presents itself, scale and any commercial benefit, and includes foundations and non-profits. Category 1 issuance always counts; other issuance solely for personal or non-commercial use may not (Rule I.A.2).

Rule I.C.1 sorts every token. Fiat-referenced and asset-referenced tokens are Category 1; non-transferable and redeemable closed-loop tokens are exempt; everything else is Category 2, placed only through a VARA-licensed distributor. VARA classifies by the token's nature, rights and business model (Rule I.C.2), and anonymity-enhanced cryptocurrencies cannot be issued at all (Regulation II.C.1).

Category 1: referenced tokens need a licence and approval of each token

A fiat-referenced virtual asset (FRVA) purports to keep a stable value against one or more fiat currencies. An asset-referenced virtual asset (ARVA) is any other token that represents ownership of, or income from, a real-world asset, tracks one, or derives its value from one (Schedule 2). Real-world assets include interests in financial instruments, physical assets and intangible rights, but not purely digital items.

In the Guidance's examples, a token pegged to one ounce of gold is Category 1, and so is a token paying rental income and sale profits from Dubai properties, although holders own no property and cannot redeem. Under VARA's rules, property tokenisation projects therefore start from Category 1.

Category 1 issuance is a licensed VA Activity: the issuer becomes a VASP bound by four further VARA rulebooks (Rule I.D.2) and needs VARA's approval of each FRVA or ARVA (Rule I.B.2 of Annexes 1 and 2). Schedule 2 of the Regulations sets an AED 100,000 application fee and an AED 200,000 annual supervision fee, and lets VARA add fees, including for token approvals and whitepapers. The licence can be revoked if the token is not issued within six months of approval (Rule I.D.7).

Paid-up capital for an FRVA issuer is AED 1,500,000 plus 2% of the value of the token's available supply. An ARVA issuer needs at least the higher of AED 1,500,000 and 2% of the average market value of its reserve assets over the preceding 24 months, where it holds reserves (Annex 1, Rule III.F.1; Annex 2, Rule III.G.1).

Reserves, redemption and audits for referenced tokens

An FRVA must be at least 100% backed by reserves in its reference currency, held only as cash, cash equivalents or highly liquid instruments such as government debt maturing within 90 days, and segregated and beyond the issuer's creditors so far as the law allows (Annex 1, Rules III.B.1 to III.B.4). Every holder has an enforceable right to redeem at par, free of charge; requests from holders with a client agreement are met within one Working Day, or one Working Day after a significant disruption in the reserve markets ends (Rules III.C.1 to III.C.3). Supply and reserves are audited, attested to VARA and published monthly.

FRVAs may be used only within the virtual-asset ecosystem, not to pay for goods or services in the UAE (Rule I.B.5). A dirham-referenced token will not be approved by VARA and sits with the Central Bank (Rule I.B.4).

An ARVA issuer whose token conveys direct ownership must ensure that ownership is validly established, passes with the token and meets any legal requirements for transferring title (Annex 2, Rule III.B.1). One whose token claims a stable value needs segregated, unencumbered reserves and a legal opinion from a registered practising lawyer confirming that segregation (Rules III.C.3 and III.C.4). Redemption is optional, but if offered must include equal value in dirhams (Rule III.E.1). Audits are six-monthly.

Only a licensed FRVA issuer may market its token in Dubai as stable against its currency (Annex 1, Rule III.E.1), and only an approved, reserve-backed ARVA tracking one real-world asset may be called a "stablecoin" (Annex 2, Rule III.F.1); read literally, the second also catches FRVAs, and the Rulebook does not reconcile them. Issuers' marketing must also state that the token is outside any investor-protection or deposit-guarantee scheme and, for an FRVA, that holders may redeem at par and whether that right is directly enforceable against the issuer (Annex 1, Rule III.E.2; Annex 2, Rule III.F.2).

Category 2 and exempt tokens: no licence, but not unsupervised

A Category 2 issuer needs no licence or prior approval, but all placement and distribution must be done by a Licensed Distributor, a VASP licensed for Broker-Dealer Services, which takes responsibility for the issuer's compliance (Rules I.E.1 to I.E.3).

Under Part IV of the Broker-Dealer Services Rulebook, the distributor must ensure "beyond all reasonable doubt" the quality of the issuer and token, including AML and sanctions exposure, whitepaper compliance and smart-contract audits. It files the whitepaper, risk statement, a signed declaration and its due-diligence reports with VARA, and may place the token only after 15 Working Days without comment or objection, which is not approval (Rule IV.D.7).

Exempt VAs are narrow (Schedule 2): non-transferable tokens that cannot be sold, redeemed or moved, and closed-loop tokens redeemable only with the issuer or its designated merchants and not otherwise sellable or transferable. The Guidance's examples are commemorative badges and loyalty points (items I.23 and I.24). They need no whitepaper, but Part II's general rules still apply, and VARA still supervises (Rule I.F.2).

The whitepaper and risk statement are liability documents

Every non-exempt issuer must publish a whitepaper before issuing and before any public offer or marketing, with a separate risk disclosure statement in the same machine-readable, easily accessible location (Rules III.A.1, III.B.1, III.B.4 and III.C.1).

Schedule 1 sets the minimum content: owners, management, relevant convictions, three years of financial history and governance; supply, use of proceeds and holders' rights; governing law; the technology; the distributor; and offer terms in AED with a refund mechanism. If an omitted item later proves applicable, the whitepaper is non-compliant, and VARA will not confirm applicability in advance (Schedule 1, A.4 and A.5).

Issuers may not exclude, or try to exclude, civil liability for any disclosure (Rule III.B.3). The Guidance treats a disclaimer of liability "to the maximum extent permitted by law", and a "no reliance" statement, as breaches, and rejects generic risk wording.

Issuers must take all reasonable steps to tell holders of any change to the token before it takes effect, save changes against a security threat or to protect its integrity. Updates are dated, earlier versions stay accessible, and every version is kept for at least eight years after the token stops circulating (Rules III.B.6 and III.B.7).

Where VARA's rules meet the CMA and the Central Bank

Under CMA Decision No. 15/Chairman of 2025, security tokens and commodity contract tokens issued in or from the UAE follow CMA securities and commodity-contract rules (Article 3) and trade only on licensed venues or through licensed wallet providers (Article 12). The decision excludes virtual assets, and real-world-asset tokens unless they represent securities (Article 4), and stays in force under Article 27(4) of Federal Decree-Law No. 32 of 2025.

Because VARA's real-world assets include financial instruments, which the Guidance says covers anything that would be a security under CMA rules, a token over shares or bonds can read as a Category 1 ARVA in Dubai and as a security token federally. Federal law excludes securities from virtual assets (Article 1 of Federal Decree-Law No. 33 of 2025; Article 3(2)(b) of Cabinet Resolution No. 111 of 2022); Dubai Law No. 4 of 2022 does not. Classifying such a token is one to confirm with both regulators, through the client's regulatory counsel.

Only the Central Bank regulates payment tokenisation (Article 156 of Federal Decree-Law No. 6 of 2025). Its Payment Token Services Regulation bars issuing payment tokens in or into the UAE without its licence or registration (Article 2(1)) and bans algorithmic stablecoins (Article 2(3)). A dollar-pegged token is a foreign payment token (Article 1); issuer licences cover dirham tokens only, and foreign-token issuers may register only if incorporated outside the UAE or in a financial free zone (Articles 5 and 9). VARA's licensees must also follow applicable Central Bank rules (Regulation III.A.4(b)). Read together, the texts appear to leave a Dubai issuer outside the DIFC no route to issue a dollar-pegged token, a point worth confirming with both regulators.

Article 39(2) of Federal Decree-Law No. 33 of 2025 bars trading any virtual asset in the UAE unless it is listed on a CMA-licensed platform and registered with the CMA. The CMA's rulebook, Decision No. 04/Chairman of 2026 (in force 28 February 2026), also requires a CMA licence for financial services related to offering or selling virtual assets "from within or inside the State" and bars algorithmic and privacy tokens (Articles 4 to 6). Neither mentions locally licensed firms, yet Cabinet Resolutions No. 111 and 112 of 2022, which provide for local licensing, remain in force so far as consistent (Article 27(3) of Federal Decree-Law No. 32 of 2025). No text we have found reconciles them; the point is unresolved.

What founders settle in the issuing structure

First, a written classification, agreed with regulatory counsel: which category, why, and what change would move the token, since the new category's requirements must be met before any such change takes effect (Rule I.C.3).

Second, the issuer entity. A Category 1 issuer must be established in Dubai in a legal form the commercial licensing authority approves and obtain VARA's approvals before commercial licensing (Article 15 of Dubai Law No. 4 of 2022; Regulation IV.A.1). The whitepaper publishes its owners, managers and governance, so the registers, UBO records and board composition must match. The Rulebook addresses entities "in the Emirate" and is silent on a foreign issuer placing tokens in Dubai, though the distributor's duties and the Marketing Regulations, which reach marketing in or targeting the UAE, still apply.

Third, the reserve and backing documents: custody agreements, segregation that survives the issuer's insolvency, redemption terms, the legal opinion and, for property tokens, a chain of title that works in law and not only on-chain.

Fourth, signatures and records: board resolutions approving each whitepaper, risk statement and update; Senior Management attestations of reserve audits; the distributor agreement; and an archive of every published version. VARA may demand records, suspend issuance and impose fines (Rules IV.2 to IV.4), and issuing in breach of Regulation II.A.1 is a fine ground in Schedule 3 of the Regulations.

Getting the order right

The category, settled before any code or marketing copy, decides the rest; securities features add the CMA, and a single-currency peg the Central Bank.

This article describes UAE laws and regulators’ rules as of 2 November 2026. It is general information, not legal or investment advice. Polaris is not a law firm and is not licensed by VARA, the CMA, the Central Bank, the DFSA or the FSRA.