UAE rules control who may market crypto and investment services, and what every advert must say

Two main regimes, both reaching across borders

Marketing a virtual asset or an investment service to people in the UAE engages at least two regulators, the Dubai Virtual Assets Regulatory Authority (VARA) and the Capital Market Authority (CMA), and both look at whom a campaign targets as well as where the firm sits.

VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024, effective from 1 October 2024, cover all marketing of virtual assets or VA Activities "in or targeting the UAE" by anyone, local or foreign, licensed or not (Marketing Regulation I.B.2). "Marketing" covers any advertisement, solicitation, offer or promotion in any medium, from social-media posts and events to airdrops and educational content (I.A.1 and I.A.2), subject to narrow exemptions. A VA Activity may be marketed only by a firm VARA has licensed for it, or on its behalf and with its approval (I.B.3), save for a limited exemption at physical events in Dubai (I.F.1). A foreign firm is outside the rules if it is not located in Dubai, carries on no VA Activity there and does no marketing in or targeting the UAE (I.B.5).

Federal Decree-Law No. 33 of 2025, in force since 1 January 2026, is the CMA's law for securities, funds and other financial products, including virtual assets for investment purposes. It lists "Promotion" and "Introducing Financial Activities" among the activities the CMA licenses (Article 3(1)(i) and (j)) and bars anyone from carrying on a financial activity in the State without a CMA licence or approval (Article 3(2)). It does not apply within the financial free zones (Article 2(4)(d)), but it reaches any person targeting clients in the State, even from abroad or from a financial free zone, where the activity is one the law regulates (Article 2(1)(d)). The CMA replaced the Securities and Commodities Authority (SCA), whose resolutions stay in force, so far as consistent with the new laws, until replaced (Articles 2(2) and 27(4) of Federal Decree-Law No. 32 of 2025).

The Central Bank runs a third regime. Under Federal Decree-Law No. 6 of 2025, "arranging, promoting, marketing" the activities it licenses, which include payment services using virtual assets, is itself a licensed activity, and their promotion in or from the State must follow that law (Articles 60(3) and 61(1)(f) and (h)). That law does not apply in the financial free zones (Article 2).

What VARA requires of the advert itself

Virtual-asset marketing aimed at the UAE must be fair, clear, not misleading and recognisable as marketing (Marketing Regulation I.C.2). It may not imply guaranteed returns, easy decisions, that past performance predicts results or that the audience must act now; it may not promote buying on credit unless the firm is VARA-licensed to provide that credit; targeted marketing must reach only the investor classes allowed to buy; and paid content must be clearly flagged.

Marketing a particular virtual asset adds further duties: no call to buy or sell, a prominent disclaimer that virtual assets may lose their value in full or in part and are subject to extreme volatility, a clear statement that the holder can lose all the money invested and has no financial protection, and no tokens sent to a wallet without consent or an expression of interest (I.C.3). VARA's non-binding Guidance shows that "Not financial advice. DYOR." falls short. Marketing anonymity-enhanced cryptocurrencies is prohibited outright (I.B.4).

Bonuses, referral rewards and gifts must not divert attention from the risks, must stay available long enough not to create urgency, and need a compliance confirmation from VARA (I.C.2.l). Firms keep a record of all marketing and its distribution for at least eight years after it last ran (I.C.4).

Agencies, influencers, events and app stores

A firm using an agency or other third party remains responsible for its marketing. The third party must itself check that the firm may market in or into the UAE, obtain the firm's approval before publishing, and is liable in its own right if it fails to do so (Marketing Regulation I.C.5).

Influencers and other "key opinion leaders" cannot use the journalistic or educational exemptions (I.D.4). In the Guidance's examples, a sponsorship note hidden in a corner of an image, or "#spon", is not enough: each paid post needs its own clear label, and the influencer is expected to confirm that the firm holds the VARA licence for the activity promoted.

Firms without a VARA licence may exhibit at physical events in Dubai if they carry on no VA Activity there, are licensed wherever they offer services, meet the marketing requirements in I.C, limit material to their name, logo, activities, fees and explanatory or educational content, state prominently that VARA does not license or regulate them, and onboard no UAE resident at the event (I.F.1). Organisers must vet attendees, keep an attendee list and obtain a signed undertaking from every exhibitor (I.F.2). App stores must ensure that apps downloadable in Dubai that facilitate VA Activities are owned or controlled by a VARA-licensed firm or approved by VARA (I.E.3).

The CMA side: promotion, introducers and finfluencers

In the CMA's rulebook of financial activities (Decision No. 13/Chairman of 2021), "promotion" means inviting or encouraging anyone to buy or subscribe for a financial product. Article 6 of its Section Three, Chapter Five, exempts from the promotion licence, among other cases, products listed on a CMA-licensed market, promotion to professional investors and counterparties (except foreign fund units) and proven "reverse promotion" of foreign securities at the unprompted request of an investor in the State. Separately, a product listed on no market is registered with the CMA before promotion, and foreign fund units may be promoted only by private offering to professional investors and counterparties.

"Introducing", inviting someone to contract with a licensed provider, carries its own duties (Article 7): the introducer may not be party to the service and must check the provider's licence, and since 30 April 2025 the provider must confirm that the introducer is CMA-licensed and sign a written agreement on roles and commission. Group and related-party introductions, and those by financial or legal consultants within their advice with commissions disclosed, need no introducing licence. The SCA's Circular No. 1 of 2024 calls hiring individuals or unlicensed companies to solicit clients "a clear violation" and required such contracts to end. Under Article 8 of Chapter Four, paid advertising specialists may market a licensed firm's services, but since 30 April 2025 only through mass media, never aimed at specific persons in any way, by telephone, mail, text or otherwise.

CMA Decision No. 10/Chairman of 2025 brings under a CMA registration regime natural persons on the mainland who give the public financial recommendations, including on virtual assets, and any other natural person in the State recommending an issuer, product, virtual asset or service the CMA regulates; recommendations made within a financial free zone are excluded (Article 2). Finfluencers show their registration number on every recommendation and disclose payments and interests; an issuer or licensed firm hiring one checks the registration, reviews content before publication and publishes its selection policy (Articles 5 and 6).

CMA-licensed virtual-asset firms follow Decision No. 4/Chairman of 2026, effective 28 February 2026: marketing names the firm and states that it is licensed by the CMA, risk warnings sit at or near the top of every page and stay fixed on screen in websites and apps, and marketing records are kept for six years (General Framework Module, Article 64; Business Regulation Module, Articles 14, 30, 31 and 103). Existing licensees have up to a year to meet the Business Regulation Module (Article 3 of the Decision). No one may, from within the State, issue or approve promotions of privacy or algorithmic tokens (General Framework Module, Articles 5(b) and 6(c)).

Where the rules overlap or leave gaps

The regimes can catch the same campaign. VARA's Marketing Regulations apply to marketing that targets the UAE, although VARA's remit is Dubai outside the DIFC, and its Guidance treats a UAE campaign as targeting Dubai unless every communication carves Dubai out. No text says how a UAE-wide virtual-asset campaign divides between VARA and CMA licences; until regulatory counsel has mapped the audience, we treat both as engaged.

DIFC and ADGM firms face similar layering. Article 41A of the DIFC Regulatory Law bars financial promotions in or from the DIFC except as DFSA rules allow; section 18 of ADGM's Financial Services and Markets Regulations restricts financial promotion there; and VARA's Marketing Regulations do not carve out firms regulated in either centre.

Other points are unclear. The finfluencer decision's mainland limb does not say whether Dubai's non-financial free zones count as mainland, and its State-wide limb covers only subjects the CMA regulates, so a Dubai free-zone influencer paid by a VARA-licensed exchange may or may not be caught, while one on the mainland may face both regimes. The CMA rulebook's "financial products" do not include virtual assets, while the 2025 law's definition does, and Decision No. 4/Chairman of 2026 lists no separate promotion activity; no text maps the two.

What a business checks before a UAE campaign

First, the audience: VARA's Guidance reads prices in dirhams, UAE imagery or celebrities, GCC-wide campaigns, chat groups aimed at UAE residents and the absence of geo-blocking as signs of targeting the UAE. Second, the licence covering each activity promoted (VARA, CMA, Central Bank, DFSA or FSRA), or the exemption relied on, recorded in writing.

Third, the people: agency agreements with an approval step, introducers' licences or exemptions and written commission terms, and influencers' CMA registration where it applies and a label on every paid post. Fourth, the content: the required disclaimers and risk warnings, no claims about returns, VARA's confirmation for incentives. Fifth, the records: the marketing archive, the firm's prior approval of each third party's marketing (I.C.5) and any finfluencer selection policy.

The cost of getting it wrong

VARA can fine up to AED 10 million per violation of the licensing, content and event rules, doubled for a repeat within a year (Marketing Regulations, Schedule 1). Financial activity without a CMA licence carries at least one year's imprisonment and a fine of AED 50,000 to AED 250 million, or either, extending to instigators and participants (Articles 71(1) and 74 of Decree-Law No. 33). Carrying on a Central Bank-licensed activity without a licence, promotion included, carries imprisonment and a fine of AED 50,000 to AED 500 million, or either (Article 170 of Decree-Law No. 6 of 2025). Under Cabinet Resolution No. 111 of 2022 and its penalty table in Cabinet Resolution No. 99 of 2024, both kept in force so far as consistent by Article 27(3) of Decree-Law No. 32, a first violation costs AED 500,000 plus closure of the headquarters for unlicensed virtual-asset activity (Resolution 111, Article 4(1); table item 1) and AED 100,000 for dealing with an unlicensed provider (Article 4(4); item 4).

Firm, agency, introducer and influencer each answer for a campaign, so every UAE campaign starts with one question: which licence, held by whom, covers what is promoted?

This article describes UAE laws and regulators’ rules as of 2 November 2026. It is general information, not legal or investment advice. Polaris is not a law firm and is not licensed by VARA, the CMA, the Central Bank, the DFSA or the FSRA.