The rule most marketers still miss
The Regulations on the Marketing of Virtual Assets and Related Activities 2024 took effect on 1 October 2024, and they are still catching firms out well into 2026. The core idea is simple and easy to underestimate: if your marketing targets the UAE, VARA treats it as targeting Dubai by default, no matter where your company is based or which server the campaign runs from.
The rulebook itself is public. Read the full text on VARA's official Rulebooks portal, and browse the wider framework on VARA's regulations and guidelines hub.
Who is even allowed to market a virtual asset
Section B of the rulebook sets a hard gate before you write a single word of copy. All marketing of a VA Activity in or targeting the UAE must be carried out either by a VASP licensed by VARA for that specific activity, or by a party acting on behalf of, and approved by, that licensed VASP. There is no general exemption for foreign entities either. VARA only lets a firm skip the rules if it is not located in the Emirate, does not conduct any VA activity in the Emirate, and does not market to the UAE at all. Miss any one of those three conditions and the rulebook applies in full.
One category is banned outright regardless of licensing: marketing of Anonymity-Enhanced Cryptocurrencies, and any activity involving them, is strictly prohibited in the Emirate.
What your copy is not allowed to say
Section C sets out the content standard, and it is stricter than most performance marketers expect. All marketing must be fair, clear and not misleading, and must be clearly identifiable as marketing rather than editorial content. Beyond that baseline, the rulebook lists specific claims that are off limits.
- No suggestion that an investment is safe, low risk, or that returns are guaranteed
- No implication that investing is trivial, simple, or easy
- No claim that past performance predicts future results
- No urgency language or fear of missing out framing to push a decision
- No promotion of buying virtual assets on credit unless the entity is licensed by VARA to offer credit or interest-accruing facilities
- No contradictory small print, meaning a disclaimer cannot quietly cancel out a bold claim made in the headline
Token-specific ads carry two more requirements on top of all this. They cannot include a direct call to buy or sell, and they must carry a prominent disclaimer that the asset can lose value in full and that the holder has no financial protection.
● If a creator or publisher is paid or otherwise compensated to post about a virtual asset, that must be clearly and prominently flagged as a paid or remunerated arrangement, in every post, not just the first one. ● This applies to influencer content and sponsored editorial exactly as it applies to display ads.
Platforms, app stores and influencers are on the hook too
Section E extends responsibility beyond the entity running the campaign. Broadcasters, publishers, search engines, social platforms and app stores that facilitate marketing of a virtual asset targeting the UAE must take commercially reasonable steps to ensure that content complies, and must keep due diligence records for eight years. App store operators specifically must confirm that any listed app facilitating a VA activity is either owned by a VARA-licensed VASP or separately approved, and must be ready to apply geo-blocking where required.
Read the platform obligations in full under Part I, Section E of the Marketing Regulations.
Records, agencies and shared liability
Every entity marketing a VA activity or virtual asset to the UAE must retain records of that marketing and its distribution for a minimum of eight years, available to VARA on request. If a brand outsources marketing to an agency, both sides stay exposed. The instructing entity remains responsible for what the agency publishes on its behalf, and the agency itself can be held directly liable if it fails to run its own due diligence or skips getting sign off before a campaign goes live.
What non-compliance actually costs
VARA has full discretion to set fine amounts, but Schedule 1 of the rulebook gives the ceiling for each category of breach.
| Violation category | Maximum fine (AED) |
|---|---|
| Marketing a VA Activity without the required VASP licence or approval | 10,000,000 |
| Breaching the general content requirements (misleading claims, urgency framing, etc.) | 10,000,000 |
| Breaching the extra requirements for marketing a specific Virtual Asset | 10,000,000 |
| Non-compliant marketing carried out by a third-party agency | 2,000,000 |
| Facilitating non-compliant marketing as a platform or channel | 10,000,000 |
| Failing to keep required due diligence records as a platform | 500,000 |
| Non-compliant marketing at a physical event in the Emirate | 10,000,000 |
| Repeat violation within one year | Fine doubled |
These are not theoretical numbers. In a recent enforcement sweep, VARA penalized 19 VASPs in a single action for unlicensed activity and marketing breaches, with individual fines ranging from roughly AED 100,000 to AED 600,000, and every firm was ordered to stop operating and stop promoting immediately. VARA's enforcement division was blunt about the message: unlicensed activity and unauthorized marketing will not be tolerated.
Quick compliance checklist for content teams
- Confirm the entity behind the campaign is a VARA-licensed VASP, or is acting for one with approval on file
- Add the required loss-of-value and no-financial-protection disclaimer to any token-specific creative
- Strip out urgency language, guaranteed-return claims and buy-now calls to action
- Flag every paid or sponsored crypto post as remunerated content, not just the first in a series
- Set up an eight-year retention system for marketing assets and distribution logs
- Get written sign-off from the instructing brand before an agency publishes anything crypto-related
