Token issuance in Dubai is a regulated activity. Under the Virtual Assets Regulatory Authority (VARA) regime – the authority established by Dubai to license and supervise virtual-asset businesses operating on the mainland – any person offering, issuing or marketing a token to the public in or from Dubai must first determine whether the instrument falls within VARA's perimeter, and if so, under which of its activity-based rulebooks. That classification decision is the first legal question every issuer faces, and it is the question most likely to be answered incorrectly at the earliest stage of a project. This page maps the regulatory perimeter, the classification logic, the offering process, and the cross-border realities an inbound issuer must resolve before launch.
What does VARA's regulatory perimeter actually cover?
VARA's jurisdiction covers virtual-asset activities conducted in or from mainland Dubai, including the issuance, offering and marketing of tokens to any person, whether or not that person is located in the UAE. The regime is distinct from the financial free zones: the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM, regulated by the FSRA) each operate separate frameworks. An issuer choosing Dubai mainland is subject to VARA; an issuer choosing a free zone is subject to a different authority. That threshold choice – mainland versus free zone – is often the first structural decision an inbound project makes, and it has downstream consequences for banking, corporate structure and investor eligibility.
VARA's rulebooks are activity-based. The authority issues licences tied to specific activities: advisory services, broker-dealer services, custody, exchange, lending and borrowing, management and investment, and transfer and settlement. Token issuance is not a standalone licence category; rather, it is regulated as part of the activity through which the token is offered or sold. A project that issues a token and simultaneously operates a secondary-market facility requires an exchange licence alongside its issuance authorisation. A project that issues and then retains custody of tokens on behalf of investors requires a custody authorisation. The practical consequence is that most real-world token launches engage more than one activity category, and the licensing stack must reflect that reality from the outset.
VARA also applies its rules extraterritorially in a meaningful sense: marketing a token to persons in Dubai, or operating a digital platform accessible from Dubai, can bring an offshore issuer within the perimeter. Issuers domiciled in another jurisdiction who target UAE investors without first engaging VARA have encountered enforcement correspondence. In our practice, we have seen inbound projects underestimate this exposure, assuming that an offshore corporate structure insulates the offering. It does not, if UAE persons are solicited.
For a scoped assessment of where your token offering sits within VARA's perimeter and whether a free-zone structure serves your project better, contact OBOLUS at info@oboluslaw.com. The perimeter analysis and the corporate-structure question need to be answered together, before any public-facing communications are issued. Map your options.
How does VARA classify tokens – and why does the label not determine the outcome?
VARA's classification logic turns on the substance of the rights a token confers, not the name an issuer assigns to it in a whitepaper or marketing document. A token described as a "utility token" may nonetheless be treated as a security equivalent under the regime if it carries profit-sharing rights, governance rights over economic parameters, or a reasonable expectation of return tied to the issuer's efforts. The opposite is also true: a token labelled a "security token" by a cautious issuer may, on analysis, fall outside the regulated perimeter entirely if the rights it represents are genuinely consumptive and non-transferable.
VARA distinguishes, at a structural level, between virtual assets that are investment products and those that are purely functional. The investment-product analysis asks whether a token holder is in an economic position analogous to an equity or debt investor – bearing market risk on an asset whose value is driven by the issuer's business. If that analysis resolves positively, the issuer faces the requirements applicable to the management and investment or broker-dealer activity categories, depending on the distribution model. If the token is a stablecoin (a token designed to maintain a stable value relative to a reference asset), VARA's stablecoin-specific rulebook applies, and the reserve, redemption and disclosure expectations are materially different from those applying to investment tokens.
A common assumption among project teams is that placing a "utility label" on a whitepaper settles the classification question. It does not. Regulators – including VARA – assess classification against the substance of what the token does and what rights it carries, not against the marketing terms an issuer chose. We assess classification against the substance of rights; the label is a starting point for analysis, not a conclusion. Misclassifying a token risks converting a product launch into an unregistered offering of a regulated instrument, with the enforcement exposure that follows.
Classification is not a one-time exercise. If the token's rights or the platform's mechanics change after launch – through governance amendments, the introduction of yield features, or secondary-market facilitation by the issuer – the classification may shift. Projects should build a classification-review trigger into their governance process so that any material change to token economics is reviewed against the applicable VARA category before implementation.
What is the process for a regulated token offering under VARA?
A regulated token offering under VARA requires the issuer to obtain the relevant activity authorisation before any public offer commences. The process involves a pre-application engagement with VARA, submission of a detailed application covering the issuer's corporate structure, the token's technical architecture, the rights it confers, the intended investor base and the distribution mechanics, followed by VARA's review and approval. VARA operates a whitepaper disclosure requirement for offerings within its perimeter: the whitepaper must meet prescribed content standards covering the issuer, the project, the rights attached to the token, the risks and the technical specifications.
The application process is not purely documentary. VARA engages with applicants through the review phase, and the quality of the initial submission has a direct bearing on the speed and outcome of the process. Applications that present a clear classification rationale, a well-structured corporate diagram and a technically precise description of the token's smart-contract mechanics tend to move more efficiently through review. Applications that present an unclear or internally inconsistent classification argument, or that describe the token's rights in aspirational rather than precise terms, attract requests for further information that extend the timeline.
Timelines vary by activity category and by the completeness of the application. Rather than stating a specific number of weeks, the practical guidance is that an issuer should plan for a multi-month engagement from initial pre-application meeting to final authorisation, with the pre-application preparation phase being at least as important as the formal submission. In our practice, issuers who engage VARA in pre-application dialogue before filing tend to experience fewer post-submission queries.
The offering documentation – the whitepaper, any investor-facing marketing materials, and the smart-contract specifications – must be finalised and approved before public distribution. VARA's rules prohibit any public communication about a forthcoming offering that is inconsistent with the approved whitepaper. The compliance obligation runs from pre-launch through to the close of the offering period and, for ongoing token programs, on a continuing basis.
How does the cross-border reality affect a Dubai token issuance?
Most Dubai-based token issuances involve a cross-border element that the VARA authorisation alone does not resolve. A Dubai issuer offering tokens to investors in the European Union is simultaneously within the MiCA regime administered by ESMA and the relevant national competent authority. MiCA's whitepaper and CASP-authorisation requirements apply to crypto-asset offers made to EU persons, regardless of where the issuer is domiciled. A Dubai issuer with EU investors therefore faces a dual regulatory obligation – VARA and MiCA – and the documentation requirements, though overlapping in structure, are not identical.
The same logic applies to Singapore (MAS, Payment Services Act), Hong Kong (SFC, VATP regime) and the United Kingdom (FCA, financial promotion rules). Each jurisdiction where the issuer solicits investors or makes an offer may impose its own classification and disclosure requirements. The practical consequence is that a token's legal profile is not determined solely by the law of the issuer's home jurisdiction; it is determined by the aggregate of obligations arising in every jurisdiction where the offer reaches. An offer that is clean under VARA may still engage securities law in a jurisdiction where the token is classified differently.
Banking adds a further layer. UAE banks have historically applied conservative onboarding standards to virtual-asset businesses, even those holding VARA authorisation. An issuer should not assume that obtaining a VARA licence automatically resolves the banking question. In practice, the banking relationship for a token issuer often involves an account in a jurisdiction other than the UAE – or a combination of a UAE operating account with offshore treasury accounts. Tax and corporate-structuring considerations then arise from that multi-jurisdiction banking footprint, and those considerations should be modelled before the corporate structure is finalised.
How should airdrops and promotional distributions be structured under the VARA regime?
Airdrops – gratuitous distributions of tokens to a defined or open population of recipients – are not automatically outside VARA's perimeter simply because no consideration is paid. The classification question turns on the same substance-of-rights analysis that applies to a paid offering: if the airdropped token carries investment characteristics or if the airdrop is designed to create secondary-market demand and thereby generate economic value for the issuer, VARA may treat the distribution as a regulated activity. The absence of a sale price does not, by itself, remove the offering from the regulated category.
For an airdrop to sit outside the regulated perimeter, the token must genuinely be a functional instrument with no investment characteristics, the distribution must not be designed to create or stimulate secondary-market trading, and the whitepaper and marketing materials must not represent the token as an investment opportunity. Structurally, the cleanest approach is to treat an airdrop as a subset of the wider offering classification exercise: if the underlying token requires VARA authorisation for a paid offering, the airdrop of the same token is likely subject to the same framework.
Geographic restrictions matter. Even a structurally clean airdrop should exclude recipients in jurisdictions where the distribution would engage a separate regulatory obligation. This typically requires a geofencing mechanism and a terms-of-distribution document that establishes the scope of the exclusions. Failure to implement geographic restrictions has caused enforcement attention in multiple jurisdictions, and VARA's extraterritorial sensitivity makes the UAE no exception.
A recent cross-border issuance – what the process looks like in practice
In a recent matter, a technology company based in a Gulf hub sought to issue a token that conferred governance rights over a protocol and a proportionate share of fee revenues generated by the protocol. The company's initial classification was "utility token." On review, the combination of governance rights and revenue participation created a profile that aligned more closely with an investment instrument under the applicable regime. We restructured the token economics to separate the governance function from the revenue-sharing mechanism, producing two distinct instruments: a governance token with no financial return and a separate participation certificate for accredited investors. The former proceeded as a free functional distribution; the latter was structured as a private placement to a limited qualified-investor pool, avoiding a public offer. The outcome was a compliant launch with a materially smaller regulatory footprint than the original design would have required.
Which issuer profile should engage VARA for a token offering – and when?
Not every token project needs a full VARA authorisation. The decision turns on the combination of the token's classification, the intended investor base and the distribution mechanism.
A project issuing a purely functional token – one that can only be redeemed for access to a service, carries no transferable value in the secondary market, and is not marketed as an investment – may fall outside the regulated perimeter entirely, or may require only a registration rather than a full activity licence. The pre-application dialogue with VARA is the appropriate forum to test that hypothesis before any public-facing steps are taken.
A project issuing a token with investment characteristics – profit-sharing, revenue participation, governance over economic parameters – requires a full VARA authorisation under the relevant activity category before any offer to the public. For that profile, the timeline and cost of authorisation should be built into the project's capital plan and launch timeline from inception, not addressed after the fundraising narrative is already public.
A project with a primarily European investor base may find that a MiCA CASP authorisation in an EU member state, combined with a lighter VARA registration for any UAE-specific activity, produces a more efficient regulatory footprint than a full VARA authorisation. The reverse – a VARA-first structure with EU investors accessed under a private-placement analysis – is also viable for certain profiles. The right answer depends on where the majority of investors sit, what secondary-market infrastructure is planned, and what the issuer's long-term operational hub will be.
If your offering structure is at the decision point and you need a clear classification analysis before committing to a jurisdiction, write to OBOLUS at info@oboluslaw.com. We map the classification, the licence stack and the cross-border obligations as a single scoped engagement. Map your options.
Related at OBOLUS
- Token Offerings & Securities Practice – the full scope of our token-issuance and securities-law counsel for digital-asset businesses
- Utility Token Legal Opinion – a formal legal opinion on token classification for institutional clients and their counsel
- Digital Asset Counsel for Institutional Investors – cross-border legal advisory for funds, family offices and institutional investors with digital-asset exposure
FAQ
Is my token a security?
Classification turns on the substance of the rights the token confers, not the label applied to it. If the token carries profit-sharing, revenue participation or an expectation of return tied to the issuer's efforts, it may be treated as a security equivalent or investment instrument under the VARA regime and under the securities laws of every jurisdiction where the offer reaches investors. A formal classification opinion, assessed against the applicable regulatory regimes in each relevant jurisdiction, is the correct first step before any public communication about the offering.
Do I need a MiCA whitepaper?
If your token offer reaches persons in the European Union or EEA, MiCA's whitepaper and disclosure requirements apply, regardless of where the issuer is domiciled. A Dubai issuer with EU investors therefore faces both VARA's whitepaper requirements and MiCA's, and the two sets of requirements, while structurally similar, are not identical. The practical approach is to draft a single disclosure document that satisfies the higher standard across both regimes, then adapt it as needed for jurisdiction-specific requirements.
How should an airdrop be structured legally?
An airdrop is not automatically outside the regulated perimeter. If the distributed token carries investment characteristics or the distribution is designed to stimulate secondary-market demand, it may engage VARA's offering rules and equivalent rules in any other jurisdiction where recipients are located. The structuring steps are: classify the token on its substance; establish geographic exclusions for jurisdictions where the distribution would create regulatory exposure; prepare a terms-of-distribution document; and, if the token requires authorisation for a paid offering, treat the airdrop as subject to the same framework.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label – a discipline that protects issuers from the enforcement exposure that follows misclassification. To discuss your offering, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token issuance structures, smart-contract legal analysis and cross-border offering compliance under VARA and equivalent digital-asset regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.