TRW & Co · Fintech and virtual assets
VARA Marketing Rules: How to Promote Virtual Assets in Dubai
The VARA marketing rules require any promotion of virtual assets in or targeting the UAE to come from, or be approved by, a VARA-licensed service provider. Every promotion must be fair, clearly labelled and carry a prominent volatility disclaimer, and influencers, agencies and platforms share responsibility. Fines can reach AED 10 million, and VARA has already penalised unlicensed marketers.
Key pointCompliance starts with the sender, not the wording: a perfectly drafted post still breaches the rules if the platform behind it is not VARA-licensed for the activity promoted, so licence checks must come before creative review.
At a glance
Regulations in force
VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024 took effect on 1 October 2024, replacing its 2022 administrative orders on marketing and penalties.
Licensed senders only
Marketing in or targeting the UAE must be carried out by, or on behalf of and approved by, a VARA-licensed VASP for the relevant activity.
UAE means Dubai
VARA treats marketing targeting the UAE as targeting Dubai unless Dubai is excluded in every communication, assessing language, currency, imagery and influencers used.
Mandatory risk disclaimer
Promotions must prominently state that virtual assets may lose value in full or in part and are subject to extreme volatility, with no financial protection.
Fines and enforcement
Fines can reach AED 10 million; in October 2025 VARA announced penalties on 19 firms for unlicensed activity and marketing breaches.
Swipe or scroll →
The VARA marketing rules decide who may promote crypto and other virtual assets to people in Dubai and, in practice, across the UAE. Since 1 October 2024, the Virtual Assets Regulatory Authority's Regulations on the Marketing of Virtual Assets and Related Activities 2024 have required that such marketing be carried out by, or on behalf of and with the approval of, a VARA-licensed virtual asset service provider.
This guide explains the scope of the rules, what every promotion must contain, how influencers, agencies and event organisers are caught, how VARA enforces, and the practical steps that keep a campaign compliant.
VARA marketing rules: the short answer
- Who may market: a VARA-licensed virtual asset service provider (VASP), or someone acting on its behalf and with its approval, for an activity the VASP is licensed to carry on.
- Where the rules bite: any marketing in or targeting the UAE. VARA treats UAE-targeted marketing as targeting Dubai unless Dubai is clearly carved out.
- What every promotion needs: fair, clear and not misleading content, clear labelling as marketing, and a prominent risk disclaimer that virtual assets may lose value in full or in part and are subject to extreme volatility.
- What is off-limits: guaranteed or low-risk claims, urgency and fear of missing out, implying investing is easy, and any marketing of anonymity-enhanced cryptocurrencies.
- The stakes: fines under the Regulations can reach AED 10 million, alongside cease-and-desist orders and action against licences.
The VARA marketing rules sit beside, not instead of, the federal media permit regime and the financial promotion rules of the other UAE regulators. A campaign can comply with one and still breach another.
The legal framework and the regulators
Dubai law and VARA's regulations
VARA was created under Dubai Law No. 4 of 2022 on the Regulation of Virtual Assets. Its core licensing regime is the Virtual Assets and Related Activities Regulations 2023, supported by compulsory and activity-specific rulebooks published on the VARA rulebooks portal.
Marketing has its own instrument. The 2024 Marketing Regulations took effect on 1 October 2024 and replaced VARA's two 2022 administrative orders on marketing and penalties. VARA also issued non-binding Guidance on the Marketing Regulations, with worked examples of compliant and non-compliant posts, podcasts and chatroom messages.
Other regulators in the picture
VARA's perimeter covers Dubai, including its free zones, but not the DIFC, where the Dubai Financial Services Authority applies its own crypto token and financial promotion rules. ADGM in Abu Dhabi has the FSRA. At federal level, the Securities and Commodities Authority has become the Capital Market Authority, which supervises onshore activity outside Dubai's virtual asset regime. Our guide to which regulator applies maps these perimeters.
Separately, individuals who publish promotional content in the UAE need a federal advertiser permit. That regime is explained in our guide to the UAE advertiser permit; it is a media licence and does not authorise anyone to market virtual assets.
| Situation | Main regime | Practical consequence |
|---|---|---|
| Promotion in or targeting Dubai or the wider UAE | VARA marketing rules | Must be by, or approved by, a VARA-licensed VASP and meet content rules |
| Firm based in the DIFC promoting crypto tokens | DFSA rules | DFSA financial promotion and crypto token regime; check the position separately before marketing beyond the DIFC |
| Firm based in ADGM | FSRA rules | FSRA authorisation and conduct rules for virtual asset activity |
| Creator posting paid content from the UAE | Federal advertiser permit plus VARA rules | Needs the media permit and must act for an approved VASP |
| Foreign firm with no Dubai presence, no Dubai activity and no UAE targeting | Outside VARA's marketing scope | All three conditions must be met; VARA looks at the campaign as a whole |
Scope: what counts as marketing and when the UAE is targeted
Marketing is defined very broadly. It covers advertisements, invitations, solicitations, offers and promotions in any medium: social media posts, blogs, endorsements, videos, podcasts, live streams, chatrooms, events in Dubai and even airdrops. VARA looks at content, audience, distribution, relevance to virtual assets, commercial purpose and intent.
How VARA assesses targeting
The VARA marketing rules apply to marketing "in or targeting" the UAE. The Guidance lists non-exhaustive indicators: UAE locations, UAE-specific press, pricing in AED, Emirati dialect, UAE or Dubai imagery, UAE-based influencers with local followings, and UAE-focused chat groups or social pages. GCC-wide campaigns are included by default.
VARA assesses the campaign as a whole, across every channel. Marketing that targets the UAE is treated as targeting Dubai unless Dubai is explicitly excluded in every communication.
The narrow out-of-scope route
Marketing from outside the UAE falls outside the regime only where three conditions are all met: the entity is not located in Dubai, it carries on no virtual asset activity in Dubai, and it does not market to or target the UAE. Geo-blocking, language choices and the absence of local influencers matter when demonstrating this.
What every compliant promotion must contain
The content standards are where most campaigns succeed or fail. The VARA marketing rules and Guidance set out the following core requirements.
- Fair, clear and not misleading. Plain language, legible or audible key information, a balanced picture of risks and benefits, and accurate statements about regulatory status. Nothing may imply that VARA endorses a product.
- Identifiable as marketing. Where the promotional nature is not obvious, label it with words such as "ad" or "advertisement".
- Sponsored content disclosed. Paid or otherwise rewarded content must say so and name the sponsor. Remuneration includes non-monetary benefits.
- The risk disclaimer. A prominent statement that virtual assets may lose their value in full or in part and are subject to extreme volatility, together with a clear statement that investors can lose everything and have no financial protection.
- Disclosure of interests. Authors should disclose ownership, employment or other benefit linked to the asset they discuss.
Making the disclaimer prominent
VARA's Guidance expects disclaimers to be legible, proportionate, close to the main content, unobscured and shown long enough to be read. Audio content should repeat the disclaimer at the start and end, and video should use a running ticker. A disclaimer hidden behind a "see more" link or flashed for a second is unlikely to pass.
Prohibited messages
Promotions must not state or imply guaranteed returns, that investing is safe, low risk, trivial or easy, or that past performance indicates future results. They must not create urgency or fear of missing out. VARA's own case study treats a post asking "Who's getting ready to trade?" with rocket emojis, ahead of an exchange listing, as non-compliant.
Marketing of anonymity-enhanced cryptocurrencies, often called privacy coins, in or targeting the UAE is prohibited. Sending virtual assets to a person's wallet without prior consent or a clear expression of interest is also not permitted.
The licence check comes first. Under the VARA marketing rules, perfect wording does not cure the wrong sender: a promotion for an unlicensed platform breaches the rules however well it is drafted. Before approving any creative, confirm that the VASP is licensed for the specific activity being promoted and that it has approved the campaign in writing.
Influencers, agencies, events and platforms
Influencers and key opinion leaders
Influencers can market virtual assets only on behalf of, and with the approval of, a VARA-licensed VASP, and they are expected to confirm that the VASP is licensed for the relevant activity. Influencers and key opinion leaders do not qualify for the journalism exemption. Their content must carry the required labels and disclaimers.
A creator based in the UAE will usually also need the federal advertiser permit. Where the content strays into financial recommendations about securities or other regulated products, the finfluencer rules described in our guide to financial promotions and finfluencers may also be engaged.
The exemptions, read narrowly
- Journalism: limited to UAE-licensed media personnel and accredited foreign correspondents acting in a journalistic capacity.
- Education: content must be purely educational, not designed to lead people to invest or sign up. Sponsored content does not qualify, and disclaimers still apply.
- Personal and private communications: limited to friends, family and colleagues. VARA's Guidance indicates that communications reaching a group of around 50 or more people are not private.
Events and exhibitions in Dubai
Unlicensed firms may market only at physical events in Dubai, and only within tight limits: a prominent disclaimer that they are not licensed or regulated by VARA, no soliciting or onboarding of UAE residents, and materials that stay at the event. Organisers are expected to obtain undertakings from exhibitors.
Agencies, publishers and app stores
Marketing agencies, publishers, broadcasters, search engines and social media platforms that facilitate virtual asset marketing must take commercially reasonable steps to ensure compliance, including diligence on whether their client may market in or to the UAE. Published commentary also notes that apps facilitating virtual asset activities and available for download in Dubai are expected to be owned or controlled by a licensed VASP or otherwise approved by VARA.
How to run a compliant campaign: step by step
- Confirm the licensing position. Identify the VASP, its VARA licence and the activities it covers, and check that the product being promoted falls within them. See our guide to VARA licensing in Dubai.
- Map the audience and channels. Decide whether the campaign is in or targeting the UAE, and record the channels, languages, currencies, imagery and geographies involved.
- Contract the participants. Put written terms in place with agencies, creators and event organisers covering VASP approval, content sign-off, disclaimers, permits and takedown.
- Draft and review content. Apply the content standards, add the risk disclaimer and sponsorship labels, and remove urgency, guaranteed-return or easy-money messages.
- Check incentives. Referral rewards, sign-up bonuses and gifts must not divert attention from risks or create urgency, and must meet VARA's conditions.
- Approve and keep records. Record the approval, final content, distribution and audience details, and keep them for the retention period the Regulations require so they can be produced to VARA on request.
- Monitor and correct. Monitor comments, reposts and creator content during the campaign and correct or remove non-compliant material quickly.
Enforcement: what VARA has done
The Regulations allow VARA to impose fines set out in a schedule, up to AED 10 million, and to use its wider supervisory powers under the 2023 Regulations, including investigations, information requests, cease-and-desist orders and action against licences.
VARA has used these powers publicly. In an enforcement notice of 7 October 2025, it reported penalising 19 firms for unlicensed virtual asset activity and breaches of its Marketing Regulations, with fines between AED 100,000 and AED 600,000 and cease-and-desist orders requiring them to stop promoting unlicensed services in or from Dubai.
Under the VARA marketing rules, the question is not only what a post says but who is allowed to send it, and to whom.
An illustrative scenario
This scenario is illustrative only and does not describe a real matter.
A foreign exchange holds licences in Europe but not from VARA. Its marketing team hires a Dubai-based creator with a large local following to post a short video in English and Arabic showing AED prices and the Dubai skyline, with a referral code and the line "listing next week, do not miss it".
Almost every element is a problem. The content targets the UAE, so the VARA marketing rules apply. The exchange is not VARA-licensed, so nobody may market its services in or to the UAE. The urgency message and missing disclaimer would breach the content standards even for a licensed firm, and the creator may also lack an advertiser permit.
The fix is structural, not cosmetic: either obtain VARA authorisation, or stop targeting the UAE altogether through geo-blocking, removal of local cues and no UAE-based influencers, so that all three out-of-scope conditions are genuinely met.
Risks and common mistakes
Assuming a foreign licence is enough
A licence in another country does not permit marketing to the UAE. Under the 2024 rules, marketing in or targeting the UAE must be carried out by or for a VARA-licensed VASP. The earlier approach, under which an unlicensed firm could seek VARA authorisation and rely on a home-country permit, no longer applies. Firms that want UAE customers need a UAE route; firms that do not should make sure their campaigns do not target the UAE, in substance as well as in form.
Treating influencer content as the creator's problem
VARA expects the VASP, agencies and the creator to share responsibility. If the VASP has not approved the content, the creator is marketing without authority; if the agency has not checked the VASP's licence, it has not taken reasonable steps. Contracts should allocate sign-off, disclaimers, permits, takedown and record-keeping clearly, and someone should check content before it goes live rather than after a complaint.
Relying on the education exemption for sponsored content
Explainers, webinars and "crypto 101" series are popular because they feel educational. But the exemption applies only to purely educational content that is not meant to lead people to invest or sign up, and sponsored content does not qualify. A tutorial that ends with a referral code, or that is paid for by an exchange, is marketing. It must meet all the content rules, including the risk disclaimer.
Weak or hidden disclaimers
A disclaimer that is technically present but small, brief, hidden or separated from the message does not meet the prominence standard in VARA's Guidance. On short-form video and stories, the disclaimer needs to be on screen for long enough to read; on podcasts, it should be spoken at the start and end. Teams should build disclaimers into templates so that creators cannot omit them, and keep evidence of what was published.
Overlooking incentives and airdrops
Referral bonuses, sign-up rewards, giveaways and airdrops are marketing. They must not distract from risk or create urgency, and VARA's conditions on incentives apply. Airdropping tokens into wallets without prior consent or a clear expression of interest is not permitted. Teams that treat growth tactics as product decisions rather than marketing often miss these points.
Cross-border campaigns
Global exchanges and token projects often run one campaign for many markets. For the UAE, the safest course is to decide early whether the UAE is a target market. If it is, VARA licensing or a licensed partner is required before marketing starts. If it is not, the campaign should be designed to avoid UAE targeting indicators and supported by geo-blocking and onboarding controls.
Campaigns run from Singapore, the UK or elsewhere in the GCC should also be checked against local rules: a promotion that is compliant in Dubai may still breach rules on crypto promotions elsewhere. For token projects, the issuance rules discussed in our guide to token issuance in the UAE also govern what may be said about a token.
Checklist: what to do next
- Confirm the VASP's VARA licence covers the activity being promoted, and obtain written approval of the campaign.
- Decide whether the campaign is in or targeting the UAE, and document the reasoning.
- Check that every creator holds the federal advertiser permit where required.
- Build the risk disclaimer, sponsorship labels and interest disclosures into every template.
- Remove urgency, guaranteed-return, low-risk and easy-money messaging.
- Review incentives, referral schemes and airdrops against VARA's conditions.
- Keep records of approvals, content, distribution and audiences for the required retention period.
- Train marketing, community and partnerships teams on the VARA marketing rules.
TRW & Co advises exchanges, token projects, agencies and creators on campaign structure, contracts and regulatory engagement, as part of our virtual assets practice. Where VARA opens an inquiry, we support the response alongside our regulatory investigations team. To discuss a campaign, contact us at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Do the VARA marketing rules apply outside Dubai?
They apply to marketing in or targeting the UAE, and VARA treats UAE-targeted marketing as targeting Dubai unless Dubai is explicitly excluded in every communication. A foreign firm falls outside the rules only if it is not located in Dubai, carries on no virtual asset activity there and does not market to or target the UAE. The DIFC has its own regulator, the DFSA, and ADGM has the FSRA, so firms based in those centres follow their own regimes.
02What disclaimer does VARA require on crypto adverts?
Promotions must include a prominent disclaimer that virtual assets may lose their value in full or in part and are subject to extreme volatility, and make clear that investors can lose all their money and have no financial protection. VARA's Guidance expects the disclaimer to be legible, close to the main message and visible long enough to read, spoken at the start and end of audio, and shown as a running ticker on video.
03Can influencers promote crypto in Dubai?
Yes, but only on behalf of, and with the approval of, a VARA-licensed VASP licensed for the activity being promoted. The influencer should confirm that licence before posting. Content must be labelled as marketing, name the sponsor and carry the risk disclaimer. Influencers are not treated as journalists, and most UAE-based creators also need a federal advertiser permit, which is a separate media licence.
04Can a firm without a VARA licence market at a Dubai crypto event?
Only within narrow limits. Unlicensed firms may market at physical events in Dubai if they display a prominent disclaimer that they are not licensed or regulated by VARA, do not solicit or onboard UAE residents, and keep their materials at the event. Organisers are expected to obtain undertakings from exhibitors. Any follow-up marketing to attendees after the event would fall under the normal rules.
05What are the penalties for breaching VARA's marketing rules?
The Marketing Regulations allow VARA to impose fines up to AED 10 million, alongside cease-and-desist orders, suspension of activities and action against licences under its wider supervisory powers. In October 2025, VARA announced penalties against 19 firms for unlicensed virtual asset activity and marketing breaches, with fines between AED 100,000 and AED 600,000, and ordered them to stop promoting unlicensed services.
06Is educational crypto content exempt from VARA marketing rules?
Only if it is purely educational and not intended to lead people to invest or sign up for a service. Sponsored educational content does not qualify, and VARA's Guidance says required disclaimers still apply. A webinar or explainer series that ends with a referral link, or that is paid for by an exchange, will usually be treated as marketing and must meet all the content and licensing requirements.
Sources and official materials
- Virtual Assets Regulatory Authority (VARA) — Dubai's virtual asset regulator: licensing, notices and enforcement
- VARA rulebooks portal — Regulations, rulebooks and the Marketing Regulations
- Guidance on the Regulations on the Marketing of Virtual Assets and Related Activities 2024 — Targeting, exemptions, disclaimers and case studies
- VARA enforcement notice, 7 October 2025 — Penalties on 19 firms for unlicensed activity and marketing breaches
- Capital Market Authority — Federal capital markets regulator, formerly the SCA
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
