Dubai's Virtual Assets Regulatory Authority has a standing rulebook that covers any marketing of virtual assets "in or targeting the UAE," and it applies whether or not the company doing the marketing is licensed by VARA at all. That is the direct answer to who this covers. The rules themselves are specific about what a crypto company can and cannot say, who has to approve the message before it goes out, and how long records of it have to be kept. This article reads the regulations as published, not as summarized by a law firm's marketing page, and it is a description of a public document, not legal advice. Whether a specific campaign complies is a question for counsel, every time.
What are VARA's Marketing Regulations, and who do they cover?
The Regulations on the Marketing of Virtual Assets and Related Activities, published on VARA's own rulebook site, took effect on 1 October 2024. They replaced an earlier administrative order from 2022, and firms that held approval under that order had 90 days to transition fully to the new text.
The scope is wide on purpose. The rules apply to any marketing of or relating to virtual assets or virtual asset activities that is "in or targeting the UAE," and they bind domestic and foreign entities alike, whether or not VARA has licensed them. A company is outside the rules only if it has no physical presence in the Emirate of Dubai, carries out no virtual asset activity there, and does no marketing aimed at the UAE. For PR planning purposes, that means a crypto project based anywhere in the world, running a campaign a UAE audience will see, is inside scope the moment the campaign targets Dubai.
What does every piece of marketing have to include?
A short list of baseline requirements applies across the board. Marketing has to be fair, clear, and not misleading in both what it says and how it presents it, and it has to be clearly identifiable as promotional rather than disguised as something else. It cannot contain inaccurate claims or contradictory fine print that undercuts the main message.
Two requirements matter most for a PR team specifically. First, paid third-party content, meaning sponsored posts, paid influencer placements, and co-marketing campaigns, must carry a clear and prominent notice that it is paid. Second, any marketing must include a prominent disclaimer that virtual assets can lose value in part or in full, are subject to extreme volatility, and that investors can lose everything with no financial protection. The rules also require the instructing company to keep records of its marketing and how it was distributed for eight years from the last time it ran, which is a longer retention window than most PR workflows are built around.
What can a crypto company never say in Dubai, regardless of license status?
A specific set of claims is banned outright, and this is the part that most directly shapes how an announcement gets written. The rules prohibit any call to buy or sell a virtual asset, any statement or implication that an investment is safe or low risk, any claim that returns are guaranteed, and any suggestion that an investment decision is simple or easy to make. Messaging cannot imply that past performance predicts future results, and it cannot create urgency or a fear of missing out, which rules out a wide range of standard crypto marketing language. Marketing also cannot exploit a consumer's inexperience or lack of knowledge, and sending a virtual asset to someone's wallet without their consent is specifically barred. Marketing or related activity for anonymity-enhanced cryptocurrencies is prohibited in the Emirate outright, with no carve-out.
None of this is unusual for a financial regulator. Singapore's MAS guidelines take a similar position on trivializing risk and avoiding promotion to the general public, even though the mechanics differ. The pattern across jurisdictions is consistent: regulators are far more comfortable with factual disclosure than with persuasion.
Does a press release count as marketing under these rules?
The regulations do not carve out an exception for press releases, and a company should not assume one exists. The text governs "marketing of or relating to" virtual assets and virtual asset activities, a description broad enough to cover a press release the same way it covers a paid ad, if the release is directed at the UAE. The safer reading for a PR team is to treat every public-facing statement, including press releases, as subject to the same risk-disclaimer and no-guaranteed-returns rules that apply to an advertisement. A crypto press release has its own structural requirements independent of VARA, and the regulatory check belongs alongside those, not after them.
Marketing of a specific virtual asset activity has to be carried out by, or with the approval of, a VARA-licensed virtual asset service provider for that activity. A company planning a Dubai-facing announcement should confirm this chain of approval before copy is finalized, not after it has already gone to a newswire.
What about an unlicensed company speaking at a Dubai event?
The rules address this directly, and the conditions are narrow. An unlicensed entity may market at a physical event in the Emirate only if it does not carry out licensable virtual asset activities there, does not sign up or onboard UAE residents at the event, includes a prominent disclaimer that it is not VARA-licensed, and limits its content to its name, logo, the type of activity it does, fees, and general educational material. Event organizers carry their own obligations, including vetting attendees, keeping attendee lists, and obtaining undertakings from exhibitors. A booth at a Dubai conference is not a loophole around the marketing rules. It is a separate set of conditions layered on top of them.
Source: VARA's Marketing Regulations penalty schedule, published on VARA's rulebook site, linked in the article.
What happens if a company gets this wrong?
VARA's penalty schedule sets fines of up to AED 10,000,000 for violations of the core activity, general, and virtual-asset-specific marketing requirements, up to AED 2,000,000 for violations tied to third-party marketing and application-store rules, and up to AED 500,000 for platform record-keeping failures. A repeat violation within one year doubles the fine, and unpaid fines accrue an additional 1% per month, compounded. VARA has sole discretion to set the fine within these ranges, and a fine from VARA is separate from, and does not replace, penalties another authority might impose for the same conduct.
Those numbers are a reason to build the compliance check into the PR process itself, rather than treating it as a final sign-off. Working with a crypto PR agency that already understands this rulebook is one way to avoid finding out about a gap after a release has already gone out under the company's name.
How should a crypto PR team actually plan around this?
A few habits follow directly from the text, without stretching it.
- Confirm licensing status and approval chain first. Before a word of copy is written, confirm whether the company, or the activity being marketed, requires a VARA-licensed provider's approval.
- Write the risk disclosure into every release, not just the ad. Treat announcements, blog posts, and press releases the same way as paid marketing when it comes to the volatility and no-guaranteed-returns disclaimer.
- Strip urgency language from the copy. Countdown framing, phrases that imply a limited window, and "don't miss out" constructions are the kind of language the rules were written to catch.
- Label every paid placement as paid. A sponsored post, an affiliate link, or a paid KOL campaign needs a visible notice that it is paid content, not folded into organic-looking coverage.
- Treat event marketing as its own checklist. Conference booths, side events, and panel appearances in Dubai each need the unlicensed-entity conditions reviewed separately from the main press plan.
None of this replaces legal advice specific to a company's structure and activity. Dubai's Trakheesi permit system for real estate marketing is a useful comparison: a different regulator, a different asset class, but the same underlying lesson that a UAE marketing permit requirement sits separately from, and in addition to, the editorial judgment a journalist applies to a story.
The direct answer, for anyone who read this far
What do VARA's marketing rules allow a crypto company to say in Dubai? Factual, clearly disclosed, risk-labeled information about a virtual asset or activity, provided the right licensed entity approves it, with no guaranteed-return claims, no urgency language, and no unlabeled paid placements. The rules apply to any marketing targeting the UAE, regardless of where the company is based or whether it holds a VARA license, and the penalties for getting it wrong run into the millions of dirhams. Read the regulations directly on VARA's rulebook site before a Dubai-facing campaign goes out, and confirm the details with counsel.
White Ocean Media builds crypto and Web3 press plans with this rulebook in view, though we do not provide legal advice and we always recommend clients confirm specifics with their own counsel. If you want a second opinion on a UAE-facing announcement before it ships, request a quotation.
