VARA

A regulated firm must be able to attribute activity to an identified person, and assets or accounts that make that impossible are barred at the licensed perimeter. This is a rule about attribution, not about whether amounts are public.

What VARA actually says

Most regimes reach anonymity-enhanced assets sideways, through listing criteria, liquidity gates or traceability tests. Dubai's regulator simply writes it down: issuance of such assets, and every activity related to them, is prohibited in the Emirate. That makes VARA the clearest counterexample to the pattern running through this section, and it is quoted far beyond the UAE precisely because so few instruments are this direct. Two things temper it. The prohibition binds licensed activity in Dubai rather than individuals, and self-custody survives: providers must document how they handle transfers involving unhosted wallets, which is a diligence obligation and not a ban.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.