# VARA

> VARA (Dubai Virtual Assets Regulatory Authority): The most explicit prohibition in any rulebook. Region: Middle East & Africa. Attribution required: A regulated firm must be able to attribute activity to an identified person, and assets or accounts that make that impossible are barred at the licensed perimeter. This is a rule about attribution, not about whether amounts are public.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Middle East & Africa
- Subject: The most explicit prohibition in any rulebook
- Authority: Dubai Virtual Assets Regulatory Authority
- Stance on on-chain confidentiality: Attribution required. A regulated firm must be able to attribute activity to an identified person, and assets or accounts that make that impossible are barred at the licensed perimeter. This is a rule about attribution, not about whether amounts are public.
- Tags: explicit prohibition, named in rulebook, AED 3,500, unhosted permitted
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-vara

## What it actually says

Most regimes reach anonymity-enhanced assets sideways, through listing criteria, liquidity gates or traceability tests. Dubai's regulator simply writes it down: issuance of such assets, and every activity related to them, is prohibited in the Emirate. That makes VARA the clearest counterexample to the pattern running through this section, and it is quoted far beyond the UAE precisely because so few instruments are this direct. Two things temper it. The prohibition binds licensed activity in Dubai rather than individuals, and self-custody survives: providers must document how they handle transfers involving unhosted wallets, which is a diligence obligation and not a ban.

## The instruments that matter

- **Regulations 2023, Part II Section C**: states that the issuance of anonymity-enhanced cryptocurrencies and all virtual asset activities related to them are prohibited in the Emirate
- **Travel rule above AED 3,500**: originator name, wallet address or account number and address, plus beneficiary name and wallet address
- **Unhosted wallets are not banned**: providers must document how they handle non-obliged entities and anonymity-enhanced transactions, which is a diligence duty rather than a prohibition

## Sources

- [VARA rulebook, prohibited virtual assets](https://rulebooks.vara.ae/rulebook/c-prohibited-virtual-assets)
- [VARA rulebook, FATF travel rule](https://rulebooks.vara.ae/rulebook/g-fatf-travel-rule)

## Related entries

- [DFSA and ADGM FSRA](https://www.sodalabs.xyz/privacy-hub/regulation/reg-uae-free-zones): The regulators that went after the tools, not just the assets
- [MENAFATF](https://www.sodalabs.xyz/privacy-hub/regulation/reg-menafatf): The same machinery, across the Gulf and North Africa
- [Bahrain](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bahrain): A listing test written against effects, not asset names
- [Egypt](https://www.sodalabs.xyz/privacy-hub/regulation/jur-egypt): Crypto barred, so data protection is the live constraint
- [Kenya](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kenya): The ban written into primary legislation, not a rulebook
- [Kuwait](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kuwait): A ban whose stated reason is anonymity itself