VARA Actions Against Unlicensed Crypto Platforms Highlight Dubai Licensing Rules

Dubai's Virtual Assets Regulatory Authority (VARA) has taken enforcement action in 2026 against specific legal entities providing virtual asset services to customers in Dubai without the required VARA licence. On 5 March, the regulator issued alerts involving entities commercially advertising as KuCoin and MEXC. VARA followed those alerts with financial penalties against specific legal entities in June.

The actions were VARA enforcement measures rather than joint enforcement by VARA and the Central Bank of the UAE (CBUAE). Separately, the CBUAE's federal regulatory perimeter has expanded under Federal Decree-Law No. 6 of 2025, including payment services using virtual assets and licensed financial activities carried out through technologies such as decentralised finance.

VARA's actions focused on specific legal entities

VARA's Marketing Regulations, effective from 1 October 2024, apply to marketing of virtual assets or virtual asset activities in or targeting the UAE. The requirements cover domestic and foreign entities whether or not they hold a VARA licence. The regulations also state that marketing of a virtual asset activity in or targeting the UAE must generally be carried out by a VASP licensed by VARA for that activity, or on behalf of and approved by such a licensed VASP.

On 5 March 2026, VARA issued an alert covering Phoenixfin Pte Ltd, MEK Global Limited, Peken Global Limited and KuCoin Exchange EU GmbH, which were commercially advertising as KuCoin. VARA said the entities may have been providing virtual asset activities to Dubai residents without the necessary regulatory approvals and instructed them to cease and desist unlicensed virtual asset activities.

A separate alert issued on the same day concerned MEXC Estonia OÜ and MEXC Global LTD, commercially advertising as MEXC. VARA stated that MEXC did not hold a licence to provide virtual asset services in or from Dubai and was not authorised to offer, promote or market virtual asset products or services in Dubai or to its residents.

The June enforcement notices targeted specific legal entities associated with those brands. On 24 June 2026, VARA imposed enforcement measures and financial penalties on Peken Global Limited, commercially operating as KuCoin, after finding that it had provided broker-dealer and/or exchange services to customers in Dubai without a VARA licence. VARA clarified that Peken Global Limited was the only legal entity targeted by that enforcement action and that the other entities identified in the March KuCoin alert were not targeted.

On 22 June 2026, VARA separately imposed enforcement measures and financial penalties on MX Global LTD, commercially operating as MEXC. VARA said the entity provided broker-dealer and/or exchange services to customers in Dubai without the necessary licence between 2022 and April 2026. It also found that the entity had onboarded users without meeting applicable Know Your Customer obligations. VARA clarified that the enforcement action applied exclusively to MX Global LTD and not to the other legal entities associated with MEXC identified in its earlier alert.

The wider UAE regulatory perimeter is also changing

The CBUAE development is separate from those VARA enforcement cases. Federal Decree-Law No. 6 of 2025 lists payment services using virtual assets among the financial activities subject to Central Bank licensing. It also provides that licensed financial activities remain subject to Central Bank licensing, regulation and oversight when carried out through virtual asset payment tokens, decentralised finance, digital platforms, protocols or other emerging technologies.

The law does not bring every form of virtual asset activity within the CBUAE framework. It states that virtual assets used for investment purposes, exchanges of one virtual asset for another, and swap operations for trading purposes are outside the scope of the decree-law and remain subject to other legislation in force in the UAE.

The decree-law took effect on 16 September 2025. The CBUAE states that persons and entities subject to it have one year from its entry into force to reconcile their positions, with the Board of Directors able to extend that period.

There is also joint UAE guidance on unlicensed virtual asset service providers, but it should not be treated as evidence that the CBUAE and VARA jointly brought the 2026 KuCoin and MEXC enforcement cases. The guidance was issued by supervisory authorities including the CBUAE, the then-Securities and Commodities Authority, VARA, the Dubai Financial Services Authority, the Financial Services Regulatory Authority of Abu Dhabi Global Market and the Ministries of Justice and Economy.

The federal market regulator's name has also changed. The Securities and Commodities Authority was renamed the Capital Market Authority (CMA) under Federal Decree-Law No. 32 of 2025. The new framework took effect on 1 January 2026.

Checking a platform requires more than checking the brand

For UAE residents, one practical lesson from the VARA cases is that a platform's international brand name does not by itself show whether the legal entity providing a particular service is authorised locally.

Licensing depends on the activity and jurisdiction involved. VARA regulates virtual asset services across Dubai outside the Dubai International Financial Centre, while other parts of the UAE framework involve regulators including the CMA, the CBUAE, the DFSA in the DIFC and the FSRA in Abu Dhabi Global Market.

Users can check the relevant regulator's official public records rather than relying only on a platform's marketing or a third-party licence tracker. VARA maintains a Public Register showing fully licensed VASPs and firms holding In-Principle Approval. VARA states that an In-Principle Approval does not allow an applicant to begin virtual asset activities or serve clients until it receives a full VASP licence.

The CMA's current open-data page for virtual asset service providers directs users to VARA's Public Register. The DFSA also maintains a public register for firms operating within its jurisdiction.

It is also important to distinguish a regulatory action from a broader judgment about a company or an asset. VARA's notices identify specific licensing, compliance or marketing issues involving named legal entities. They do not determine the future value of a cryptocurrency or establish that virtual assets offered through a licensed provider are free from risk.

A licence can help establish which regulator supervises an entity and what activities it is authorised to perform. It does not remove risks such as price volatility, custody failures, operational disruption, fees or losses associated with virtual assets.

Key Takeaways

• VARA's March and June 2026 actions involving entities operating as KuCoin and MEXC were VARA-led measures concerning services provided to customers in Dubai, not joint VARA-CBUAE enforcement.
• VARA's 2024 Marketing Regulations apply broadly to domestic and foreign entities marketing virtual assets or virtual asset activities in or targeting the UAE.
• The CBUAE's regulatory perimeter has separately expanded under Federal Decree-Law No. 6 of 2025 for activities including virtual-asset payment services and licensed financial activities conducted through emerging technologies. Investment-purpose virtual assets and virtual-asset-to-virtual-asset trading are treated separately under the law.
• Checking the exact legal entity, authorised activities and current status on the relevant regulator's official register is more reliable than relying only on a global brand name or a private licence tracker. A VARA In-Principle Approval should not be treated as permission to begin operating.

Sources: VARA – Licensing and Enforcement Notices, and Warnings, VARA – KuCoin Investor and Marketplace Alert, 5 March 2026, VARA – MEXC Investor and Marketplace Alert, 5 March 2026, VARA – Notice of Fines: Peken Global Limited (KuCoin), 24 June 2026, VARA – Notice of Fines: MX Global LTD (MEXC), 22 June 2026, VARA – Regulations on the Marketing of Virtual Assets and Related Activities 2024, VARA – Public Register, CBUAE – Legislation and Federal Decree-Law No. 6 of 2025 FAQs, UAE Ministry of Finance – Federal Decree-Law No. 6 of 2025, CBUAE – Joint Guidance on Combating the Use of Unlicensed Virtual Asset Providers in the UAE, Capital Market Authority – New CMA Law, Capital Market Authority – Virtual Asset Service Providers, DFSA – Public Register.

Disclaimer: This content is for educational and informational purposes only. It is not legal, financial, investment, cybersecurity, medical, business, career, or other professional advice. Verify important information with official sources or qualified professionals before acting.