VARA Issuance Guidance 2026: Stablecoins, Tokenised Assets and the Derivatives Rules

Dubai’s Virtual Assets Regulatory Authority published its Guidance on Virtual Asset Issuance on 9 April 2026 and, nine days earlier, on 31 March 2026, added formal rules for exchange-traded derivatives to its Exchange Services Rulebook.

The two dates that sources mix up belong to different documents: the March date is the exchange rulebook, the April date is the issuance guidance, and each affects a different type of business.

Token issuers care about the issuance guidance, which explains how fiat-referenced and asset-referenced tokens, tokenised real-world assets and ordinary tokens are sorted into categories. Exchanges and brokers care about the derivatives rules. This guide covers both, clearly separated, and flags the points where sources differ or are silent.

“Issuing a token in Dubai is no longer one question. The first step is deciding which of three categories it falls into, because that decides whether you need a licence or a licensed distributor.”

The dates that sources mix up

Adviser articles describe VARA’s 2026 updates as arriving in either March or April, and both are right, for different documents. Legal500 and others report that Part V of the Exchange Services Rulebook, covering exchange-traded derivatives, was published on 31 March 2026 and described as Version 2.1. The Issuance Guidance followed on 9 April 2026, according to an adviser article reporting the announcement and a second law firm commentary.

A third source dates its own article to June 2026, which reflects when that adviser wrote it rather than when VARA published. The category framework itself is older than both. Linklaters reports that the Issuance Rulebook replaced earlier categories with Category 1 and Category 2 in an update on 2 June 2025, with a compliance date of 19 June 2025.

See our guide on VARA’s 2026 licensing requirements for virtual asset businesses for the licensing basics that apply before any issuance or exchange question arises.

The three issuance pathways

The guidance sorts issuances into Category 1, Category 2 and exempt virtual assets. Category 1 covers fiat-referenced virtual assets, which hold a stable value against a non-sanctioned fiat currency, and asset-referenced virtual assets, defined broadly to capture tokens referencing a financial instrument or a physical or intangible asset. VARA can add other assets to Category 1 over time.

Category 2 is the residual group: any issuance that is neither Category 1 nor exempt. The issuer does not need a VARA licence, but all placement and distribution must run through a licensed distributor. Exempt assets include non-transferable and closed-loop redeemable tokens such as simple loyalty points, and these can be issued without prior approval though still under supervision.

Classification is not mechanical. Commentary notes that VARA may consider the factors it deems appropriate, so a token that looks like a utility asset but behaves like a claim on revenue may be treated differently. Since the guidance is described as non-binding, it works as a statement of how VARA reads its own rules, not as a safe harbour.

See our guide on the UAE crypto licence under VARA and DMCC for how licence applications work if the project ends up in Category 1.

Stablecoins, reserves and the Central Bank

For fiat-referenced tokens, the reported requirements are reserve assets, redemption rights and a clear legal structure. Direct-ownership tokens that represent a single unfragmented asset are reported to be outside the strictest reserve rules, while stablecoin-type tokens need reserves to support stability and redeemability.

One report, covering the April announcement, adds that dirham-referenced stablecoins need separate approval from the Central Bank of the UAE, and that tokens built to hide holder identity are banned. We have not seen the underlying VARA text for either point, so treat them as reported and check them against the guidance before building a product around them.

The Central Bank angle is part of a wider shift in how financial activities are supervised after the Central Bank Law transition. See our guide on the Central Bank Law and its passed compliance deadline for how payment-linked businesses fit into that picture.

Whitepapers and risk statements

Every issuer other than exempt asset issuers must publish a whitepaper and a risk disclosure statement. The guidance, as described by law-firm commentary, requires them to be freely available to anyone with no registration wall, paywall or precondition, and requires risks to be ranked by materiality with the most severe presented first. Prior versions must be kept for at least eight years after circulation ceases.

Category 1 issuers face fuller whitepaper and disclosure requirements, and one adviser says VARA reviews them substantively. A separate adviser reports penalties of AED 10 million per breach for marketing violations across the marketing chain, from issuers to influencers and payment processors. We have not verified that figure against VARA’s marketing rules, so it should not be treated as confirmed.

On liability, the question founders ask first, we could not confirm from the sources we read who bears legal responsibility for whitepaper content or how far it extends to directors. Take advice on that point and read the guidance’s whitepaper section before signing off any document.

See our guide on the UAE Capital Markets Authority and what replaces the SCA for the securities side, relevant if a token has profit-sharing features that could be treated as a security.

The distributor route

Category 2 turns on the licensed distributor. The issuer avoids its own licence, but the distributor takes on compliance responsibility for the placement, according to Linklaters’ description of the framework. For a small project, that makes the choice of distributor a core business decision: it controls the investor-facing process and carries regulatory risk.

Diligence on a distributor should cover its VARA licence scope, its experience with comparable tokens, who bears marketing and onboarding responsibility, and what happens if the distributor loses its licence mid-offering. The commercial terms are not set by VARA, so contracts should say who prepares the whitepaper, who approves marketing material and how fees are paid.

See our guide on crypto-friendly banks for UAE companies for the banking side, since an issuer or distributor still needs an account to receive and hold funds.

Derivatives and retail leverage

The updated Exchange Services Rulebook creates formal rules for exchange-traded derivatives, including contracts for difference, futures, options and perpetual contracts. Offering them is no longer a free extension of an exchange licence: the activity must be named in the Exchange Services licence, with a separate application showing the risk framework.

Retail investors face a hard leverage cap of 5:1, which equals a 20% minimum initial margin. Qualified and institutional investors are left to the platform’s own policies, subject to risk assessment. Suitability is continuing: the platform must assess knowledge, financial position, risk appetite and capacity for loss, and block an unsuitable client immediately. Margin must be held as client money or client virtual assets and only in approved asset types.

An earlier update tightened the qualified investor test, according to Linklaters, to AED 3.5 million in net assets and AED 700,000 annual income. For a platform, that makes the investor classification the gate for any leverage above 5:1.

See our guide on the UAE fintech regulatory sandboxes if your product is still a pilot and you want to test it before applying for a full licence.

Planning an issuance project

A sensible sequence starts with classification. Write a one-page description of what the token does, what it references, how it is redeemed and who can hold it, then test it against the Category 1, Category 2 and exempt definitions. If the token references a currency or an asset, assume Category 1 until a lawyer says otherwise, because the cost of overestimating is lower than the cost of building a product that cannot be launched.

Next, choose the entity and the licence plan. A Category 1 issuer needs a VARA licence and the company-level requirements that come with it, such as governance, compliance, technology and market conduct standards. A Category 2 issuer needs a distributor agreement and a whitepaper, and should budget for the distributor’s review time. In both cases, the whitepaper and the risk statement take longer than most teams expect, because they are reviewed and because every claim in them has to be supportable.

Then think about reserves and redemption for any stable-value token. Where assets back the token, decide where they are held, who audits them and how a holder redeems in a stress scenario. Finally, plan marketing early. Dubai’s rules apply to promotions aimed at Dubai whether or not the issuer is based there, and influencer and paid-media activity need the same discipline as the whitepaper.

Keep the document trail tidy as well. Because earlier whitepaper versions must be retained, version control, sign-off records and a log of what was changed between versions are not optional extras. An issuer that updates its whitepaper after a product change should be able to show what investors saw at each point in time.

What we could not confirm

We could not open the full text of the guidance or the rulebook version history on VARA’s site, so the details above come from law-firm and trade commentary. Specific gaps include whitepaper liability, the CBUAE approval point for dirham tokens, the AED 10 million marketing figure, and whether the 31 March derivatives text applies to existing licensees immediately or after a transition.

Sources also differ in labelling. Some describe five token classes, such as payment, utility and security tokens, while VARA’s own framework in the guidance uses Category 1, Category 2 and exempt. Use VARA’s categories for compliance planning.

Common mistakes when approaching VARA issuance and exchange rules

• Treating the March and April 2026 publications as one document and applying exchange rules to an issuance project, or the reverse.
• Assuming a tokenised real-world asset is Category 2 because it is not a stablecoin, when asset-referenced tokens fall into Category 1.
• Putting the whitepaper behind a sign-up form, which the guidance is described as ruling out.
• Offering leverage to retail clients above 5:1 or enabling derivatives without the activity named in the licence.

When professional help is worth it

Specialist help matters at the classification step, because a wrong category assumption changes the licence, the timeline and the budget. A regulatory lawyer can map your token to the categories, draft the whitepaper and risk statement, and review distributor contracts. Exchange operators should have counsel check the derivatives application and client suitability process.

An e.zone consultant who works with crypto and virtual asset applicants can help prepare the corporate structure and licence file around the regulatory work. See e.zone’s guide on how to start a crypto company with a Dubai licence for the application route.

This is general information and not legal or investment advice. VARA rules change, so check the current rulebook and guidance before acting.

Frequently asked questions

Related Reading

Banking & Finance

Source of Wealth vs Source of Funds: What UAE Banks Ask For

Banking & Finance

UAE BNPL Licensing: Credit Caps, Fee Limits and What Merchants Should Check

Banking & Finance

UAE Capital Markets Authority 2026: What Replaces the SCA and Why It Matters

Banking & Finance

UAE Central Bank Law: The 2026 Compliance Deadline Has Already Passed