Somebody else has to sell your token

The pitch has barely changed in a decade, and it has never quite died. Create a token. Publish a paper explaining what it will do. Sell it to people who believe you. No investors on the board, no dilution you have to negotiate, no six-month diligence exercise, and a buyer pool that is the entire internet rather than the four funds who returned your email.

Whatever else it was, that was a claim about permission: that a company could raise money without asking anyone.

In Dubai, that claim is answered in a single line of the rulebook, and the answer is not the one most founders arrive with. It is not that a token sale is banned. It is that the selling is somebody else's job, and that somebody is licensed, is liable for you, and can say no.

The first question is not whether you need a licence

It is what the token points at, because that determines which route you are on before any other question is worth asking.

VARA divides issuance into categories. Category 1 covers Fiat-Referenced Virtual Assets and Asset-Referenced Virtual Assets — tokens whose value refers to a currency, or to some other asset or basket. Its guidance is unambiguous about what that means for you: any entity in the emirate seeking to issue a Virtual Asset falling within Category 1 must be Licensed by VARA prior to issuing it. Issuance is not something bolted onto another permission. The issuance of a fiat-referenced token is itself a virtual asset activity, and "VA Issuance Category-1" appears in its own right on VARA's published list of the eight licensed activities. For a fiat-referenced token there is a further layer: a licensed issuer must obtain approval from VARA before issuing each such asset. The licence is the entry ticket, not the permission for a given launch.

Category 2 is everything else — issuances that are neither Category 1 nor an Exempt VA. This is where almost every founder who says "we're doing a token" actually sits: a network token, a governance token, a utility token, a points-with-ambitions token. And here the guidance says something that sounds, for about four seconds, like relief. No licence is required.

Read the next clause.

Category 2 does not remove the gate, it moves it

Rule I.E.1 of the VA Issuance Rulebook: entities in the emirate may only issue Virtual Assets falling within Category 2 provided that all placement and distribution is carried out by a Licensed Distributor.

There is no version of this where you sell it yourself. The whole architecture of the original idea — our token, our website, our sale, our terms — is removed by that sentence and replaced with a commercial dependency on a regulated firm that has no obligation to take you on.

Rule I.E.3 explains why the firm will care so much. Licensed Distributors providing distribution services to a Category 2 issuer assume the responsibility for assuring and validating that the issuer complies with the VA Issuance Rulebook. Your compliance becomes their exposure. Rule I.E.4 keeps them on the hook for their own licence conditions and every other applicable rule at all times, which means that taking on a project that later goes wrong is not a bad quarter for them — it is a supervisory conversation about their permission to operate.

And Rule I.E.5 closes off the reading that a founder most wants: no Virtual Asset issued under Category 2 shall be deemed in any way to have been approved by VARA, and may not be construed or considered as such. Getting a token to market in Dubai does not buy you the regulator's name to put in the deck. It buys you the obligation to say the opposite.

The distributor is not a placement agent, it is a second diligence

The rules governing what a distributor must do to you before it agrees to sell anything are, if anything, harder than the issuance rules themselves.

Rule IV.B.1 sets the standard: a firm providing licensed distribution services must ensure, beyond all reasonable doubt, the quality of all issuers and virtual assets. Not reasonable satisfaction. Not a customary diligence exercise. The rulebook's own phrase, applied to you.

What quality covers is then spelled out, and it reaches every part of a project a founder would rather keep internal: consumer protection, FATF and sanctions compliance, fraud prevention, market integrity, cybersecurity, legal compliance and adherence to the issuance rulebook. Rule IV.B.3 requires diligence on the asset itself — that it meets the applicable standards, that the whitepaper requirements are met, that risk disclosures comply, that investor classification rules are respected, and that the smart contracts have been audited. Rule IV.B.4 requires comprehensive diligence on the issuer, meaning the company, its people and its money. Rule IV.B.5 requires the documentation to carry a plain statement that VARA has made no representation and gives no warranty about the issuer or the asset.

Notice what has happened to the original proposition. The founder set out to avoid a diligence process run by investors. What arrives instead is a diligence process run by a licensed intermediary whose own permission is at stake, applying a standard written by the regulator, with a smart contract audit in it. Everything the equity route would have asked, asked earlier, by a party with more to lose than an investor and less appetite for a story.

Anyone who has been through a funding round will recognise the shape of it. The structures that quietly make a UAE company impossible to invest in sets out what an equity investor actually tests. Read that list against this one before deciding which route is lighter.

The whitepaper is the one document you are not allowed to disclaim

Every founder has written a pitch deck. Every pitch deck ends with a page of disclaimers saying that nothing in it is a representation, that forward-looking statements may be wrong, and that no liability is accepted by anyone for anything.

A whitepaper under this rulebook is built to do the opposite.

The disclosures set out in Schedule 1 must be provided in a single easily accessible location in a machine-readable format — not scattered across a site, not a PDF behind a form, not a thread. The document must be kept accurate and complete at all times, which converts it from a launch artefact into a maintained obligation: if the asset changes, the paper changes. Owners must be notified of changes before those changes take effect, with a narrow exception where the issuer is responding to a security or other threat. And the provision that ought to stop a founder mid-sentence: an issuer is prohibited from excluding any form of actual or potential civil liability in respect of any information in any whitepaper.

So the marketing document is the liability document. The two things a founder is used to keeping separate — the story told to buyers and the risk accepted for telling it — are the same instrument here. A roadmap slide that would be unremarkable in a deck is, in a whitepaper, a statement you have been forbidden from disclaiming.

One design constraint belongs in the same paragraph, because it is decided in code long before anyone reads a rule: VARA's published position is that anonymity enhanced tokens are prohibited. A privacy feature that is a selling point on a forum is a dead project here, and it is much cheaper to know that at the architecture stage.

Two official answers to the approval question

Here the honest account requires admitting a conflict rather than papering over it.

The VA Issuance Rulebook says, at Rule I.E.2, that entities issuing Category 2 Virtual Assets do not need prior approval from VARA. VARA's own website says the opposite. Its published FAQ answers the question "can an entity issue a Category 2 VA without approval from VARA" with a flat no, and states that entities seeking to carry out such an issuance must obtain prior approval, submitting an Issuance Approval Form, the purpose and use of the asset, a whitepaper, full details of the issuer, evidence of AML and CFT compliance, and evidence of technical, information security, data privacy and cryptographic controls. Its licensed activities page carries the same requirement.

Both were read on the same day. This article does not resolve the conflict, because a reader cannot act on a resolution invented by a consultancy.

What it does say is how to behave in front of one. Assume the stricter reading while you prepare, because everything the FAQ describes — the paper, the issuer detail, the AML evidence, the controls — is going to be demanded by your distributor anyway under Rule IV.B.3. Then put the question to VARA in writing, and keep the answer. The one thing worth nothing at all is a verbal assurance from an adviser about which of the regulator's two publications is the live one. There is a broader lesson in this: VARA has already answered the activity name on your licence sets out how much of this market runs on second-hand readings of documents nobody re-checked.

Telling anyone about it is a separate permission

The last assumption to go is that once the token exists, reaching buyers is a marketing problem.

VARA's marketing regulations define Marketing as any advertisement, invitation, inducement, solicitation, offer or promotion, and apply it regardless of the media or channel — expressly including social media, events, educational content, and airdrops. Every word there is load-bearing. A thread is marketing. A conference talk is marketing. A "we're just educating the community" blog is marketing. An airdrop, which most teams file mentally under growth rather than distribution, is named in the text.

The residency line is the one that undoes the original global-buyer fantasy. VARA's published answer to an unlicensed virtual asset firm wanting to market in Dubai is that it may do so where the relevant marketing permit is obtained, but that it is not permitted to onboard Dubai residents as customers, and that its marketing material must carry disclosures clearly indicating that the products or services are not available to residents of Dubai.

Read that as a general principle rather than as a rule about your specific case, which it may not be. A regulator that draws a line between who may see your material and who may buy is telling you that "sold to global investors" is not one audience and not one compliance question. It is as many questions as you have jurisdictions, and Dubai has just shown you what one of those answers looks like when it is written down. Whether an ordinary issuer promoting its own Category 2 token needs the same permit as an unlicensed service provider is a question to put to VARA directly; it is not answered here because it was not established.

What the money is, and what it is not

Two things follow, and both are usually discovered late.

A token buyer is not a shareholder. Nothing in an issuance puts anyone into the shareholding recorded in your company's constitutional documents. There is no pre-emption, no drag-along, no reserved matter, no exit mechanism, and no board seat. That sounds like the point — until the project needs a decision that a few thousand holders believe they were promised a say in, or until a real investor arrives and asks what the token holders are owed and by whom. A whitepaper is not a shareholders' agreement, and it is the document you were forbidden from disclaiming.

Nobody here can tell you what the receipt is. Money taken now against something to be delivered later is not obviously revenue and not obviously capital, and this article asserts nothing about how it should be recognised or taxed. That is a question for your auditor and for the current tax material, against your actual facts — see audit and accounting and corporate tax for what those conversations involve. If the company sits in a free zone and relies on qualifying status, the cost of getting this wrong is not a rounding error, and being paid in crypto does not make you a crypto business explains why that status is more fragile around virtual assets than most people assume.

And when the proceeds convert to dirhams, they land in a bank that will ask where they came from. That conversation is its own project: banking advisory covers what is actually being tested.

Where issuing a token is the wrong way to fund this

We would rather talk a client out of this than assemble it and watch it fail at the distributor.

It is wrong if the reason is speed. A licence for Category 1, or a distributor's beyond-reasonable-doubt diligence for Category 2, is not a shortcut past a funding round. It is a different queue, and there is no evidence it is a shorter one.

It is wrong if the reason is to avoid diligence. The diligence still happens. It is performed by a firm whose own licence is at risk if it gets you wrong, to a standard the regulator wrote, including an audit of your smart contracts. That is a harder room than a seed investor's.

It is wrong if the token does nothing. A distributor is required to assure the quality of the asset, not merely the paperwork around it. A token that exists to be sold, with a use invented afterwards to justify the sale, is the exact profile this whole architecture was built to stop.

It is wrong if the product depends on privacy features. Anonymity enhanced tokens are prohibited. That is a design decision, not a compliance decision, and it cannot be fixed by wording.

It is wrong if you cannot live with a maintained public document. The whitepaper has to stay accurate at all times, holders have to be told about changes before they take effect, and you may not exclude civil liability for what it says. A team that changes direction every quarter is signing up to publish every one of those changes.

It is wrong if the plan is to reach anyone, anywhere. The residency conditions attached to marketing in Dubai are one jurisdiction's answer. Every other jurisdiction your buyers live in has its own, and none of them is disposed of by a Dubai permission. A UAE licence is an emirate licence, not a global one, and that is even truer of an offering than of a trade.

And it is wrong if you actually wanted a payment mechanism. Some of what gets built as a token is really an attempt to move money faster. If that is the underlying problem, the answers are elsewhere entirely — including one the Central Bank is building, set out in the Digital Dirham can arrive with conditions attached.

What to settle before you write a line of the paper

Four things, in this order, and none of them requires a fee to be paid.

Establish which category the token falls into, in writing, from the referencing model rather than from what you intend to call it — because Category 1 needs a licence before anything is issued and Category 2 does not, and nothing else you decide matters until that is settled. Approach two Licensed Distributors early and ask what they require from an issuer, because their answer is the real specification and it will be longer than yours. Get VARA's own position on the approval conflict in writing and keep it on file. Then, before a single line of the whitepaper is drafted, decide whether you are prepared to publish a document you may never disclaim and must keep true indefinitely.

If those four answers hold up, this is a route, and our virtual asset licensing page sets out what the licensed end of it costs. If the appeal was that it let you avoid asking anyone, the appeal was never real. VARA states on its own licensing page that no virtual asset activity is exempt from regulatory supervision, and it is better to hear that from us than from a distributor's rejection six months into a build.

Frequently asked questions