What founders need to know
Key Takeaways
- VARA’s Marketing Regulations apply to all marketing of virtual assets in or from the UAE, regardless of where the marketer is licensed, including offshore firms targeting UAE residents.
- Marketing must be fair, clear and not misleading, carry prominent risk warnings, and avoid guaranteed-return or risk-free claims.
- Influencer and affiliate promotions are in scope: endorsements must be disclosed, and the firm behind the promotion is accountable for compliant content.
- ADGM (FSRA), the DFSA, the CMA and the CBUAE each apply financial-promotion rules within their perimeters; a UAE-wide campaign can touch several at once.
- Targeting UAE or Dubai residents from outside the country still triggers the rules. The geography of the audience, not the server, decides jurisdiction.
- VARA fined 19 firms in 2025, several for marketing-rule breaches alongside unlicensed operation.
- Marketing compliance is an ongoing programme, not a one-time sign-off; content, channels and influencer relationships need monitoring.
The Marketing Perimeter
Who Do the UAE Crypto Marketing Rules Apply To?
The most misunderstood feature of UAE crypto marketing is reach. The rules are not limited to licensed firms or to companies physically in the UAE. They follow the audience.
- All marketers, not just licensees. VARA’s Marketing Regulations apply to any person marketing virtual assets in or from the UAE, including firms that hold no VARA licence and firms licensed by another regulator.
- Offshore firms targeting UAE users. Promoting to UAE or Dubai residents from outside the country still triggers the rules. Accepting UAE-resident sign-ups, running geo-targeted ads, or appointing UAE-based promoters brings a campaign into scope.
- Several regulators at once. A national campaign can engage VARA in Dubai, the FSRA and DFSA in the free zones, the CMA onshore and the CBUAE for payment-token messaging. The marketing analysis runs across every perimeter the campaign touches.
The starting question is never where the company sits. It is who the campaign reaches. If the audience includes UAE residents, the UAE rules apply.
What the Rules Require
What Does Compliant Crypto Marketing Require?
Across the UAE regulators the principles are consistent, even where the detailed rules differ. Compliant marketing meets five tests.
- Fair, clear and not misleading. No overstated benefits, no hidden risks, no cherry-picked performance. The overall impression a reasonable consumer takes away must be accurate.
- Prominent risk warnings. Clear, legible warnings that virtual assets are high-risk and that capital is at risk, placed where the audience will actually see them, not buried in a footer.
- No guaranteed returns. Promises of guaranteed, risk-free or fixed returns, and language that downplays volatility, are prohibited.
- Disclosed endorsements. Influencer and affiliate promotions must be identified as paid, and the firm behind the promotion is accountable for what the promoter publishes.
- Records and approvals. Marketing material kept on record, approved through an internal sign-off process, and, where a regulator requires it, cleared or notified before publication.
Who Must Comply
Who Needs to Meet the UAE Crypto Marketing Rules?
If you promote virtual assets to a UAE audience, in any channel, the rules apply. Typical cases:
You are generally lower-risk, though still bound by general law, if you are:
Rules apply
- Exchanges and VASPs Any licensed or unlicensed firm promoting virtual asset services to UAE users.
- Token issuers and projects Promoting a token sale, listing or campaign to a UAE audience.
- Influencers and KOLs Paid endorsements of virtual assets reaching UAE followers must be disclosed and compliant.
- Affiliates and marketing agencies Agencies and affiliates running crypto campaigns aimed at UAE residents.
- Offshore firms targeting the UAE Companies outside the UAE running geo-targeted ads or onboarding UAE users.
- Payment-token and stablecoin issuers Promoting payment tokens, where CBUAE messaging rules also apply.
Generally lower-risk
- Purely factual, non-promotional information Neutral educational or technical content that does not promote a specific product or firm.
- Internal or B2B non-promotional communication Communications not directed at consumers and not promoting a virtual asset to the public.
- Not targeting UAE audiences Campaigns that genuinely exclude UAE residents and do not onboard them.
Whether a campaign is in scope turns on audience and wording. A legal strategy call reviews your channels and disclosures in 30 minutes.
Rules by Regulator
How Does Each UAE Regulator Treat Crypto Marketing?
For which firms currently hold licences under each regulator, see the live UAE VASP Licence Tracker , updated monthly.
| Regulator | Marketing reach | What it focuses on |
|---|---|---|
| VARA (Dubai) | All VA marketing in or from the UAE, licensed or not | The Marketing Regulations: fair and clear messaging, risk warnings, influencer rules, enforcement |
| ADGM (FSRA) | Financial promotions within and from ADGM | Financial-promotion restrictions, professional-client targeting, approval of communications |
| DFSA (DIFC) | Financial promotions within and from the DIFC | Promotion rules tied to client classification and the firm-led suitability model |
| CMA (federal) | Onshore federal marketing and extraterritorial targeting | Marketing tied to the licensed activity, with extraterritorial reach to UAE-targeting firms |
| CBUAE (payment tokens) | Payment-token and stablecoin messaging | Promotion of payment tokens consistent with the Payment Token Services Regulation |
A single campaign that reaches the whole UAE can engage several of these at once. The analysis maps the campaign against every perimeter it touches.
How VARA Enforces the Marketing Rules
Enforcement in Dubai is active and visible. In 2025 VARA fined 19 firms, several for marketing-rule breaches alongside unlicensed operation, and has issued public cessation orders against unauthorised promotion. The enforcement posture does not turn on company size or stage. A non-compliant campaign run from offshore, by an affiliate, or through an influencer, is treated as the firm’s responsibility. The practical lesson is that marketing is reviewed before it runs, not after a regulator notices it.
Engagement Model
How Does NeosLegal Structure a Marketing Compliance Engagement?
Across 20+ VASP engagements since 2016, marketing is where firms most often create avoidable enforcement risk, usually through an influencer or affiliate channel nobody reviewed. The model below puts a compliant programme around the marketing function rather than checking a single asset.
- 01
Perimeter and audience analysis
Which regulators a campaign engages, based on audience and channel, and whether the firm’s current activity is even permitted to be marketed. Output: a written marketing-perimeter memo.
- 02
Content and disclosure review
Campaign assets, landing pages, risk warnings and claims reviewed against the applicable rules, with specific redrafts where messaging overstates benefits or understates risk.
- 03
Influencer and affiliate framework
Compliant promoter agreements, disclosure requirements and approval workflows, so paid endorsements are controlled and the firm is not exposed by a third party’s wording.
- 04
Approval and record-keeping process
An internal sign-off and record-keeping process built into the marketing function, so compliance is demonstrable and repeatable rather than ad hoc.
- 05
Ongoing monitoring retainer
Continuing review of new campaigns, channels and influencer relationships, and monitoring of rule changes across the regulators the firm touches.
How engagements are priced
Marketing compliance is not a capital-based licence. NeosLegal works on fixed-fee, milestone-based engagements: a one-off campaign or framework review, or an ongoing monitoring retainer for firms marketing continuously. A specific written cost estimate is provided after the free assessment call, before any engagement commitment.
“The marketing breach almost never comes from the firm’s own website. It comes from an influencer the growth team paid in tokens, who promised followers a guaranteed return in a story that nobody on the legal side ever saw. VARA does not care that it was a third party. It is your campaign and your liability. Marketing compliance is a programme around the whole funnel, not a disclaimer at the bottom of a banner.”
WHY CHOOSE NEOSLEGAL
Why Founders and Institutions Choose NeosLegal
NeosLegal has worked only on crypto and Web3 since 2016, before VARA existed, before ADGM had a crypto framework, and before most UAE firms understood what Bitcoin was. That head start shows in the track record, the recognition, and the way engagements run.
Track Record
- 300+ UAE Web3 and crypto projects structured and 700+ founders advised since 2016, with zero client enforcement actions in ten years.
- USD 500 billion in transactions advised and deals closed.
- 20+ VASP licence applications advised across the UAE regulators.
- 250+ Tier-1 exchange legal opinions at a 100% acceptance rate, a commercially verifiable outcome across hundreds of submissions.
Independent Recognition
- Best UAE Crypto Law Firm 2026, UAE Business Awards Middle East.
- Middle East Technology Legal Team of the Year, The Oath Middle East, November 2025.
- Authors the UAE chapters of the Chambers Blockchain and Crypto Assets guide, 2025 and 2026.
- Irina Heaver ranked as Recommended Blockchain Lawyer in the UAE 2025 and 2026, Lexology.
Regulatory Coverage
- All five UAE regulatory pathways, VARA, ADGM (FSRA), DIFC (DFSA), the federal CMA and CBUAE, handled within a single firm, with no coordination overhead between separate advisers.
- 60+ jurisdictions covered in total for cross-border structuring since 2016.
- Federal CMA Category RWA Tokenization Exchange, broker-dealer and OTC dealing desk licences delivered end to end, including the full policy suite, AML risk and controls register, and Approved Persons submissions the regulator requires.
Every engagement is fixed-fee with defined milestones confirmed before work begins. Direct access to Irina Heaver and senior associates throughout, not associates managing the relationship.
Founder differentiator
Founded by Irina Heaver, a former co-founder of a UAE crypto exchange (later exited), NeosLegal operates with founders’ commercial realities in mind. Irina has also drafted crypto laws and advised on virtual asset policy for multiple regulators and governments, including UAE regulators, helping shape the frameworks her clients are now licensed under, a perspective no other crypto lawyer in the UAE can offer.
Track record
Representative Marketing Compliance Cases
-
Marketing Compliance
Influencer & KOL Compliance Program
Advised a VARA-licensed business on its influencer and KOL marketing program, drafting compliant promotion agreements, disclosure requirements and an approval workflow aligned with VARA's marketing rules.
-
Marketing Compliance
Marketing-Compliance Framework for an Exchange
Built the marketing-compliance framework for a crypto exchange, establishing pre-publication review, risk-warning standards and record-keeping to satisfy regulator marketing requirements.
-
Marketing Compliance
Regulator Marketing-Enforcement Response
Advised a crypto business on responding to a regulator marketing query, remediating non-compliant promotions and implementing controls to prevent recurrence.
-
Marketing Compliance
Cross-Border Campaign Compliance Review
Reviewed a global marketing campaign for UAE compliance, screening claims, audience targeting and disclaimers against VARA and federal requirements before launch.
Browse 100+ Representative Case Studies
View All Case Studies