VARA Unlicensed Firms Register: Complete Analysis
VARA maintains a public enforcement register and a separate unlicensed firms register tracking entities identified as conducting virtual asset activities in Dubai without authorization. This analysis consolidates all published enforcement data, identifying patterns in entity types, geographic distribution, and violation categories that inform practitioner compliance strategy.
Enforcement Register Overview
As of March 2026, VARA’s published enforcement actions list more than thirty entities. The register provides five data fields for each action: entity name, date, violation category, violation detail, and enforcement notice type. This structured data enables systematic pattern analysis.
Entity Type Distribution
The enforced entities span multiple corporate structure types:
DMCC (Dubai Multi Commodities Centre): The single largest category of enforced entities. DMCC has historically been a popular free zone for commodity trading and crypto-related businesses. Enforced DMCC entities include Mastercoin DMCC, Coin Aska DMCC, Mercy Crypto DMCC, Shenzhou Crypto DMCC, Mkan Coin DMCC, Coin Swapz Trading DMCC, Crypto Desk Exchange Services (though nominally not DMCC), Crypto Force DMCC, Stabit DMCC, Koto Crypto DMCC, and others.
FZCO (Free Zone Company): Entities registered in various Dubai free zones including Airdance Global FZCO, Tirupati Capitals FZCO (Paycio), UAEC Digital Fintech FZCO, Morpheus Software Technology FZE (Fuze), Hokk Finance FZCO, Hatom Labs FZCO, LBK Blockchain FZCO, and others.
L.L.C. (Mainland Limited Liability Company): Mainland-registered entities including Vesta Prime Portal Co. L.L.C., MarinaCoins Technologies L.L.C, CoinsBooth Payment Services Co L.L.C, I Teller Commercial Brokers L.L.C, BlueAxis Commercial Brokers LLC, CoinCashy Commercial Brokers LLC, CryptoHome Payment Services Provider L.L.C, BTC Bay Payment Services Provider LLC, and others.
Other Structures: The Open Network Foundation (foundation), entities with dual structures (Binalex Capital FZCO and Binalex Point Payment Services Provider L.L.C., Shenzhou Crypto DMCC and its representative office).
Violation Category Analysis
Category 1 — Unlicensed Activities (Dual Violation): The majority of enforcement actions cite both engaging in unlicensed VA activities and advertising/marketing. This dual violation indicates entities that were both operating and promoting VA services.
Category 2 — Advertising/Marketing Only: A smaller subset was cited solely for marketing violations without evidence of operational VA activity. This includes Mastercoin DMCC, Coin Aska DMCC, and Vesta Prime Portal.
Category 3 — Regulatory Breaches: Two cases involve regulatory breaches rather than purely unlicensed activity: Morpheus Software (Fuze) (AML failures + unlicensed + disclosure) and The Open Network Foundation (marketing regulation breaches).
Temporal Distribution
Enforcement actions cluster in batch operations:
- Late 2024: Initial enforcement batch (BTC Bay, CoinCashy, Crypto Force, Stabit, Koto Crypto — August/September 2024)
- January 2025: Nine-entity batch
- March 2025: Twelve-entity batch — the largest single enforcement event
- April-May 2025: Six entities across multiple dates
- July-August 2025: Three entities including the complex Fuze case
- January 2026: Vesta Prime Portal — most recent published action
Enforcement Measure Patterns
The enforcement register reveals consistent patterns in how VARA applies its enforcement tools:
Standard response for unlicensed activity: Every enforcement action against an unlicensed entity results in cease-and-desist orders combined with financial penalties. This combination represents VARA’s baseline enforcement response, applied uniformly regardless of entity type, violation scope, or operating duration.
Enhanced response for regulatory breaches: For the two cases involving regulatory breaches (Morpheus Software and Open Network Foundation), VARA applied additional measures beyond the standard C&D plus fine combination. Morpheus received a skilled person appointment, while Open Network Foundation received a public statement. These enhanced measures signal the escalation available for more complex or serious violations.
No published license revocations: As of March 2026, no published enforcement action has resulted in license suspension or revocation. This suggests VARA has applied the skilled person route — monitoring and remediation — rather than terminating licensed entities. However, this enforcement tool remains available and may be deployed in future cases.
Free Zone Entity Misconceptions
A recurring theme across the enforcement register is the misconception that free zone registration equates to VA licensing. Several aspects of this misconception merit practitioner attention:
DMCC crypto licenses: DMCC offers business license categories that reference cryptocurrency or blockchain activity. These commercial licenses authorize the holder to conduct business from the DMCC free zone, but they do not constitute VARA licensing. Entities holding DMCC crypto licenses must still obtain separate VARA authorization before conducting or marketing VA activities. Multiple DMCC entities on the enforcement register likely held DMCC crypto licenses while lacking VARA authorization.
Other free zone registrations: Similarly, free zone registrations in DAFZA, IFZA, JAFZA, RAKEZ, and other authorities do not substitute for VARA licensing. The FZCO entities on the enforcement register demonstrate that VARA enforces against entities across all Dubai free zones.
Mainland trade licenses: Dubai DET trade licenses, regardless of activity description, do not authorize VA activities. The L.L.C. entities on the enforcement register — including Vesta Prime Portal — confirm that mainland commercial registration does not satisfy VARA’s licensing requirement.
Geographic Risk Indicators
The enforcement register provides indirect intelligence on geographic patterns of unlicensed VA activity in Dubai:
DMCC concentration: The high representation of DMCC entities reflects DMCC’s historical popularity for crypto-related business registration. Practitioners advising firms considering DMCC registration should ensure clients understand that DMCC registration is a commercial necessity (business premises, visa sponsorship) but not a regulatory authorization.
Payment services providers: Several enforced entities were registered as payment services providers (BTC Bay Payment Services Provider LLC, CryptoHome Payment Services Provider L.L.C., Almizan Alfedhi Payment Service Provider L.L.C.), suggesting that some entities attempted to operate VA services under payment services designations.
Commercial brokers: Multiple enforced entities held commercial broker designations (CoinCashy Commercial Brokers LLC, I Teller Commercial Brokers L.L.C, BlueAxis Commercial Brokers LLC), indicating attempts to conduct VA activities under commercial brokerage licenses.
Compliance Implications
The unlicensed firms register delivers clear messages to practitioners:
- No safe harbor — No entity structure, free zone designation, or commercial license provides exemption from VARA’s VA licensing requirement
- Marketing is enough — Advertising VA services without a license is a standalone enforcement trigger
- Batch enforcement capability — VARA can and does conduct coordinated enforcement against multiple entities simultaneously
- Sustained enforcement — Enforcement is ongoing, not a one-time exercise
- Broad entity coverage — VARA enforces against DMCC entities, FZCO entities, mainland L.L.C.s, foundations, and other structures without exception
- Payment and brokerage entities included — Entities registered as payment providers or commercial brokers are not exempt from VA licensing requirements
Practical Steps for Unlicensed Entities
Entities currently operating or marketing VA services in Dubai without VARA authorization face a clear choice:
- Cease operations and marketing immediately — Continuing operations increases the risk of enforcement and the potential magnitude of financial penalties
- Initiate the VARA licensing process — Begin the two-step application to regularize operations. During the application period, all VA operations and marketing must remain suspended until the license is granted
- Evaluate alternative jurisdictions — If the VARA licensing pathway is not suitable, consider ADGM authorization or DFSA authorization as alternatives
- Engage professional advisory — Retain advisory firms and legal counsel with VARA experience to guide the compliance pathway
- Build compliance infrastructure — Begin developing AML programs, KYC procedures, and compliance technology deployments in parallel with the licensing application
For the VARA licensing process to ensure compliance, see our VARA license application guide. For alternative jurisdictions, see ADGM and DFSA guides. For the full enforcement toolkit, see our VARA enforcement powers deep dive.
For enforcement tracking, see our enforcement action dashboard. For regulatory context, visit UAE Tokenization Regulations and Dubai Tokenisation.