Cease-and-Desist Order
A cease-and-desist order is an enforcement measure requiring a VASP or other entity to stop any virtual asset activity or other business activity, either for a specified or indefinite period of time. Under VARA’s enforcement framework, cease-and-desist orders are the primary tool for halting unauthorized virtual asset operations in Dubai.
Legal Basis
VARA’s authority to issue cease-and-desist orders derives from the Virtual Assets and Related Activities Regulations 2023. The Full Market Product Regulations establish the activities that require licensing, and the enforcement provisions authorize VARA to compel cessation of unlicensed activities.
Operational Impact
A cease-and-desist order has immediate and comprehensive operational impact:
Activity Cessation: The entity must halt all specified activities upon receipt of the order. For unlicensed operators, this means stopping all virtual asset operations, marketing, customer onboarding, and transaction processing.
Marketing Removal: Cease-and-desist orders in advertising/marketing cases require removal of all promotional materials, website content, social media posts, and other marketing collateral.
Client Impact: Firms with existing client relationships must manage the orderly wind-down of those relationships, which may include returning client assets, closing positions, and communicating the regulatory status to affected customers.
Enforcement Patterns
Cease-and-desist orders appear in virtually every published enforcement action on VARA’s enforcement register. They are consistently combined with financial penalties and, in some cases, additional measures:
- Vesta Prime Portal — C&D + Financial Penalties (marketing violation)
- UAEC Digital Fintech — C&D + Financial Penalties (unlicensed activities)
- Morpheus Software (Fuze) — C&D + Financial Penalties + Skilled Person (AML failures)
- Open Network Foundation — C&D + Financial Penalties + Public Statement (marketing breaches)
See the enforcement action dashboard for the complete enforcement register.
Types of Cease-and-Desist Orders
VARA’s enforcement register reveals several variations of cease-and-desist orders depending on the nature of the violation:
Activity cessation orders: Requiring the entity to stop conducting virtual asset operations. This applies to entities like UAEC Digital Fintech FZCO that were engaged in unlicensed VA operations. The entity must cease all customer-facing services, stop processing transactions, and wind down any active positions.
Marketing cessation orders: Requiring the entity to stop advertising and marketing VA activities. This applies to marketing-only violations such as Vesta Prime Portal. The entity must remove websites, social media content, promotional materials, and all other advertising directed at the Dubai market.
Combined orders: Requiring cessation of both operational and marketing activities. The majority of enforcement cases involve both categories, as entities typically market the services they are operating.
Specified period vs. indefinite: Cease-and-desist orders may be time-limited or indefinite. For unlicensed entities, the order is effectively permanent unless the entity subsequently obtains a valid VARA license. For licensed entities with compliance deficiencies, the order may be limited to a specified period during which remediation is expected.
Non-Compliance Consequences
Continuing operations after receiving a cease-and-desist order constitutes a separate and more serious violation. VARA’s enforcement framework authorizes escalating responses to non-compliance including:
- Daily financial penalties: Periodic penalty payments that accumulate for each day of continued non-compliance
- Public interest orders: Broader orders that may restrain the entity and its principals from any business activity
- Legal referral: Referral to law enforcement authorities for criminal prosecution, particularly if the non-compliance involves ongoing consumer harm or financial crime
- Take-down notices: Instructions to internet service providers, domain registrars, or hosting providers to take down the entity’s online presence
Compliance Implications
Practitioners must understand that:
- Continuing operations after receiving a cease-and-desist constitutes a separate violation
- Marketing alone (without conducting transactions) can trigger a cease-and-desist
- Cease-and-desist orders may be issued alongside other enforcement measures
- Proper licensing is the only way to avoid cease-and-desist risk
- Free zone company registration or commercial trade licenses do not provide immunity from cease-and-desist orders
- The order applies to the entity and may extend to its principals, directors, and officers
For the full enforcement toolkit analysis, see our VARA enforcement powers deep dive. For enforcement response procedures, see our how to respond to enforcement guide. For the complete enforcement timeline, see the enforcement action dashboard.
Timeline and Procedural Aspects
VARA’s cease-and-desist orders are typically issued as part of a regulatory decision that may follow a supervisory review, complaint investigation, or market surveillance finding. The procedural timeline varies:
Unlicensed activity cases: These may result in expedited cease-and-desist orders, as the violation is binary — either the entity holds a valid license or it does not. VARA’s enforcement register shows that unlicensed activity cases can move from identification to published enforcement action within weeks, particularly when the entity is actively marketing virtual asset services to Dubai-based consumers.
Licensed entity cases: For licensed VASPs found in breach of FMP Regulations, the procedural pathway typically involves a supervisory finding, an opportunity for the entity to respond, and a regulatory decision. Cease-and-desist orders for licensed entities may target specific activities or practices rather than requiring total cessation of operations.
Comparison Across UAE Jurisdictions
Cease-and-desist powers are not unique to VARA. ADGM-FSRA and DFSA maintain equivalent enforcement powers to compel cessation of unauthorized activities within their respective jurisdictions. The enforcement approaches comparison examines how each jurisdiction deploys its enforcement measures.
Related Terms
For regulatory context, visit UAE Tokenization Regulations and Dubai Tokenisation.