Virtual assets: Why VASPs should stay on the right side of the law

In November last year, the UAE announced strict new measures to clamp down on unlicensed virtual assets service providers (VASPs), including cryptocurrency companies operating within the country. We spoke to Praveena Pechetti, senior associate at UAE-based KARM Legal Consultants, a law firm specialising in areas such as blockchain, cryptocurrency, Web3 and fintech to learn more about what the new guidelines mean for unlicensed VASPs and the benefits of being licensed by the UAE’s regulatory authorities.

1. With the recent guidance issued on combating unlicensed virtual assets service providers (VASPs), what is the impact it is likely to have on unlicensed operators?

In November last year, the UAE National Anti-Money Laundering and Combating Financing of Terrorism and Financing of Illegal Organisations Committee in collaboration with other UAE authorities such as the Central Bank of UAE, issued “guidance” to combat the use of unlicensed virtual asset service providers (VASPs).

The guidelines are primarily targeted toward licensed financial institutions (LFIs) such as banks, payment service providers, and other financial intermediaries who may face enforcement actions if they demonstrate ‘wilful blindness’ in their dealings with unlicensed VASPs and have weak anti-money laundering (AML) and combating financial terrorism (CFT) controls. Consequently, for unlicensed VASPs, this can translate into a tightened business environment from an operational perspective where their access to financial services (for example, bank accounts) is severely curtailed.

Also, the UAE regulators have given a clear message that enforcement actions will be taken against unlicensed VASPs (including against their owners and senior management) operating in the UAE. For unlicensed VASPs, undertaking regulated activities such as operating a crypto exchange or an over-the-counter desk, engaging in financial advisory or asset management, the likelihood of facing enforcement actions is even higher.

Under the UAE Federal AML laws, a person/ company operating as a VASP without a proper license/ authorisation, is liable to imprisonment of at least six months and/or penalties of at least Dhs200,000 that could go up to Dhs5m.

In addition to the AML Laws, for VASPs operating in the UAE without a valid license from the Virtual Assets Regulatory Authority (VARA), the fines under VARA’s regulations range from Dhs20 million to Dhs50m or higher.

2. What are the benefits for licenced companies operating in the virtual assets space?

Licensed VASPs have numerous advantages. These include:

• Access to increased business opportunities: Globally, legacy financial companies are foraying into the virtual assets sector by collaborating with VASPs. Also, businesses globally are seeking services from VASPs for various reasons such as accepting crypto payments or making investments for treasury purposes. In general, such entities prefer to engage with licensed and regulated VASPs.
• Regulatory and operational certainty: Operating in a grey regulatory environment poses material risks to the business. UAE is quite a unique jurisdiction in this respect as it offers a nuanced and be-spoke framework for licensing and supervision of virtual assets activities. For VASPs, this can translate into regulatory certainty as they would be able to operate in a stable regulatory environment.
• Access to critical services: From an operational perspective, licensed VASPs will find it easier to access other service providers such as LFIs and designated non-financial business or professions (DNFBPs) or for that matter even official app stores offered by Android or Apple.
• Access to growth capital: Licensed VASPs also have better access to growth capital from PE/ VC firms since having a financial license adds a layer of legitimacy to the VASP.

3. What changes can VASPs expect when dealing with LFIs in the future?

LFIs are expected to exercise continuing vigilance in their engagement with VASPs, starting with the implementation of robust due diligence and monitoring measures. In February 2023, the CBUAE issued detailed guidance to help LFIs understand their statutory obligations under the UAE AML laws while dealing with VASPs.

As such, the LFIs will implement strong measures to address the risks of financial crime. These include:

• recognising various fraudulent methods unlicensed VASPs adopt
• analysing high-risk patterns and adjusting monitoring systems to adopt new rules for reporting
•  using advanced technologies, to effectively intercept transactions with unlicensed VASPs
• reporting suspicious transactions and activity where required, to the UAE Financial Intelligence Unit
• Running awareness campaigns for their customers to educate investors on how they can identify unlicensed entities and the associated risks
• The latest guidance further entrenches the position that LFIs must be highly vigilant while dealing with unlicensed VASPs

4. How does this align with the global money laundering compliance expected by the UAE?

Over the last few years, the UAE has introduced a slew of measures to strengthen its AML/CFT framework, as evidenced by the current guidance as well as various legal amendments that were issued earlier. The UAE’s framework is in line with the requirements of the Financial Action Task Force (the global money laundering and terrorist financing watchdog) which recommends that…

• VASPs should be regulated for AML and CFT purposes
• Should be licensed or registered
• Be subject to effective systems for monitoring or supervision

Overall, the UAE regulators governing VASPs require VASPs to implement robust AML/ CFT controls such as developing internal AML policies and manuals, reporting suspicious transactions, transaction monitoring, complying with the FATF Travel Rule, and undertaking customer due diligence.

The UAE’s approach reflects that it is committed to promoting responsible innovation while maintaining standards for financial integrity.

5. Will global virtual service operators be expected to have a UAE licence in addition to their global one? Please explain a scenario if multiple licenses are expected from companies.

VASPs seeking to engage in regulated virtual assets activities in the UAE are required to obtain the appropriate licenses from the concerned UAE authorities. Considering the differing approaches globally in the regulation of virtual assets activities, at present, there is no passporting regime. For example, in the case of fund managers in the legacy financial space, there is a framework for fund managers licensed in comparable jurisdictions to be recognised as foreign fund managers in the UAE, but a similar framework is currently not available for VASPs. The current scenario may change once MICA (EU crypto regulations) becomes effective in the EU region and other GCC countries open their doors to VASPs, the current scenario may change.

5. Explain the process of securing a license and the requirements for the same.

In general, VASPs are required to complete the following steps as part of the licensing process:

• Contacting the relevant authority and engaging in initial discussions
• Submitting application forms along with detailed supporting documents
• Demonstrating the internal systems and controls to the satisfaction of the regulator by submitting detailed policies and manuals
• Taking steps to achieve operational readiness such as incorporating a company (if required), making mandatory appointments, opening a bank account, depositing the minimum capital and securing insurance policies.

We have advised numerous renowned global VASPs on defining their products and services in line with the UAE’s regulatory landscape. VASPs should bear in mind that each regulator’s licensing process varies, and they could benefit from appropriate legal assistance during the process.

7. What is the current regional landscape (in the GCC and neighbouring countries) related to regulations for virtual assets companies?

The regional landscape presents a varied picture. Bahrain is one of the first jurisdictions globally to issue a bespoke and comprehensive regulatory framework for VASPs.

In contrast, Kuwait has placed a prohibition on using virtual assets as a payment tool/currency, dealing with virtual assets as an investment medium as well as mining virtual assets. Kuwait has also banned the issuance of commercial licenses to VASPs. Saudi Arabia has also placed a similar restriction on virtual assets activities.

While Qatar also has similar restrictions in place, changes appear to be in the offing.

In October 2023, the Qatar Financial Centre issued a consultation paper on its Proposed Digital Assets Regulatory Rules Framework, indicating its intent to legitimise and regulate virtual assets activities in Qatar. Similarly, earlier in 2023, Oman’s Capital Market Authority began development of a virtual assets regulatory framework.

In summary, while the position across GCC countries is not uniform, some jurisdictions are moving towards regulating VASPs, to monitor and mitigate the risks of money laundering and terrorist financing.