The rule.
The Dubai Virtual Assets Regulatory Authority (VARA) regulates virtual-asset activity in the Emirate of Dubai. Alongside its Compulsory Rulebook and the activity-specific rulebooks, VARA issued a standalone set of Marketing Regulations in 2023 — a separate instrument governing promotion, distinct from the conduct rules that govern the service itself. MiCA, by contrast, folds marketing into Articles 88 and 99 of a general regime; the FCA reaches it through the financial-promotion perimeter. Dubai gave it its own book.
Section II of those Marketing Regulations covers Approval and Notification. Its practical effect, and the reason it is the first rule in NorthPoint’s VARA pack, is that VARA reserves the right to require that a marketing campaign by a licensed VASP be approved or notified before it runs. That is an upstream gate. It is not a content standard you can satisfy retroactively by rewriting a headline.
NorthPoint cites the instrument and the section, and does not reproduce VARA’s rulebook text on this page. VARA’s rulebooks are published by VARA and are the only authoritative wording; read them at source before you rely on them.
Everything below the citation line on this page is NorthPoint’s operator-grade reading of how the section behaves in a marketing workflow — information, not legal advice, and not a substitute for qualified UAE counsel.
Two things follow from where this rule sits. First, it binds the licensed entity, not the agency, the KOL or the growth contractor — but it is almost always the agency’s launch calendar that breaks it. Second, it is a rule about process evidence. The question a reviewer asks is not “is this creative good?” but “where is the record?”
What triggers it.
The distinction that decides most real cases is campaign versus organic content. VARA’s regime is not a rule that every social post must be cleared; treating it that way would stop a marketing team functioning, and no regulator has asked for that. The signals that move an asset from “content” to “campaign” are the ordinary marketing ones:
Paid media spend. Money behind distribution — performance ads, sponsored placements, paid KOL contracts, OOH in Dubai — is the single strongest campaign signal.
Multi-asset, multi-channel rollout. One post is content. A coordinated push across paid, owned and earned, with a shared creative concept, is a campaign.
A scheduled launch window. A dated go-live, a countdown, an embargo, a listing date — anything with a calendar attached — is the shape of a campaign, and it is also the thing that makes an approval step genuinely inconvenient. That is why it gets skipped.
UAE reach. The regime is territorial in a specific way: VARA applies in the Emirate of Dubai. DIFC and ADGM run separate regimes under the DFSA and FSRA respectively, and federal-level marketing across the wider UAE reaches into the Securities and Commodities Authority’s territory. A campaign geo-fenced to ADGM only is not a VARA campaign — but if the geo-fence is not visible in the media plan, nobody downstream can tell.
Where those signals are present and the promoting entity is VARA-licensed, the honest position is that the approval-and-notification section is live and the record needs to exist before the launch date, not after the first flag.
What it is not.
The mirror-image failure is treating an approval as a marketing asset. It is not one. Where a campaign has been approved or notified, that fact is procedural compliance, not a quality signal, and promoting it as endorsement is separately prohibited — the free VARA check flags exactly this pattern under Prohibited Content (VARA Marketing Regulations 2023, §IV; UAE Federal Decree-Law No. 14 of 2023).
A licence is not an endorsement of a token, of a return, or of the safety of a product. Neither is an approval reference. This is the same error MiCA punishes through Article 88’s fair-clear-not-misleading standard and the FCA punishes through the approval-marker rules: the regulator’s name is a fact about permission, never a fact about merit.
Common failure patterns.
A Dubai-licensed exchange books a four-week paid push around a listing date. Creative is signed off by brand and legal. There is no approval or notification reference anywhere in the file.
The creative is fine and the process is missing. Internal legal sign-off is not the regulatory record; the record is the one the regulator can be shown. Citation: VARA Marketing Regulations 2023, §II.
A launch is described internally as organic-only, while the media plan contains three paid KOL contracts, a boosted post budget and an embargoed press date.
The label in the deck does not decide the classification; the media plan does. If paid distribution and a launch window are present, the campaign reading is the defensible one. Citation: VARA Marketing Regulations 2023, §II.
A landing page carries the line “VARA-approved campaign” above the fold.
Misframes a procedural acknowledgement as a regulatory endorsement of the offer. Drop the phrasing; if licence status must be stated, state the licence and its scope, factually. Citation: VARA Marketing Regulations 2023, §IV; UAE Federal Decree-Law No. 14 of 2023.
A campaign is described as “DIFC and institutional only”, but runs on channels with no audience gate and Dubai-emirate targeting left on by default.
A jurisdiction claim you cannot evidence in the targeting is not a jurisdiction claim. VARA, DFSA and FSRA are separate regimes; which one applies is decided by reach, not by an internal label.
How operators handle it.
Put one line at the top of every brief: campaign or organic, and why. Paid spend, multi-channel rollout, scheduled launch window, UAE reach — four boxes. The classification is cheap on day one and expensive on the day the media buy goes live.
The obligation attaches to the licensed VASP. Whoever builds the campaign, the submission goes through the entity’s regulatory contact, with the creative bundle, the media plan, the target audience and the disclaimers as they will actually ship.
Store the reference in the same place as the asset, not in an inbox. A year later, the question will be asked about a specific banner, and the answer needs to be retrievable from the banner.
VARA publishes the register of licensed and permitted virtual-asset service providers on vara.ae. This page asserts no register row for any named firm — a licence list is a point-in-time fact, and the only correct version of it is the one you read on the day you publish. Record the date you checked alongside the campaign record.
If the campaign is meant to sit outside Dubai, the exclusion belongs in the ad targeting, the KOL contracts and the landing-page audience gate — not only in the terms. Then the classification question has a documented answer.
Common questions.
Does VARA pre-approve marketing campaigns?
VARA's Marketing Regulations 2023 reserve, at Section II (Approval and Notification), the right to require prior approval or notification of marketing campaigns run by licensed VASPs. In practice that means a campaign-scale promotion with UAE reach should carry an approval or notification record before it launches, held by the licensed entity. Single-channel organic content is generally a different case. This is information, not legal advice; campaign decisions need qualified UAE counsel.
Can we say “VARA-approved” once a campaign has been cleared?
No. An approval or notification is procedural compliance, not a regulatory endorsement of the product, the token or the returns. Marketing the approval as a quality signal is treated as prohibited content in its own right, and the free VARA check on northpoint.fi flags regulator-endorsement framing as a distinct finding. If licence status has to appear, state the licence and its scope factually, without implying merit.
Does VARA apply to a campaign aimed at DIFC or ADGM?
VARA's remit is the Emirate of Dubai. DIFC and ADGM operate separate financial free-zone regimes under the DFSA and FSRA, and federal-level marketing across the wider UAE also engages the Securities and Commodities Authority. A campaign genuinely fenced to ADGM only is not a VARA campaign — but the fence has to be visible in the targeting, not just asserted in the brief, or the safe reading is that Dubai audiences are in scope.
Related rules.
-
10 of the 38 VARA rules, including the prior-approval signal and “VARA-approved” framing. No signup.
-
The EU treatment of the paid-distribution signal that most often makes a Dubai push a campaign.
-
The UK analogue: an upstream permission question that no amount of copywriting can answer after the fact.
-
Fair, clear and not misleading — the standard that also bars using a regulator's name as a merit claim.
-
MiCA, FCA, GDPR, SEC and VARA rules, quoted where quotable and cited throughout.
How this page is sourced.
Repackaged from NorthPoint’s own 38-rule VARA marketing pack (authored 2026-05-21, operator-grade interpretive notes current through Q1 2026), restricted to the rule themes already surfaced publicly on /check/vara. Subscriber-only rule text, check logic and rewrite patterns are deliberately not reproduced here. VARA’s Marketing Regulations 2023, the Compulsory Rulebook and the activity-specific rulebooks are published by VARA and remain the authoritative wording. Page published 2026-08-13; no enforcement outcome, register row or licence status is asserted for any named firm.