ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority Virtual Assets and Related Activities Regulations 2023 7 February 2023 ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 2 Contents INTRODUCTION .................................................................................................................................................................... 4 FUNDAMENTAL PRINCIPLES AND GOALS .............................................................................................................. 5 I. PART I – THE REGULATOR .............................................................................................................................. 6 A. Establishment of VARA ......................................................................................................................................................... 6 B. Rules, Directives and Guidance.......................................................................................................................................... 6 II. PART II – ISSUING VIRTUAL ASSETS .......................................................................................................... 9 A. Issuance Rules............................................................................................................................................................................. 9 B. Power to classify Virtual Assets ....................................................................................................................................... 9 C. Prohibited Virtual Assets ..................................................................................................................................................... 9 III. PART III – REGULATED VA ACTIVITIES ...................................................................................................10 A. General prohibition and exemptions ........................................................................................................................... 10 IV. PART IV – LICENSING .......................................................................................................................................12 A. Licensing requirements ...................................................................................................................................................... 12 B. VARA's Licensing and authorisation powers .......................................................................................................... 14 V. PART V – VA ACTIVITY RULEBOOKS .......................................................................................................17 VI. PART VI – ANTI-MONEY LAUNDERING AND COMBATING THE FINANCING OF TERRORISM ...........................................................................................................................................................18 A. VARA's Supervisory Authority ....................................................................................................................................... 18 B. AML/CFT obligations of VASPs .................................................................................................................................... 18 VII. PART VII – MARKETING, ADVERTISING OR PROMOTION ..............................................................19 A. Marketing Regulations ........................................................................................................................................................ 19 VIII. PART VIII – MARKET OFFENCES .................................................................................................................20 A. Market Offences and VARA's power to stipulate Market Offences and Accepted Practices ...... 20 B. Inside Information ................................................................................................................................................................. 20 ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 3 C. Insider Dealing ......................................................................................................................................................................... 21 D. Unlawful Disclosure .............................................................................................................................................................. 22 E. Prohibition of Insider Dealing and of Unlawful Disclosure.............................................................................. 22 F. Legitimate behaviour of treating Inside Information ......................................................................................... 22 G. Market Sounding .................................................................................................................................................................... 23 H. Market Manipulation ........................................................................................................................................................... 25 I. Prohibition of Market Manipulation ............................................................................................................................ 27 J. Prevention and detection of Market Offences ...................................................................................................... 27 IX. PART IX – SUPERVISION, EXAMINATION AND ENFORCEMENT .................................................29 A. Investigation or examination by VARA ...................................................................................................................... 29 B. Examination .............................................................................................................................................................................. 29 C. Enforcement, fines and penalties .................................................................................................................................. 30 X. PART X – CONFIDENTIALITY ........................................................................................................................32 A. Duty of confidentiality ........................................................................................................................................................ 32 SCHEDULE 1 – VA ACTIVITIES ....................................................................................................................................33 SCHEDULE 2 – SUPERVISION AND AUTHORISATION FEES .........................................................................36 SCHEDULE 3 – FINES .......................................................................................................................................................38 SCHEDULE 4 – DEFINITIONS ........................................................................................................................................40 ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 4 Introduction The Dubai Virtual Assets Regulatory Authority [VARA] was established and authorised by Law No. [4] of 2022 Regulating Virtual Assets in the Emirate of Dubai [Dubai VA Law] to regulate Virtual Assets and Virtual Asset Service Providers [VASPs]. VARA is affiliated to the Dubai World Trade Centre Authority [DWTCA] and is the competent entity in charge of regulating, supervising, and overseeing Virtual Assets and VA Activities in all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre [the Emirate]. As set out in Article 5 of the Dubai VA Law, VARA has the following objectives: 1. to promote the Emirate as a regional and international hub for Virtual Assets and related services; to boost the competitive edge of the Emirate at the local and international levels; and to develop the digital economy in the Emirate; 2. to increase awareness on investment in the Virtual Asset services and products sector, and encourage innovation in this sector; 3. to contribute to attracting investments and encourage companies operating in the field of Virtual Assets to base their business in the Emirate; 4. to develop the regulations required for the protection of investors and dealers in Virtual Assets, and to endeavour to curb illegal practices in coordination with the concerned entities; and 5. to develop the regulations, rules and standards required for regulating, supervising, and overseeing Virtual Asset platforms, VASPs, and all other matters related to Virtual Assets. The Virtual Assets and Related Activities Regulations 2023 [these Regulations] have been enacted with a view to advance the above objectives. These Regulations set out the regulatory framework governing Virtual Assets and all related activities in the Emirate, including the general and specific supervision and enforcement powers of VARA. VARA may, from time to time, amend these Regulations in its sole and absolute discretion to address emerging risks and continually evolving developments in the global Virtual Asset sector. The most updated version of these Regulations will be made available on VARA's website. Capitalised terms in these Regulations have meanings defined herein or as defined in Schedule 4. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 5 Fundamental Principles and Goals These Regulations are guided by the following fundamental principles for effective regulation of Virtual Assets and VA Activities— 1. Market integrity and stability: the market should be fair, orderly, transparent, and prevent fraud and other criminal activity. The market should be systemically safe with consideration given to prudential risks. The market can be volatile whilst still being considered to be fair and orderly. The regime should be fully FATF compliant. 2. Consumer protection: the regime seeks to prevent harms arising from misinformation, abuse and/or poor operational practices. Market participants are free to engage with risk, so long as they give "informed consent" about their investments and VASPs have provided them with all information necessary for such consent in accordance with all applicable laws and regulations. 3. Technology neutrality and supportive of innovation: the regime must not discriminate against technology, but instead against illicit or harmful activities. If an activity is not illicit, it should be possible and desirable to regulate it without banning it entirely. VARA does not regulate products or protocols as the starting point for achieving its policy goals (except in special cases). VARA does not decide which innovations are subjectively valuable or not. 4. Regulatory resilience: the regime must not become quickly outdated with loopholes given the fast-paced nature of the industry. The regime is principles-driven and VARA is mindful when it makes prescriptive carve-outs. 5. Regulatory efficiency and proportionality: enforce a regime that is not only effective [i.e. achieves the policy intent], but does so in the least burdensome way possible for both VARA and VASPs. Any burden imposed is justified relative to the potential harm that is being mitigated. Underpinning these fundamental principles are VARA's two primary policy goals, which are to— 1. promote the Emirate and ultimately the UAE as a safe and progressive jurisdiction worthy of attracting meaningful Virtual Asset growth and innovation, in complement with all related UAE Government programmes, and 2. position VARA and the UAE as globally trusted and respected in the realm of international law, particularly with respect to FATF compliance, and by designing a system that lends itself to interoperability and passportability. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 6 I. Part I – The Regulator A. Establishment of VARA 1. VARA jurisdiction. a. The Dubai VA Law and these Regulations apply to all Virtual Assets and VA Activities in the Emirate. b. VARA has sole and absolute discretion to interpret, waive, modify or otherwise adapt these Regulations in exercising its

powers and in furtherance of its functions and objectives under the Dubai VA Law. 2. VARA powers and functions. a. VARA has such functions, powers and objectives as are conferred on it by or under the Dubai VA Law and any amendments thereto. b. VARA may do whatever it considers necessary for or in connection with, or reasonably incidental to, exercising its powers, performing its functions and fulfilling its objectives under the Dubai VA Law. 3. Power to amend Regulations. VARA may, from time to time, amend these Regulations in its sole and absolute discretion. B. Rules, Directives and Guidance 1. General power to issue Rules, Directives and Guidance. VARA may from time to time issue Rules, Directives and Guidance for the purposes of these Regulations or exercising its powers, performing its functions and fulfilling its objectives under the Dubai VA Law. 2. Rules. a. VARA may issue Rules which have binding effect. b. All Rules, as may be amended from time to time, shall be— i. contained in these Regulations, any Rulebooks or any other Rule-making instruments; and ii. published by VARA on its website. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 7 3. Directives. a. VARA may from time to time direct any Entity or VASP, or a specified class of Entities or VASPs, to take or refrain from taking such other action as is specified and in addition to the requirements set out in these Regulations or Rules, including but not limited to— i. comply with specific regulatory capital or liquidity requirements; ii. apply a specific provisioning policy or treatment of specified Virtual Assets; iii. comply with specified limits on material risk exposures; iv. comply with specified limits on exposures to related parties; v. meet additional or more frequent reporting and/or notification requirements; or vi. take or refrain from taking any other actions deemed not prudent or otherwise which may affect the ability of an Entity or a VASP to comply with applicable laws and regulations, or have an adverse effect on the Virtual Asset market in the UAE, as determined by VARA in its sole and absolute discretion. b. Directives shall be— i. communicated in writing by VARA to any Entity or VASP to which they relate; or ii. published on VARA's website. c. Unless otherwise specified by VARA, no Entity or VASP shall publish or otherwise publicise the details of any Directives not published on VARA's website. d. VARA may issue Directives that waive or otherwise modify the application of any Regulations or Rules. e. VARA may at any time amend or revoke a Directive. 4. Guidance. a. VARA may issue Guidance which is indicative and non-binding, and which may comprise any information as further elaboration or explanation on the application of these Regulations, or any Rules or Directives. b. Guidance may be incorporated into Rulebooks and/or Directives or separately in another form issued by VARA. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 8 c. All Guidance, as may be amended from time to time, shall be identified by VARA as indicative and non-binding. 5. Modification or waiver of Regulations, Rules, Directives and Guidance. VARA may at any time interpret, waive, modify or otherwise adapt any Regulations, Rules, Directives or Guidance by— a. publishing revised or new versions on its website; b. publishing an announcement setting out the details of such interpretation, waiver, modification or adaptation; or c. communicating the details of such interpretation, waiver, modification or adaptation to any VASPs or Entities to which it applies. 6. General supplementary powers. Regulations, Rules or Directives made by VARA may— a. make different provisions for different cases and may, in particular, make different provisions in respect of different descriptions of Virtual Assets, VA Activities or VASPs; b. make provision by reference to other Regulations, Rules, Directives or Guidance issued by VARA, as in effect from time to time; c. make provision by reference to other laws, regulations or rules made by other competent authorities, as in effect from time to time; and d. contain such incidental, supplemental, consequential and transitional provision as VARA considers appropriate. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 9 II. Part II – Issuing Virtual Assets A. Issuance Rules 1. General requirement. Any Entity in the Emirate that issues a Virtual Asset in the course of a business, must comply with the VA Issuance Rulebook, as may be amended from time to time. B. Power to classify Virtual Assets 1. VARA may, in its sole and absolute discretion, classify, or otherwise provide clarification or opinion, by public notice either generally or in a specific case, on— a. any Virtual Asset, or type of Virtual Asset, as being prohibited in the Emirate; b. any Virtual Asset, or type of Virtual Asset, as being regulated by the CBUAE; or c. VARA's interpretation, classification or regulatory treatment of any Virtual Asset or type of Virtual Asset. C. Prohibited Virtual Assets 1. The issuance of Anonymity-Enhanced Cryptocurrencies and all VA Activity[ies] related to them are prohibited in the Emirate. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 10 III. Part III – Regulated VA Activities A. General prohibition and exemptions 1. General prohibition. No Entity may carry out any VA Activity by way of business or promote, offer, or purport to do so, in the Emirate, unless it is— a. authorised and Licensed by VARA for the VA Activity; b. an employee carrying on or otherwise facilitating a VA Activity on behalf of its employer that is Licensed by VARA; or c. an Exempt Entity. 2. "By way of business" requirement. For the purposes of Regulation III.A.1, VARA shall have sole and absolute discretion in determining whether an Entity carries on a VA Activity by way of business, and shall have regard to the following factors when making such determination— a. whether the Entity holds itself out as conducting a VA Activity by way of business; b. the regularity, scale and continuity of the VA Activity carried out by the Entity; and c. whether there is any commercial element in how the VA Activity is being conducted, such as whether the Entity receives remuneration or other commercial benefits or value in kind for carrying out the VA Activity. 3. False claims of VASP or Exempt Entity status. a. An Entity which, in relation to the VA Activity in question, is neither Licensed by VARA to carry out the VA Activity nor an Exempt Entity— i. must not describe itself in whatever terms as— 1. a VASP or otherwise authorised or Licensed by VARA; or 2. an Exempt Entity; ii. behave, or otherwise hold itself out, in a manner which indicates, or which is reasonably likely to be understood as indicating, that it is— 1. a VASP or otherwise authorised or Licensed by VARA; or 2. an Exempt Entity. 4. UAE Central Bank. a. All VA Activities relating to UAE-CBDCs shall remain under the sole and exclusive regulatory purview of the CBUAE. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 11 b. VASPs providing VA Activities in the Emirate will need to comply with any applicable CBUAE regulation on Virtual Assets. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 12 IV. Part IV – Licensing A. Licensing requirements 1. Requirement to hold a Licence. a. All Entities wishing to carry out one or more VA Activities in the Emirate must seek authorisation from VARA prior to conducting any VA Activity. b. All Entities shall apply for, obtain and maintain a Licence issued by VARA in order to be permitted to carry out each VA Activity that it will conduct in the Emirate. 2. Licensing process. All Entities seeking a Licence from VARA shall adhere to the licensing process as prescribed by VARA from time to time when applying for the Licence. 3. Requirement to meet licensing conditions. VASPs shall comply with any and all licensing conditions as communicated by VARA in its Licence or otherwise from time to time, which shall include but not be limited to compliance with all Regulations, Rules and Directives. 4. Activities outside of the Emirate. If a VASP carries out any VA Activity for which it is Licensed by VARA to carry out in the Emirate in any jurisdiction outside of the Emirate, it shall comply with all Regulations, Rules and Directives in respect of such VA Activity carried out in such other jurisdiction as a minimum standard. 5. Professional Exemption. a. Duly registered [i] practising lawyers; [ii] accountants; and/or [iii] other professionally licensed business consultants that carry out any VA Activity in a manner that is wholly incidental to their professional practice do not need a Licence, provided that they— i. remain at all times appropriately authorised by a competent professional body to operate in the Emirate; and ii. maintain professional indemnity insurance as applicable to their profession. [the Professional Exemption]. b. VARA has sole and absolute discretion at any time to decide whether an Entity has appropriately relied on this Professional Exemption in respect of any VA Activities it has carried out. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 13 6. Exempt Entities. a. Exempt Entities shall not be subject to the requirements in Regulations IV.A.1-4, provided that such Exempt Entities must— i. notify VARA and obtain confirmation of its Exempt Entity status; ii. in such instance, obtain a no-objection confirmation from VARA prior to carrying out any VA Activities in the Emirate; and iii. comply with all requirements of these Regulations, Rules, Directives and other conditions notified to it by VARA as a condition of providing such no-objection confirmation. b. VARA has sole and absolute discretion at any time in deciding whether an Entity is an Exempt Entity and/or granting any no-objection confirmation under Regulation IV.A.6.a above. 7. Mandatory registration for large proprietary traders. a. Any Entity in the Emirate that actively invests its own portfolio in Virtual Assets at or above USD 250,000,000 equivalent value of Virtual Assets during any rolling thirty [30] calendar days period, must register with VARA, in accordance with the registration process prescribed by VARA from time to time, prior to investing at, or in no event later than three [3] Working Days of having invested, such volume. b. Registration under Regulation IV.A.7.a does not permit any Entity to carry out any VA Activity[ies] in the Emirate and/or constitute any authorisation or Licence from VARA for any business or activities that Entity carries out and Regulations III and IV.A.1 shall apply at all times. c. An Entity investing its own portfolio does not permit accepting or trading Virtual Assets belonging to another Entity. 8. Voluntary registration for other market participants. a. Any Entity seeking to obtain a commercial or free zone licence in the Emirate to carry out the following business activities may voluntarily register with VARA in accordance with the registration process prescribed by VARA from time to time— i. providers of technology services relating to or utilising Distributed Ledger Technology to other businesses; or ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 14 ii. Entities that actively invest their own portfolio in Virtual Assets. b. Registration under Regulation IV.A.8.a does not permit any Entity to carry out any VA Activity[ies] in the Emirate and/or constitute any authorisation or Licence from VARA for any business activities that Entity carries out and Regulations III, IV.A.1 and IV.A.7.a shall apply at all times. B. VARA's Licensing and authorisation powers 1. Granting of Licences. a. VARA may, in its sole and absolute discretion, grant a Licence for a VASP to carry out one or more VA Activities to which a licensing application relates, having regard to the information provided during the licensing process along with any other information VARA deems relevant. b. In respect of each granted Licence, VARA shall specify the permitted VA Activities, described in such a manner as VARA considers appropriate. c. VARA may— i. incorporate in the Licence such

limitations and stipulations as it considers appropriate, for example, circumstances in which a VA Activity may, or may not, be carried on; ii. specify a narrower or wider description of a VA Activity than that to which a licensing application relates; and/or iii. grant a Licence for the carrying on of a VA Activity only for a specified time. d. In determining whether to grant a Licence, VARA may have regard to any judgment, opinion, or actions taken by any other regulator or authority, inside or outside of the Emirate, which VARA deems to be relevant to such licensing application. 2. Variation, suspension, or revocation of Licences. a. Power to vary, suspend or revoke Licences. VARA may in its sole and absolute discretion— i. vary a Licence in any way, including but not limited to, by adding a VA Activity, removing a VA Activity or varying the description of a VA Activity, or by varying any limitations which apply to such Licence; ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 15 ii. revoke or suspend all, or any part, of a Licence— 1. on any ground on which it may refuse to issue a Licence; 2. for a material violation of any law, Regulation, Rule or Directive; 3. for Good Cause; 4. if the VASP is Insolvent or subject to Insolvency Proceedings; or 5. for failure of the VASP to pay a judgment, made by any court, within or outside the UAE, within thirty [30] calendar days after the judgment becomes final or otherwise payable by the VASP. b. Suspension. In the event VARA suspends a Licence under Regulation IV.B.2.a.ii, it shall prescribe the period for which such Licence is suspended which shall be communicated to the VASP. Such VASP may not re-commence any VA Activity[ies] subject to such suspension without prior approval from VARA to do so, regardless of whether the period communicated has expired. c. Preservation of powers. Nothing in these Regulations shall be construed as limiting any power granted to VARA under any other provision of the Dubai VA Law, including any power to investigate possible violations of laws, Regulations, Rules or Directives, or to impose penalties, or take any other action, against any Entity for violation of such laws, Regulations, Rules or Directives. 3. Imposition of further requirements by VARA. a. Where an Entity has applied to VARA for a Licence, or a variation of a Licence, VARA may impose on such Entity additional requirements as it considers appropriate including, but not limited to, in the following circumstances— i. the Entity is failing, or is likely to fail, to satisfy the licensing conditions; ii. the Entity has contravened any applicable laws, Regulations, Rules or Directives; or iii. it is desirable for VARA to exercise its power to further one or more of its objectives. 4. Authorisation and supervision fees. a. VARA may charge an Entity seeking to apply for a Licence, or any other authorisation from VARA, a fee for processing such application. If an application is denied or ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 16 withdrawn, no fees shall be refunded. Such application fees will be applicable per application. b. Any Entity who has been granted a Licence, any other approval or is otherwise subject to supervision by VARA, will be charged applicable fees by VARA for such supervision. c. The fees set out in Schedule 2 of these Regulations, as may be amended from time to time, shall apply to all VASPs. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 17 V. Part V – VA Activity Rulebooks 1. Rulebooks. VASPs must comply at all times with the following Rulebooks, as may be amended from time to time— a. Company Rulebook; b. Compliance and Risk Management Rulebook; c. Technology and Information Rulebook; and d. Market Conduct Rulebook. 2. VA Activity specific Rulebooks. In addition to the Rulebooks in Regulation V.1 above, VASPs must comply at all times with each of the following Rulebooks that correspond to the VA Activity[ies] it is Licensed to carry out, as may be amended from time to time— a. Advisory Services Rulebook; b. Broker-Dealer Services Rulebook; c. Custody Services Rulebook; d. Exchange Services Rulebook; e. Lending and Borrowing Services Rulebook; f. Payments and Remittances Services Rulebook; and g. VA Management and Investment Services Rulebook. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 18 VI. Part VI – Anti-Money Laundering and Combating the Financing of Terrorism A. VARA's Supervisory Authority 1. These Regulations are made in recognition of Federal Decree-Law No. [20] of 2018 on Anti Money Laundering, Combating the Financing of Terrorism and Financing of Illegal Organisations, Federal Law No. [7] of 2014 on Combating Terrorism Offences and any other federal legislation relating to money laundering, terrorist financing, the financing of unlawful organisations or sanctions non-compliance as may be amended from time to time [the Federal AML-CFT Laws]. 2. A reference in these Regulations to money laundering is taken to include the financing of terrorism and all other unlawful organisations, and sanctions non-compliance. 3. For the purposes of the Federal AML-CFT Laws, by virtue of the Dubai VA Law, VARA— a. is designated as a Supervisory Authority for the Emirate in respect of all VASPs and VA Activities; b. is responsible for regulation in relation to money laundering in the Emirate in respect of all VASPs and VA Activities; and c. has the power to supervise compliance with relevant Federal AML-CFT Laws by VASPs in the Emirate. 4. Nothing in these Regulations is intended to limit any function or power conferred on another body or authority under the Federal AML-CFT Laws. 5. Where VARA detects conduct that it suspects may relate to money laundering, it shall promptly report its suspicions to the relevant authority exercising powers and performing functions under the relevant Federal AML-CFT Laws. B. AML/CFT obligations of VASPs 1. VASPs must comply with all Federal AML-CFT Laws as well as all other legislation, regulatory requirements, these Regulations, Rules and Directives in respect of AML/CFT as may apply to its VA Activities, businesses or operations in any jurisdiction at all times, including but not limited to those contained in Rulebooks and FATF recommendations as may be incorporated by VARA into its regulatory framework from time to time. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 19 VII. Part VII – Marketing, Advertising or Promotion A. Marketing Regulations 1. All Entities must comply with the Administrative Order No. [01] of 2022: Relating to Regulation of Marketing, Advertising and Promotions Related to Virtual Assets and Administrative Order No. [02] of 2022: Pursuant to Issued Administrative Order No. [01] of 2022: Relating to Regulation of Marketing, Advertising and Promotions Related to Virtual Assets, issued by VARA and as may be amended from time to time. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 20 VIII. Part VIII – Market Offences A. Market Offences and VARA's power to stipulate Market Offences and Accepted Practices 1. For the purposes of these Regulations, Market Offences are any of the offences listed in Regulation VIII.A.2, with the exception of any Accepted Practice, when conducted in the Emirate or having an effect on the price of a Virtual Asset traded in the Emirate, whether conducted by one Entity alone or by two or more Entities jointly or in concert. 2. The following are Market Offences— a. Insider Dealing; b. Unlawful Disclosure; and c. Market Manipulation. 3. VARA may, in its sole and absolute discretion, prescribe or otherwise classify any other behaviour as being a Market Offence in addition to those listed in Regulation VIII.A.1 above from time to time and/or for any specified period of time. 4. By way of exception to Regulations VIII.A.1-3 above, any behaviour that has been specified as an Accepted Practice either under any of Regulation VIII.B-H or by VARA specifying such behaviour as an Accepted Practice in its sole and absolute discretion for any specified period of time, shall not amount to a Market Offence. B. Inside Information 1. Inside Information means information of a precise nature, which has not been made public, and which, if it were made public, would reasonably be expected to affect the price of a Virtual Asset or would affect the investment judgment of a reasonable individual in respect of a transaction involving that Virtual Asset. The information need not be the determining factor behind any given transaction, but should have a material impact on the decision of any reasonable investor as to whether to carry out such transaction [Inside Information]. 2. For the purposes of Regulation VIII.B.1, information shall be deemed to be of a precise nature if it indicates a set of circumstances which exists or which may reasonably be expected to come into existence, or an event which has occurred or which may reasonably be expected to occur, ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 21 where it is specific enough to enable a conclusion to be drawn as to the possible effect of that set of circumstances or event on the price of a Virtual Asset. 3. An Entity may possess Inside Information as a result of, but not limited to— a. being a member of the administrative, management or supervisory bodies of any Issuer; b. being an investor in any Issuer; c. having access to the Inside Information through any employment, profession, volunteering, contribution or duties; d. being involved in illegal or criminal activities; or e. any circumstances where the Entity knows or should reasonably have known that any information is Inside Information. C. Insider Dealing 1. Insider Dealing arises where an Entity possesses Inside Information and uses that information by carrying out a transaction, for its own account or for the account of a third party, directly or indirectly, in relation to a Virtual Asset to which the Inside Information relates [Insider Dealing]. 2. The use of Inside Information by cancelling or amending a transaction or order concerning a Virtual Asset to which the Inside Information relates, where the transaction or order was started or placed before the Entity concerned possessed the Inside Information, shall also be Insider Dealing. 3. Recommending, counselling, procuring or otherwise facilitating another Entity to engage in Insider Dealing, or inducing another Entity to engage in Insider Dealing arises where the Entity possesses Inside Information and it recommends, counsels or procures on the basis of that Inside Information, that another Entity— a. carry out a transaction in relation to the Virtual Asset to which that Inside Information relates, or induces that Entity to carry out such a transaction; or b. cancel or amend a transaction or order concerning a Virtual Asset to which that Inside Information relates, or induces that Entity to make such a cancellation or amendment. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 22 D. Unlawful Disclosure 1. Unlawful disclosure of Inside Information arises where an Entity possesses Inside Information and discloses that Inside Information to any other Entity, except where the disclosure is made in the normal exercise of an employment, a profession or duties [Unlawful Disclosure]. 2. For the purposes of these Regulations, the onward disclosure of recommendations or inducements amounts to Unlawful Disclosure where the Entity disclosing the recommendation or inducement knew or ought to have known that it was based on Inside Information. E. Prohibition of Insider Dealing and of Unlawful Disclosure 1. No Entity shall— a. engage or attempt to engage in Insider Dealing; b. recommend that another Entity engage in Insider Dealing or induce or otherwise facilitate another Entity to engage in Insider Dealing; or c. engage or attempt to engage in Unlawful

Disclosure. F. Legitimate behaviour of treating Inside Information 1. For the purposes of Regulation VIII.E.1, where an Entity is a legal entity and not an individual, such Entity has not engaged in Insider Dealing on the basis of possessing Inside Information where that Entity— a. has established, implemented and maintained adequate and effective internal arrangements and procedures to limit access to Inside Information and prevent Insider Dealing to effectively ensure that neither the individual who made the decision on the VASP's behalf to carry out a transaction in relation to a Virtual Asset to which the Inside Information relates, nor another individual who may have had an influence on that decision, was in possession of the Inside Information; and b. has not encouraged, made a recommendation to, induced or otherwise influenced the individual who made the decision on its behalf to carry out a transaction in relation to a Virtual Asset to which the information relates. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 23 2. For the purposes of Regulation VIII.E.1, it shall not be deemed from the mere fact that an Entity is in possession of Inside Information that such Entity has used that Inside Information and has engaged in Insider Dealing on the basis of a transaction where that Entity— a. for the Virtual Asset to which that Inside Information relates, is a market maker or an Entity authorised to act as a counterparty, and the transaction in relation to the Virtual Asset to which the Inside Information relates is made legitimately in the normal course of the exercise of its function as a market maker or as a counterparty for that Virtual Asset; or b. is authorised to execute orders on behalf of third parties, and the transaction in relation to the Virtual Assets to which the order relates, is made to carry out such an order legitimately in the normal course of the exercise of that Entity's employment, profession or duties. 3. For the purposes of Regulation VIII.E.1, it shall not be deemed from the mere fact that an Entity is in possession of Inside Information that such Entity has engaged in Insider Dealing on the basis of a transaction where that Entity conducts a transaction and that transaction is carried out in the discharge of an obligation that has become due in good faith and not to circumvent the prohibition against Insider Dealing and— a. that obligation results from an order placed or an agreement concluded before the Entity concerned possessed Inside Information; or b. that transaction is carried out to satisfy a legal or regulatory obligation that arose before the Entity concerned possessed Inside Information. G. Market Sounding 1. Market Sounding comprises the communication of information, prior to the announcement of a transaction in Virtual Assets, in order to gauge the interest of potential investors in a possible transaction in Virtual Assets and the conditions relating to it such as its potential size or pricing, to one or more potential investors in those Virtual Assets by— a. an Issuer; ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 24 b. a secondary offeror of a Virtual Asset, in such quantity or value that the transaction is distinct from ordinary trading and involves a selling method based on the prior assessment of potential interest from potential investors; or c. a VASP or other third party acting on behalf or on the account of an Entity referred to in Regulation VIII.G.1.a or b [Market Sounding]. 2. A disclosing Entity shall, prior to conducting the Market Sounding, specifically consider whether the Market Sounding will involve the disclosure of Inside Information. The disclosing Entity shall make a written record of its conclusion and the relevant reasons. It shall provide such written records to VARA upon request. This obligation shall apply to each disclosure of information throughout the course of the Market Sounding. The disclosing Entity shall keep the written records referred to in this Regulation VIII.G.2 up-to-date and in any event update them weekly. 3. A disclosing Entity shall, before making the disclosure— a. obtain the consent of the Entity receiving the Market Sounding to receive the information; b. inform the Entity receiving the Market Sounding that it is prohibited from using that information, or attempting to use that information, by acquiring or disposing of, for its own account or for the account of a third party, directly or indirectly, Virtual Assets relating to that information; c. inform the Entity receiving the Market Sounding that it is prohibited from using that information, or attempting to use that information, by cancelling or amending an order which has already been placed concerning a Virtual Asset to which the information relates; and d. inform the Entity receiving the Market Sounding that by agreeing to receive the information it is obliged to keep the information confidential. 4. The disclosing Entity shall make and maintain a record of all information given to Entities receiving the Market Sounding, including the information given in accordance with Regulation VIII.G.3, and the identity of the potential investors to whom the information has been disclosed, including but not limited to the Entity and the date and time of each disclosure. The disclosing Entity shall provide such record to VARA upon request. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 25 5. Where information that has been disclosed in the course of a Market Sounding ceases to be Inside Information according to the assessment of the disclosing Entity, the disclosing Entity shall inform the recipient accordingly, as soon as possible. 6. Any Entity receiving a Market Sounding shall assess for itself whether it is in possession of Inside Information or when it ceases to be in possession of Inside Information. 7. The disclosing Entity shall keep the records referred to in this Regulation VIII.G for a period of at least eight [8] years. H. Market Manipulation 1. Market Manipulation shall comprise the following activities, with the exception of any Accepted Practice— a. entering into a transaction, placing an order to trade or any other behaviour which— i. gives, or is likely to give, false or misleading signals as to the supply of, demand for or price of a Virtual Asset; or ii. secures, or is likely to secure, the price of one or several Virtual Assets at an abnormal or artificial level; b. entering into a transaction, placing an order to trade or any other activity or behaviour which affects or is likely to affect the price of one or several Virtual Assets, which employs a fictitious device or any other form of deception or contrivance; c. disseminating information through the media, which gives, or is likely to give, false or misleading signals as to the supply of, demand for, or price of a Virtual Asset, or is likely to secure the price of one or several Virtual Assets at an abnormal or artificial level, including the dissemination of rumours where the Entity who made the dissemination knew, or ought to have known, that the information was false or misleading; d. transmitting false or misleading information or providing false or misleading inputs in relation to a benchmark where the Entity who made the transmission or provided the input knew or ought to have known that it was false or misleading, or any other behaviour which manipulates the calculation of a benchmark; ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 26 e. the conduct by an Entity, or Entities acting in collaboration, to inflate the price of a Virtual Asset by securing a dominant position over the supply of or demand for a Virtual Asset; f. the buying or selling of Virtual Assets at a particular point in time in the trading or settlement cycle of any given Virtual Asset so as to have the effect of misleading investors acting on the basis of the prices displayed; g. the placing of orders on a trading venue operated by a VASP providing Exchange Services or other organised market for Virtual Assets, including any cancellation or modification thereof, by any available means of trading, including by electronic means, which has one of the effects referred to in this Regulation VIII.H.1— i. disrupting or delaying the functioning of the trading system of the trading venue or being likely to do so; ii. making it more difficult for other Entities to identify genuine orders on the trading system of the trading venue or being likely to do so, including by entering orders which result in the overloading or destabilisation of the order book; or iii. creating or being likely to create a false or misleading signal about the supply of, or demand for, or price of, a Virtual Asset, in particular by entering orders to initiate or exacerbate a trend; h. taking advantage of occasional or regular access to the traditional or electronic media by voicing an opinion about a Virtual Asset [or indirectly about its Issuer] whilst having previously taken positions on that Virtual Asset and profiting subsequently from the impact of the opinions voiced on the price of that Virtual Asset without having simultaneously disclosed that conflict of interest to the public in a proper and effective way; i. omission or failure to take any action which would correct any activities listed in Regulations VIII.H.1.a-h; and j. distributing, maintaining, or otherwise making available to others any software, algorithm, or other computer programme designed to carry out any of the activities listed in Regulations VIII.H.1.a-h with the exception of any Accepted Practice [Market Manipulation]. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 27 2. Where the Entity referred to in Regulation VIII.H.1 is a legal entity, the Regulation shall also apply to the individual[s] who participate in the decision to carry out activities for the account of the legal entity concerned. 3. By way of exception to Regulation VIII.H.1, Accepted Practices shall include, but not be limited to, the following, which shall not amount to Market Manipulation— a. entering into a lending, borrowing, repurchase or reverse repurchase transaction in respect of a Virtual Asset for legitimate trading purposes which does not disrupt the fair and orderly functioning of any market involving Virtual Assets and without any intention to do so; b. entering into a transaction involving the provision of a Virtual Asset as collateral that is not designed to have any of the effects described in Regulation VIII.H.1.g; c. entering into a transaction in a Virtual Asset for the purposes of satisfying a prior legal or regulatory obligation, provided that [where that commitment was created under contract] the obligation entered into does not disrupt the fair and orderly functioning of any market involving Virtual Assets and without any intention to do so; and d. use of an algorithmic or high-frequency trading strategy that is not designed to have any of the effects described in Regulation VIII.H.1.g and which has been designed and implemented in such a way as to not disrupt the fair and orderly functioning of any market involving Virtual Assets and without any intention to do so. I. Prohibition of Market Manipulation 1. No Entity shall engage in or attempt to engage in Market Manipulation in the Emirate. J. Prevention and detection of Market Offences 1. VASPs shall establish and maintain effective arrangements, systems and procedures aimed at preventing and detecting Market Offences or attempted Market Offences. 2. VASPs shall report transactions, orders or activities to the UAE FIU and to VARA where the VASP has a reasonable suspicion that such transactions, orders or activities in any Virtual Asset, whether placed or executed on or outside a trading venue operated by a VASP providing Exchange Services or other organised market for Virtual Assets, could constitute a Market ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 28 Offence, an attempted Market Offence or any other unfair practice detrimental to the fair and orderly functioning of any market involving Virtual Assets. 3. When reporting suspicious transactions, orders or activities, VASPs shall include— a. the name of the Virtual Asset that may be impacted by suspicious transactions, orders or activities; b. the identity of any Entities involved; c. specific dates and times of the suspicious transactions, orders or activities; d. an explanation of

reasons for believing that a Market Offence or any other unfair practice has been committed; e. all other information required by the UAE FIU; and f. all additional information reasonably requested by VARA, or the UAE FIU, in order to make an accurate assessment. 4. VASPs shall make all relevant data in their possession available to VARA for inspection on request. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 29 IX. Part IX – Supervision, Examination and Enforcement A. Investigation or examination by VARA 1. All Entities are subject to investigation and/or examination by VARA at any time or in any way deemed necessary by VARA for the purposes of exercising its powers, performing its functions, or fulfilling its objectives under the Dubai VA Law. 2. All Entities shall co-operate with VARA during any investigation and/or examination and must provide VARA with all books and records requested by VARA to facilitate any investigation and/or examination. 3. VASPs and Issuers remain subject to Regulations, Rules and Directives for a period of ten [10] years following the date that it is no longer regulated by VARA. B. Examination 1. All Entities shall allow and assist VARA to examine the Entity whenever in VARA's judgment such examination is necessary or advisable for the purposes of exercising its powers, performing its functions or fulfilling its objectives under the Dubai VA Law. 2. VASPs and Issuers shall ensure, without limitation, that VARA is able to determine— a. the financial condition of the VASP or Issuer; b. the safety and soundness of the conduct of its business, VA Activities or Virtual Asset; c. all management and/or operational policies of the VASP or Issuer; d. whether the VASP or Issuer has complied with the requirements of all applicable laws, Regulations, Rules and Directives; and e. such other matters as determined by VARA which may affect a VASP's conduct of VA Activities and/or compliance with its licensing conditions. 3. VASPs and Issuers shall allow and assist VARA in any investigations as it shall deem necessary to determine whether a VASP or Issuer has violated any applicable laws, Regulations, Rules or Directives and, to the extent necessary, shall allow and assist VARA to examine all relevant data, facilities, books, records, accounts, documents, and other information. 4. VASPs and Issuers shall ensure they have all necessary consent of their clients to report information for transactions over which VARA has jurisdiction. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 30 5. For the purpose of determining the financial condition of the VASP or Issuer, its safety and soundness practices, or whether it has complied with the requirements of all applicable laws, Regulations, Rules and Directives, VASPs and Issuers shall assist VARA, when in VARA's judgment it is necessary or advisable, to examine an affiliate of the VASP or Issuer. 6. VASPs and Issuers shall provide or produce information or documents requested by VARA— a. before the end of such period as may be specified in the relevant notice issued by VARA, unless the VASP or Issuer demonstrates to VARA's satisfaction that such period is unreasonable; and b. through such means as may be specified in the notice. 7. VARA may require any information or documents provided by a VASP or Issuer to be verified or authenticated in such manner as VARA requires. C. Enforcement, fines and penalties 1. VARA may, in its sole and absolute discretion, take enforcement actions against any Entity in the event of the following— a. for violation of any law [including the Dubai VA Law and Federal AML-CFT Laws]; b. for any violation of these Regulations, or any Rules or Directives; c. on any ground on which VARA might refuse to issue a Licence under these Regulations; d. for Good Cause; and e. other grounds determined by VARA in exercising its powers, performing its functions or fulfilling its objectives under the Dubai VA Law. 2. Such enforcement actions may include but are not limited to— a. issuing written reprimands; b. issuing enforcement notices requiring non-compliance to be rectified within a specified period of time; c. limiting or revising the scope of any Virtual Assets or VA Activities under a Licence; d. suspending or revoking a Licence; e. requiring a VASP to cease any VA Activity or other business activity, either for a specified or indefinite period of time; ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 31 f. requiring any Entity to stop or refrain from doing or continuing to do any acts and seek a preliminary injunction or other legal means when necessary to restrain such Entity, when deemed by VARA to be in the public interest; g. imposing fines or other civil penalties in accordance with Schedule 3 to these Regulations or otherwise published by VARA from time to time; h. undertaking additional supervision, monitoring or reporting requirements; and i. any other enforcement action determined by VARA. 3. VARA may impose fines, civil penalties or other enforcement actions directly against the Responsible Individuals of a VASP. 4. VARA will consider the full circumstances of each case when determining whether or not to issue a fine and the amount thereof. VARA may do this either in conjunction with, or independently of, any other type of enforcement action as set out in Regulation IX.C.2. The types of factors which will be evaluated include— a. the nature, seriousness and impact of the violation; b. whether any action constitutes a violation of a Market Offence; c. the conduct of the Entity after the violation and throughout any investigation or examination by VARA; d. the previous disciplinary record and compliance history of the Entity or relevant individual[s]; e. the interpretation and application of VARA published materials including Guidance, industry codes and other such materials as may be published from time to time; and f. any action taken by VARA or by other domestic or international regulatory bodies in similar cases. 5. Grievances. VARA may establish a committee or other body to hear grievances or complaints in respect of any enforcement action it has taken, the details of which shall be published by VARA from time to time. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 32 X. Part X – Confidentiality A. Duty of confidentiality 1. All Entities must keep confidential all information relating to the operations, business or other affairs of VARA, including but not limited to all communication and correspondence with VARA and any investigations, enforcement or other actions by VARA, unless or until— a. such information is released into the public domain either by— i. VARA; or ii. an Entity without being in contravention of this Regulation X.A.1 or any other duty of confidentiality howsoever established; or b. VARA has given explicit written consent to the disclosure of such information. 2. All Entities must ensure that any Entity, including any employees, contractors, service providers or any other individuals howsoever engaged, who has access to such information are subject to the same or stricter obligations of confidentiality as specified in Regulation X.A.1. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 33 Schedule 1 – VA Activities VA Activity Definition "Advisory Services" means offering, providing or agreeing to provide a personal recommendation* to a client, either upon its request, or on the initiative of the Entity providing the recommendation, in respect of one or more actions or transactions relating to any Virtual Assets. *When providing a personal recommendation, the Entity providing the recommendation shall consider the following factors at a minimum in respect of each client— [a] knowledge and experience in investing in Virtual Assets; [b] investment objectives including, but not limited to, risk tolerance, time horizon and venues through which they can acquire Virtual Assets; and [c] financial circumstances including, but not limited to, their ability to bear sudden and significant losses or proportion of their net worth invested in Virtual Assets. "Broker-Dealer Services" means any of the following— [a] arranging orders for the purchase and sale of Virtual Assets between two Entities; [b] soliciting or accepting orders for Virtual Assets and accepting fiat currency, or other Virtual Assets, for such orders; [c] facilitating the matching of transactions in Virtual Assets between buyers and sellers; [d] entering into Virtual Asset transactions as a dealer on behalf of the Entity for its own account; [e] making a market in Virtual Assets using client assets; or ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 34 VA Activity Definition [f] providing placement, distribution or other issuance* related services to clients issuing Virtual Assets. *As per Regulation II, any Entity in the Emirate that issues a Virtual Asset in the course of a business, must comply with the VA Issuance Rulebook, as may be amended from time to time. "Custody Services" means safekeeping Virtual Assets for or on behalf of another Entity and acting only on verified instructions from or on behalf of such Entity*. *All VASPs shall be subject to Rules regarding the storage and custody of clients' Virtual Assets. Only VASPs which segregate each client's assets in separate VA Wallets will qualify for a Custody Services Licence. "Exchange Services" means any of the following— [a] conducting an exchange, trade or conversion between Virtual Assets and fiat currency; [b] conducting an exchange, trade or conversion between one or more Virtual Assets; [c] matching orders between buyers and sellers and conducting an exchange, trade or conversion between [i] Virtual Assets and fiat currency or [ii] one or more Virtual Assets; or [d] maintaining an order book in furtherance of [a], [b] or [c] above. "Lending and Borrowing Services" means carrying out a contract under which a Virtual Asset shall be transferred or lent from one or more parties [the Lender[s]] to one or more other parties [the Borrower[s]] where the Borrower[s] shall commit to return the same, at the request of the Lender[s], at any time either during or at the end of the period agreed upon. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 35 VA Activity Definition "Payments and Remittances Services" means receiving Virtual Assets, for the transmission or transfer of such Virtual Assets from one Entity to another Entity or from one Entity to another VA Wallet, address or location. "VA Management and Investment Services" means acting on behalf of an Entity as an agent, or fiduciary, or otherwise taking responsibility for the management, administration or disposition of that Entity's Virtual Assets. Examples may include, but shall not be limited to— [a] investment management services or otherwise managing Virtual Assets; and [b] taking responsibility for the staking of Virtual Assets for the purposes of earning fees or other amounts paid to validators and/or node operators of a proof-of-stake Distributed Ledger Technology. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 36 Schedule 2 – Supervision and Authorisation Fees 1. The fees set out in the table below are applicable to all Licence applications and VASPs: VA Activity Licence Application Fee [for one regulated VA Activity only] Licence Extension Fee [for each additional regulated VA Activity] Annual Supervision Fee [for each regulated VA Activity] Advisory Services AED 40,000 50% of lower Licence Application Fee[s] AED 80,000 Broker-Dealer Services AED 100,000 AED 200,000 Custody Services AED 100,000 AED 200,000 Exchange Services AED 100,000 AED 200,000 Lending and Borrowing Services AED 100,000 AED 200,000 Payments and Remittances Services AED 40,000 AED 80,000 VA Management and Investment Services AED 100,000 AED 200,000 2. The Licence Application Fee is payable

for all Licence applications for any regulated VA Activity. Where an Entity is applying for a Licence for more than one regulated VA Activity, the Licence Extension Fee is payable for each additional VA Activity. These fees are only due at the time of ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 37 submission of the Licence application. The application will not be processed until the payment of these fees is received. 3. VASPs must pay an Annual Supervision Fee for each VA Activity Licensed, in advance of conducting VA Activity[ies]. 4. VARA may, in its sole and absolute discretion, impose additional fees or otherwise modify supervision and authorisation fees, including but not limited to in circumstances where it considers necessary to allocate additional resources for regulatory oversight or supervision or in response to complaints made to VARA about a VASP. 5. Any fees charged by VARA are separate from, and independent of, any fees which may be charged by any other competent authority, either in or outside of the UAE. 6. VARA may, in its sole and absolute discretion, impose a fee for applications by prospective Issuers for approval to issue a Virtual Asset. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 38 Schedule 3 – Fines 1. The following table sets out the nature and amounts of fines that VARA may impose for violations of Regulations, Rules, Directives or Licence conditions, but which shall be determined by VARA in accordance with applicable local and federal laws and by reference to its assessment of all relevant factors, including those set out in Regulation IX.C. VARA may amend the fines set out in this Schedule 3, including adding new categories of fines, by amendment to these Regulations or by Directive at any time. No. Nature of Violation Fine Amount [AED] 1. Violation of Regulations, Rules or Directives relating to AML/CFT and "know your customer" requirements [per violation] To be determined in accordance with applicable local and federal laws. 2. Violation of Rules in the Compliance and Risk Management Rulebook, Market Conduct Rulebook, or Regulations and Directives related to Market Offences [per violation] One or more of: • disgorgement of the profits gained or losses avoided; • up to AED 20,000,000 for any individual; • up to AED 50,000,000 or 15% annual revenue of any VASP; or • 300% of the profits gained or losses avoided [if greater than the above values]. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 39 No. Nature of Violation Fine Amount [AED] 3. Violations of Rules in all other Rulebooks [per violation] One or more of: • up to AED 8,000,000 for an individual; • up to AED 20,000,000 or 5% annual revenue for a VASP; or • 200% of the profits gained or losses avoided [if greater than the above values]. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 40 Schedule 4 – Definitions Term Definition "Accepted Practice" means any behaviour that does not amount to a Market Offence as a result of being specified as an accepted practice either under any of Regulation VIII.B-H or by VARA acting in its sole and absolute discretion under Regulation VIII.A. "AML/CFT" means anti-money laundering, combating the financing of terrorism, counter proliferation financing and financial sanctions compliance. "Anonymity-Enhanced Cryptocurrencies" means a type of Virtual Asset which prevents the tracing of transactions or record of ownership through distributed public ledgers and for which the VASP has no mitigating technologies or mechanisms to allow traceability or identification of ownership. "CBUAE" means the Central Bank of the United Arab Emirates. "Company Rulebook" means the Company Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "Compliance and Risk Management Rulebook" means the Compliance and Risk Management Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "Directive" means a directive issued by VARA under these Regulations which shall have binding effect and shall, if required, attach a penalty determined and imposed by VARA at its sole discretion. "Distributed Ledger Technology" or "DLT" has the meaning ascribed to the term "Distributed Ledger Technology" in the Dubai VA Law. "Dubai VA Law" means Law No. [4] of 2022 Regulating Virtual Assets in the Emirate of Dubai, as may be amended from time to time. "DWTCA" means the Dubai World Trade Centre Authority. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 41 Term Definition "Emirate" means all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre. "Entity" means any legal entity or individual. "Exempt Entity" means— [a] UAE Government Entities; and [b] all public, non-profit, not-for-profit and charitable Entities of an UAE Government Entity. "FATF" means the Financial Action Task Force. "Federal AML-CFT Laws" means all UAE federal government legislation relating to AML/CFT, the financing of unlawful organisations or sanctions noncompliance as may be in force from time to time, including all executive regulations, cabinet resolutions or cabinet decisions relating to the same, as may be amended from time to time, including but not limited to— [a] Cabinet Resolution No. [24] of 2022 Amending certain Provisions of Cabinet Resolution No. [10] of 2019 Issuing the Executive Regulations of Federal Decree-Law No. [20] of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations; [b] Cabinet Resolution No. [10] of 2019 Issuing the Executive Regulations of Federal Decree-Law No. [20] of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations; [c] Federal Decree-Law No. [26] of 2021 Amending Some Provisions of Federal Decree-Law No. [20] of 2018 on ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 42 Term Definition Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations; [d] Federal Decree-Law No. [20] of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations and its executive regulations, as may be amended from time to time; and [e] Cabinet Decision No. [74] of 2020 Regarding Terrorism Lists Regulation and Implementation of UN Security Council Resolutions on the Suppression and Combating of Terrorism, Terrorist Financing, Countering the Proliferation of Weapons of Mass Destruction and its Financing and Relevant Resolutions. "Good Cause" means, in VARA's sole and absolute discretion, where an Entity has defaulted or is likely to default in performing its obligations or financial engagements, or engages in unlawful, dishonest, wrongful or inequitable conduct, or practices that may cause harm to the public. "Guidance" means any Guidance issued by VARA under these Regulations which is indicative and does not have binding effect. "Inside Information" has the meaning ascribed to it in Regulation VIII.B.1. "Insider Dealing" has the meaning ascribed to it in Regulation VIII.C.1. "Insolvency Proceedings" means any legal proceedings or other procedure taken in relation to— [a] the suspension of payments, a moratorium of any indebtedness, winding up, receivership, bankruptcy, dissolution, administration or reorganisation [by way of voluntary arrangement, scheme of arrangement or otherwise]; ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 43 Term Definition [b] the appointment of a liquidator, receiver, administrator, compulsory manager, trustee or similar officer in respect of an Entity and/or its assets; [c] enforcement of any security over any asset of an Entity; or [d] any analogous procedure or step is taken in any jurisdiction. Except that, the above shall not apply to any winding up petition which is frivolous or vexatious and is discharged or stayed or dismissed with fourteen [14] calendar days of commencement. "Insolvent" means— [a] the Entity— a. is unable to pay debts as they fall due; b. is deemed to, or is declared to, be unable to pay its debts under applicable law; c. suspends or threatens to suspend making payments on any of its debts; or d. by reason of actual or anticipated financial difficulties, commences negotiations with one or more creditors with a view to rescheduling its indebtedness; [b] the value of the assets of the Entity is less than its liabilities taking into account contingent and prospective liabilities; or [c] a moratorium is declared in respect of the indebtedness of an Entity. "Issuer" means the Entity responsible for the issuance of a Virtual Asset. "Licence" means a licence granted by VARA to an Entity under which VARA explicitly authorises such Entity to carry out one or more VA Activity[ies] in the Emirate. "Licensed" means having a valid Licence. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 44 Term Definition "Market Conduct Rulebook" means the Market Conduct Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "Market Manipulation" has the meaning ascribed to it in Regulation VIII.H.1. "Market Offences" has the meaning ascribed to it in Regulation VIII.A.1. "Market Sounding" has the meaning ascribed to it in Regulation VIII.G.1. "Professional Exemption" has the meaning ascribed to it in Regulation IV.A.5. "Regulations" means these Virtual Assets and Related Activities Regulations 2023, as may be amended from time to time. "Responsible Individuals" has the meaning ascribed to it in the Company Rulebook. "Rule" means a rule issued by VARA under these Regulations which have binding effect. "Rulebook" means a rulebook issued by VARA containing Rules and/or Guidance, as may be amended from time to time. "Supervisory Authority" has the meaning ascribed to it in the Federal Decree-Law No. [20] of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations. "Technology and Information Rulebook" means the Technology and Information Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "UAE" means the United Arab Emirates. "UAE-CBDC" means any digital currency issued by the CBUAE. "UAE Government" means the federal government of the United Arab Emirates and the government of each emirate. "UAE FIU" means the UAE Financial Intelligence Unit. "Unlawful Disclosure" has the meaning ascribed to it in Regulation VIII.D.1. "VA Activity" means the activities listed in Schedule 1 of these Regulations, as may be amended from time to time. ae.vara@varaconnectصندوق برید: 9292 دبي، الإمارات العربیة المتحدة - سُلطة تنظیم الأصول الافتراضیة varaconnect@vara.ae - PO Box 9292, Dubai, UAE - Virtual Assets Regulatory Authority 45 Term Definition "VA Issuance Rulebook" means the Virtual Asset Issuance Rulebook issued by VARA pursuant to these Regulations, as may be amended from time to time. "VARA" means the Dubai Virtual Assets Regulatory Authority. "VASP" means an Entity Licensed by VARA to carry out VA Activity[ies] in the Emirate. "Virtual Asset" or "VA" has the meaning ascribed to it in the Dubai VA Law. "VA Wallet" has the meaning ascribed to the term "Virtual Asset Wallet" in the Dubai VA Law. "Working Day" means any day which is not a weekend or public holiday in the Emirate.