NAMLCFTC Issues Guidance on Combating the Use of Unlicensed Virtual Asset Service Providers

The United Arab Emirates (“UAE”) is proactively tackling the hazards posed by unlicensed virtual asset service providers in the ever-changing field of virtual asset transfers. As the global domain of virtual assets becomes more complex, the UAE has taken major steps to protect its financial sector. To that purpose, on 6^th November 2023, the National Anti-Money Laundering and Combating the Financing of Terrorism Committee (“NAMLCFTC”) released an extensive joint guidance note in coordination with the Central Bank of the UAE, Securities and Commodities Authority, Dubai Financial Services Authority, Abu Dhabi Global Market, and Virtual Assets Regulatory Authority (“Supervisory Authorities”).[1]

This collaborative guidance closely matches with the Financial Action Task Force’s (“FATF”) updated framework for a risk-based approach to virtual assets and VASPs, with an emphasis on unlicensed providers. The UAE’s commitment to combating money laundering, terrorist financing, proliferation financing, and the laundering of illicit proceeds within its borders, as mandated by its Anti-Money Laundering (“AML”) and Combating the Financing of Terrorism (“CFT”) legislation, highlights the importance of this initiative.[2]

“The new guidance on combating the use of unlicensed virtual asset service providers comes at a time when virtual assets become more accessible through digital channels. As our digital economy matures, our work on combating all kinds of financial crimes intensifies through raising awareness of their risks and emphasizing the importance of compliance with relevant regulations and legislation to ensure the integrity of the UAE's financial system,” said Khaled Mohamed Balama, Governor of the Central Bank of UAE and chairman of the NAMLCFTC[3].

A critical role has been assigned to licensed companies, which include Licensed Financial Institutions (“LFIs”), Designated Non-Financial Businesses and Professions (“DNFBPs”), and Licensed Virtual Asset Service Providers (“VASPs”). They are required to improve their governance and operational processes to remain adaptable in the face of evolving trends and dangers. The guidance emphasizes the significance of monitoring, good risk management, complete due diligence on VASPs, reporting suspicious transactions, and increasing customer awareness.

Red Flags of Unlicensed VASPs and Additional Guidance for Stakeholders

The regulatory authorities, collectively known as the Supervisory Authorities, have identified a range of red flags associated with unlicensed VASPs in the UAE. These indicators serve as crucial warning signs for investors and consumers. Some of them include:

1. Lack of Regulatory License: Unlicensed VASPs often operate without official licensing from UAE Supervisory Authorities and may misrepresent themselves as licensed entities.
2. No Physical Presence:  The absence of a physical presence within the UAE is cause for concern. Unlicensed VASPs may not maintain a registered office or a legitimate business address.
3. Ponzi Schemes: Investors should exercise caution when confronted with unrealistic promises or Ponzi schemes. VASPs that make extravagant claims of exceptionally high returns or guaranteed profits with minimal risk may be operating fraudulent schemes such as using new investors’ funds to pay returns to earlier investors.
4. Poor Website and Communications: Poor website quality and unprofessional communications should also raise suspicions as they are indicative of potential scams.
5. Pressure to Invest Quickly: Pressure to invest quickly is a tactic frequently employed by scammers. Individuals should be wary of high-pressure strategies aimed at rushing them into making hurried investment decisions.
6. Unlicensed Products: Licensed VASPs are authorized to provide financial services related to virtual assets only as specified by the Supervisory Authorities.
7. Consumer Protection: Inadequate consumer protection (such as safeguards for client assets, insurance coverage, or dispute resolution mechanisms) is another warning sign associated with unlicensed VASPs.
8. Social Engineering: Social engineering attacks, particularly phishing attempts involving fraudulent emails or websites impersonating legitimate crypto exchanges or wallets, are a significant threat.
9. Initial Coin Offerings: Investors should be cautious when considering participation in Initial Coin Offerings (“ICOs”) that have not been approved or registered by a Supervisory Authority. Fraudulent ICOs often promise revolutionary projects but fail to deliver, resulting in the misappropriation of investors’ funds.
10. Fake Wallets and Exchanges: These fraudulent platforms promise unrealistic returns in a short timeframe, only for users to discover that their assets have been stolen.
11. Illicit Transactions: The transactions involving crypto asset exchanges followed by funds transfers to high-risk regions should be approached with suspicion, as should fundraising activities involving virtual currencies that may be associated with terrorism financing.

These red flags are crucial tools for investors, LFIs, DNFBPs, and Licensed VASPs to identify and report potentially illicit activities, contributing to a more secure and compliant virtual asset ecosystem in the UAE.

Suspicious Transaction Reporting

The vigilance of LFIs, DNFBPs, and VASPs plays a pivotal role in upholding the integrity of the UAE’s financial system. The Supervisory Authorities expect all stakeholders to promptly report any suspicious transactions or activities through the UAE’s Financial Intelligence Unit’s (“FIU”) goAML reporting platform. Any failure to do so (whether through intentional omission or gross negligence) will constitute a federal offence. Reports submitted through whistleblowing mechanisms, such as email or phone calls will be actively investigated by the relevant regulatory authorities, ensuring confidentiality and safeguarding against retaliation.

Civil and Criminal Penalties

Unlicensed VASPs operating without a valid license in the UAE can be subject to various civil and criminal penalties. Among the probable legal implications are financial sanctions imposed on the organisation, its owners, and top management. Furthermore, LFIs, DNFBPs, and VASPs that engage in wilful blindness in interactions with unlicensed VASPs and exhibit lax AML, CFT, and Combating Proliferation Financing (“CPF”) controls may face enforcement action.This year, the Dubai Virtual Assets Regulatory Authority (“VARA”) adopted its first Virtual Assets and Related Activities Regulations 2023[4]

The Regulation imposes penalties that demonstrate Dubai’s strict actions against an offense under the act, they contribute to and help exhibit the overall effectiveness of the UAE’s anti-financial crimes compliance framework.

The regulation mandates the process of obtaining a license in “Part IV – Licensing” which states that, any entity intending to engage in Virtual Asset (VA) Activities within the Emirate of the UAE is required to obtain a license from the Virtual Asset Regulatory Authority (VARA) before commencing any such activities. This licensing process is defined by VARA and must be adhered to by all entities seeking to conduct VA Activities. Additionally, entities, commonly referred to as Virtual Asset Service Providers (VASPs), must fulfill the licensing conditions specified by VARA, which may encompass compliance with all relevant regulations, rules, and directives.[5]

Conclusion

The careful and responsible engagement of stakeholders, especially investors and financial institutions, is critical to maintaining the integrity of the UAE’s virtual asset ecosystem. To collectively improve the UAE’s commitment to responsible innovation and the highest standards of financial integrity and national security, there is a requirement to heed the red flags associated with unlicensed VASPs and report suspicious actions promptly. Supervisory Authorities, regulatory authorities, and whistleblowers are working together to keep the financial system secure, transparent, and compliant. This can serve as a lesson and a road map for improving the regulation of such assets across jurisdictions.

[1] https://www.centralbank.ae/media/g5bgxlz5/joint-guidance-on-combating-the-use-of-unlicensed-virtual-asset-providers-in-the-uae-en.pdf.

[2] https://www.centralbank.ae/media/3dnhw4kq/namlcftc-issues-guidance-on-combating-the-use-of-unlicensed-virtual-asset-service-providers-en.pdf.

[3] https://www.khaleejtimes.com/uae/uae-fines-announced-for-owners-managers-of-unlicensed-virtual-asset-service-providers

[4] https://rulebooks.vara.ae/node/31

[5] https://rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_18_VER992_0.pdf