Dubai has become one of the world’s leading crypto hubs, and many Dubai-licensed exchanges and brokers count Indians, both residents in the UAE and users in India, among their biggest customer groups. A VARA licence is a significant achievement. But it doesn’t give a platform the right to serve users in India.
India has its own registration requirement for crypto service providers, and its Financial Intelligence Unit enforces it against offshore platforms, including those licensed elsewhere. This guide explains why Dubai exchanges serving Indian users also need FIU-IND registration, how enforcement in both countries has intensified in 2026, and what dual compliance looks like in practice.
VARA enforcement in 2026: a licence is not optional in Dubai
VARA’s message to the market in 2026 has been consistent: only licensed firms may serve customers in or from Dubai. On 24 June 2026, VARA issued a notice of fines against Peken Global Limited, operating as KuCoin, after finding it had provided broker-dealer and/or exchange services to customers in Dubai without a VARA licence (VARA). MEXC was also cited for unlicensed activity, following marketplace alerts issued in March 2026 (Unlock Blockchain).
On 24 July 2026, VARA fined Shelbit General Trading for continuing to provide virtual asset services in and from Dubai without a licence, onboarding users without mandatory KYC, and marketing in Dubai without authorisation (VARA). As one commentary put it, a foreign licence, a global brand or an offshore structure doesn’t replace VARA approval when services are offered in or from Dubai (Unlock Blockchain).
The same principle runs the other way. A VARA licence doesn’t replace India’s own requirements when a Dubai platform serves users in India.
Why Indian users bring FIU-IND into play
Since March 2023, India has treated “virtual digital asset service providers” (VDA SPs) as reporting entities under the Prevention of Money-laundering Act, 2002. A business is a VDA SP if it carries out, on behalf of others, activities such as exchanging VDAs and fiat, exchanging one VDA for another, transferring VDAs, safekeeping or administering them, or providing financial services for token offerings. VDA SPs must register with FIU-IND, India’s Financial Intelligence Unit.
Crucially, these obligations apply to offshore platforms serving Indian users, not only to Indian companies (CryptoSlate). FIU-IND has enforced this rule aggressively. It blocked and penalised offshore exchanges in 2023 and 2024, including a fine of ₹18.82 crore on Binance, and sent registration notices to 25 more offshore platforms in October 2025 (Oquilia). In September 2026, it issued non-compliance notices to 15 offshore VDA SPs with directions to take down their apps (CryptoTimes).
For a Dubai exchange, the question is therefore not just “Are we licensed by VARA?” but also “Are we serving users in India?” If the answer is yes, FIU-IND registration is required, and operating without it risks blocking of apps and websites in India, penalties under the PMLA, and reputational damage in one of the world’s largest crypto markets.
What FIU-IND registration requires
FIU-IND’s AML and counter-terrorist financing guidelines for VDA SPs were updated on 8 January 2026 (CryptoSlate). A registered VDA SP must appoint a Principal Officer and a Designated Director, carry out KYC and customer due diligence, screen against sanctions lists, file suspicious transaction reports and other prescribed reports with FIU-IND, comply with the travel rule, and keep records.
| Question | VARA (Dubai) | FIU-IND (India) |
|---|---|---|
| What it covers | Virtual asset services offered in or from Dubai | Virtual digital asset service providers (VDA SPs) under the PMLA, including offshore platforms serving Indian users |
| Nature of the approval | A licence to operate in Dubai | An anti-money laundering registration; it is not a licence and does not mean SEBI or RBI authorisation |
| Who must apply | Firms serving customers in or from Dubai | Platforms serving users in India, wherever they are based |
| Key duties | Licensing conditions, KYC and strict marketing controls | Principal Officer, Designated Director, KYC, sanctions screening, suspicious transaction reports, travel rule and record-keeping |
| 2026 enforcement | Fines on unlicensed operators, including KuCoin’s operating entity (24 June) and Shelbit (24 July) | Non-compliance notices to 15 offshore VDA SPs with directions to take down their apps (September 2026) |
Much of this overlaps with what VARA already requires, so a VARA-licensed platform has a strong foundation. But the reporting is India-specific: reports go to FIU-IND in its formats, and the Principal Officer must be able to deal with Indian authorities. Platforms also need to think about Indian tax. India’s 1% TDS on crypto transfers and, since April 2026, crypto transaction reporting under Section 509 of the Income-tax Act, 2025 can apply to platforms serving Indian users.
It’s also important to be accurate in marketing. FIU-IND registration is an anti-money laundering registration, not a licence, and it doesn’t mean the platform is authorised by SEBI or the RBI (CryptoTimes).
Dual compliance in practice: serving Indians from Dubai
A Dubai platform with Indian users has three realistic options. The first is to register with FIU-IND and build an India compliance function alongside its VARA framework. The second is to exclude users in India, through KYC rules, geoblocking and marketing controls, while continuing to serve Indian nationals resident in the UAE. The third is a hybrid, offering limited services to Indian users through a separately structured, registered offering.
| Option | What it involves | Main risk |
|---|---|---|
| 1. Register with FIU-IND | Build an India compliance function alongside the VARA framework | Cost and continuing reporting to FIU-IND |
| 2. Exclude users in India | KYC rules, geoblocking and marketing controls, while continuing to serve Indian nationals resident in the UAE | Leakage through Indian app stores, rupee payment options or India-targeted marketing |
| 3. Hybrid | Limited services to Indian users through a separately structured, registered offering | Complex structuring; each entity must stay inside its own regulatory perimeter |
Whichever option a platform chooses, it should record the decision in a board-approved policy, so regulators in both Dubai and India can see that the approach was deliberate. The distinction between Indian nationals in Dubai and users in India matters. Serving an Indian expatriate who lives and banks in the UAE is a Dubai activity. Serving someone in Mumbai through an app downloadable in India, with marketing aimed at Indian audiences and rupee payment options, is serving Indian users. Platforms should look at the full picture: where customers are located, which payment rails are used, where marketing is targeted, and whether apps are available on Indian app stores.
Customer onboarding is where dual compliance becomes practical. A Dubai platform should capture residence, nationality and location data at KYC, flag customers whose residence or banking points to India, and apply its India policy consistently. Records of these decisions are the best evidence if FIU-IND or VARA later asks questions. Marketing deserves special care. VARA strictly controls marketing in Dubai, and in India, using influencers to promote crypto platforms to Indian audiences without FIU-IND registration is the kind of activity that attracts attention from Indian regulators.
Enforcement and remedies
If FIU-IND issues a show-cause notice, respond fully and on time, register if required, and seek a hearing before any penalty. Under Section 13 of the PMLA, FIU-IND can impose penalties for each failure to comply, and penalty orders can be appealed to the Appellate Tribunal and then to the High Court. Blocking orders under Section 69A of India’s IT Act can be challenged, but registration is usually the fastest route to restoring access. VARA’s decisions follow its own appeal process in Dubai. Enforcement in both countries is now active, and the platforms that thrive will be those with a clear, documented approach to FIU-IND alongside their VARA licence.
Related reading: the full FIU-IND registration guide for crypto exchanges and Web3 businesses, Dubai vs GIFT City for crypto and Web3 businesses, the UAE’s September 2026 deadline and Indian DeFi teams, crypto fraud between Dubai and India, building a Web3 startup with an Indian team and India’s crypto policy paper and the regulatory vacuum; also using an Indian exchange’s Dubai entity and launching a token from Dubai with Indian investors.
Quick answers
Does a VARA licence allow a Dubai exchange to serve users in India?
No. Platforms serving users in India must also register with FIU-IND under India’s anti-money laundering law.
Has VARA fined unlicensed exchanges in 2026?
Yes. VARA fined KuCoin’s operating entity in June 2026 and Shelbit in July 2026 for unlicensed virtual asset services in Dubai.
Can a Dubai exchange serve Indian expatriates in the UAE without FIU-IND registration?
Serving UAE residents is a Dubai activity under VARA, but serving users located in India triggers FIU-IND obligations.
What happens if a Dubai exchange serves Indian users without FIU-IND registration?
It risks blocking of its apps and websites in India, penalties under the PMLA and reputational damage. FIU-IND blocked and penalised offshore exchanges in 2023 and 2024, including a fine of ₹18.82 crore on Binance.
Is FIU-IND registration a licence?
No. It is an anti-money laundering registration, and it does not mean the platform is authorised by SEBI or the RBI.
Final word
Halverton & Co. is an Indian law firm advising Indian founders, investors, NRIs and crypto businesses in Dubai and across the UAE on Indian law, including FIU-IND registration, PMLA compliance and India-facing structuring for Dubai crypto platforms. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and work alongside UAE-licensed counsel, who advise on UAE law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.
This article reflects developments reported up to early October 2026. It is for general information only, is not legal advice, and does not create an advocate-client relationship. Halverton & Co. is an Indian law firm and does not advise on UAE law; UAE-law points should be confirmed with UAE-licensed counsel.
Related practice area
Crypto, Web3 & Digital Assets
Advice for virtual digital asset businesses on registration, reporting and structure.
View the practice area
