VARA Licensing in Dubai: The Complete Guide for Crypto Businesses

Dubai was the first jurisdiction anywhere to create a regulator dedicated exclusively to virtual assets. That decision has done more for the emirate’s position in crypto than any tax advantage, because a licence from a specialist authority is something a bank, an institutional counterparty and a foreign regulator can all understand.

It is also a real regulatory regime rather than a registration exercise. There are four compulsory rulebooks before you reach the activity-specific ones, capital held in trust with the regulator as beneficiary, pre-clearance of marketing, and named individuals personally accountable for compliance. Firms that approach it as paperwork tend to discover this expensively.

This guide covers the framework end to end — what is regulated, how to apply, what it requires, what life looks like afterwards, and the alternatives worth weighing first.

The legal foundation and what VARA covers

VARA was established under Dubai Law No. 4 of 2022, with the detailed framework set out in the Virtual Assets and Related Activities Regulations 2023 and a series of rulebooks beneath them.

Jurisdiction: Dubai mainland and its free zones, excluding the DIFC, which operates its own regime under the DFSA. Abu Dhabi Global Market sits under the FSRA, and activity outside the free zones UAE-wide can also engage the federal Securities and Commodities Authority. Dubai is therefore not a single regulatory space, and the first question in any structuring exercise is which regulator you actually fall under.

The trap that catches existing UAE companies: a free zone crypto licence is not a VARA licence. Entities holding NFT marketplace commercial licences or other free zone crypto permissions must separately obtain the appropriate VARA licence — typically exchange or broker-dealer — based on what they actually do. Many firms operating in Dubai believe they are already covered and are not.

The licensed activities

VARA licenses activities individually rather than issuing a single blanket crypto permission. Holding one authorisation does not imply another, and firms conducting multiple activities need multiple permissions.

A naming note that causes application delays: VA Transfer and Settlement Services replaced the retired Payments and Remittances Services category. The old term still circulates in advisory material; use the current one when scoping.

Proprietary trading — a firm trading only its own capital — does not require a full VASP licence but does require a no-objection certificate, carrying a flat annual fee of AED 1,000 regardless of firm size.

The four compulsory rulebooks

This is the part most summaries skip, and it is where the actual obligations live. Four rulebooks apply to every VASP licensed to carry out any activity in the emirate, with activity-specific rulebooks layered on top.

Activity-specific rulebooks add a further layer tailored to each licensed activity, so an exchange operator is complying with five documents rather than four. The May 2025 rulebook updates are now fully implemented, and firms working from earlier versions are working from superseded text.

The application process

VARA operates a two-stage process, and the fee schedule follows it.

1. Initial Disclosure Questionnaire. Submitted through your commercial licensor — the relevant free zone authority or Dubai Economy and Tourism — rather than directly. An instalment of 50% of the application fee is invoiced after this stage. The IDQ exists to surface fundamental problems before the full fee is committed.

2. Full licensing package. The detailed submission against the applicable rulebooks: business plan, governance structure, policies and procedures, technology and security arrangements, AML framework, financial projections, and fit-and-proper documentation for named individuals.

3. In-principle approval. Permits you to prepare — build systems, hire, finalise banking — but does not permit servicing clients.

4. Final licence. Granted once VARA is satisfied the operational conditions are met. The remaining application fee plus a full year of supervision fees are collected before any client work is permitted.

In-principle approval is not a licence: this distinction catches both applicants and their customers. An entity with IPA appears in public materials in a way that reads like authorisation, but it cannot serve clients. If you are a counterparty checking a desk on the register, read which status you are looking at. If you are an applicant, do not build a launch plan that assumes revenue at IPA.

What you need in place

Entity and premises

• A Dubai-incorporated entity licensed by DET or a relevant free zone authority

• Genuine physical presence in Dubai — not a flexi-desk for regulated client-facing activities

• Space requirements confirmed with your commercial licensor based on staffing

People

• A Responsible Officer, named and accountable under the Compliance and Risk Management Rulebook

• Compliance officer and MLRO functions

• Senior management and board subject to fit-and-proper assessment

These are salaried roles that must be in place before licensing, generating cost through a period with no revenue. Cash flow, not the fee schedule, is what most commonly breaks an application.

Capital

Set out in Part VI of the Company Rulebook as the higher of a fixed dirham amount or a percentage of fixed annual overheads.

• Where it sits. Held at all times in a UAE trust account with VARA as beneficiary, or via an acceptable surety bond. Committed, not spent.

• Multi-activity firms stack. Capital is held per activity, with fixed annual overheads allocated between them on a mutually exclusive and collectively exhaustive basis. You cannot count an overhead twice to reduce the total.

• Additional tests apply. Expense-based capital of at least 1.2 times monthly operational expenses, alongside net liquid asset requirements.

The structural lever worth modelling early: using a VARA-licensed custody provider rather than self-custodying roughly halves the capital floor for exchange, broker-dealer and management activities. For exchange services that is the difference between AED 800,000 and AED 1,500,000 — a decision about operating model, not about fees.

Fees at a glance

Lower tier covers Advisory Services and VA Transfer and Settlement Services; standard tier covers everything else. White paper submission for issuance carries AED 5,000, with AED 50,000 where a detailed review is required. Fees are set out in Schedule 2 of the Virtual Assets and Related Activities Regulations 2023.

Timeline realism

VARA publishes no end-to-end processing standard. Advisory commentary commonly describes the full process as running many months, with six to twelve months a frequently cited range for a substantive application.

Plan by stage and revise against regulator feedback rather than against an assumed total. The variable that most affects duration is not VARA — it is the completeness and internal coherence of your submission.

Life after licensing

The obligations that persist are more demanding than the application, and they are where firms most often underestimate the operating cost of being regulated.

Reporting and records

The Compliance and Risk Management Rulebook requires detailed transaction-level records — date, time, amount and nature of each transaction — with the ability to summarise that data meaningfully and generate reports at scale. In practice this is a systems requirement rather than a policy one, and firms that treat it as documentation discover the gap at their first inspection.

The Marketing Regulations

Effective from October 2024 and among the most operationally intrusive parts of the regime.

• Pre-clearance of promotional content before distribution

• Prescribed disclaimers on marketing materials

• Rules governing influencer use and social media strategy

• An eight-year record retention obligation for all marketing materials

For consumer-facing firms this is a standing operational cost. A marketing function that ships campaigns weekly cannot run on ad hoc legal review, and the retention obligation means you need an archive from day one rather than assembled retrospectively.

Ongoing supervisory obligations

• Material event disclosures to VARA

• Complaints handling to prescribed standards

• Capital and prudential compliance maintained continuously, not at year end

• Travel Rule obligations — originator and beneficiary data collected, verified and transmitted for transfers at or above AED 3,500, under Cabinet Decision 134 of 2025

• Regulatory inspections

The Sponsored VASP route

Formalised in Part VII of the Compliance and Risk Management Rulebook, this is the part of the framework most guides omit entirely — and the most relevant option for smaller entrants.

The model allows an entity that is not independently licensed to carry out certain virtual asset activities under the umbrella of a sponsoring VASP that holds a valid VARA licence. The sponsor is held fully accountable for the sponsored entity’s compliance. Commentators draw a parallel with the UK’s appointed representative regime, though with stricter safeguards.

The conditions

• A common control structure between sponsor and sponsored entity

• VARA approval mandatory before any operations begin

• Compliance with the full rulebook stack, not a reduced set

• Capital requirements stack per sponsored entity

• Full segregation of data, accounts and client funds

• Marketing must not present the sponsored entity as independently licensed

• Ongoing audit, reporting and oversight by the sponsor

Who this actually suits: the common control requirement means this is not a way for an unrelated startup to rent a licence. It is a structure for groups launching a new entity or business line under an existing licensed arm, and for novel models that need a supervised pathway. It lowers the entry barrier without lowering the standard — which is the point, and also why it is narrower than it first appears.

VARA and the alternatives

VARA is not automatically the right choice, and the correct regime depends on your model, clients and banking needs.

Banking recognition is the deciding factor for most firms. VARA licences carry the strongest recognition among traditional UAE banks. RAK DAO licensing is reported as accepted by neobanks and several mid-tier banks and is significantly faster and cheaper — a reasonable path for a startup that will bank with a digital-first institution, and a poor one for a firm that needs a tier-one relationship.

Sequencing: licence first, then bank

Founders routinely attempt this in the wrong order. Banks want to see your regulatory authorisation before opening an account, so attempting to bank first generally stalls.

Reported onboarding timelines run from one to five business days at digital banks for well-prepared applicants, against two to eight weeks at traditional banks conducting enhanced due diligence — and that is after licensing. Traditional institutions commonly expect substantial average balances; neobanks considerably less. Build the licensing timeline, then the banking timeline, then your launch date.

Common and expensive mistakes

• Assuming a free zone crypto licence covers regulated activity — it does not

• Budgeting the application fee as the cost of the licence, when capital typically exceeds it several times over

• Treating in-principle approval as permission to onboard clients

• Applying for more activities than the business actually needs, since supervision and capital scale per activity

• Defaulting to self-custody without pricing the capital consequence

• Working from superseded rulebook versions

• Treating transaction reporting as a documentation task rather than a systems build

• Discovering the Marketing Regulations after the marketing team has already shipped campaigns

• Attempting to secure banking before licensing

Frequently asked questions

Who needs a VARA licence?

Any entity carrying out a regulated virtual asset activity in or from Dubai, excluding the DIFC. Existing free zone crypto licence holders are not exempt and must obtain the appropriate VARA authorisation separately.

How long does licensing take?

VARA publishes no end-to-end standard. Six to twelve months is commonly cited for a substantive application, driven largely by submission quality rather than regulator speed.

What is the cheapest activity to license?

Advisory Services, at AED 40,000 application, AED 80,000 annual supervision and AED 100,000 paid-up capital. VA Transfer and Settlement shares the fee tier with different capital treatment.

Can I operate under someone else’s licence?

Only through the Sponsored VASP regime, which requires a common control structure between sponsor and sponsored entity and prior VARA approval. It is not a route to renting an unrelated firm’s licence.

Do I need an office in Dubai?

Yes. Genuine physical presence is required, and client-facing regulated activities such as exchange, custody and broker-dealer are expected to operate from private office space rather than shared desks.

Is paid-up capital an expense?

No. It is committed — held in a UAE trust account with VARA as beneficiary or via a surety bond. It remains yours but is unavailable as working capital, so it belongs on a separate budget line from fees.

What happens if I operate without a licence?

Unlicensed virtual asset activity in the UAE attracts substantial penalties, reported to include fines in the millions of dirhams, disgorgement of profits and possible criminal referral.

Should I choose VARA or a cheaper regime?

Depends on your banking requirement above all. VARA carries the strongest recognition with traditional UAE banks; lighter regimes are faster and cheaper but narrow your banking options considerably.

The short version

VARA licenses activities individually under four compulsory rulebooks plus activity-specific layers, through a two-stage process that begins with an Initial Disclosure Questionnaire and ends with fees and a full year of supervision payable before you can serve a single client. Capital is committed rather than spent, scales per activity, and can be roughly halved for several activities by using a licensed custody provider.

Budget for the obligations that persist — transaction reporting at scale, marketing pre-clearance with eight-year retention, and continuous prudential compliance — because they cost more over time than the application ever will. And sequence the work properly: regime choice, then licence, then bank, then launch.

Disclaimer: This guide is general information, not legal or regulatory advice. It reflects publicly reported details of the VARA framework as of 2026, including the Virtual Assets and Related Activities Regulations 2023 and rulebooks as updated in May 2025. Requirements change — verify current rules against VARA’s own published materials and take qualified legal advice before applying.

Looking for a Trusted OTC Desk?

Compare licensed crypto OTC desks by jurisdiction, minimum trade size, and settlement terms.

Explore the OTC Directory →