Summary
- Dubai excluding DIFC. A business must obtain permission for each regulated activity it performs. Mainland incorporation and free-zone registration do not replace VARA authorisation. Limited exemptions require their own conditions. (Dubai Law No. 4 of 2022, art. 15; Virtual Assets and Related Activities Regulations 2023 (VARA Regulations), III.A, IV.A.)
- Dubai. Own-portfolio trading by commercial entities requires a VARA no-objection certificate and an appropriately coded commercial licence. Active investment at the USD 250 million threshold also triggers registration under the rolling-period rule. Customer-facing dealing requires a separate activity assessment. (VARA circular, 31 July 2025, pp. 1–2; VARA Regulations, IV.A.7–8, Schedule 1.)
- Dubai. Custody generally requires a separate group entity. Approved transfer and settlement services and authorised staking from custody qualify that separation rule. A sponsored business requires an approved relationship and cannot describe itself as independently VARA-licensed. (Custody Services Rulebook, III.B.5–6, IV.A; Compliance and Risk Management Rulebook, VII.D–E.)
- Dubai and UAE federal. Token issuance and payment functions require separate classification. Category 2 issuance can proceed without an issuer licence only through the prescribed licensed-distributor route. VARA permission alone does not satisfy the applicable Central Bank payment-token licensing or registration requirements. (Virtual Asset Issuance Rulebook, I.C–F; CBUAE Payment Token Services Regulation, arts. 2(1), 5, 8–9; VARA circular, 23 July 2025, paras. 1–3.)
- DIFC. Financial services in or from the Dubai International Financial Centre fall under Dubai Financial Services Authority (DFSA) authorisation. Its current crypto-token suitability rules distinguish non-fiat tokens, Fiat Crypto Tokens and a custody exception. (Regulatory Law 2004, DIFC Law No. 1 of 2004, art. 41; DFSA GEN 3A.2.1.)
- Dubai. VARA charges application and annual supervision fees by activity. Paid-up capital, net liquid assets, client backing and insurance are separate requirements. A fee quotation cannot establish the venture’s total funding need. (VARA Regulations, Schedule 2; Company Rulebook, VI.B–E.)
- Dubai. Approval to Incorporate permits preparatory establishment, without authorising virtual asset operations. Marketing restrictions apply before launch, while exchange-traded derivatives require express additional authorisation. (VARA, Licence Applications, Stages 1–2; Marketing Regulations 2024, I.B; Exchange Services Rulebook, V.A–B.)
Territory and the responsible regulator
VARA regulates virtual asset services across Dubai’s mainland and free zones, except the DIFC. Choosing a free-zone commercial licence therefore does not remove VARA jurisdiction. An applicant proposing regulated activity must obtain the required VARA approvals before commencing commercial licensing procedures. The resulting entity must operate within its authorised conditions. (Dubai Law No. 4 of 2022, arts. 3, 15.)
Federal competence also matters. The Capital Market Authority (CMA) succeeded the Securities and Commodities Authority from 1 January 2026. The succession legislation preserves Cabinet Resolutions Nos. 111 and 112 of 2022, insofar as consistent, until amendment, replacement or repeal. The change of federal regulator therefore does not itself terminate Dubai’s existing virtual asset arrangements. (Federal Decree-Law No. 32 of 2025, arts. 2(2)–(3), 27(3), 30.)
The federal regulator’s published cooperation arrangement distinguishes servicing the wider UAE from establishing operations in another emirate. It describes federal registration for VARA licensees, while requiring federal licensing for operations based elsewhere. That administrative statement does not grant an unrestricted right to establish in every jurisdiction. Federal applications must also be assessed under the VASP framework adopted by CMA Resolution No. 04/Chairman of 2026, including its transitional provisions. Commencement is the day after Gazette publication, not issuance. Article 3 gives CMA-licensed entities and accredited persons no more than one year from commencement to meet the Business Regulation and Alternative Trading System Module requirements; Article 5 separately governs pending applications. A Dubai operator serving foreign markets must also meet the higher applicable VARA or host-jurisdiction standards. (SCA administrative announcement, 9 September 2024, “Licensing of VASPs”; CMA Resolution No. 04/Chairman of 2026, arts. 1–3, 5–7; General Framework Module, art. 4; VARA Regulations, IV.A.4.)
Activities within the VARA perimeter
The general prohibition applies when an entity conducts, or purports to conduct, a regulated activity by way of business. VARA considers commercial benefit, regularity, continuity, scale and representations to the public. An operation can satisfy that test without charging a cash commission. Employee and exempt-entity routes remain subject to the conditions attached to those categories. (VARA Regulations, III.A.1–3.)
The eight activity categories distinguish personal recommendations (Advisory), order arrangement and dealing (Broker-Dealer), qualifying issuance (Category 1), safekeeping (Custody), trading and order-book operation (Exchange), repayable asset transfers (Lending and Borrowing), management of another entity’s assets (VA Management and Investment), and asset transmission or settlement (VA Transfer and Settlement). Each applicable permission must cover the actual service. (VARA Regulations, IV.A.1, Schedule 1.)
Consider a proposed over-the-counter desk that arranges customer orders, accepts assets and executes conversions. Its off-exchange trading format does not resolve which regulated roles it performs. A proposed application that routes orders to another venue can still perform regulated arrangement. These are conditional applications of the activity definitions; describing the product as software does not remove the transaction role. (VARA Regulations, Schedule 1, definitions of Broker-Dealer Services and Exchange Services.)
A technology supplier that performs no regulated transaction function presents a different case. VARA permits voluntary registration for certain distributed-ledger technology services. That registration does not authorise regulated activities, and critical service providers can face direct VARA supervision. A non-custodial design therefore requires assessment of order handling and other functions beyond possession of private keys. (VARA Regulations, IV.A.8–11, Schedule 1.)
Own-portfolio trading and limited exemptions
A commercial entity investing only its own assets must still address VARA’s no-objection process. The regulator’s 31 July 2025 circular requires a prior no-objection certificate and the correct commercial activity code, 6920017. This requirement does not depend on reaching the separate large-investor registration threshold. (VARA, VA Proprietary Trading circular, 31 July 2025, pp. 1–2.)
Registration becomes mandatory when a Dubai entity actively invests its own portfolio at or above USD 250,000,000 equivalent value during any rolling 30-calendar-day period. Registration must occur before investment at that level or within three Working Days of reaching it. The rule’s investment measure should not be replaced with an assumed year-end balance-sheet test. (VARA Regulations, IV.A.7.)
A dealer cannot rely on the own-portfolio route solely because it uses corporate funds. Schedule 1 separately captures dealing on an entity’s own account. Customer-facing execution must therefore be tested against Broker-Dealer and Exchange definitions; proprietary registration gives no permission to conduct those services. The decisive distinction depends on the business’s transaction role and the scope of its approved activity. (VARA Regulations, IV.A.7(b)–(c), IV.A.8(b), Schedule 1.)
Professionally licensed lawyers, accountants and consultants have a limited incidental-services exception. The virtual asset activity must be wholly incidental to their professional practice, within the provider’s professional authorisation, and covered by applicable professional indemnity insurance. A separately marketed investment service does not become incidental merely because its provider holds a professional licence. VARA determines whether the conditions are met. Exempt Entities must notify VARA, obtain confirmation and secure the required prior no-objection certificate. (VARA Regulations, IV.A.5–6.)
Custody and group structure
A group proposing exchange services and a dedicated custody business must plan separate legal entities. The custody entity must be distinct from group members conducting other virtual asset activities. Each client’s assets ordinarily require separate wallets. Custodians cannot treat safeguarded assets as their own or rehypothecate them, even with client consent. (Custody Services Rulebook, III.B.1–5.)
Two express qualifications prevent an absolute separation rule. VARA can approve Transfer and Settlement Services in the custody entity, subject to the required segregation. It can also authorise Staking from Custody Services within that entity. Staking requires explicit client opt-in and compliance with the dedicated custody-staking rules. Neither qualification permits an exchange to add an unrestricted custody business without the relevant approval. Collateral Wallet Services also require express authorisation in the custodian’s licence and explicit client opt-in. Their designated wallets may hold pooled client assets as a limited exception to the separate-client-wallet rule, while the custodian remains responsible for safekeeping and the group-entity separation requirement continues to apply. (Custody Services Rulebook, III.B.6, IV.A.1–5, IV.B.3, V.A.1–5, V.B.1–4, V.D.1–3.)
Responsibility for staking another entity’s assets also appears within Management and Investment Services. The custody-staking permission is a specific route for assets already held in custody. A proposed pooled staking service cannot assume it qualifies: the custody rules require separate client assets and a single client per node. (VARA Regulations, Schedule 1, VA Management and Investment Services; Custody Services Rulebook, IV.A.4, IV.C.1–2.)
The general client-asset rules also apply to service providers outside the dedicated custody category. Outsourcing storage does not settle whether the applicant needs its own additional permission. The proposed client agreement, control over transfers and custody provider’s approval must match the chosen operating model. (VARA Regulations, Schedule 1, Custody Services definition and note; Compliance and Risk Management Rulebook, IV.B, V.B; Custody Services Rulebook, III.D.3.)
Sponsored businesses
A sponsored virtual asset service provider (VASP) can operate through an approved sponsorship relationship. The sponsor must control the sponsored entity, or both must share a controller. The sponsored business must be a Dubai legal entity, and the parties need the prescribed written agreement and prior VARA approval. An unrelated operator cannot infer permission from a private agreement to use another firm’s licence. (Compliance and Risk Management Rulebook, VII.B, VII.D.1–2.)
Approved sponsored activities receive the authorisation treatment prescribed by the general prohibition. Public communications must identify the business as a Sponsored VASP and disclose its sponsor, rather than claim independent VARA-licensed status. The sponsor must meet the prudential requirements for its own business and each sponsored VASP. Sponsorship therefore requires an approved operating and capital structure. (Compliance and Risk Management Rulebook, VII.E.1–3, VII.H.)
Token issuance and payment functions
Securities require a separate classification analysis. Federal Decree-Law No. 33 of 2025 excludes digital representations of Securities from its definition of Virtual Assets. A token representing a share therefore cannot be assigned to the ordinary virtual asset route solely because it uses a distributed ledger. The relevant rights and activity must first be tested under the capital-market provisions. (Federal Decree-Law No. 33 of 2025, arts. 1–3.)
An issuer must classify the token before choosing an application route. Category 1 includes Fiat-Referenced Virtual Assets (FRVAs), Asset-Referenced Virtual Assets (ARVAs), and other assets designated by VARA. Category 1 issuance requires a licence. Category 2 generally avoids an issuer licence only where all placement and distribution occurs through a licensed distributor. That route does not represent VARA approval of the token. (Virtual Asset Issuance Rulebook, I.C.1, I.D.1, I.E.1–5.)
Qualifying Non-Transferable Virtual Assets or Redeemable Closed-Loop Virtual Assets can fall within Exempt VAs, provided they are outside Category 1. Exemption from prior issuance requirements does not disapply every general rule or supervisory power. A label identifying a token as a collectible does not establish its exemption. A change in token features can require reclassification before the change takes effect. (Virtual Asset Issuance Rulebook, I.C.1–3, I.F.)
VARA requires separate approval of each FRVA, beyond the issuer’s Category 1 licence. Dirham-referenced assets remain within the Central Bank’s exclusive remit under the issuance rules. VARA-approved FRVAs have a restricted permitted use within the virtual asset ecosystem; that approval does not authorise payment for goods and services in the UAE. (Virtual Asset Issuance Rulebook, Annex 1, I.B.2, I.B.4–5.)
Anonymity-Enhanced Cryptocurrencies are prohibited, including their issuance and related activities. The definition concerns assets that prevent transaction or ownership tracing where the VASP lacks mechanisms permitting traceability or ownership identification. A privacy-related product name alone is therefore insufficient to apply that definition. (VARA Regulations, II.C.1, Schedule 4, definition of Anonymity-Enhanced Cryptocurrencies.)
The Central Bank payment-token boundary also affects service providers. VARA’s 23 July 2025 circular directs VASPs engaged in fiat-backed payment-token activities to obtain Central Bank registration. It identifies 20 August 2025 as the grace-period expiry and requires engagement with the Central Bank and notification to VARA. A proposed covered business must obtain the applicable Central Bank licence or registration alongside its VARA permissions, subject to the Regulation’s exclusions and exemptions. The non-objection registration routes include conversion by a qualifying Virtual Assets Exchange Platform Operator and custody and transfer of Foreign Payment Tokens by a VASP licensed for custody. That custody registration does not authorise custody and transfer of Dirham Payment Tokens. The issuer routes distinguish a Dirham Payment Token Issuer licence from Foreign Payment Token Issuer registration for eligible issuers established outside the UAE or in a financial free zone. These routes carry their own applicable prudential and operating requirements. (VARA, Compliance with CBUAE Payment Token Services Regulation circular, 23 July 2025, paras. 1–3; CBUAE Payment Token Services Regulation, Part 1, arts. 2(1), 4–6, 8(1)–(3), 9.)
Financial services in the DIFC
A firm conducting financial services in or from the DIFC must assess DFSA authorisation, subject to the statutory exceptions. Dubai Law No. 4 of 2022 excludes the DIFC from VARA’s territorial remit. Establishment in that centre therefore changes the applicable licensing analysis; it does not confer permission to operate without financial authorisation. (Dubai Law No. 4 of 2022, art. 3; DIFC Regulatory Law 2004, art. 41.)
The DFSA’s crypto-token amendments took effect on 12 January 2026. Under GEN 3A.2.1, an Authorised Person generally assesses a non-fiat Crypto Token’s suitability on reasonable grounds. A Fiat Crypto Token instead requires the DFSA to be satisfied of suitability. The rule contains a specific Providing Custody exception. Token suitability and authorisation for the financial service remain separate requirements. (DFSA, Crypto Tokens, “Updates effective from 12 January 2026”; GEN 3A.2.1(1)–(4).)
Exchange-traded derivatives
An Exchange Services licence does not automatically permit exchange-traded derivatives. Part V of the Exchange Services Rulebook, effective 31 March 2026, requires express VARA authorisation recorded in the licence. The applicant must submit the required product, risk, operational and financial arrangements. VARA can impose additional conditions. A proposed derivatives venue must therefore budget and apply for that permission before offering those contracts. (Exchange Services Rulebook, V.A.1–3, V.B.1–4.)
Authorisation and commencement
The application process separates establishment from operating permission. The first stage starts with the Initial Disclosure Questionnaire through the Department of Economy and Tourism or the relevant free-zone authority. VARA examines the proposed business and ownership information. Approval to Incorporate permits establishment preparations, including premises and hiring, while prohibiting virtual asset operations. (VARA, Licence Applications, Stage 1.)
The second stage requires a full application and review of supporting documents. VARA can seek further information and conduct interviews. Remaining application fees and the first annual supervision fee precede completion of the licensing process. The applicant must satisfy operating conditions before commencing the authorised activities. A commercial incorporation certificate or initial approval cannot substitute for that final permission. (VARA, Licence Applications, Stage 2; VARA Regulations, IV.A.1–3.)
Ownership transactions require their own approval analysis. Dubai Law No. 4 of 2022 prohibits assignment of a permit without prior VARA approval and renders a non-compliant assignment void. Buying a business therefore does not justify treating its permission as freely transferable. The proposed transaction must preserve the correct licensed entity and meet applicable approval conditions. Actions that may result in a change of control of a VASP, or a merger or acquisition of all or a substantial part of a VASP’s assets, require prior written VARA approval. (Dubai Law No. 4 of 2022, art. 17; Company Rulebook, VIII.C.1–2, VIII.D.1–2.)
Application and annual fees
The scheduled fees are denominated in UAE dirhams. Advisory Services and VA Transfer and Settlement Services each carry an AED 40,000 application fee and AED 80,000 annual supervision fee. Each of the other six activity categories carries AED 100,000 and AED 200,000 respectively. (VARA Regulations, Schedule 2, para. 1.)
For multiple activities, VARA reduces the lower additional application fees by 50%; annual supervision fees remain cumulative. For an approved single-entity Exchange plus Transfer and Settlement model, the derived application total is AED 100,000 + (50% × AED 40,000) = AED 120,000. Annual supervision is AED 200,000 + AED 80,000 = AED 280,000. Together, those scheduled first-cycle fees equal AED 400,000. (VARA Regulations, Schedule 2, para. 1.)
This calculation excludes capital and operating expenditure. VARA can levy additional or modified fees; other authorities charge separately. Issuance can attract additional approval or whitepaper fees. Separate group companies should not assume the same combined-application discount. (VARA Regulations, Schedule 2, paras. 2–6.)
Applications also carry rejection risk: VARA does not refund application fees if an application is denied or withdrawn. Authorised Staking from Custody Services and Collateral Wallet Services attract incremental licensing or supervision fees under their specific rules. These charges must be assessed separately from the standard activity schedule. (VARA Regulations, IV.B.4(a); Custody Services Rulebook, IV.A.1, V.A.3.)
Paid-up capital and custody choices
Paid-up capital must remain available in the prescribed form. The standard minimums are set by activity. In the formulae below, overhead means fixed annual overheads, and the higher amount applies whenever two figures appear. (Company Rulebook, VI.B.1.)
Advisory requires AED 100,000. Custody requires the higher of AED 600,000 or 25% of overhead. Lending and Borrowing and Transfer and Settlement each require the higher of AED 500,000 or 25%. (Company Rulebook, VI.B.1.)
Qualifying custody lowers certain thresholds. Broker-Dealer requires the higher of AED 400,000 or 15% of overhead; otherwise, AED 600,000 or 25%. Exchange requires AED 800,000 or 15%; otherwise, AED 1,500,000 or 25%. Management and Investment requires AED 280,000 or 15%; otherwise, AED 500,000 or 25%. Qualifying custody means a VARA-licensed custodian or custody otherwise approved during licensing. (Company Rulebook, VI.B.1.)
Capital requirements accumulate across activities, with overhead allocated without omission or double counting. Permitted arrangements include the prescribed UAE bank trust account, qualifying surety bond, or another VARA-approved arrangement. The activity-specific minimum therefore cannot be treated as a one-off application expense. (Company Rulebook, VI.B.2–3.)
A hypothetical exchange with AED 8 million of allocated fixed annual overhead illustrates the custody decision. With qualifying custody, the calculation is the higher of AED 800,000 and 15% × AED 8 million, producing AED 1.2 million. Otherwise, the higher of AED 1.5 million and 25% × AED 8 million produces AED 2 million. The derived AED 800,000 difference excludes the custodian’s charges and any additional requirement imposed through licensing conditions. (Company Rulebook, VI.B.1; VARA Regulations, IV.B.3.)
Liquidity, client backing and issuer capital
Current liquid assets must exceed current liabilities by at least 1.2 times monthly operating expenses. Daily reconciliation and monthly reporting apply. Eligible holdings are cash, cash equivalents and VARA-approved USD- or AED-referenced virtual assets. Current liabilities must include the portion of operational virtual asset exposure agreed with VARA. With hypothetical monthly expenses of AED 100,000, the derived required surplus is AED 120,000. This test measures liquidity separately from activity-based paid-up capital. (Company Rulebook, VI.C.1–4.)
VASPs must maintain reserve assets covering 100% of their liabilities to clients, in the same virtual assets on a one-to-one basis. Daily reconciliation and periodic independent audit apply. Client backing cannot be substituted with an unsupported promise to raise founder capital later. An applicant’s financial model must distinguish the resources supporting client claims from its own operating budget. (Company Rulebook, VI.E.1–3.)
Issuer capital follows additional rules. FRVA issuers require AED 1,500,000 plus 2% of the value of available FRVA supply. ARVA issuers require the higher of AED 1,500,000 and 2% of average reserve-asset market value, where applicable, over the preceding 24 months. The additive FRVA formula must not be replaced with the ARVA higher-of formula. (Virtual Asset Issuance Rulebook, Annex 1, III.F.1; Annex 2, III.G.1.)
Insurance also creates a recurring funding requirement. VARA ordinarily requires professional indemnity, directors’ and officers’, and relevant hot-wallet crime cover with a regulated insurer. Licence conditions can require further cover. VARA may approve alternative protections where an applicant demonstrates why prescribed insurance cannot be obtained. That discretion does not create a general uninsured-business option. (Company Rulebook, VI.D.1–4.)
Personnel and operating controls
A VASP must appoint two Responsible Individuals of sufficient seniority, notified to and approved by VARA. They must be full-time employees, fit and proper, and UAE residents or UAE passport holders. The residency alternative matters: the rule does not impose a universal UAE-nationality requirement. (Company Rulebook, I.C.1–4.)
The Compliance Officer needs at least five years of relevant compliance experience, VARA approval as a fit and proper person, full-time employment, the prescribed residence or passport status, and direct Board reporting. The Money Laundering Reporting Officer needs at least two years of experience handling AML/CFT matters and must be fit and proper. Non-client-facing roles may be combined where duties do not conflict, subject to the rules and VARA’s assessment. (Compliance and Risk Management Rulebook, I.C.1–4, III.A.1–4.)
Client due diligence, transaction monitoring and sanctions controls must operate throughout the relationship. VARA requires immediate suspicious-transaction reporting to the Financial Intelligence Unit and compliance with applicable information requests. Its Travel Rule provisions require prescribed originator and beneficiary information and counterparty checks. Federal requirements can impose additional obligations. Outsourcing these functions does not remove the responsible officer’s accountability. (Compliance and Risk Management Rulebook, III.A.3, III.E–H.)
The applicant must also implement client-money and client-asset protection, records, audit and regulatory reporting arrangements. Operational preparations must address technology security and continuity, rather than stop at written policy approval. The Compliance Officer’s duties include implementation of the required business continuity and disaster recovery plan. VARA also requires compliance with its Technology and Information and Market Conduct Rulebooks. (Compliance and Risk Management Rulebook, I.C.2, I.F–I, Parts IV–V; VARA Regulations, V.1–2.)
Marketing before and after launch
VARA’s marketing rules reach communications in or targeting the UAE. Marketing of a regulated activity generally must come from a VASP licensed for that activity, or be approved and issued on its behalf. An offshore advertiser cannot establish an exception solely through its place of incorporation. A business awaiting permission must assess promotional communications separately from its incorporation preparations. (Regulations on the Marketing of Virtual Assets and Related Activities 2024, I.A–B.)
Genuine exemptions have conditions. At a physical Dubai event, an unlicensed participant must avoid unauthorised activity and cannot onboard UAE residents there. It must carry the prescribed status disclaimer, hold required foreign permissions, restrict promotional content and meet general marketing standards. The event exception therefore permits only the defined promotional conduct. (Marketing Regulations 2024, I.F.1.)
Licensed operators must use fair, clear and non-misleading communications. They must retain marketing records for eight years after the last communication. Appointing an agency does not remove the prescribed responsibilities for its work. Marketing approval and record retention therefore belong in the launch process and ongoing controls. (Marketing Regulations 2024, I.C.2, I.C.4–5.)
Enforcement and administrative review
VARA can restrict activities, suspend or revoke permission, impose financial penalties and require corrective action. It can also take action against Responsible Individuals under the applicable provisions. A business must therefore preserve compliance after authorisation; payment of annual fees does not prevent intervention for substantive breaches. (VARA Regulations, IX.C.1–3, Schedule 3.)
Dubai Law No. 4 of 2022 provides a written grievance route against decisions, procedures or measures taken under the Law. The affected person has 30 days from notification to submit the grievance to the Director General. The committee must determine it within 15 days of referral. Article 22 describes the committee’s decision as final. The statutory time limits require prompt review of any adverse notice. (Dubai Law No. 4 of 2022, art. 22.)
