TRW & Co · Fintech and virtual assets
VARA Licensing in Dubai: How to License Virtual Asset Activities
A VARA licence in Dubai is required for any virtual asset business operating in or from the emirate, on the mainland or in a free zone, except the DIFC. VARA licenses eight activities, applies four compulsory rulebooks to every firm and runs a two-stage process through Dubai Economy and Tourism or a free zone. Here is how it works in practice.
Key pointMost delays come from activity scoping, not paperwork: if your Dubai entity controls client keys or settles transfers, VARA will treat it as custody or transfer business whatever your application says.
At a glance
Who needs a licence
Any business carrying on virtual asset activities in or from Dubai, including its free zones, must hold VARA authorisation; the DIFC is the only exception.
Eight licensed activities
Advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and virtual asset issuance each need separate authorisation.
Four compulsory rulebooks
Every licensee follows the Company, Compliance and Risk Management, Technology and Information, and Market Conduct rulebooks, plus the rulebook for each activity.
Two-stage process
An Initial Disclosure Questionnaire through DET or a Dubai free zone leads to approval to incorporate, followed by full VARA review and the VASP licence.
Federal overlay from 2026
The federal Capital Market Authority replaced the SCA on 1 January 2026 and issued an onshore virtual asset framework that operates alongside VARA.
Swipe or scroll →
A VARA licence in Dubai is required before any business carries on a virtual asset activity in or from the emirate, whether it is set up on the mainland or in a Dubai free zone. The only exception is the DIFC, which has its own regulator. As of October 2026, the Virtual Assets Regulatory Authority licenses eight distinct activities, each with its own rulebook, on top of four compulsory rulebooks that every licensee must follow.
This guide explains what the licence covers, how the two-stage application works, what VARA expects on governance, technology and market conduct, and where firms most often stumble.
The short answer: who needs a VARA licence in Dubai
If you exchange, broker, hold, lend, manage, transfer, advise on or issue virtual assets as a business, and you do it in or from Dubai outside the DIFC, you need VARA authorisation for each of those activities. Operating first and applying later is not an option: VARA's regime prohibits unlicensed virtual asset activity.
- Activity-based. You apply for the specific activities you will carry on, and each comes with its own activity rulebook and conditions.
- Two licensors. Your commercial licence comes from Dubai Economy and Tourism (DET) or a Dubai free-zone authority; your activity licence comes from VARA.
- Two stages. An initial disclosure stage through DET or the free zone leads to approval to incorporate; a full VARA assessment then leads to the VASP licence, usually with operational conditions.
- Ongoing supervision. Licensees pay annual supervision fees, report to VARA and must keep pace with rulebook updates, which have been frequent.
The legal framework behind VARA
VARA was established by Dubai Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai. Its detailed regime is set out in the Virtual Assets and Related Activities Regulations 2023 and in a family of rulebooks published on the VARA rulebooks portal.
The rulebooks fall into two groups. Four compulsory rulebooks apply to every licensee: the Company Rulebook, the Compliance and Risk Management Rulebook, the Technology and Information Rulebook and the Market Conduct Rulebook. Activity rulebooks then apply according to what the firm actually does.
The federal overlay after the capital markets reform
Since 1 January 2026, the federal Securities and Commodities Authority has been replaced by the Capital Market Authority (CMA), under Federal Decree-Laws No. 32 and No. 33 of 2025. In April 2026 the CMA issued a new federal virtual asset framework for onshore activity.
Published commentary describes VARA as remaining the competent authority for virtual asset businesses established in Dubai outside the DIFC, with the CMA framework operating alongside it. The day-to-day boundary is still settling, so firms with onshore clients beyond Dubai should take advice on both regimes. Our guide to which UAE regulator covers which crypto activity maps this in detail.
The eight VARA activities, and how to choose
Getting the activity scope right is the most important decision in a VARA licence in Dubai. Apply too narrowly and your business model breaches the licence; apply too broadly and you take on capital, staffing and compliance costs for activities you do not carry on.
| Activity | What it broadly covers | Typical business |
|---|---|---|
| Advisory Services | Advice and recommendations on virtual assets or related transactions | Research houses, advisory boutiques |
| Broker-Dealer Services | Arranging, executing or dealing in virtual asset transactions for clients, including as principal | OTC desks, brokerage apps, liquidity providers |
| Custody Services | Safekeeping and administration of virtual assets or keys on behalf of clients | Custodians, wallet providers holding client keys |
| Exchange Services | Operating a venue that matches orders between participants | Centralised exchanges and trading platforms |
| Lending and Borrowing Services | Intermediating or providing virtual asset loans and borrowings | Lending platforms, yield products structured as loans |
| VA Management and Investment Services | Managing portfolios or investment vehicles holding virtual assets | Crypto fund and portfolio managers |
| VA Transfer and Settlement Services | Transferring virtual assets between parties or settling transactions | Payment-style transfer and settlement services |
| VA Issuance | Issuing virtual assets, with Category 1 licensing for higher-risk issuances | Token issuers, including fiat- and asset-referenced tokens |
Issuance has its own logic. VARA requires a Category 1 licence for higher-risk issuances, including fiat-referenced and asset-referenced tokens, while certain lower-risk issuances can proceed through a VARA-licensed distributor. Our guide to token issuance in the UAE explains the categories and disclosure duties.
Common activity combinations
Many firms need more than one activity. An exchange usually also needs custody, and a broker-dealer that holds client assets overnight will need custody or a licensed third-party custodian. Each additional activity added to a VARA licence in Dubai brings its own rulebook, capital and insurance expectations and supervisory fee, so map the client journey end to end before you decide.
How the VARA licence application works
VARA's licence applications page sets out a two-stage process for new firms. In practice there is substantial preparation before stage one and a long tail of conditions after the licence is issued.
- Scope and gap analysis. Define the activities, client types, products and jurisdictions you will serve, then compare your draft policies against the compulsory and activity rulebooks
- Choose your commercial licensor. Decide between a mainland DET licence and a Dubai free zone. The choice affects office requirements, visas and costs, but not VARA's rulebooks
- Submit the Initial Disclosure Questionnaire. File the IDQ with DET or the free zone, with a business plan and details of beneficial owners and senior management, and pay the initial fees
- Obtain approval to incorporate. If the IDQ is approved, you can incorporate and build out operations, but you cannot yet carry on virtual asset activities
- File the full VARA submission. Submit governance, risk and compliance, technology, cyber security and AML documentation in line with VARA's guidance, and respond to its questions and meetings
- Pay fees and receive the licence. Pay the remaining licence fees and first-year supervision fees and receive the VASP licence, which may carry operational conditions
- Satisfy conditions before full launch. Meet any pre-launch conditions VARA sets, such as completing testing, appointing staff or obtaining audits, before operating at full scale
Plan the budget as well as the timetable. Beyond the VARA licence and supervision fees, costs typically include the commercial licence and office, senior hires based in Dubai, external audits of reserves and controls, technology and cyber security assessments, insurance, and legal and compliance support. VARA also sets capital and liquidity expectations that vary by activity, so model them per activity before you fix the scope of your VARA licence in Dubai.
Investors and banks will ask about the licence too. Banks generally scrutinise virtual asset businesses closely at onboarding and will want to see where the licence stands, so build banking into the timetable and keep evidence of your licensing progress ready for their due diligence.
The stage that decides your timeline is the full VARA review. Its length depends almost entirely on the quality of what you submit. Policies copied from another jurisdiction, with no mapping to VARA's rulebooks, generate rounds of questions; a rulebook-by-rulebook gap analysis filed with the application usually shortens them.
What VARA expects from licensees
Governance and people
Holding a VARA licence in Dubai means meeting standards that continue long after approval. VARA looks for real, substantive presence in Dubai. Expect to show a board and senior management with relevant experience, defined responsibilities and enough time committed to the UAE entity, plus a compliance officer and money laundering reporting officer who understand both VARA's rules and UAE anti-money laundering law.
Technology, cyber security and custody
The Technology and Information Rulebook requires documented controls over systems, key management, cyber security, business continuity and third-party technology providers. Custody models attract particular scrutiny: how keys are generated, stored and recovered, how client assets are segregated and how reserves are evidenced.
In October 2026 VARA published a circular setting minimum expectations for independent audits of reserve assets and client asset safeguarding, following a thematic review of earlier proof-of-reserve reports. Firms holding client assets should treat audit-grade reserve evidence as part of the licence, not a marketing exercise.
Market conduct and disclosures
The Market Conduct Rulebook covers fair dealing, conflicts, market abuse and disclosures to clients. VARA's Version 2.0 activity rulebooks, announced in May 2025, tightened controls on margin trading, token distribution and collateral wallets. A later update to the Exchange Services Rulebook, effective from 31 March 2026, introduced a separate approval regime for exchange-traded virtual asset derivatives.
Marketing is a separate area of risk. VARA applies its own marketing rules, including to promotions aimed at Dubai residents from outside the emirate. See our guide to virtual asset marketing rules in Dubai.
Anti-money laundering and the Travel Rule
Every licensee is a reporting entity under UAE anti-money laundering law. That means customer due diligence, transaction monitoring, sanctions screening, suspicious transaction reporting to the UAE Financial Intelligence Unit and Travel Rule compliance on transfers. Our guide to AML and the Travel Rule for virtual asset firms covers the detail, and our AML compliance practice supports programme design and testing.
VARA compared with the other UAE routes
A VARA licence in Dubai is not the only route to a UAE virtual asset business. The right choice depends on where your clients are, what products you offer and whether you want a common-law financial centre.
| Route | Regulator | Best suited to | Key consideration |
|---|---|---|---|
| Dubai mainland or Dubai free zone | VARA (with DET or the free-zone authority) | Retail and institutional platforms based in Dubai | Activity-specific rulebooks and frequent updates |
| DIFC | DFSA | Institutional business wanting a common-law financial centre | Crypto tokens regulated within the DFSA's wider financial services regime |
| ADGM | FSRA | Institutional and fund-related business in Abu Dhabi | Virtual assets integrated into the FSRA's financial services framework |
| Onshore outside Dubai | CMA | Firms serving clients across the federal onshore market | New federal framework from 2026 with its own transition |
Payment-style stablecoin activity can also bring in the Central Bank of the UAE. See our guide to stablecoins and payment tokens in the UAE.
An illustrative scenario
This scenario is illustrative only and does not describe a real client or matter. It shows how scoping decisions shape a VARA licence in Dubai.
A European crypto brokerage plans a Dubai hub to serve Gulf institutional clients. Its first draft application seeks Broker-Dealer Services only, on the assumption that client assets will sit with its European affiliate.
During gap analysis it emerges that the Dubai entity will control client wallets for settlement and occasionally hold assets overnight. That is custody in substance. The firm either adds Custody Services to its application or restructures so that a VARA-licensed custodian holds client assets under a documented arrangement.
It chooses the second route, maps its group policies to VARA's four compulsory rulebooks, appoints a Dubai-based compliance officer and MLRO, and files a clean submission. The scope is narrower, the capital and staffing burden lower, and the business model matches the licence.
Risks and common mistakes
Starting activity before the licence
Incorporating after approval to incorporate does not authorise virtual asset activity. Onboarding clients, taking deposits or running a soft launch before the VASP licence is issued, and before pre-launch conditions are met, exposes the firm and its managers to enforcement and can derail the application. Keep marketing, onboarding and product teams aligned with the licensing timetable, and record when each condition has been satisfied.
Copy-paste policies
Group policies written for another regulator rarely map onto VARA's rulebooks. VARA reviewers check that each requirement is addressed in a way that reflects the Dubai entity's actual staff, systems and products. A rulebook-by-rulebook mapping, with clear owners for each control, saves months of back-and-forth and shows that the firm understands what it is signing up to.
Under-scoping activities
Firms often apply for one activity while their operations involve another, typically custody, transfer or lending. If your systems control client keys, settle transfers or lend out assets, VARA will see the activity regardless of the label. Map the full client and asset flow before choosing activities, and restructure or add activities rather than hoping the issue is missed.
Thin local substance
A licence held by a Dubai entity run entirely from abroad is a common weakness. VARA expects key functions and decision-makers to be genuinely engaged with the Dubai business. Outsourcing is permitted within limits, but accountability stays with the licensee, so document oversight of every outsourced function and be ready to show who in Dubai makes the decisions.
Ignoring rulebook updates
VARA updates its rulebooks regularly, sometimes with short transition windows: the May 2025 Version 2.0 activity rulebooks gave firms about a month to comply. Licensees need a regulatory-change process that tracks VARA publications, assesses impact and records implementation, because supervisors ask for that evidence during reviews.
The cross-border angle
Groups from the UK, Singapore, India, China and elsewhere often run a Dubai VARA entity alongside licences at home. Each regulator will want to understand intra-group arrangements: who holds client assets, where trading is booked and how liquidity flows between entities.
Serving clients in Saudi Arabia or other GCC states from Dubai raises separate questions under those countries' rules, and a VARA licence in Dubai does not authorise activity there. Equally, a foreign licence does not authorise activity in Dubai, and promotions targeting Dubai residents can fall within VARA's reach even when made from abroad.
Checklist before you apply
Use this checklist to test whether you are ready to pursue a VARA licence in Dubai.
- Define each activity, product, client type and target market, and map them to VARA's eight activities.
- Decide between a DET mainland licence and a Dubai free zone, and confirm office and visa requirements.
- Complete a gap analysis against the four compulsory rulebooks and each relevant activity rulebook.
- Identify Dubai-based senior managers, a compliance officer and an MLRO with the right experience.
- Document custody, key management, reserves and cyber security controls to audit standard.
- Build AML, sanctions screening and Travel Rule processes before onboarding the first client.
- Check whether any activity also touches the CMA, the Central Bank or a foreign regulator.
- Set up a regulatory-change process to track VARA rulebook updates after licensing.
TRW & Co advises on scoping, application documents, rulebook mapping and post-licence compliance as part of our virtual assets practice and broader fintech regulation work. If you are preparing a VARA licence in Dubai, contact us to discuss your timetable.
Frequently asked questions
01How long does it take to get a VARA licence in Dubai?
VARA does not publish a fixed timeline. The initial disclosure stage through DET or a free zone is usually the quicker part; the full VARA review takes longest and depends heavily on the quality of the submission and how quickly the firm answers questions. Firms with a rulebook-by-rulebook gap analysis, local senior staff in place and audit-ready custody and AML documentation generally move faster. Plan for several months and build licence conditions into your launch plan.
02Do free-zone companies in Dubai need a VARA licence?
Yes. VARA regulates virtual asset activities across the whole of Dubai, including its free zones such as DMCC, DWTC and Dubai Silicon Oasis. The free-zone authority issues the commercial licence and handles the first stage of the application, but VARA issues the activity licence. The only exception is the DIFC, where virtual asset activity falls under the DFSA instead.
03What are the four compulsory VARA rulebooks?
All firms applying for a VARA licence must comply with the Company Rulebook, the Compliance and Risk Management Rulebook, the Technology and Information Rulebook and the Market Conduct Rulebook. On top of these, each firm follows the activity rulebook for every activity it is licensed for, such as Exchange Services or Custody Services. The rulebooks are published on VARA's rulebooks portal and are updated periodically.
04Can I operate while my VARA application is pending?
No. Approval to incorporate allows you to set up the company and build operations, but not to carry on virtual asset activities. You need the VASP licence, and must satisfy any pre-launch conditions attached to it, before serving clients. Firms that operated before VARA's regime began were handled through a separate legacy programme, which does not help new entrants.
05Does a VARA licence let me serve clients elsewhere in the UAE?
A VARA licence covers activity in or from Dubai. Since January 2026, the federal Capital Market Authority has applied its own virtual asset framework to onshore activity, and the DIFC and ADGM have separate regulators. Published commentary treats VARA as the competent authority for Dubai-established firms, but if you target clients across the UAE you should confirm how the federal framework applies to your model.
06Do I need a VARA licence to issue a token in Dubai?
It depends on the token. VARA requires a Category 1 issuance licence for higher-risk issuances, including fiat-referenced and asset-referenced tokens. Certain lower-risk issuances can proceed without a standalone licence through a VARA-licensed distributor, subject to VARA's disclosure rules. Payment tokens used for payments in the UAE may also fall under the Central Bank's regime, so analyse the token's use as well as its design.
Sources and official materials
- Virtual Assets Regulatory Authority — VARA's official site: regulations, register and announcements
- VARA licence applications — Two-stage application process, activities and compulsory rulebooks
- VARA rulebooks portal — Compulsory and activity rulebooks in their current versions
- VARA issues updated activity rulebooks (May 2025) — Version 2.0 rulebooks and transition period
- Capital Market Authority — Federal regulator that replaced the SCA from January 2026
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
