VARA License Dubai: Complete Guide to UAE Crypto Licensing

A VARA license is an authorisation issued by Dubai's Virtual Assets Regulatory Authority, the world's first independent virtual-asset regulator, established in March 2022 under Law No. 4 of 2022. It permits a firm to provide one or more of eight licensed VA Activities across Dubai, excluding the DIFC.

If you are planning a crypto exchange, a custody business, a broker-dealer or a token issuer aimed at the Middle East, Dubai is one of the most-asked-about destinations, and VARA is usually the first regulator that comes up. The challenge for founders is rarely the appetite. It is the map. The United Arab Emirates does not have a single crypto regulator, it has several overlapping ones, and choosing the wrong lane can cost months. This complete guide explains what a VARA license is, the eight activities it covers, the two-stage process to obtain one, and exactly how VARA sits alongside the federal CMA (formerly the SCA), Abu Dhabi's ADGM/FSRA and the DIFC's DFSA. It is part of our wider review of the best countries for a crypto license, and it keeps cost detail at overview altitude, pointing you to the dedicated VARA license cost, requirements and process page for the figures.

What Is VARA and What Does It Regulate?

VARA, the Virtual Assets Regulatory Authority, is the competent body in charge of regulating, supervising and overseeing virtual assets and VA Activities in Dubai. It was established in March 2022 under Law No. 4 of 2022 on the Regulation of Virtual Assets in Dubai, and it describes itself as the world's first independent regulator dedicated solely to virtual assets. Its remit covers Dubai's mainland, special development zones and free zones, with one notable carve-out.

That single-purpose mandate is what makes VARA different from most financial regulators that treat crypto as a sub-topic. VARA built a dedicated Virtual Assets and Related Activities Regulations 2023 rulebook from the ground up, organised into Parts (Part IV Licensing, Part VI AML/CFT, Part VIII market offences, Part IX supervision and enforcement) and a Schedule 1 that lists and defines the licensable activities.

VARA's statutory basis and mandate

VARA was created by Law No. 4 of 2022, which gives it the authority to regulate, license and supervise persons providing virtual-asset services in Dubai. The authority publishes its rules through a structured rulebook rather than a single act, anchored by the Virtual Assets and Related Activities Regulations 2023 and supported by activity-specific and compulsory rulebooks. VARA frames the framework as built on "economic sustainability and cross-border financial security," mandating gold-standard risk assurance and anti-money-laundering standards.

VARA's jurisdiction (Dubai mainland and free zones, excluding the DIFC)

VARA regulates virtual assets and VA Activities across Dubai's mainland, special development zones and free zones, but it does not cover the Dubai International Financial Centre. The DIFC is carved out and is regulated separately by the DFSA. This distinction matters in practice: two firms a few kilometres apart in Dubai can answer to entirely different regulators depending on which zone they incorporate in. We make this carve-out explicit because it is the single most common point of confusion among founders comparing Dubai options.

How VARA's authority is delegated by the federal regulator

VARA does not operate in isolation from the UAE's federal system. Its authority is delegated by the federal regulator, originally the Securities and Commodities Authority (SCA) and now the Capital Markets Authority (CMA), under Cabinet Decision No. 111 of 2022 (and the related Decision 112). The federal layer retains a remit over digital securities and digital commodities, and it set an expectation that VASPs within VARA's jurisdiction also obtain federal approval before commencing full market operations. We return to that federal overlay in detail below, because it is a nuance many guides miss.

The Eight VA Activities Licensed by VARA

VARA licenses eight distinct VA Activities, and the activity (or activities) you apply for shapes everything that follows, from capital to documentation. The current Licensed Activities register lists eight. Note a naming evolution: the original 2023 announcement described "seven licensed activities" plus issuance, and used "Payments and Remittances" where the rulebook now uses "Transfer and Settlement." The eight, as set out in Schedule 1 of the Regulations, are advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and VA issuance.

Infographic 1 placement: the eight-activity grid sits here, after this intro paragraph and before the H3 groupings.

Advisory, broker-dealer, exchange and management activities

This cluster covers the firms most founders have in mind. Advisory Services means offering or agreeing to provide a personal recommendation to a client about actions or transactions in virtual assets. Broker-Dealer Services covers arranging orders for the purchase and sale of virtual assets between two entities, accepting orders and fiat, facilitating the matching of transactions between buyers and sellers, dealing on own account, market-making and issuance-related services. Exchange Services covers conducting an exchange, trade or conversion between virtual assets and fiat, or between virtual assets, matching orders between buyers and sellers, or maintaining an order book. VA Management and Investment Services means acting as an agent or fiduciary, or otherwise taking responsibility for the management, administration or disposition of another entity's virtual assets. These definitions are reproduced from Schedule 1 of the VARA Regulations.

Lending, transfer and settlement, and issuance activities

The remaining activities round out the framework. Lending and Borrowing Services covers contracts under which a virtual asset is transferred or lent from one or more lenders to one or more borrowers, with the borrower committing to return the same. VA Transfer and Settlement Services covers the transmission, transfer or settlement of virtual assets from one entity to another, or to another wallet, address or location. VA Issuance (Category 1) is named as a licensed activity in Schedule 1, with its full definition set out in a dedicated VA Issuance Rulebook rather than in Schedule 1 itself. Token issuers planning to use Dubai as a base should treat issuance as its own licensing track.

Why custody must be a separately licensed entity

Custody is the one activity VARA treats differently from all the others. VARA states that Virtual Asset Custody Services "is the only regulated activity that is required to be segregated from other Virtual Asset Services licence categories," and that "a VA Custodian must be set up as a distinct legal entity with a standalone licence." In plain terms, you cannot bolt custody onto an exchange or broker-dealer entity. If your model holds client assets, you need a separate legal vehicle with its own custody license. This is a structural decision to make early, because it affects your group corporate map, capital allocation and governance, not just a checkbox on an application.

The compulsory cross-cutting rulebooks

Beyond the activity-specific rulebooks, every applicant must also comply with a set of compulsory, cross-cutting rulebooks. These broadly cover company conduct, compliance and risk management, technology and information, and market conduct, sitting on top of the Virtual Assets and Related Activities Regulations 2023. We keep this at the "broadly covering" level deliberately: the exact rulebook titles should be confirmed against the live VARA rulebook index at the time of application, as titles and structure are periodically refined.

How to Get a VARA License: The Two-Stage Process

VARA licensing runs in two stages: Initial Approval, then the Full VASP Licence. The first stage lets you incorporate and establish the entity, the second authorises you to actually provide virtual-asset services. The staging detail below follows the VARA licensing process as advisers describe it, consistent with Part IV of the Regulations.

1. Initial Approval. Submit an Initial Disclosure Questionnaire, pay roughly half the application fees, and receive Initial Approval, which is taken to the free-zone registrar to obtain a non-operational licence.
2. Incorporate. Use Initial Approval to establish the Dubai entity, secure the reserved company name, finalise corporate documents and identify a physical office.
3. Full VASP Licence. Within about twelve months, submit full documentation (policies, procedures, personnel appointments), pay the remaining fees, and receive operating permissions.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

Stage 1: Initial Approval (provisional, approval to incorporate)

Stage 1 is provisional authorisation to establish and incorporate the legal entity in Dubai. The applicant submits an Initial Disclosure Questionnaire (IDQ); after review and payment of around 50% of application fees, VARA issues Initial Approval, which is presented to the free-zone registrar to obtain a non-operational licence. At this point the requirements are a Dubai-incorporated entity (mainland or a permitted free zone), a reserved company name and corporate documents, an identified physical office and a basic business plan. Crucially, the firm is not yet authorised to provide VA services. Initial Approval is the green light to build the entity, not to trade.

Stage 2: Full VASP Licence (operational permissions)

Stage 2 converts the provisional setup into an operating license. Within roughly twelve months of Initial Approval, the applicant submits full documentation, including governance, risk, compliance and AML/CFT policies, procedures and personnel appointments, and pays the remaining fees. VARA then grants operating permissions for the activities applied for. This is the stage where the substance built in Stage 1, the office, the resident officers, the policy suite, is tested against the rulebook before the firm can serve clients.

Indicative timeline end to end

Advisers cite an indicative end-to-end timeline of around 4 to 7 months, with Stage 2 typically completed within about twelve months of Initial Approval. We present these as adviser estimates rather than regulator-guaranteed service levels (VERIFY): real timelines depend on the activities applied for, the completeness of your documentation and how quickly governance hires and the office are in place. Custody applications, given the standalone-entity requirement, tend to run longer than a single advisory or broker-dealer license.

The Federal Overlay: Do You Also Need SCA/CMA Approval?

A VARA license alone may not be enough to go fully live. The federal regulator, the SCA, clarified that all VASPs in Dubai falling under VARA's jurisdiction would also need to obtain the federal regulator's approval before commencing full market operations. The delegation of authority to VARA was made under Cabinet Decision No. 111 of 2022, and that decision (with Decision 112) remains in effect.

We flag this carefully. The clearest published statement of the federal-approval requirement dates from the SCA era, and the federal regulator has since changed (see below). The principle, that a Dubai VARA license sits within a federal framework that can require its own approval, is well established, but founders should confirm the exact 2026 mechanism with current guidance before relying on it. This is precisely the kind of overlap where good advice saves months.

What the SCA-now-CMA transition means in 2026

In January 2026, the Securities and Commodities Authority (SCA) was replaced by the federal Capital Markets Authority (CMA) under new federal laws. Importantly, Cabinet Decisions 111 and 112 of 2022, which delegate authority to VARA, remain in effect until repealed or amended. The federal approval requirement that applied under the SCA is understood to persist under the CMA, but because the relevant 2026 detail is still settling, we treat the precise post-transition mechanism as needing confirmation (VERIFY) rather than as settled fact. The name of the federal body has changed; the structural relationship between Dubai's VARA and the federal layer has not been removed.

The UAE Crypto Regulator Map: VARA vs SCA/CMA vs ADGM vs DIFC

This is where most Dubai crypto plans go wrong, and where this guide earns its keep. The UAE has a multi-regulator map, and a business picks its regulator largely by where it incorporates. The table below sets out the four lanes.

Sources for the map: VARA About, Reed Smith on VARA vs the SCA, CMS Law-Now on the CMA, ADGM/FSRA, DFSA.

Infographic 2 placement: the four-lane UAE regulator map sits here, accompanying the table above.

VARA: Dubai mainland and free zones (excluding DIFC)

VARA is the dedicated virtual-asset regulator for Dubai outside the DIFC. It is the world's first standalone VA regulator and the highest-profile route for exchanges, brokers, custodians and issuers targeting Dubai. If you incorporate on Dubai's mainland or in a Dubai free zone that is not the DIFC, VARA is your licensing authority for VA Activities.

SCA → CMA, the federal layer

The federal layer is now the Capital Markets Authority, formerly the SCA. It retains a remit over digital securities and digital commodities across onshore UAE, and onshore VASPs may need both a local authority license and federal approval before commencing full market operations. The CMA is not an alternative to VARA so much as a federal umbrella over it: VARA's authority flows down from the federal level under Cabinet Decisions 111 and 112 of 2022.

ADGM / FSRA: Abu Dhabi's separate digital-asset framework

Abu Dhabi Global Market runs its own digital-asset regime through the Financial Services Regulatory Authority (FSRA), entirely separate from VARA. The ADGM/FSRA framework covers Virtual Assets (broker-dealer, custody, exchange, asset management and proposed staking) and Fiat-Referenced Tokens, with around 20+ regulated VA/FRT firms and FRT rules effective 1 January 2026. A firm incorporated in ADGM is licensed by the FSRA, not VARA. For founders weighing Dubai against Abu Dhabi, the choice is driven largely by where you incorporate, and how each regime treats your specific activity.

DIFC / DFSA: the Dubai financial-centre carve-out

The Dubai International Financial Centre is a common-law financial free zone inside Dubai, but it is carved out of VARA's jurisdiction and regulated by the DFSA. The DFSA's Crypto Token regime was first introduced in 2022, with updated rules in force from 12 January 2026 under which firms now self-assess token suitability rather than relying on a regulator-published recognised-token list. A firm in the DIFC answers to the DFSA, full stop, even though it shares the Dubai postcode with VARA-regulated firms.

Which UAE regulator should you choose?

There is no single passport across the UAE the way MiCA offers one across the EU, so the choice comes down to where you incorporate and what you do. As a rule of thumb, VARA licenses firms in Dubai outside the DIFC, ADGM/FSRA is the Abu Dhabi route, and the DIFC's DFSA governs firms inside the DIFC. The federal CMA layer sits above onshore activity. Custody plans must account for VARA's standalone-entity rule. Because the lanes do not overlap cleanly and the federal overlay adds nuance, this is the decision most worth getting right before you spend on incorporation. It is also where comparing Dubai with peer jurisdictions such as Switzerland FINMA crypto licensing or Bahrain CBB crypto licensing pays off, since the best regulator depends on your model, not on brand prestige alone.

VARA License Requirements at a Glance

VARA's substance and governance expectations are demanding, in line with its gold-standard positioning. The list below is an overview; the exact per-activity capital and fee figures live on the dedicated VARA license cost, requirements and process page.

• A Dubai-incorporated legal entity (mainland or permitted free zone such as DWTC).
• A physical office in Dubai with a lease agreement.
• At least two full-time, UAE-resident Responsible Individuals meeting "Fit and Proper" criteria.
• An appointed Compliance Officer and an AML/CFT officer (MLRO).
• Comprehensive governance, risk, AML/CFT and cybersecurity policies.
• Activity-dependent paid-up capital plus an expense-based floor, commonly cited at around 1.2 times monthly operating expenses (overview only).

Local entity, physical office and substance

VARA expects real substance in Dubai, not a nameplate. Applicants need a Dubai-incorporated legal entity, formed on the mainland or in a permitted free zone such as the Dubai World Trade Centre (DWTC), together with a physical office in Dubai and a lease agreement. This substance requirement is established during Stage 1 (Initial Approval) and tested again at Stage 2, so it should be planned and budgeted from the outset rather than treated as a last-minute formality.

Governance, fit-and-proper and AML/CFT roles

On governance, VARA requires at least two full-time, UAE-resident Responsible Individuals who meet "Fit and Proper" criteria, an appointed Compliance Officer and an AML/CFT officer (MLRO), plus a full suite of governance, risk, AML/CFT and cybersecurity policies. The AML/CFT regime sits in Part VI of the Regulations and is described by VARA as "gold-standard". If you are mapping a broader anti-money-laundering programme, our guide to crypto AML and KYC compliance sets out the wider framework that VARA's Part VI plugs into.

Capital requirements (overview)

Capital under VARA is activity-dependent. Each licensed activity carries its own minimum paid-up capital, and on top of that there is an expense-based floor, commonly cited at around 1.2 times monthly operating expenses. We keep the exact per-activity figures off this overview deliberately, because they move with the rulebook and depend on your specific activity mix. For the detailed numbers, see the dedicated VARA license cost, requirements and process page.

How Much Does a VARA License Cost?

VARA application fees and per-activity capital depend on the activities you apply for, so there is no single headline figure that fits every applicant. Custody, exchange and issuance carry different capital expectations from advisory or broker-dealer activity, and the expense-based floor scales with your running costs. Rather than print figures that may be out of date or that do not match your model, we maintain a dedicated page with the current breakdown. See VARA license cost, requirements and process for fees, per-activity capital and the full process detail, and read it alongside this overview so the numbers sit in context.

Why Work With Crypto Valley Partners on Your VARA Application

Crypto Valley Partners AG is a Swiss advisory firm based in Zug, the heart of Europe's "Crypto Valley," and we help founders and operators navigate exactly the kind of multi-regulator map the UAE presents. From our practice, the part of a VARA application that derails timelines is rarely the headline license itself. It is the structural choices made too late: realising custody needs a standalone entity after the group is already incorporated, discovering the federal-approval overlay after Stage 2, or building substance that does not match the activities applied for.

We work the problem in the order VARA does. First we confirm the right lane in the UAE map, VARA, ADGM/FSRA, DIFC/DFSA, or a federal route, against your model. Then we structure the entity (and any separate custody vehicle) before incorporation, line up the resident Responsible Individuals and compliance officers, and prepare the policy suite the Full VASP Licence stage will test. Our work is led and reviewed by Magnus Müller, our founder and crypto-licensing expert. Because we also advise across Switzerland, the EU under MiCA and other jurisdictions, we can tell you honestly when Dubai is the right answer and when it is not. The same discipline applies to becoming a licensed VASP or starting a licensed crypto exchange anywhere on the global crypto licensing map.

By Magnus Müller · Reviewed by Magnus Müller · Last updated: 2026-06-14