VARA Licensing in Dubai: A Practical Guide

Any firm carrying on a regulated virtual asset activity in or from Dubai, including its free zones but not the Dubai International Financial Centre (DIFC), needs a license from the Virtual Assets Regulatory Authority (VARA) first. New firms apply in two stages through Dubai Economy and Tourism (DET) or their free zone: first an Approval to Incorporate, then the full Virtual Asset Service Provider (VASP) license, issued under Dubai Law No. 4 of 2022, the Virtual Assets and Related Activities Regulations 2023 and VARA's rulebooks.

Current as of October 2026.

Who Needs a VARA License?

VARA's Licensed Activities page lists eight regulated activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and Category 1 VA Issuance.

Under Regulation III.A.2, an activity needs a license when it is carried out "by way of business": VARA looks at whether the firm holds itself out as doing it, its regularity and scale, and any commercial element such as fees. VARA also states that "no virtual asset activity is 'exempt'".

A few positions sit outside the full license:

• Professional exemption. Lawyers, accountants and licensed business consultants whose virtual asset activity is "wholly incidental" to their practice do not need a license (Regulation IV.A.5).
• Proprietary trading. Trading only your own money needs a No Objection Certificate, not a license (Licensed Activities). An entity investing USD 250 million or more of its own virtual assets in any rolling 30 days must also register with VARA, before reaching that level or within three working days (Regulation IV.A.7).
• Token issuance. The Virtual Asset Issuance Rulebook splits issuance into three categories:
  • Category 1: fiat-referenced and asset-referenced virtual assets, and any other token VARA designates. These need a VARA license.
  • Category 2: any other non-exempt token. Under Rule I.E.2 it needs no license or prior approval if a "Licensed Distributor", meaning a VARA-licensed Broker-Dealer, handles all placement and distribution. VARA's FAQ and Licensed Activities page still describe an older Category 2 approval form; check with VARA.
  • Exempt VAs: non-transferable and redeemable closed-loop tokens.

All non-exempt issuers must publish a whitepaper and a risk disclosure statement before any offer or marketing.

Does VARA Regulate All of Dubai and the Rest of the UAE?

No. The Regulations define "Emirate" as "all zones across the Emirate of Dubai, including Special Development Zones and Free Zones but excluding the Dubai International Financial Centre".

Three other regulators share the rest of the UAE:

• Federal level: the Capital Market Authority (CMA), formerly the Securities and Commodities Authority, issued a Virtual Assets Framework on 13 April 2026 with five modules and eight regulated activities (CMA). Firms on VARA's Public Register also carry a CMA registration number; confirm with both regulators what it permits before serving clients elsewhere in the UAE.
• DIFC: the Dubai Financial Services Authority (DFSA) runs its own Crypto Token regime. On 12 January 2026 it moved to firm-led suitability assessments and dropped its list of Recognised Crypto Tokens (Government of Dubai Media Office).
• ADGM (Abu Dhabi): the Financial Services Regulatory Authority (FSRA) regulates virtual asset activities. On 10 June 2025 it changed how tokens become Accepted Virtual Assets (WAM report via Aletihad).

Federal rules still apply inside Dubai. Under Annex 1 of the Issuance Rulebook, an AED-referenced stablecoin stays with the Central Bank of the UAE (CBUAE), not VARA. Fiat-backed payment token services also need CBUAE registration under its Payment Token Services Regulation, with a grace period that ended on 20 August 2025 (VARA circular, 23 July 2025).

What Are the Stages of a VARA License Application?

VARA's Licence Applications page sets out two stages for new firms.

Stage 1: Approval to Incorporate (ATI). The firm submits an Initial Disclosure Questionnaire to DET or its free zone, then further documents (including a business plan and details of its beneficial owners and senior management) and the initial fees ("typically 50% of the licence application fee"). The ATI lets it incorporate and set up office, staff and systems, but not carry on virtual asset activities.

Stage 2: VASP license. VARA reviews further documents and gives feedback, "which may include meetings, interviews, and submission of further documentation". The firm pays the remaining application fee and the first year's supervision fee, and receives a license "which may be subject to operational conditions". VARA's Public Register also lists In-Principle Approval holders, "a conditional step in the licensing process"; they may not start operations or serve clients.

The license is renewed every 12 months, with notice 90 days ahead (FAQ). Applicants must be a legal entity set up with DET or a free zone (LLC or FZ-CO preferred; no sole proprietorships). VARA requires a physical presence in Dubai, and every activity except Advisory needs a private office. Firms operating before 7 February 2023 follow a separate legacy route.

Which VARA Rulebooks Apply to Your Firm?

Part V of the Regulations requires every VASP to comply with four compulsory rulebooks, plus the rulebook for each activity it is licensed for (VARA rulebooks index):

• Company Rulebook: ownership, governance, fit and proper tests, outsourcing, capital and wind-down, including two full-time, VARA-approved Responsible Individuals who are UAE residents or passport holders, and governance disclosure for complex structures such as DAOs.
• Compliance and Risk Management Rulebook: a Compliance Officer with five years' compliance experience who lives in the UAE (or holds a UAE passport) and reports to the board; a Money Laundering Reporting Officer with two years' AML/CFT experience; client asset rules; and the FATF Travel Rule, which applicants must show they meet during licensing.
• Technology and Information Rulebook: cybersecurity, key and wallet management, and a Chief Information Security Officer who is not the Compliance Officer. It also requires independent third-party vulnerability assessments and penetration tests, including smart contract audits where relevant, at least once a year and before any new system, application or product goes live.
• Market Conduct Rulebook: client agreements, complaints, investor classification, public disclosures and the own-account trading ban. Its Part IV Qualified Investor test for individuals is relevant knowledge plus net assets of at least AED 3.5 million (excluding the main residence) and/or annual income of AED 700,000. A January 2026 circular adds that only clients who pass a suitability assessment qualify (VARA circular, 8 January 2026).

VARA's Version 2.0 rulebooks (19 May 2025) tightened margin trading and token distribution controls (VARA announcement). The Exchange Services Rulebook changed again from 31 March 2026: a new Part V lets an exchange offer exchange-traded derivatives only if its license expressly authorizes them (Exchange Services Rulebook).

Federal Decree-Law No. 10 of 2025 on AML/CFT took effect on 14 October 2025, and VARA required a clause-by-clause gap assessment against it (VARA circular, 24 November 2025). Its Executive Regulations, Cabinet Resolution No. 134 of 2025, followed on 14 December 2025; VARA expects proliferation-financing risk assessment, due diligence on occasional transactions of AED 3,500 or more, and eight-year record keeping (VARA circular, 4 March 2026).

How Much Does a VARA License Cost, and How Much Capital Is Needed?

Schedule 2 of the Regulations sets the fees. The application fee is AED 40,000 for Advisory or Transfer and Settlement and AED 100,000 for each of the other six activities. The annual supervision fee is AED 80,000 or AED 200,000 per activity. Each additional activity costs 50% of the lower application fee. Fees are not refunded "if an application is denied or withdrawn" (Regulation IV.B.4).

Part VI of the Company Rulebook sets paid-up capital per activity: AED 100,000 for Advisory; for Exchange Services, the higher of AED 1.5 million or 25% of fixed annual overheads, or AED 800,000 or 15% when it uses a VARA-licensed custodian. Capital is held in a UAE bank trust account or a surety bond with VARA as beneficiary. Firms must also:

• keep net liquid assets of at least 1.2 times monthly operating expenses;
• hold professional indemnity, directors' and officers', and crime cover for assets in hot wallets;
• hold reserve assets equal to 100% of what they owe clients, one-to-one in the same virtual asset, with an independent audit at least every six months. A 6 October 2026 circular sets that audit's minimum scope: every wallet and custodian, daily reconciliation and any rehypothecation (VARA circular).

How Do VARA's Marketing Rules Apply?

The Regulations on the Marketing of Virtual Assets and Related Activities 2024, in force since 1 October 2024, apply to every entity marketing in or targeting the UAE, licensed or not. "Marketing" includes social posts, podcasts, events, airdrops and educational content.

• Marketing of a VA activity must come from, or be approved by, a VASP licensed for that activity.
• Token marketing carries a prominent warning that virtual assets "may lose their value in full or in part".
• No call to buy, no claims of safety or guaranteed returns, and no urgency.
• Paid promotions are labeled, and the firm that hires an agency or influencer stays responsible for the content.
• Fines reach AED 10 million (Schedule 1).

In October 2025 VARA fined 19 firms between AED 100,000 and AED 600,000 for unlicensed activity and marketing breaches (VARA enforcement notice).

Where Do VARA Applications Stall?

VARA publishes no data on refusals or delays, but its requirements show where preparation is heaviest:

1. Wrong activity scope. VARA licenses each activity separately and can refuse an ATI when activities "fall outside the regulatory perimeter". Custody needs its own licensed entity, and proprietary trading a separate company (Licensed Activities).
2. People. The Responsible Individuals and Compliance Officer must clear the residency rule and VARA's fit and proper review; the CISO cannot be the Compliance Officer.
3. The document set. VARA's application document list includes a regulatory business plan, financial projections, source-of-funds evidence, proof of paid-up capital, a reserve account report, insurance certificates, a succession plan and a wind-down plan.
4. Token disclosures. Schedule 1 of the Issuance Rulebook requires the whitepaper to state the number of tokens, the issuance schedule and allocations to the issuer, investors and advisors; a missing applicable item makes it non-compliant. A tokenomics audit with a regulatory classification check is one way to test these disclosures before filing.

Relocating to Dubai does not by itself make a launch compliant, as covered in why crypto projects collapse after TGE. Blockphrase checks token designs against MiCA, VARA, RBI and SEBI requirements before launch as part of its regulatory advisory work. Annex 2 of the Issuance Rulebook also governs asset-referenced tokens, which matters for RWA tokenization structures issued from Dubai.

Frequently Asked Questions

Does a token issuer need a VARA license to launch a token in Dubai?

Only for Category 1 tokens: fiat-referenced or asset-referenced virtual assets, or others VARA designates. Other non-exempt tokens are Category 2. Under Issuance Rulebook Rule I.E.2, in force since 19 June 2025, they need no license or prior approval if a VARA-licensed Broker-Dealer handles all placement and distribution. VARA's FAQ still describes a prior-approval form, so confirm with VARA.

Does a VARA license cover the DIFC or Abu Dhabi's ADGM?

No. VARA's rules apply across Dubai's mainland, free zones and Special Development Zones, but not the DIFC. Crypto activity in the DIFC falls under the Dubai Financial Services Authority's Crypto Token regime. In ADGM, the Financial Services Regulatory Authority regulates virtual asset activities.

Which roles in a VARA-licensed firm have UAE residency requirements?

The two Responsible Individuals and the Compliance Officer. Each must be a full-time employee, pass VARA's fit and proper review, and live in the UAE or hold a UAE passport. The Compliance Officer also needs five years of compliance experience. The Money Laundering Reporting Officer needs at least two years of AML/CFT experience.

Are VARA license application fees refunded if an application fails?

No. Regulation IV.B.4 says no fees are refunded if an application is denied or withdrawn. The application fee is AED 40,000 or AED 100,000 for the first activity, plus 50% of the lower fee per further activity. VARA's Licence Applications page says new firms typically pay half at the Approval to Incorporate stage and the rest before licensing.

Can a VARA-licensed exchange also offer custody or proprietary trading?

Not from the same company. Custody is the only VARA activity that has to be set up as a separate legal entity with its own license. Licensed VASPs may not trade for their own account or their group's portfolio, so proprietary trading needs a separate company holding a VARA No Objection Certificate.

Sources

This guide is general information, not legal advice. Rules and regulator guidance change; check the primary sources below before acting.

• VARA: Licence Applications
• VARA: Licensed Activities
• VARA: Virtual Assets and Related Activities Regulations 2023
• VARA: Rulebooks
• VARA: Company Rulebook
• VARA: Compliance and Risk Management Rulebook
• VARA: Technology and Information Rulebook
• VARA: Exchange Services Rulebook
• VARA: Market Conduct Rulebook
• VARA: Virtual Asset Issuance Rulebook
• VARA: Regulations on the Marketing of Virtual Assets and Related Activities 2024
• VARA: Frequently Asked Questions
• VARA: Public Register
• VARA: VARA Issues Updated Activity Rulebooks to Strengthen Market Integrity and Risk Oversight (19 May 2025)
• VARA: Steps Up Enforcement, 19 Unlicensed Firms Penalised (7 October 2025)
• VARA: Circular on Compliance with CBUAE PTSR (23 July 2025)
• VARA: Circular on Federal Decree-Law No. 10 of 2025 and Mandatory Gap Assessment (24 November 2025)
• VARA: Circular on Implementation of the UAE AML/CFT and Proliferation Financing Requirements Applicable to VASPs (4 March 2026)
• VARA: Circular on Onboarding and Classification of Qualified Investors (8 January 2026)
• VARA: Circular on Reserve Assets Audit Report (6 October 2026)
• Capital Market Authority: The CMA Issues the Virtual Assets Framework (13 April 2026)
• Government of Dubai Media Office: The DFSA Implements Major Updates to Crypto Token Regulatory Framework (12 January 2026)
• Aletihad (WAM): ADGM FSRA Implements Amendments to Its Digital Asset Regulatory Framework (10 June 2025)