Dubai has done something no other jurisdiction has managed: built a purpose-built, standalone regulator entirely dedicated to virtual assets. The Virtual Assets Regulatory Authority — VARA — was established under Dubai Law No. 4 of 2022 and launched its Full Market Regulatory Regime in February 2023. Since then, it has become the global benchmark for crypto regulation and the primary reason Dubai attracts more regulated virtual asset businesses than any other city in the world.
If you want to operate a crypto exchange, custody service, broker-dealer, advisory firm, or any other virtual asset business in or from Dubai, a VARA VASP licence is not optional. This guide covers everything you need to know to obtain one in 2026: the licence categories, the two-stage application process, key requirements, and what ongoing compliance looks like once you are licensed.
What Is VARA and Who Does It Regulate?
VARA — the Virtual Assets Regulatory Authority — is the sole regulator of virtual asset activities across Dubai’s mainland and free zones. Its jurisdiction is defined by activity, not just geography: if your business conducts regulated virtual asset activities in or from Dubai, VARA’s rules apply to you, regardless of whether you are incorporated locally or overseas and targeting Dubai-based customers.
There is one important carve-out: the Dubai International Financial Centre (DIFC) operates under its own legal framework and its virtual asset businesses are regulated by the DFSA, not VARA. All other Dubai free zones — including DMCC, DAFZA, and Dubai South — fall squarely under VARA’s remit.
A crucial feature of the VARA framework that applicants often underestimate: VARA licences activities, not just companies. A single business offering VA exchange services and VA custody must be separately authorised for each activity and must meet the full requirements for both. There is no bundled licence that covers operating multiple services under a single approval.
VARA Licence Categories
VARA currently authorises seven categories of regulated virtual asset activity. Each has its own rulebook, capital requirements, and operational standards:
| Licence | What It Covers | Typical Business |
| VA Advisory | Personalised recommendations to clients on VA transactions | Crypto advisory firms, investment consultants |
| VA Broker-Dealer | Executing or facilitating client orders; dealing in VAs | OTC desks, institutional trading desks |
| VA Exchange | Operating a VA trading platform, order book, or conversion service | Centralised exchanges, spot trading platforms |
| VA Custody | Safeguarding or controlling client virtual assets and private keys | Custodians, prime brokers, wallet providers |
| VA Lending & Borrowing | Providing or facilitating VA-collateralised lending | Crypto lenders, yield platforms |
| VA Transfer & Settlement | Processing VA transfers and payment instructions | Payment processors, remittance platforms |
| VA Issuance | Issuing, offering, or listing virtual tokens — two VARA categories | Token issuers, IEO platforms, stablecoin issuers |
Proprietary trading firms — those trading only their own capital with no client involvement — may not require a full VASP licence, but must obtain a formal No-Objection Certificate (NOC) from VARA and remain subject to VARA’s reporting requirements.
The Two-Stage VARA Licensing Process
VARA licensing is a structured two-stage process. In 2026, expect the full journey from initial application to Full VASP Licence to take four to seven months. Complex applications — those involving multiple activities, novel business models, or extended Additional Information Request exchanges — can take longer.
Stage 1 — Initial Approval
- Step 1: Incorporate your company in Dubai through either the Department of Economy and Tourism (DET/mainland) or a freezone authority (excluding DIFC). Your company must have a genuine, leased physical office in Dubai — co-working spaces and flexi-desks are not accepted for most activity types.
- Step 2: Submit the Initial Disclosure Questionnaire (IDQ) through your chosen commercial licensor. The IDQ sets out your planned VA activities, business model, governance structure, and compliance approach. It is screened by the commercial licensor before being transferred to VARA for assessment.
- Step 3: VARA reviews the IDQ and, if satisfied, issues an In-Principle Approval (IPA). The IPA is permission to proceed to Stage 2 — it is not a licence to operate and does not authorise any client-facing VA activity.
Stage 2 — Full VASP Licence
- Step 4: Prepare and submit the full VASP licence application to VARA. This stage requires: a detailed Regulatory Business Plan; AML/CFT policies and procedures; governance and organisational structure documentation; technology and cybersecurity architecture; capital adequacy evidence; fit and proper assessments for all Responsible Individuals; and the signed office lease.
- Step 5: VARA conducts a detailed review. It is common for VARA to issue Additional Information Requests (AIRs) — applicants must respond comprehensively and promptly. VARA may also conduct on-site visits and management interviews.
- Step 6: Upon successful completion of the review, VARA issues the Full VASP Licence for each approved activity. Your business may now legally operate in or from Dubai.
Key Requirements for VARA Licensing
| Requirement | What VARA Expects |
| UAE legal entity | Incorporated through DET or a freezone (not DIFC) before the VARA application is submitted |
| Physical Dubai office | A genuine leased office — no minimum size, but it must be a real, dedicated business space |
| Responsible Individuals (RIs) | Two RIs must be full-time UAE-resident employees, each passing VARA’s Fit and Proper assessment covering competence, integrity, and financial soundness |
| Compliance Officer / MLRO | A qualified Compliance Officer and Money Laundering Reporting Officer — these roles can be combined in smaller firms |
| Paid-up capital | Minimum capital requirements apply and vary by activity type. Exchange and custody businesses face higher thresholds. All capital must be held in a UAE-bank trust account or surety bond with VARA (via CARA) as beneficiary |
| Nationality | No nationality restrictions on applicants — applications must be made on behalf of a UAE-incorporated entity |
Ongoing Compliance: Life as a Licensed VASP
A VARA licence is not a one-time approval — it is the entry ticket to a continuous compliance programme. Licensed VASPs must maintain all of the following on an ongoing basis:
- AML/CFT controls: robust KYC onboarding, transaction monitoring, and Suspicious Activity Report (SAR) filing with UAE financial intelligence authorities at all times.
- Travel Rule: for VA transfers exceeding AED 40,000 in a single transaction, VASPs must collect and transmit originator and beneficiary information to the receiving VASP — in line with FATF standards.
- Client asset segregation: custody and exchange businesses must strictly separate client assets from company funds. Commingling is a serious regulatory breach.
- Technology and cybersecurity: ongoing compliance with VARA’s Technology Rulebook, including regular security audits, penetration testing, and mandatory incident reporting.
- Marketing compliance: all VA-related marketing materials must comply with VARA’s Marketing Rulebook — mandatory risk disclosures, prohibition on misleading claims, and pre-approval requirements for certain campaign types.
- Regulatory reporting: periodic financial and operational reports to VARA; immediate notification of material events including breaches, key personnel changes, or business model changes.
- Annual supervision: VARA may conduct inspections and request information at any time. Enforcement actions, licence suspensions, and public sanctions have been issued since the regime launched — compliance is a core operational function, not a background one.
VARA, ADGM, or DIFC — Which Jurisdiction Is Right?
For businesses in the digital asset space, three Dubai/UAE jurisdictions are relevant. The right choice depends on your target market, business model, and investor base:
- VARA (Dubai mainland / freezones) is the right choice for businesses seeking broad retail and institutional market access in Dubai, operating exchanges or high-volume platforms, or wanting the prestige of the world’s most recognised VA-specific regulatory brand.
- ADGM (Abu Dhabi) via the FSRA is often preferred by digital asset funds, family offices, and institutional-grade businesses that value ADGM’s English common law framework and proximity to Abu Dhabi’s sovereign wealth ecosystem. ADGM also operates a regulatory sandbox for fintech and digital asset innovation.
- DIFC (Dubai) via the DFSA suits businesses with a hybrid traditional finance and digital asset model — particularly those already embedded in DIFC’s established banking and asset management community.
For a detailed side-by-side analysis of the two financial centre options, read our full DIFC vs ADGM guide.
Start Your VARA Licence Application with Rosemont
Dubai’s virtual asset regulatory framework is one of the most advanced and demanding in the world. A successful VARA application requires careful corporate structuring, detailed compliance documentation, and experienced management of the two-stage review process from IDQ submission through to Full VASP Licence issuance.
Rosemont works with crypto founders, Web3 businesses, and digital asset firms to structure and manage the full VARA licensing journey. We coordinate VARA licensing with wider corporate structuring, tax planning, and banking introductions — ensuring your Dubai operation is built for the long term from day one.
Contact Rosemont today for a confidential consultation on obtaining your VARA licence in Dubai.
