VARA licensing in Dubai: what virtual asset businesses need to know

If you want to run an exchange, a brokerage, a custody service or any other virtual asset business in Dubai, you need a licence from the Virtual Assets Regulatory Authority (VARA) before you serve a single client. That applies on the mainland and in every Dubai free zone except the DIFC. The application goes through your commercial licensor in two stages, and VARA sets the fees, the capital you must hold and the people you must hire.

This guide is general information, not legal or investment advice. Almahira is not a virtual asset service provider and does not provide regulated financial services. We help founders with company setup and build the technology, working alongside their legal advisers.

Do you need a VARA licence?

VARA was set up under Dubai Law No. 4 of 2022. Its FAQ is direct: no virtual asset activity is exempt from supervision, and each one needs a VARA licence, a registration or a No Objection Certificate. Licensed firms need a physical presence in Dubai, and every activity except advisory requires a private office; VARA sets no minimum size, so check space rules with your licensor and our guide to office requirements and flexi-desks.

The FAQ also covers a few boundary cases:

• Trading your own money. Proprietary trading needs no licence, but it does need a VARA No Objection Certificate, and registration once your rolling 30-day trading volume passes AED 1 billion.
• NFT marketplaces. These need an exchange licence, a broker-dealer licence or both, depending on what they do.
• Metaverse businesses. Generally not licensed, unless they carry on a regulated virtual asset activity.

Location matters as much as activity. The DIFC has its own regulator, the DFSA, as does ADGM in Abu Dhabi, the FSRA. Onshore activity in the other emirates falls to the federal Capital Market Authority. Our guide to who regulates what in UAE finance sets out the full map.

The eight activities VARA licenses

Each activity is licensed separately, and you apply for each one explicitly:

1. Advisory services
2. Broker-dealer services
3. Custody services
4. Exchange services
5. Lending and borrowing services
6. VA management and investment services
7. VA transfer and settlement services
8. VA issuance (Category 1)

Custody has to sit in its own legal entity with a standalone licence. Category 2 token issuances, such as new token releases or NFT minting, are not a licensed activity, but they need VARA's approval. VARA's public register now also flags exchange licences that include exchange-traded derivative services.

Map your product to these definitions before you build. A wallet app that only shows balances is a different proposition from one that moves client assets, and adding a swap or payout feature can bring a product into broker-dealer or transfer territory. Every activity you add brings its own fee, capital requirement and rulebook.

How the application works

You don't apply to VARA directly. The file goes through the Department of Economy and Tourism (DET) for mainland firms, or through your Dubai free zone, and VARA reviews it in two stages.

1. Initial Disclosure Questionnaire. Submit the IDQ to DET or the free zone, with a business plan and details of your beneficial owners and senior management.
2. First payment. Pay the initial fee, typically 50% of the licence application fee, so the review can start.
3. Approval to Incorporate (ATI). If VARA is satisfied, it issues an ATI. You can now incorporate the company, rent an office and hire staff, but you may not carry on any virtual asset activity.
4. Licence application. Submit the full document set: governance framework, compliance and risk policies, technology and security documentation, financial projections, proof of paid-up capital, insurance certificates and wind-down plans. Expect questions, meetings and interviews.
5. Remaining fees. Pay the balance of the licence fee and the first year's supervision fee.
6. VASP licence. VARA issues the licence, which may come with operational conditions.

The licence is annual, and VARA sends a renewal notice 90 days before it expires. VARA does not publish a standard processing time.

Fees and capital, as of October 2026

Fees are set in Schedule 2 of VARA's Virtual Assets and Related Activities Regulations 2023, and paid-up capital in Part VI of its Company Rulebook. For the most common activities:

Lending and borrowing, management and investment, and Category 1 issuance also carry the AED 100,000 application fee and AED 200,000 supervision fee. The table hides several details:

• Capital is "the higher of". For most activities the requirement is the higher of the fixed amount or 15% to 25% of your fixed annual overheads.
• The lowest floors need a licensed custodian. The AED 400,000 broker-dealer and AED 800,000 exchange figures, and AED 280,000 for management and investment, apply only if you use a VARA-licensed custodian or VARA approves another arrangement. Otherwise they rise to AED 600,000, AED 1.5 million and AED 500,000.
• Capital is held in a set way: a trust account with a UAE bank naming VARA as beneficiary, or a surety bond. You also need net liquid assets of at least 1.2 times your monthly operating expenses.
• Extra activities cost more. Each additional activity adds an extension fee of 50% of the lower application fee, plus its own supervision fee.
• Fees are not refunded if an application is refused or withdrawn, and VARA can charge higher supervision fees to riskier firms.

On top of this come professional indemnity, directors' and officers' and crime insurance, an annual external audit, and the cost of the company itself: the commercial licence, office and visas through DET or the free zone, which work like any other business setup in Dubai.

The people VARA expects you to hire

VARA assesses people as closely as business plans. Its rulebooks require:

• Two Responsible Individuals, senior enough to answer for the firm's compliance, employed full-time, approved by VARA as fit and proper, and resident in the UAE or holding a UAE passport.
• A Compliance Officer with at least five years of compliance experience, employed full-time, UAE-resident or a UAE passport holder, and reporting directly to the board.
• A Money Laundering Reporting Officer (MLRO) with at least two years of AML/CFT experience.
• A board and senior management with documented roles and a clear process for appointments.

One person can hold the compliance officer and MLRO roles together if that creates no conflict, which helps a small firm. The MLRO, the information security officer and the data protection officer (see our guide to the UAE data protection law) can be outsourced under conditions, although VARA encourages in-house appointments and can require them.

This is where many plans fail. A founder who means to run compliance from abroad, or to share one part-time officer across several companies, won't meet these rules. Recruit early: VARA approves these people individually, and replacing a Responsible Individual needs its prior approval.

What you can and can't say in marketing

VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024 have applied since 1 October 2024 to anyone marketing virtual assets in or targeting the UAE, licensed or not. The core rules:

• Only a VARA-licensed firm, or someone acting for it with its approval, may market a virtual asset activity.
• Marketing a virtual asset must include a prominent disclaimer that virtual assets may lose their value in full or in part and are subject to extreme volatility, and must state that investors can lose all the money they invest.
• You may not state or imply guaranteed returns, low risk or easy decisions, use past performance as a promise, or create urgency or fear of missing out.
• Paid promotions must be clearly labelled as paid, and influencers ("key opinion leaders") must follow the rules in full.
• Records of all marketing must be kept for eight years.

Fines go up to AED 10 million per violation and double for a repeat within a year. Unlicensed firms may market at physical events in Dubai only under strict conditions, including a disclaimer that they are not licensed by VARA and a ban on signing up UAE residents.

Where the federal regulator fits

Cabinet Decision No. 111 of 2022 made the federal securities regulator, then the Securities and Commodities Authority (SCA), responsible for virtual assets at federal level. A companion decision, No. 112 of 2022, delegates certain competencies, and VARA lists both among its governing laws alongside Dubai Law No. 4 of 2022. The SCA and VARA signed a cooperation agreement on 5 September 2024 covering joint licensing and oversight.

On 1 January 2026 the SCA became the Capital Market Authority (CMA). In April 2026 the CMA issued its own Virtual Assets Framework, with eight regulated activities under the federal regime. VARA's public register shows a CMA registration number for each licensed Dubai firm.

In practice, a Dubai business outside the DIFC applies to VARA. If you plan to serve clients across the UAE or set up in another emirate, ask your lawyer how the CMA framework applies before you settle on a structure.

Common mistakes

• Treating an approval as a licence. At ATI stage you can incorporate and hire, nothing more. VARA's register lists firms with In-Principle Approval separately and states that they may not operate or serve clients until fully licensed.
• Marketing too early. A launch campaign, an influencer post or a waitlist that hints at returns can breach the marketing rules before you hold a licence.
• Paying for "fast-track" access. VARA says it has no partnership with external consultancies for licence applications, and that no firm may claim a favourable relationship with it.
• Assuming the trade licence is enough. A DET or free zone licence is the commercial licence. It does not replace VARA's.
• Underfunding the first year. Model a full year with capital in trust, fees, insurance and a resident compliance team before you commit.

If you are on the other side, checking a firm before you deal with it, read our guide to checking whether a broker is regulated. If you are planning a virtual asset business, our blockchain and Web3 team can map your product against VARA's activities and build it alongside your lawyers.

Sources

• VARA: Licence applications and stages
• VARA: Frequently asked questions
• VARA Company Rulebook: governance, staff and capital
• VARA: Virtual Assets and Related Activities Regulations 2023, including fees
• VARA: Regulations on the Marketing of Virtual Assets and Related Activities 2024
• Capital Market Authority: Virtual Assets Framework announcement, April 2026