Dubai VARA VASP License

The Dubai Virtual Assets Regulatory Authority (VARA) is the world's first regulatory body established exclusively for virtual assets. Created under Dubai Law No. 4 of 2022, VARA has jurisdiction over all virtual asset activities conducted in or from the Emirate of Dubai — excluding the Dubai International Financial Centre (DIFC), which operates under its own separate framework. Since the Virtual Assets and Related Activities Regulations 2023 came into force on 7 February 2023, any firm seeking to provide virtual asset services in Dubai must hold a VARA VASP License before commencing operations.

As of 2026, prominent global operators including Binance, OKX, Bybit, Crypto.com, and Backpack.Exchange hold VARA licenses — demonstrating that the framework is both commercially serious and internationally recognised. VARA's rulebook-based architecture is frequently compared in rigor to the EU's MiCA regulation and in some respects exceeds it in its requirements around custody segregation, market abuse monitoring, and real-time STR reporting.

The Seven VARA Activity Categories

A VARA VASP License is activity-based. Applicants must specify which of the seven regulated activity categories they intend to operate, and each activity carries its own rulebook, capital requirement, and compliance obligations. Multiple activities can be covered under a single license — with the important exception that Custody Services must always be held in a separate legal entity with its own dedicated VARA license.

1. VA Advisory Services — providing advice on buying, selling, or investing in virtual assets. Minimum paid-up capital: AED 100,000. Annual supervision fee from USD 17,400.

2. VA Broker-Dealer Services — soliciting, matching, and executing orders for clients in virtual assets. Capital: AED 400,000–600,000+. Annual supervision fee from USD 17,400.

3. VA Custody Services — safekeeping and administration of client virtual assets. Capital: AED 4,000,000. Must be a separate licensed entity. Annual supervision fee from USD 21,350.

4. VA Exchange Services — operating a platform matching buyers and sellers of virtual assets. Capital: AED 800,000 (using VARA-licensed custodian) or AED 1,500,000 (other cases), or a percentage of fixed annual overheads — whichever is higher. Annual supervision fee from USD 21,350.

5. VA Lending and Borrowing Services — facilitating lending and borrowing of virtual assets. Annual supervision fee from USD 17,400.

6. VA Management and Investment Services — discretionary management of virtual asset portfolios. Annual supervision fee from USD 21,350.

7. VA Transfer and Settlement Services — facilitating the transfer of virtual assets between parties or platforms.

For firms seeking multiple activities, capital requirements are cumulative. A firm applying for Broker-Dealer, Custody, and Exchange simultaneously must be prepared for a total capital commitment that can exceed AED 10 million. Capital must be maintained in a UAE-based bank trust account or as a surety bond at all times.

The Two-Stage Licensing Process

VARA licensing proceeds in two mandatory stages. Stage 1 is the Approval to Incorporate (ATI), and Stage 2 is the Full VASP License.

Stage 1 — ATI: The applicant submits an Initial Disclosure Questionnaire (IDQ) through Dubai Economy and Tourism (DET) for mainland entities, or through the relevant Dubai Free Zone Authority (FZA) for free zone entities. The IDQ includes a comprehensive regulatory business plan, details of beneficial owners and senior management, and the initial application fee (50% of the total license fee). VARA reviews operational readiness, governance structure, and compliance framework. If approved, the ATI is issued — but the firm is not yet permitted to conduct virtual asset activities.

Stage 2 — Full VASP License: Following ATI, the applicant finalizes legal incorporation, secures a physical office lease, completes all policy documentation, passes a technology and cybersecurity assessment, and pays the remaining 50% of the license fee. VARA issues the Full VASP License upon satisfaction of all operational requirements. The license is valid for one year and must be renewed annually.

The total timeline from IDQ submission to Full VASP License is typically 4 to 7 months, depending on the complexity of the business model and completeness of documentation at submission.

Key Requirements

• •Legal entity in Dubai — mainland (via DET) or a Dubai free zone (excluding DIFC). The commercial licensor (DET or FZ) processes the initial IDQ before VARA assessment
• •Physical office in Dubai — a private office is required. There is no minimum size requirement from VARA, but the commercial licensor may have space requirements based on headcount
• •Qualified management team — fit and proper assessment for all beneficial owners, directors, and senior management. Custody services require at least one independent director
• •AML/CFT framework — full compliance with UAE AML/CFT legislation plus VARA's Compliance and Risk Management Rulebook. STRs must be filed in near real-time through the goAML portal with a 48-hour response window to regulator queries
• •Technology and cybersecurity — penetration testing, cybersecurity infrastructure assessment, incident response plan, and ongoing cyber resilience demonstration required at application and ongoing
• •Four mandatory rulebooks — all VASPs must comply with the Company Rulebook, Compliance and Risk Management Rulebook, Technology and Information Rulebook, and Market Conduct Rulebook, regardless of activity
• •Activity-specific rulebooks — one additional rulebook per licensed activity category
• •Privacy coins prohibited — issuance of and all activities related to anonymity-enhanced cryptocurrencies are strictly prohibited
• •Marketing restriction — since October 2024, only VARA-licensed VASPs may market virtual asset activities in or targeting Dubai. Unlicensed marketing is a regulatory violation

VARA's 2025 Rulebook Updates

In May 2025, VARA updated its existing activity rulebooks and issued a new rulebook specifically covering Virtual Asset Issuance. The updates intensified focus on market abuse prevention, introducing more explicit requirements around cross-platform collusion typologies and requiring VASPs to integrate on-chain and off-chain signals into a unified client behaviour monitoring framework. Near real-time STR submission requirements were formalized, and the 48-hour response time to VARA queries was codified. These 2025 updates have been broadly welcomed by the market as providing further regulatory clarity, though they increase the compliance infrastructure requirements for smaller operators.

Dubai vs. Other Virtual Asset Jurisdictions

VARA occupies a distinct position relative to other crypto-friendly jurisdictions. Compared to the BVI VASP Act or Cayman Islands CIMA framework, VARA has significantly higher capital requirements and a more demanding ongoing compliance burden — but also carries substantially greater institutional credibility and access to the UAE banking infrastructure. Compared to EU MiCA, VARA's framework is activity-specific and arguably more granular in its technology and market conduct requirements, while offering the geographic and tax advantages of Dubai. For operators targeting the GCC and Middle East market, VARA is the only framework that provides regulatory standing within the Emirate of Dubai itself.

How Zitadelle AG Assists

Zitadelle AG assists clients with the full VARA licensing process — from initial scoping of the activity categories appropriate for the business model through IDQ preparation, regulatory business plan drafting, AML/CFT policy development, technology framework documentation, and VARA application management. Our team works with the relevant free zone authority or DET on the commercial licensing dimension alongside the VARA regulatory application.