VARA Licence in Dubai

For platforms that facilitate crypto trading, exchange operations, or crypto-to-fiat / crypto-to-crypto transactions.

For businesses that arrange or execute virtual asset transactions for clients, including high-volume or institutional trading models.

For companies that safeguard virtual assets, private keys, or other client access mechanisms.

For businesses that move, settle or facilitate transfers of virtual assets between users, wallets or counterparties.

For projects that provide or facilitate virtual asset lending, borrowing or similar financial structures.

For companies managing virtual asset portfolios, investment strategies, or client assets.

For businesses that provide regulated advice on virtual assets, investment decisions, or market activity.

• For projects that plan to issue virtual assets requiring approval under VARA’s regulatory framework.
• Dubai is less suitable for projects looking for a simplified registration model without physical presence, local substance, compliance infrastructure, and readiness for ongoing supervision.

The applicant must be incorporated in mainland Dubai or through a relevant Dubai free zone authority.

VARA must be able to identify the full ownership chain, Ultimate Beneficial Owners, control structure, and voting rights.

The company must clearly define the roles, powers, responsibilities, and reporting lines of the Board and Senior Management.

Board members and key persons must satisfy VARA’s fit-and-proper requirements and may be subject to approval and annual assessment.

A VASP must maintain a real physical presence in Dubai to carry out licensed Virtual Asset Activities.

A private office is mandatory for most regulated activities, including exchange, custody, broker-dealer, transfer, lending, asset management, and Category 1 VA issuance.

Trusts, nominee arrangements, DAOs or other complex governance models must be explained to VARA, including how regulatory compliance will be ensured.

Changes to ownership, control, governance or the business model may require VARA’s prior written approval.

In addition to official VARA fees and paid-up capital, the company must budget for office premises, employees, compliance, audit, insurance, cybersecurity, legal support and regulatory reporting.

A VASP may carry out only those Virtual Asset Activities that are expressly authorized in its VARA License. Any activity outside the approved scope may require additional approval or a license amendment.

The MLRO is responsible for AML/CFT matters and must have relevant experience in anti-money laundering, financial crime prevention and regulatory reporting.

Obtaining a VARA License does not guarantee access to bank accounts, payment providers, liquidity providers, or cooperation from custodians. Each financial partner will conduct its own due diligence.

Changes to the business model, ownership structure, control arrangements, organizational setup or licensed activities may require VARA’s prior approval.

After licensing, the company remains subject to VARA supervision, annual renewal, reporting duties and continuous compliance with applicable Rulebooks.

Marketing of virtual assets in Dubai or to the UAE market must comply with VARA’s marketing regulations. Breaches may lead to fines, restrictions or other regulatory measures.

A VARA License does not replace licenses or registrations required in other jurisdictions. If the company serves clients outside Dubai, local rules in those markets must also be assessed.

• Dubai is not the best option for projects that do not plan to maintain local substance, an office, compliance infrastructure, and a real operational presence.
• The main risk is entering the VARA process without proper preparation. A strong business model, a clear ownership structure, a realistic budget, complete documentation, and a compliance-ready team are critical to reducing delays and regulatory objections.

Manimama analyses the business model, planned services, client flow, asset flow and target markets to determine which Virtual Asset Activities may require VARA authorization.

The applicant prepares and submits the Initial Disclosure Questionnaire, business plan, ownership information, UBO details, and information on Senior Management.

At this stage, the applicant usually pays 50% of the License Application Fee. The Approval to Incorporate allows the company to proceed with incorporation, office leasing, hiring, and operational setup, but does not yet allow regulated activity.

The legal entity is incorporated through Dubai Economy and Tourism or the relevant Dubai free zone authority, depending on the selected structure and business model.

The company submits the full regulatory package, including corporate, financial, AML/CFT, compliance, risk management, technology, and activity-specific documents.

VARA may ask additional questions, request clarifications, review documents, hold meetings or interviews, and assess whether the applicant meets the required regulatory standards.

After the assessment stage, the applicant pays the outstanding balance of the License Application Fee and the Annual Supervision Fee for the first year.

• If VARA is satisfied with the application, the VASP License is issued. The License may include specific operating conditions, restrictions, or activity-related requirements.
• The official VARA fees do not include company incorporation costs, office expenses, personnel, compliance, audit, cybersecurity, insurance, banking or other operational costs required to maintain a licensed business in Dubai.

The minimum paid-up capital starts from AED 100,000 for Advisory Services.

For activities such as Exchange Services, Broker-Dealer Services, or VA Management and Investment Services, the capital requirement may be higher and can depend on annual fixed overheads.

The official License Application Fee starts from AED 40,000 for Advisory Services and VA Transfer and Settlement Services.

The Annual Supervision Fee starts from AED 80,000 and is payable for each licensed Virtual Asset Activity.

For Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment Services, and Category 1 VA Issuance, the License Application Fee is generally AED 100,000, and the Annual Supervision Fee is AED 200,000.

If the application covers multiple activities, an additional License Extension Fee may apply to each additional activity.

The VASP must maintain Net Liquid Assets equal to at least 1.2 times its monthly operating expenses.

The company must maintain appropriate insurance, which may include professional indemnity, directors’ and officers’ liability, and commercial crime insurance.

Certificate of incorporation, ownership structure, UBO information, source of funds evidence, group structure and information on close links or associated entities.

Governance framework, organizational structure, board and senior management roles, succession plan, wind-down plan, and internal decision-making procedures.

Regulatory Business Plan describing the company’s services, target markets, operating model, client flow, asset flow, revenue model and planned Virtual Asset Activities.

Financial projections, proof of paid-up capital, reserve account report, available capital confirmation, insurance certificates and, where relevant, group-level or entity-level financial statements.

CVs, passport copies, job descriptions, fit and proper confirmations, and information on Responsible Individuals, Compliance Officer, MLRO, CISO, and other key persons.

AML/CFT policies and procedures, compliance manual, compliance monitoring program, sanctions controls, transaction monitoring framework, and risk-based procedures.

Technology infrastructure design, technology risk assessment, information security policy, penetration testing results, business continuity plan, and IT disaster recovery plan.

Depending on the license scope, VARA may require additional documents, such as a VA listing policy, trade execution and settlement procedures, wallet/key management policy, product approval policy, or market conduct documents.

The first step is to analyze the proposed services, client flows, asset flows, target markets, and applicable VARA activity categories.

The applicant prepares the Initial Disclosure Questionnaire, business plan, ownership information, UBO details, and information on Senior Management.

The ATI stage allows the applicant to proceed with Dubai company incorporation, office setup, hiring, and operational preparation.

The timeline may depend on incorporation, office leasing, appointment of key personnel, compliance setup, and internal governance preparation.

The company submits the complete regulatory package for the VASP License stage, including corporate, financial, compliance, AML/CFT, risk and technology documents.

VARA may provide comments, request clarifications, hold meetings or interviews, and ask for additional documents before making a licensing decision.

Once the review is completed, the applicant pays the outstanding License Application Fee and the Annual Supervision Fee for the first year.

If VARA is satisfied that the applicant meets the applicable requirements, the VASP License may be issued, sometimes with operating conditions or restrictions.

Companies in Dubai are generally subject to UAE corporate tax: 0% on taxable income up to AED 375,000 and 9% on taxable income exceeding AED 375,000.

A free zone company may benefit from a 0% corporate tax rate on Qualifying Income only if it meets the conditions for Qualifying Free Zone Person status, including substance, audited financial statements and transfer pricing compliance.

The standard UAE VAT rate is 5%. Mandatory VAT registration generally applies when taxable supplies and imports exceed AED 375,000 during the previous 12 months or are expected to exceed this threshold within the next 30 days.

The transfer of ownership of virtual assets and their conversion may be exempt from VAT, but fee-based services such as custody, management, advisory or other separately charged services may still be subject to VAT.

The VASP must maintain effective KYC, AML/CFT procedures, transaction monitoring, sanctions screening and compliance with the FATF Travel Rule.

Licensed VASPs must keep proper records and submit required reports to VARA in line with the applicable Rulebooks and license conditions.

The company must protect client funds and virtual assets, maintain complaints handling procedures, and ensure appropriate safeguarding arrangements.

The VASP must maintain cybersecurity controls, business continuity planning and incident response procedures suitable for its activities and risk profile.

The company must notify VARA of material incidents and obtain approval, where required, for changes to ownership, control structure, business model, or licensed Virtual Asset Activities.

A VASP must appoint 2 Responsible Individuals who are full-time employees, sufficiently senior, approved by VARA, and either UAE residents or UAE passport holders.

The Compliance Officer must have relevant compliance experience, work full-time for the VASP, meet fit-and-proper requirements, and report directly to the Board of Directors.

The MLRO is responsible for AML/CFT matters and must have relevant experience in anti-money laundering, financial crime prevention and regulatory reporting.

The company must have a properly staffed risk management function with qualified personnel who can oversee the VASP’s overall risk profile.

A CISO must be appointed to oversee information security and cybersecurity matters. This role must be separate from the Compliance Officer.

The compliance function must be independent of operational and commercial teams and supported by sufficient resources, internal controls, and monitoring procedures.

The company must provide staff training, maintain a compliance testing program, and ensure regular reporting to the Board.

• The continued suitability of Responsible Individuals, the Compliance Officer, and the MLRO must be reviewed annually.
• Some roles may be combined where VARA allows and no conflict of duties arises, but the company must always demonstrate that its compliance, AML/CFT, risk, and cybersecurity functions are effective and properly resourced.