Virtual Assets Regulatory Authority · Emirate of Dubai
VARA Virtual Asset
Regime Visual Guide
An interactive breakdown of Dubai's Virtual Assets and Related Activities Regulations 2023, built solely from VARA's official website and rulebooks. Navigate the licensing journey, activity categories, and rulebook architecture — and jump straight to the source.
8
Licensed VA Activities
4
Compulsory Rulebooks
2
Stage Licensing Process
12
Month Licence Cycle
Read This First
Jurisdictional Scope — Where VARA Actually Regulates
VARA's own website is explicit and repeated on every page footer: VARA is the sole authority for virtual assets across Dubai's mainland and free zones, except the Dubai International Financial Centre (DIFC). VARA has no licensing mandate in the Abu Dhabi Global Market (ADGM) at all — that is a different emirate, under a different regulator.
🚨 Common Misconception: There is no "VARA regime in DIFC" or "VARA regime in ADGM." VARA's founding law (Dubai Law No. 4 of 2022) explicitly carves DIFC out of its territorial scope, and ADGM sits in a separate emirate (Abu Dhabi) entirely outside VARA's remit. Firms seeking to conduct virtual asset activity from DIFC or ADGM must look to the DFSA or FSRA frameworks respectively — not VARA.
VARA Jurisdiction
Dubai Mainland & Free Zones
VARA is the competent authority regulating, supervising and overseeing Virtual Assets and VA Activities across all zones of the Emirate of Dubai, including Special Development Zones and Free Zones — but excluding DIFC. Applications route through Dubai Economy & Tourism (DET) for mainland firms, or through any Dubai free zone.
Outside VARA
DIFC — Dubai International Financial Centre
Expressly excluded from VARA's regulations. Virtual asset and crypto-token activity conducted from DIFC falls under the Dubai Financial Services Authority (DFSA) — a separate regulator with its own rulebook (including the DFSA's Crypto Token regime), not covered by this guide.
Outside VARA
ADGM — Abu Dhabi Global Market
A separate financial free zone in the Emirate of Abu Dhabi. VARA's statutory remit is confined to Dubai; it has no licensing or supervisory authority over ADGM. Virtual asset business from ADGM is regulated by the Financial Services Regulatory Authority (FSRA), an entirely distinct regime.
Two-Stage Process
Licensing Flow
Applying for a VASP Licence is completed in two stages: first an Approval to Incorporate (ATI), then the full VASP Licence application. Submissions are always lodged through the applicant's commercial licensor — DET for mainland, or a Dubai free zone — never directly with VARA.
1
Initial Disclosure
Submit an Initial Disclosure Questionnaire (IDQ) to DET or the relevant Free Zone.
2
Documentation & Fees
Provide business plan, UBOs, senior management details. Pay ~50% of the licence application fee to commence review.
3
Approval to Incorporate
Receive an ATI to finalise legal incorporation and complete operational set-up — office, staffing, etc. No VA activity permitted yet.
4
Stage 2 Submission
Submit further documentation per VARA's guidance. Receive feedback — potentially meetings, interviews, further requests.
5
Remaining Fees
Pay the balance of application fees plus the first year's supervision fee.
6
VASP Licence
Full VASP Licence issued, possibly with operational conditions. Annual licence — renews every 12 months.
⚠ Not Yet Operational: Holding an Approval to Incorporate (ATI) — or later an In-Principle Approval — does not permit any Virtual Asset activity. VARA is explicit that applicants holding an IPA/ATI are strictly prohibited from initiating operations or servicing clients until the full VASP Licence is granted.
ℹ Annual Renewal: The VA licence is renewed every 12 months. VARA issues a renewal notification 90 days in advance, and an annual supervision fee is payable at renewal.
The Regulatory Perimeter
Eight Licensed VA Activities
VARA has identified eight distinct Virtual Asset activities. Each is "discrete" — a VASP must apply explicitly for every activity it wishes to offer. Multiple activities can usually sit under one overarching licence, with one key exception: Custody.
Advisory Services
Providing advice on Virtual Assets and VA activities to clients.
Advisory Services Rulebook
Broker-Dealer Services
Dealing in Virtual Assets, including on behalf of or against clients. Requires a private office.
Broker-Dealer Services Rulebook
Custody Services
Holding Virtual Assets on behalf of clients. The only activity VARA requires to be segregated into a distinct legal entity with a standalone licence. Requires a private office.
Custody Services Rulebook
Exchange Services
Operating a platform for the exchange of Virtual Assets for other Virtual Assets or fiat currency. Requires a private office.
Exchange Services Rulebook
Lending and Borrowing Services
Facilitating lending or borrowing of Virtual Assets between parties. Requires a private office.
Lending & Borrowing Rulebook
Management and Investment Services
Managing Virtual Assets or a portfolio of Virtual Assets on behalf of clients. Requires a private office.
Mgmt & Investment Rulebook
Transfer & Settlement Services
Transferring or settling Virtual Assets between parties, wallets, or platforms. Requires a private office.
Transfer & Settlement Rulebook
VA Issuance — Category 1
Issuance of Fiat-Referenced Virtual Assets (FRVA) and similar Category 1 issuances. Follows the standard VARA Licensing Process. Requires a private office.
VA Issuance Rulebook (Cat. 1)
🪙 VA Issuance — Category 2: Any issuance that does not meet the Category 1 definition (e.g. many token launches, NFT mints) needs prior VARA approval rather than a full VASP Licence — via an Issuance Approval Form, a whitepaper, and AML/CFT and technical-control confirmations. Anonymity-enhanced tokens are prohibited.
⚠ No Activity Is Exempt: VARA states plainly that no VA activity is "exempt" from regulatory supervision. Every VA service requires a Licence, a Registration, or a No Objection Certificate (NOC) — including proprietary trading above certain volumes, and DLT service providers carrying out any of the eight listed activities.
Regulations & Guidelines
Rulebook Architecture
Every VASP licence application must satisfy four compulsory, activity-agnostic rulebooks — plus the specific rulebook(s) that correspond to each licensed VA activity.
Compulsory — Applies to Every VASP
Company Rulebook
Corporate structure, governance, Fit & Proper, and Part VI Capital & Prudential Requirements.
Compliance & Risk Management Rulebook
AML/CFT controls, risk management framework, financial crime prevention.
Technology & Information Rulebook
Operational resilience, cybersecurity, data privacy, cryptographic controls.
Market Conduct Rulebook
Market surveillance, conflicts of interest, disclosure and conduct-of-business standards.
Activity-Specific — Applies per Licensed Activity
| Rulebook | Governs | Source |
|---|---|---|
| Advisory Services Rulebook | VA Advisory Services | |
| Broker-Dealer Services Rulebook | VA Broker-Dealer Services | |
| Custody Services Rulebook | VA Custody Services (standalone entity) | |
| Exchange Services Rulebook | VA Exchange Services | |
| Lending and Borrowing Services Rulebook | VA Lending and Borrowing Services | |
| Management and Investment Services Rulebook | VA Management and Investment Services | |
| Transfer and Settlement Services Rulebook | VA Transfer and Settlement Services | |
| VA Issuance Rulebook (Category 1) | VA Issuance — Category 1 (incl. FRVA) |
Entity, People & Presence
Governance & Physical Presence Requirements
VARA sets baseline requirements on legal form, key personnel, and physical footprint that apply irrespective of which activity is being licensed.
Legal Entity Type
A Limited Liability Company (LLC) or Free Zone Company (FZ-CO) is preferable. Applications from sole proprietorships are not accepted.
Two Responsible Individuals
Each VASP must appoint two Responsible Individuals (RIs) — full-time employees, UAE resident or UAE passport holder, and approved by VARA as Fit and Proper.
No Nationality Restriction
There is no restriction on the nationality of applicants — provided the application is made on behalf of a legal entity established with DET or a Dubai free zone (excluding DIFC).
Which Activities Require a Private Office?
| VA Activity | Private Office Required |
|---|---|
| Advisory Services | Not specified as mandatory |
| Broker-Dealer Services | ✓ Required |
| Custody Services | ✓ Required |
| Exchange Services | ✓ Required |
| Lending and Borrowing Services | ✓ Required |
| Management and Investment Services | ✓ Required |
| Transfer & Settlement Services | ✓ Required |
| VA Issuance — Category 1 | ✓ Required |
ℹ Note: VARA sets no minimum office size — space/staffing requirements are checked by the commercial licensor (DET or the relevant Free Zone), not by VARA itself.
Stage 2 Submission
VASP Licence Application Documentation
A non-exhaustive list of documents VARA requires under Corporate Structure & Governance for a VASP Licence application. VARA may request further documentation as the review progresses.
01 Certificate of entity incorporation
02 List of Ultimate Beneficial Owner(s) (UBOs)
03 Fit and Proper confirmations
04 Source of funds evidence
05 Organisational structure
06 Governance framework
07 Local entity website
08 Key personnel details — job descriptions, CVs, passport copies
09 Regulatory Business Plan
10 Financial projections
11 Group-level and entity-level financial statements
12 Proof of paid-up capital
13 Available capital locked-up evidence
14 Reserve account report
15 Insurance certificate(s)
16 Succession plan
17 Wind-down plan
18 Close links / associated entities analysis
⚠ Additional Categories: VARA's published checklist also lists separate document sets under Risk & Compliance, Technology, and Other headings on its site, without itemising every document publicly — expect further requests specific to your licensed activity during the Stage 2 review.
Firms Operating Before Feb 2023
Legacy VASP Transition Pathway
Firms carrying on VA activities in or from Dubai (excluding DIFC) prior to 7 February 2023 — "Legacy VA Operators" — follow a dedicated transition route into the full regime, under the Dubai Legacy Programme.
Stage 1
Initial Disclosure Questionnaire (IDQ)
Legacy VA Operators register by completing an IDQ with DET or a Free Zone, screened by the commercial licensor and passed to VARA for assessment. Eligible firms receive an Application Acknowledgment Notice (AAN).
Stage 2
Legacy Operating Permit (LoP)
Valid for 12 months, non-renewable. Offers up to a 50% discount on licensing fees and reduced capital requirements while the firm builds out full compliance. Firms must apply for a full VASP Licence 90 days before LoP expiry.
Stage 3
Full VASP Licence — or Wind-Down
On completion of full requirements, VARA issues (or declines) the VASP Licence. Firms unable to comply within the 12-month LoP window must cease VA operations and wind down.
🚨 Withdrawal Triggers: VARA can withdraw an AAN/LoP where a VASP fails to fulfil licence requirements, conducts illicit activity, or is found not to fall under VARA's regulatory regime at all.
Statutory References
Fees & Capital Requirements
VARA does not publish fee tables or capital thresholds on its general marketing pages — these figures live inside the formal regulatory instruments themselves. This guide links directly to the governing provisions rather than reproducing numbers that change between rulebook versions.
Licensing & Supervision Fees
Set out in Schedule 2 (Supervision and Authorisation Fees) of the Virtual Assets and Related Activities Regulations 2023. Stage 1 typically requires ~50% of the application fee upfront; the balance plus the first year's supervision fee is paid at Stage 2.
Capital & Prudential Requirements
Set out in Part VI of the Company Rulebook, applying capital adequacy expectations calibrated to the licensed activity(ies) and scale of operations.
Advertising, Events & Promotions
VA Marketing Regulations
Any marketing, advertising, or event activity related to Virtual Assets in Dubai (excluding DIFC) must confirm adherence to VARA's Marketing Regulations and Guidelines, even where the promoter itself is not VARA-licensed.
Event Organisers
Apply for a VA event permit through the DET e-Permit system (category: VA Event) and confirm adherence to VARA's Marketing Regulations and Guidelines.
Outdoor / Media Advertising
Billboards, taxis, and outdoor advertising apply through Dubai Municipality's central government advertising system (category: Virtual Asset Activity).
Unlicensed VASP Marketing
Unlicensed VASPs may still market in Dubai with the correct permit, but may not onboard Dubai residents — marketing material must disclose the product/service is unavailable to Dubai residents.
⚠ Penalties Apply: Failure to comply with VARA's Marketing Regulations and Guidelines may result in substantial fines and penalties, including potential entity closure.
Regulatory Notices
Enforcement & Supervision
VARA supervises the Dubai virtual asset market through both on-chain and off-chain methods, coordinating enforcement with commercial licensing bodies.
⚠️
Warnings & Reprimands
Lower-severity breaches
Formal warnings and reprimands issued for non-compliance with Regulations and Rulebooks.
🛑
Cease & Desist Orders
Halt unlicensed activity
Issued against unlicensed VA activity or serious ongoing breaches.
💸
Fines & Penalties
Material financial consequence
Substantial punitive measures for non-compliance, up to and including entity closure.
🔒
Licence Suspension / Limitation
Scope or market restriction
VARA may suspend licences or limit scope of service or market access as a disciplinary outcome.
Reference
Glossary
Key abbreviations used across VARA's licensing framework.
VASP
Virtual Asset Service Provider
Any entity carrying out a licensed VA activity in or from Dubai (excluding DIFC).
IDQ
Initial Disclosure Questionnaire
First-stage disclosure submitted to DET or a Free Zone to begin the licensing or legacy transition process.
ATI
Approval to Incorporate
Stage 1 approval permitting legal incorporation and operational set-up — not yet permission to conduct VA activity.
AAN
Application Acknowledgment Notice
Confirmation issued to eligible Legacy VA Operators after IDQ assessment.
LoP
Legacy Operating Permit
12-month, non-renewable transitional permit for pre-2023 Legacy VA Operators, with discounted fees and capital relief.
NOC
No Objection Certificate
Confirmation that an activity (e.g. proprietary trading) may proceed under regulatory oversight without a full VA Licence.
RI
Responsible Individual
One of two mandatory, VARA-approved Fit & Proper senior staff each VASP must appoint as full-time UAE residents.
FRVA
Fiat-Referenced Virtual Asset
A Category 1 VA issuance type subject to the VA Issuance Rulebook's Annex 1 rules.
DET
Dubai Economy & Tourism
Commercial licensor for mainland Dubai applicants routing VASP applications to VARA.
FZ
Free Zone
Any Dubai free zone (excluding DIFC) authorised as a commercial licensor for VASP applicants.
DIFC
Dubai International Financial Centre
Expressly excluded from VARA's jurisdiction; regulated instead by the DFSA.
ADGM
Abu Dhabi Global Market
A separate financial free zone in Abu Dhabi, entirely outside VARA's remit; regulated by the FSRA.