How to Get a VARA Licence in Dubai: The Complete 2026 Guide for Virtual Asset Businesses
Quick Summary: If you are planning to launch a crypto exchange, digital asset platform, or any virtual asset business in Dubai, you legally need a VARA licence before you start operations. This guide walks you through everything, including what VARA is, which activities it covers, the full application process, official fees, compliance requirements, and total costs. Written for founders, investors, and entrepreneurs who want to get licensed the right way in 2026.
What Is VARA and Why Does It Matter?
The Virtual Assets Regulatory Authority (VARA) is the world’s first dedicated, standalone regulator built exclusively for virtual assets. It was established under Dubai Law No. 4 of 2022 and operates as a specialised authority linked to the Dubai World Trade Centre Authority (DWTCA), with its own legal identity and financial independence.
In plain terms, VARA is Dubai’s crypto regulator. If your business does anything with virtual assets in Dubai, VARA is your regulator.
VARA’s Jurisdiction at a Glance
| Area | Under VARA? |
| Dubai Mainland | Yes |
| Dubai Free Zones (DMCC, DWTCA, etc.) | Yes |
| Dubai International Financial Centre (DIFC) | No (governed by DFSA) |
| Abu Dhabi (ADGM) | No (governed by FSRA) |
| Other Emirates | No (governed by CMA, formerly SCA) |
What VARA Does
- Licences and supervises all Virtual Asset Service Providers (VASPs) in Dubai
- Sets rules on governance, compliance, technology, and conduct for VASPs
- Protects investors and maintains market integrity
- Ensures alignment with FATF international standards
- Coordinates with the Central Bank of UAE and the Capital Markets Authority (CMA)
A Key 2025 Development: CMA and VARA Partnership
In August 2025, VARA and the Capital Markets Authority (CMA, formerly the Securities and Commodities Authority or SCA) signed a mutual recognition agreement. Under this agreement, a VARA licence is intended to confer nationwide authorisation across the UAE without the need for a separate CMA application. This is a significant development that makes a VARA licence even more strategically valuable in 2026.
Which Businesses Need a VARA Licence?
Any entity, whether based in the UAE or internationally, that conducts virtual asset activities in or from Dubai must hold a valid VARA licence before starting operations.
You Need a VARA Licence If You Are:
- Running a crypto exchange (centralised or decentralised)
- Offering digital asset custody
- Providing crypto investment or portfolio management
- Facilitating crypto lending or borrowing
- Issuing tokens or stablecoins
- Operating as a crypto broker or dealer
- Providing virtual asset transfer or settlement services
- Offering advisory services on virtual assets
You Do NOT Need a VARA Licence If You Are:
- Holding virtual assets as a personal investor
- Occasionally accepting crypto as payment for goods or services (not as a core business activity)
The Marketing Rule (Since October 2024)
Even if you are not yet conducting VA activities, you need a VARA licence (or be working on behalf of a licensed entity) before you can market virtual asset services in Dubai. This includes:
- Social media posts and paid advertising
- Influencer endorsements and referral links
- Whitepapers with promotional intent
- Event sponsorships and promotions
- Any Arabic language or AED-denominated content targeting UAE audiences
Penalty for non-compliance: Fines of up to AED 500,000 per non-compliant advertisement under the Marketing Regulations (October 2024). Note that some serious or repeat breaches can attract fines of up to AED 10 million.
VARA’s enforcement is active and real. In October 2025, VARA simultaneously sanctioned 19 firms for unlicensed operations, with fines ranging from AED 100,000 to AED 600,000 per firm. Cointelegraph confirmed that 31 sanctions were issued in 2025 alone, with 38 total entities listed on VARA’s enforcement page.
The 8 Regulated Virtual Asset Activities
VARA regulates eight distinct categories of virtual asset activity under Schedule 1 of the Virtual Assets and Related Activities Regulations 2023. In May 2025, VARA issued Version 2.0 of its complete Rulebook framework, updating requirements across all eight categories.
| # | Activity | Plain English Explanation |
| 1 | Advisory Services | Professional advice on virtual assets, investment recommendations, and VA-related consulting for clients |
| 2 | Broker-Dealer Services | Acting as an intermediary in buying and selling virtual assets on behalf of clients or as a principal |
| 3 | Category 1 VA Issuance | Issuing utility tokens, stablecoins (Fiat Referenced Virtual Assets), or asset backed tokens. Requires VARA approved Whitepaper before any public sale. Category 1 now requires prior VARA approval under the 2025 Rulebook V2.0 |
| 4 | Custody Services | Holding or safeguarding virtual assets (hot or cold wallets) on behalf of clients |
| 5 | Exchange Services | Operating a platform matching buyers and sellers of virtual assets, including spot, stablecoins, and derivatives. Margin trading rules were codified under VARA Rulebook V2.0 (June 2025) |
| 6 | Lending and Borrowing Services | Providing crypto collateralised loans, margin lending, or yield-generating products |
| 7 | VA Management and Investment Services | Managing VA portfolios or funds on behalf of third parties, including discretionary management |
| 8 | VA Transfer and Settlement Services | Facilitating VA transfers between wallets or parties, including crypto payment processors and remittance services |
Important note on Category 2 Issuances (Rulebook V2.0): Category 2 issuances (e.g., utility tokens outside the Category 1 definition) must now be distributed exclusively through licensed distributors. This change took effect on 19 June 2025 after a 30-day transition period.
The Two-Stage VARA Licensing Process
Getting a VARA licence involves two mandatory stages. You cannot conduct any virtual asset activity until both stages are fully complete.
Stage 1: Approval to Incorporate (ATI)
This stage gives you the legal green light to set up your entity and prepare for operations. It does not permit you to serve clients or conduct VA activities yet.
How to apply:
You submit through either:
- Dubai Economy and Tourism (DET) for mainland entities
- Your chosen Dubai free zone authority for free zone entities
What you submit at Stage 1:
- Initial Disclosure Questionnaire (IDQ) submitted through DET or the free zone
- A comprehensive business plan covering proposed VA activities, target market, technology stack, and financial projections
- Details of all beneficial owners (UBOs), directors, senior management, and proposed Responsible Individuals (RIs)
- Payment of the initial licence application fee (typically 50% of the total licence application fee) before processing begins.
Stage 2: Full VASP Licence
Once ATI is received, you move to Stage 2, which results in the full VASP Licence and authorisation to begin operations.
What Stage 2 requires:
- Governance documents: Board composition, organisational chart, delegation of authority framework
- AML and CFT policies: Full KYC and CDD frameworks, transaction monitoring systems, Suspicious Transaction Reporting procedures, and MLRO appointment
- Technology and cybersecurity documentation: Penetration test results, business continuity and disaster recovery plans, data governance frameworks (aligned to VARA’s Technology and Information Rulebook)
- Compliance manuals: Aligned to applicable VARA activity-specific rulebooks (V2.0 as of June 2025)
- Physical office proof: A private and dedicated office in Dubai. Shared or virtual offices do not qualify
- Fit-and-proper assessments: Completed for all Responsible Individuals
- Remaining fees: Balance of the licence application fee plus the first-year annual supervision fee
Realistic Timeline
| Stage | Typical Duration |
| Stage 1 (ATI application and approval) | 4 to 8 weeks |
| Operational setup during the ATI period | 4 to 8 weeks |
| Stage 2 documentation preparation | 6 to 10 weeks |
| Stage 2 VARA review and approval | 8 to 12 weeks |
| Total: First application submission to VASP Licence | 4 to 7 months (well-prepared applicants) |
Official VARA Fee Schedule 2025 to 2026
The table below is sourced directly from Schedule 2 of the Virtual Assets and Related Activities Regulations 2023, published on VARA’s official Rulebooks portal (rulebooks.vara.ae). Cabinet Resolution No. 83 of 2025 governs applicable charges for licensing and regulatory services.
| VA Activity | Licence Application Fee | Annual Supervision Fee | Extension Fee (per additional activity) | Indicative Min. Capital |
| Advisory Services | AED 40,000 | AED 80,000 | 50% of the lower fee | AED 100,000 minimum |
| Broker-Dealer Services | AED 100,000 | AED 200,000 | 50% of the lower fee | AED 400,000 to AED 600,000 |
| Category 1 VA Issuance | AED 100,000 | AED 200,000 | 50% of the lower fee | Varies by token type |
| Custody Services | AED 100,000 | AED 200,000 | 50% of the lower fee | AED 500,000 or more |
| Exchange Services | AED 100,000 | AED 200,000 | 50% of the lower fee | AED 1,000,000 or more |
| Lending and Borrowing | AED 100,000 | AED 200,000 | 50% of the lower fee | AED 1,000,000 or more |
| VA Management and Investment | AED 100,000 | AED 200,000 | 50% of the lower fee | AED 500,000 or more |
| VA Transfer and Settlement | AED 40,000 | AED 80,000 | 50% of the lower fee | AED 100,000 minimum |
Source: Schedule 2 of the Virtual Assets and Related Activities Regulations 2023. VARA Rulebooks Portal: rulebooks.vara.ae. Capital figures based on VARA’s Company Rulebook (Part VI) and market practice guidance from Addleshaw Goddard (2024) and Neo Legal (2025).
Critical Points About the Fee Structure
Point 1: Extension fees apply when you apply for more than one activity. Example calculation: Exchange Services (AED 100,000) plus Advisory Services (AED 40,000) equals AED 100,000 plus AED 20,000 (which is 50% of the lower AED 40,000) equals AED 120,000 in application fees alone, on top of separate annual supervision fees for both activities.
Point 2: The Annual Supervision Fee is paid before you start operations and is charged per licensed activity. It is not a one-off payment.
Point 3: VARA can impose additional supervision fees based on your risk profile, client base complexity, business model, or regulatory track record. These discretionary charges are not publicly listed and are assessed on a case-by-case basis.
Total Budget: What You Actually Need to Spend in Year 1
VARA regulatory fees are just one part of the full picture. Here is a realistic cost breakdown for year one:
| Cost Category | Low Estimate | High Estimate |
| VARA application fee (single activity) | AED 40,000 | AED 100,000 |
| VARA first-year annual supervision fee | AED 80,000 | AED 200,000 |
| Entity incorporation (commercial licence and free zone or DET fees) | AED 15,000 | AED 50,000 |
| Minimum paid-up capital (locked, not for operations) | AED 100,000 | AED 1,000,000 or more |
| Physical office space (annual lease, Dubai) | AED 60,000 | AED 200,000 |
| Two Responsible Individuals (annual salaries combined) | AED 400,000 | AED 1,000,000 or more |
| AML and CFT compliance infrastructure setup | AED 100,000 | AED 300,000 |
| Technology and cybersecurity compliance | AED 50,000 | AED 150,000 |
| Legal and advisory support for the application | AED 100,000 | AED 250,000 |
Year 1 Total Estimates by Licence Type
| Licence Category | Approximate Year 1 Budget |
| Advisory Services or Transfer Services (simplest) | AED 995,000 to AED 1,200,000 |
| Broker-Dealer or Custody Services | AED 1,500,000 to AED 2,500,000 |
| Exchange Services (full operational) | AED 5,000,000 to AED 10,000,000 or more |
Critical reminder: Minimum paid-up capital must be held in a dedicated UAE bank account or trust arrangement as per Part VI of VARA’s Company Rulebook. It cannot be used for day-to-day operating expenses.
AML and CFT Compliance: The Non-Negotiable Core
AML (Anti-Money Laundering) and CFT (Combating Financing of Terrorism) compliance is the most operationally demanding part of VARA licensing and ongoing supervision. VARA’s framework is fully aligned with FATF Recommendation 15.
The UAE’s AML Credibility Milestones
| Event | Date | Significance |
| UAE removed from the FATF grey list | February 2024 | Confirmed AML reform credibility internationally |
| UAE removed from EU high-risk AML list | July 2025 | Reduced compliance friction for EU-based institutions and investors |
| The UAE signed the OECD CARF agreement | 2024 | Enables automatic exchange of crypto transaction information with tax authorities |
Mandatory AML and CFT Requirements for All VASPs
- Appoint a full-time, qualified Money Laundering Reporting Officer (MLRO) who is a senior UAE resident and member of the firm’s leadership
- Build a documented, risk-based AML and CFT programme that covers:
- Customer Due Diligence (CDD) for all clients
- Enhanced Due Diligence (EDD) for higher-risk clients and counterparties
- Ongoing transaction monitoring across all VA activity
- Suspicious Transaction Reporting (STR) to the UAE Financial Intelligence Unit (FIU)
- Implement the FATF Travel Rule for all VA transfers exceeding AED 3,500, which requires the collection and transmission of originator and beneficiary data
- Maintain complete transaction records for a minimum of 8 years
- Conduct regular independent AML audits of the firm’s compliance programme
VARA conducts both scheduled and surprise supervisory examinations. A weak AML and CFT programme is one of the most cited grounds for licence suspension and enforcement action. growing, and the professionals who enter it legally and compliantly are the ones who will benefit most.
FAQs
Q. Can a foreign company apply for a VARA licence without incorporating in Dubai?
No. VARA issues licences to legal entities incorporated in Dubai (either on the mainland through DET or in a Dubai free zone). Foreign companies must establish a Dubai legal entity as part of the Stage 1 ATI process. 100% foreign ownership is permitted in most Dubai free zones, making this structurally straightforward for international applicants.
Q. How long does the full VARA licensing process take?
For a well-prepared applicant with complete documentation, a strong governance structure, and a robust AML and CFT framework, the full process from Stage 1 submission to VASP Licence issuance typically spans 4 to 7 months. Planning for a minimum of 6 months is strongly advised.
Q. Can I conduct VA activities during the ATI period?
No. The ATI authorises a firm to incorporate its entity and complete the operational setup only. It does not permit the conduct of any virtual asset activities. Operating VA services before the full VASP Licence is issued is a direct violation of Dubai Law No. 4 of 2022.
Q. How many Responsible Individuals do I need?
A minimum of two RIs who are UAE residents or UAE passport holders, pass VARA’s fit-and-proper assessment, and work full-time exclusively for your VASP.
How BlueKryon LLC Can Help You Get Licensed
At BlueKryon LLC, we have been helping businesses set up, structure, and get licensed in Dubai since 2014. We have supported 500+ entrepreneurs from 100+ countries and hold a 4.9 Google rating from verified clients.
When it comes to VARA licensing and virtual asset business setup, our team provides:
Our VARA Licensing Services
- Regulatory perimeter assessment: We confirm whether your business model requires a VARA licence and which of the 8 activity categories applies before you spend a dirham on applications
- Entity structuring advice: We help you choose the right free zone or mainland incorporation for your goals, risk profile, and client base
- Stage 1 ATI preparation and submission: Full IDQ preparation, document compilation, and application submission support
- AML and CFT framework design: We help you build a FATF-aligned compliance programme, appoint an MLRO, and set up transaction monitoring infrastructure
- Documentation coordination: We work with specialist VARA legal counsel to prepare and review your full Stage 2 application package
- Responsible Individual sourcing: We help identify and connect you with suitably qualified RI candidates who can pass VARA’s fit-and-proper assessment
- Physical office setup: We assist with identifying and leasing a compliant Dubai office that meets VARA’s dedicated office requirements.
- Bank account opening: Corporate bank account setup is one of the most complex parts of any virtual asset business setup. We have established relationships to support this process
- Ongoing compliance support: Post-licence support to keep your VASP in full compliance with VARA’s evolving Rulebook requirements, including V2.0 updates
Conclusion
Dubai is no longer just crypto friendly. It is the world’s most structured and enforced virtual asset jurisdiction in 2026. With over USD 30 billion in crypto inflows, more than 500,000 daily active traders, and over 70 licensed VASPs already operating, the opportunity is massive, and the rules are clear. A VARA licence is not just paperwork. It is your legal right to operate, grow, and be taken seriously by banks, partners, and investors across the region. BlueKryon LLC has helped 500-plus businesses get licensed and set up in Dubai since 2014. Your turn starts today.