A digital-asset operator choosing between Dubai and the British Virgin Islands is not making a cosmetic decision. The choice determines which regulator sits above the business, which banking correspondent will onboard it, and whether institutional counterparties treat the entity as compliant or offshore-lite. Operating without the right licence exposes the business to enforcement action, frozen payment rails and the kind of banking termination that takes months to reverse. That risk concentrates at the moment a business selects its primary home and gets the analysis wrong.
This page runs a direct comparison of the VARA regime (administered by Dubai's Virtual Assets Regulatory Authority) and the BVI VASP framework (administered by the BVI Financial Services Commission under the Virtual Asset Service Providers Act 2022). It covers regulator posture, licence categories, substance requirements, AML obligations, tax and banking interaction, and a decision matrix by operator profile. No blanket verdict is offered – the right answer depends on your entity, your user base and your capital stack.
The Regulatory Posture: VARA vs BVI FSC
VARA is a full-authorisation regime designed to position Dubai as a primary operating jurisdiction, not a flag-of-convenience address. The VARA rulebooks cover seven regulated virtual-asset activities – advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, and transfer and settlement – each with its own conduct, capital and systems obligations. A VARA licence signals that the business is supervised at a level broadly comparable to a Tier-1 financial-services jurisdiction, and institutional counterparties increasingly recognise it as such.
The BVI FSC administers registration under the Virtual Asset Service Providers Act 2022. BVI positions itself as a registration jurisdiction rather than a full-authorisation hub. The regime is lighter-touch: it is built for entities that use the BVI as a corporate home for fund structuring, holding vehicle purposes or light-service activities, rather than for businesses running a live exchange or custody platform at scale. The BVI is also one of the world's dominant offshore fund-formation hubs, and that context shapes the type of operator for whom BVI VASP registration makes sense.
The contrast matters immediately. VARA is a substance-first regime where the regulator expects staff, systems and decision-making to sit in Dubai. The BVI FSC operates with a lighter presence requirement, but that comes with a corresponding ceiling on market recognition. Neither is inherently superior – they solve different problems.
What Licence Categories Are Available?
VARA's activity-based licensing model means an operator must identify every regulated activity it performs and obtain authorisation for each. An exchange that also provides custody and facilitates transfers holds three separate activity authorisations under a single entity – but each activity carries its own rulebook obligations. This granularity is intentional. It allows VARA to calibrate capital, systems and conduct requirements precisely to the risk profile of the activity.
In our practice, the most common VARA configurations are the exchange-plus-custody stack (trading platforms that self-custody client assets) and the broker-dealer-plus-transfer stack (OTC desks and payment corridors). Fund managers using Dubai as an operational base typically add the management and investment authorisation. Each layer adds compliance overhead, but also adds a verifiable permission that institutional clients and bank compliance teams can check.
BVI VASP registration covers the core FATF-aligned categories of virtual-asset service. For a fund vehicle that merely issues tokens or holds digital assets as part of a broader fund structure, BVI registration is often sufficient. For a business operating a trading platform or providing custody to third parties at scale, the registration framework was not designed to carry that weight. Operators attempting to use a BVI VASP registration as the primary licence for an active exchange routinely encounter pushback from banking counterparties and institutional clients who expect a full-authorisation regime.
How Much Substance Does Each Jurisdiction Require?
VARA requires genuine operational substance in Dubai: qualified staff, a physical presence, board-level accountability and systems that meet the regulator's technology and security standards. The VARA rulebooks specify that key management functions must be Dubai-resident, and the regulator conducts ongoing supervisory engagement rather than a one-off registration check. This is a feature for operators who want a credible primary hub, and a cost for those who want a low-overhead holding structure.
The substance requirement under the BVI framework is materially lighter. A registered BVI VASP does not need to maintain a trading desk or compliance team in the BVI. That flexibility makes the BVI well-suited to fund vehicles, token issuance special-purpose vehicles, and holding structures where the operational activity sits elsewhere. It does not make the BVI a substitute primary hub for a business that actively serves retail or institutional clients from that entity.
A common pattern in our cross-border practice is a dual-jurisdiction structure: a VARA-licensed operating entity in Dubai running the client-facing business, paired with a BVI holding company or fund vehicle sitting above it. These are complementary, not competing, choices. The decision to combine them – rather than choose one – is itself a structuring question that turns on the operator's revenue model and investor profile.
The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. For a scoped assessment of your licensing options across Dubai and the BVI, contact OBOLUS at info@oboluslaw.com.
AML, KYC and the Travel Rule: How Do the Regimes Compare?
Both VARA and the BVI VASP framework are built on FATF Recommendation 15, the international standard for virtual-asset service providers, and both implement the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer above the applicable threshold). The UAE is a FATF member and the BVI complies as a FATF-aligned jurisdiction.
In practice, VARA's AML obligations are more detailed and more actively supervised. VARA-licensed entities must maintain a compliance programme that satisfies both the VARA rulebooks and the broader UAE AML regime, with regular regulatory reporting and the expectation of real-time supervisory engagement. The Travel Rule threshold and the de-minimis treatment of low-value transfers are set by the applicable UAE provisions and are subject to regulatory update – operators should track them through current VARA guidance rather than assuming a fixed number.
BVI-registered VASPs must also meet the AML/CFT requirements in the applicable BVI provisions, including Travel Rule compliance. The supervisory intensity is lower than VARA's, but the compliance obligations exist and are not optional. A BVI entity that serves EU or UK clients will also need to consider whether those jurisdictions' AML rules reach the entity directly – which they often do for businesses with any EU or UK user base.
The cross-border AML point is important. An operator licensed only in the BVI but actively marketing to users in the EU, the UK or Singapore is not operating in an AML-free zone. Those jurisdictions' AML obligations may apply to the activity regardless of where the entity is incorporated. We regularly advise operators who discover this exposure after the fact, at which point the remediation cost is materially higher than getting the structure right at the outset.
Tax Environment and Banking Access
Dubai's tax environment is a significant draw for VARA-licensed operators. The UAE imposes no personal income tax and the corporate tax regime – now in effect – applies at a rate that is low by global standards, with free-zone entities potentially qualifying for preferential treatment subject to substance conditions. Operators should take specific tax advice on whether a VARA-licensed entity qualifies for free-zone benefits, as the interaction between the VARA licensing framework and the free-zone tax regime requires careful analysis.
Banking access for VARA-licensed entities has improved materially as the Dubai virtual-asset ecosystem has matured. Several UAE-based banks now have established onboarding pathways for VARA licence holders, and international correspondent banks increasingly treat a VARA authorisation as a meaningful compliance indicator. That does not mean banking is frictionless – compliance teams still conduct thorough due diligence – but the VARA licence meaningfully improves the conversation.
The BVI imposes no corporate income tax, no capital gains tax and no withholding tax on BVI-incorporated entities. For a holding structure or fund vehicle, this is commercially attractive. Banking access for a BVI VASP entity is more restricted. Correspondent banks in the major financial centres view BVI VASPs with greater scrutiny than VARA-licensed operators, and a BVI-only digital-asset business often finds its banking options limited to smaller or specialist institutions. Where a BVI entity is paired with an operating subsidiary in a supervised jurisdiction, the banking conversation typically runs through the supervised entity.
Which Profile Fits Which Jurisdiction?
The right jurisdiction turns on the operator's business model, user base and capital position. No single answer fits every operator, and the choice is rarely binary.
Profile A – Active exchange or trading platform: An operator running a live exchange serving institutional or retail clients needs full regulatory authorisation, not registration. VARA is the stronger primary hub for this profile. The activity-based licence, the supervisory credibility and the banking access that comes with it are worth the substance and capital investment. Timeline to authorisation varies by activity and application quality; operators should plan for a process that runs over several months and engage counsel before submitting.
Profile B – Custodian serving institutional clients: Again, VARA's custody authorisation is the cleaner answer. Institutional clients – family offices, funds, corporates – run counterparty due diligence that a full-authorisation regime satisfies more cleanly than a registration framework. A BVI custody vehicle may work as a secondary holding entity but is unlikely to pass the institutional compliance screen as a primary custodian.
Profile C – Token issuer or DAO operating entity: This profile is more nuanced. A token issuance SPV with limited ongoing service activity may be well served by BVI incorporation paired with VASP registration. Where the token carries economic rights that bring it closer to a security or an asset-referenced token under MiCA, a more heavily supervised jurisdiction – VARA or a MiCA CASP authorisation in the EU – becomes necessary. The substance of the token determines the right answer, not the marketing label.
Profile D – Digital-asset fund or fund-of-funds: The BVI is the dominant vehicle jurisdiction for offshore fund formation, and a BVI fund with VASP registration is a well-understood structure for institutional investors. Where the fund manager is an active operating entity providing management services to third-party clients, a VARA management-and-investment authorisation for the manager entity sits alongside the BVI fund vehicle. This is the combination structure referenced earlier – operationally, it is the most common configuration we see for institutional digital-asset managers entering the Gulf.
If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. To map the licence, banking and tax stack for your build, write to OBOLUS at info@oboluslaw.com.
A Common Assumption About Offshore Licensing
A common assumption among operators entering the market is that a single offshore registration covers global client activity. It does not. A BVI VASP registration does not authorise the business to provide exchange services to EU clients, to custody assets for Singapore-regulated funds, or to operate a payment corridor touching UK users. Each of those activities may trigger licensing obligations in the client's jurisdiction, in the user's jurisdiction, or in the jurisdiction where the relevant payment or transfer settles.
The Travel Rule alone illustrates the point. A BVI VASP sending a transfer to a VARA-licensed counterparty in Dubai must transmit originator data. The Dubai counterparty's VARA obligations require it to receive and verify that data. If the BVI entity's compliance programme does not generate Travel Rule-compliant messages, the VARA-licensed entity may be required to limit or refuse the transfer. In a cross-border business, a gap in one entity's compliance programme creates friction for the entire group.
We have seen this play out in practice. In a recent cross-border licensing matter, a payments company had structured its primary operating entity in a light-touch offshore jurisdiction and found that its major banking partner – and a key VARA-licensed counterparty – both required the operating entity to hold a full-authorisation licence before they would expand the commercial relationship. The remediation required a parallel VARA application and a six-month pause on planned growth. Getting the structure right at the outset would have cost a fraction of the delay.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how OBOLUS structures the licence stack across operating, custody and payment layers
- VASP Licensing in El Salvador – a worked example of an emerging-market digital-asset licence in a Bitcoin-law jurisdiction
- Real-World Asset Tokenization for Institutional Clients – structuring tokenised-asset issuance for institutional investors across jurisdictions
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction and activity type. A VARA authorisation in Dubai is a multi-stage process involving pre-application engagement, documentation review and supervisory assessment; operators should plan for a process running over several months from initial submission. BVI VASP registration is typically faster, but the lighter process reflects the lighter regulatory weight the registration carries. Application quality – complete documents, a credible compliance programme – is the single largest variable in both regimes.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. An active exchange or custodian serving institutional clients needs full regulatory authorisation, and VARA is the stronger primary hub in the Gulf. A holding vehicle, fund SPV or token-issuance entity may be well served by BVI VASP registration, often paired with an authorised operating subsidiary elsewhere. The right answer turns on your business model, your user base, your counterparty expectations and your capital position. We map that analysis before any application is filed.
Do I need a separate custody licence?
Under the VARA regime, custody is a separately regulated activity. A business that holds virtual assets on behalf of clients – even incidentally to an exchange function – must hold the applicable custody authorisation under the VARA rulebooks. In the BVI, the registration framework covers custody as part of the VASP category without a separate instrument, but the compliance obligations still apply. In most major regulated jurisdictions, providing custody without the relevant authorisation is a regulatory violation regardless of how the activity is labelled commercially.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so that the structure is built for the business you are running, not the business you described at incorporation. We also work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications when things go wrong. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in activity-based licensing strategy across the Gulf, offshore fund jurisdictions and the cross-border interaction between full-authorisation and registration regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.