Operating a digital-asset business without the right regulatory authorisation is not a calculated risk – it is a countdown. Enforcement actions, frozen payment rails and collapsed banking relationships have ended otherwise viable businesses in the time it takes to complete a licence application. For founders and general counsel weighing the two most-discussed licensing hubs of the past three years, the question is not abstract: Dubai under the Virtual Assets Regulatory Authority (VARA) or Singapore under the Monetary Authority of Singapore (MAS)?
Both regimes offer a credible, internationally recognised VASP registration or licence. Both carry material compliance obligations. Neither is a shortcut. The right answer turns on operator profile, user geography, banking needs and the long-term capital structure of the business – not on which flag looks best on a pitch deck.
This analysis works through the key decision axes: regulator posture, licence categories, substance requirements, AML obligations, tax and banking interaction, and the cross-border reality that any operator serving users in multiple markets must confront. A decision matrix by operator profile closes the comparison.
Regulator Posture: VARA and MAS Compared
VARA and MAS are both active, supervisory regulators – but their postures differ in ways that matter operationally. VARA, established under Dubai law and operating under the broader UAE virtual-asset policy framework, uses an activity-based licensing model with detailed rulebooks that cover each licensed function. MAS supervises digital-asset businesses primarily through the Payment Services Act, which introduced a tiered licensing structure for digital payment token (DPT) service providers.
VARA's scope covers mainland Dubai. It does not extend to the Dubai International Financial Centre (DIFC), which operates under a separate financial-services regime. This distinction trips up operators who assume a VARA licence covers the entire UAE – it does not. Businesses operating within the DIFC must deal with the DIFC's own regulatory architecture. For most crypto exchanges, custodians and token businesses that want to be physically present in Dubai, VARA is the relevant authority.
MAS takes a more principles-led approach, but its DPT licensing process has become progressively more demanding since the Payment Services Act came into force. In our practice, we have seen MAS apply close scrutiny to governance structures, key-personnel backgrounds and technology-risk management. The agency has also been explicit that it views Singapore as a hub for institutional digital-asset activity rather than retail speculation – a posture that shapes which applicants succeed.
Both regulators expect substantive local presence. Neither will accept a brass-plate entity. The depth of substance required – staffing, governance, local leadership – is a major cost driver that operators should model before choosing a jurisdiction.
What Licences Are Actually Available?
VARA offers activity-based licences across seven defined functions: advisory services, broker-dealer services, custody services, exchange services, lending and borrowing, management and investment services, and transfer and settlement services. A business may hold multiple activity licences under a single VARA authorisation, which suits vertically integrated exchanges that also offer custody and lending.
Each activity licence carries its own rulebook obligations – capital requirements, governance standards, AML/CFT protocols and product rules. The rulebooks are published and detailed. Operators know, in principle, what is expected before they apply. That transparency is genuinely useful for compliance planning.
Under the MAS Payment Services Act, DPT service providers fall into one of three licence tiers: money-changing licence, standard payment institution licence, or major payment institution licence. The tier is determined by transaction volumes and the nature of the services provided. A major payment institution licence is required for businesses exceeding defined transaction thresholds – and that tier carries proportionately heavier capital and risk-management obligations.
Singapore also maintains a separate regime for activities that touch securities – meaning a token that MAS classifies as a capital-markets product may require a Capital Markets Services licence rather than, or in addition to, a Payment Services Act licence. The classification question is not always obvious. We regularly advise clients to obtain a formal view on token classification before structuring the Singapore application, because the applicable licence determines the entire compliance architecture.
For a mid-market CTA or fund manager with digital-asset exposure, the Singapore capital-markets route may be the more appropriate path – but it also carries higher supervisory expectations than the Payment Services Act track.
How Much Local Substance Does Each Jurisdiction Require?
Both VARA and MAS have moved decisively away from tolerating minimal-substance operations. The expectation in each hub is a functioning office, locally resident key personnel, a board or senior management with demonstrable competence in digital assets, and technology and risk infrastructure that is genuinely operational – not merely documented.
Dubai's overall ecosystem – free-zone costs, real-estate availability and the absence of personal income tax – makes the cost of physical presence more manageable than in many competing hubs. For a business that wants its operating entity in Dubai and its holding structure elsewhere, the interaction with UAE corporate-tax rules (introduced relatively recently for businesses above the applicable threshold) needs to be factored into the structuring conversation. We work through that interaction with clients before they commit to a Dubai operating entity.
Singapore's cost base is higher. Office costs, personnel costs and the general cost of doing business in Singapore are material considerations. MAS has also signalled that it expects technology risk management and AML functions to be genuinely staffed locally – not outsourced to a parent entity in another jurisdiction. For a lean early-stage business, that cost of substance can be prohibitive. For an institutional operator that is already committed to Asian expansion, Singapore's infrastructure, legal system and talent pool often justify the investment.
A common mistake we see is operators underestimating the substance requirement and then discovering, mid-application, that the regulator expects more than the entity was built to provide. Retrofitting substance after an application is submitted is more difficult and more expensive than building it correctly from the start.
For a scoped assessment of which substance model fits your build, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking – change the analysis materially.
AML, CFT and the Travel Rule: How Do the Two Regimes Compare?
Both jurisdictions implement the Travel Rule (the FATF obligation to pass originator and beneficiary data alongside a virtual-asset transfer). The precise de-minimis threshold and technical implementation expectations differ between the two regimes, and each is subject to revision as FATF guidance evolves. Operators should verify the current threshold with local counsel rather than relying on a figure from any secondary source.
VARA's AML/CFT rulebooks are detailed and prescriptive. They address customer due diligence, transaction monitoring, sanctions screening and Travel Rule compliance in specific terms. VARA expects a licensed virtual-asset service provider to have a compliance programme that maps to those rulebooks – not a generic financial-services compliance manual adapted for crypto.
MAS operates within Singapore's strong AML/CFT legislative regime, which has consistently ranked among the more demanding in Asia-Pacific. The expectation of risk-based customer due diligence, ongoing transaction monitoring and prompt suspicious-transaction reporting applies in full. Singapore's position as a global financial centre means that banking counterparties and institutional clients impose their own enhanced due diligence requirements on top of the regulatory baseline.
The cross-border dimension is significant. A business licensed in Dubai that accepts users from Singapore, the EU or the United States is not insulated from those jurisdictions' rules by its VARA licence. MiCA's marketing restrictions, the SEC's extraterritorial reach and the EU's AML obligations may each apply depending on where the users are located. A single licence does not create a global permission. We address this in the decision matrix below.
Tax and Banking: The Practical Infrastructure
Tax treatment is a major driver of the Dubai choice for many operators. The UAE offers no personal income tax, and the corporate-tax regime introduced for businesses above the applicable threshold is structured in a way that, for many digital-asset businesses, produces an effective rate well below what Singapore or European alternatives would impose. The interaction between the Dubai operating entity, any offshore holding structure and the substance requirements of each layer needs careful analysis – but for the right operator, the tax efficiency is real and material.
Singapore's corporate-tax framework is competitive by global standards, and specific incentive schemes for financial institutions and fund managers have historically been accessible to qualifying digital-asset businesses. However, Singapore taxes corporate income, and the applicable rates and incentive conditions should be verified for the specific business model before any commitment is made.
Banking is the unresolved problem in both hubs. Access to fiat payment rails, corporate banking and settlement accounts remains genuinely difficult for crypto businesses in Dubai and in Singapore, despite the regulatory clarity each jurisdiction has created. Banks apply their own risk-appetite rules, which often diverge sharply from the regulator's posture. In our cross-border practice, we have seen well-licenced operators in both hubs struggle to open or maintain banking relationships – and the de-risking problem is global, not specific to either jurisdiction.
Operators we advise routinely build a banking strategy in parallel with the licence application, rather than treating banking as a problem to solve after authorisation is granted. Waiting until the licence is in hand to approach banks adds months to the timeline and creates operational risk during the gap.
If a banking relationship has already been closed or refused, that is a separate problem requiring a different analysis. To map the licence, banking and compliance stack for your build, write to OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back.
Decision Matrix: Which Profile Fits Which Jurisdiction?
No single jurisdiction is universally superior. The right choice is a function of operator profile, target markets, capital structure and strategic intent.
A retail-facing crypto exchange targeting the Middle East, Africa and emerging markets is typically a stronger fit for Dubai and the VARA licensing regime. VARA's activity-based structure accommodates the full exchange-plus-custody stack under a single authorisation. Dubai's time zone, business culture and absence of personal income tax appeal to founding teams that intend to be based there. The indicative licensing timeline under VARA is a matter of months, though it varies by application quality and activity scope – write qualitatively, as VARA has not published a fixed service standard. The key risk is banking: MENA banking for crypto remains patchy, and the operator will likely need to layer multiple banking relationships across jurisdictions.
An institutional digital-asset manager or custodian targeting Asian markets generally finds Singapore a better fit. MAS's reputation with institutional counterparties – prime brokers, fund administrators and pension allocators – is stronger than VARA's in that context, at least for the current cycle. The Singapore legal system (common law, courts with strong property-rights jurisprudence) provides a recovery forum that institutional investors value. The capital requirements and substance costs are higher, but for an operator with institutional backing, they are manageable. The indicative timeline for MAS DPT licensing has lengthened as the agency's scrutiny has increased – plan for a process measured in many months, with no guarantee of approval.
A token issuer planning a significant public offer needs to resolve the classification question in both jurisdictions before choosing a domicile. If the token is a capital-markets product under MAS analysis, Singapore imposes a materially heavier disclosure and authorisation burden. VARA's token-related obligations are defined in its own rulebooks. Neither jurisdiction should be chosen on the basis that it is "lighter" – the substance of the regime must be mapped against the specific token design.
A crypto fund or asset manager looking at both hubs should weigh the fund-management licensing tracks available in each, the applicable investor-eligibility rules (both regimes restrict retail access to higher-risk digital-asset products), and the interaction with the fund's domicile (Cayman Islands, BVI or elsewhere). The fund domicile, the manager's licence and the distribution rights are three separate legal questions that interact but do not collapse into a single choice.
A common myth among founders at this stage is that a single offshore licence – a BVI registration or a Cayman exemption – is sufficient to serve clients globally. It is not. A BVI or Cayman registration addresses the entity's home-jurisdiction obligations. It does not create permission to provide services to users in Singapore, the EU or the UAE. Those users' home regulators apply their own rules to the operator, regardless of where the entity is registered. Building the cross-border permission map before launch is not optional – it is the work that prevents enforcement downstream.
The Cross-Border Reality No Single Licence Resolves
Every credible digital-asset operator serves users across multiple jurisdictions. That reality means the licence-domicile decision is the beginning of the regulatory conversation, not the end.
MiCA, now the operative regime across the EU and EEA, applies its own authorisation and marketing requirements to businesses that actively target EU users – regardless of whether the operator is licensed in Dubai or Singapore. The FATF Travel Rule applies in both hubs and interacts with Travel Rule obligations in the users' home jurisdictions. US persons trigger a separate layer of SEC, CFTC and FinCEN analysis that a non-US licence does not displace.
In a recent cross-border licensing matter, a custodian licensed in one Gulf jurisdiction sought to expand its institutional client base into Southeast Asia. The entity's existing authorisation covered the activity in its home market but did not extend to regulated custodial services for Singapore-based fund managers. We mapped the additional MAS authorisation requirements and identified a structuring option that avoided duplicating the compliance infrastructure. The timeline to the additional authorisation was a matter of months once the structural question was resolved.
The cross-border permission map is not a one-time exercise. As user bases grow and new products are added, the regulatory perimeter expands. Operators we advise build a living map of where their licence applies, where it does not, and what triggers an obligation to register or authorise in an additional jurisdiction.
For the operator that has already built a presence in one hub and is now looking at the other, the question is often whether to establish a second licensed entity or to restructure the group to use a single entity with passporting or equivalence recognition where available. That analysis is jurisdiction-specific and turns on the activity scope, the user base and the tax consequences of the group structure.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how OBOLUS structures and manages licence applications across 70+ jurisdictions
- Economic Substance for Licensed VASPs in Poland – substance requirements under EU MiCA and what they mean for operational planning
- De-Risking and Account Closure Defence – a cross-jurisdiction comparison for licensed operators facing banking withdrawal
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction, activity type and application quality. Under VARA in Dubai, a well-prepared application for a defined activity licence typically takes a number of months from submission to authorisation – the exact duration depends on VARA's current processing volume and the completeness of the applicant's documentation. MAS DPT licensing in Singapore has generally taken longer as scrutiny has increased; operators should plan for a process measured in many months. Neither regulator publishes a binding service standard. Early-stage preparation – entity structure, governance, AML framework – is the most effective way to compress the timeline.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your activity (exchange, custody, issuance, fund management), your target user base, your banking strategy, your capital structure and your substance capacity. Dubai under VARA suits operators targeting Middle East and emerging-market users who can commit to local substance. Singapore under MAS suits institutional-facing businesses with Asian expansion plans. Both impose genuine compliance obligations. A decision without a full mapping of the licence stack, banking and cross-border user obligations is incomplete.
Do I need a separate custody licence?
In both Dubai (VARA) and Singapore (MAS), custody is treated as a distinct regulated activity. Under VARA, custody services require a dedicated custody activity licence. Under the MAS Payment Services Act, safeguarding of digital payment tokens triggers specific regulatory obligations. A business that holds client assets – even incidentally to a primary activity such as exchange or lending – should not assume that its primary licence covers the custody function. The answer depends on the facts of how assets are held. We map the activity perimeter before an application is filed to avoid this gap appearing post-authorisation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the structure you build holds under regulatory scrutiny. We also work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where recovery matters arise. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VARA, MAS and cross-border licence-stack structuring for digital-asset operators entering the Gulf and Asia-Pacific markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.