Operating a digital-asset business without the right regulatory authorisation is not a calculated risk – it is an enforcement event waiting to happen. Frozen banking rails, blocked correspondent accounts and regulatory cease-and-desist orders are the documented consequences. For a founder or general counsel weighing where to establish a licensed entity, the choice between Dubai's VARA (Virtual Assets Regulatory Authority) regime and Switzerland's FINMA framework sits near the top of every serious shortlist. Both jurisdictions attract institutional-grade operators. Both impose real substance requirements. And both carry traps that a surface-level comparison misses entirely.
This analysis sets the two regimes side by side across the axes that matter to a business decision: regulator posture, licence categories, operator substance, AML and Travel Rule posture, tax and banking interaction, and the cross-border reality of serving clients from one hub while banking in another. The goal is a decision matrix that fits your operator profile – not a verdict that fits ours.
Regulator Posture: VARA and FINMA Compared
VARA and FINMA approach digital-asset regulation from very different institutional histories, and that difference shapes every application experience downstream. VARA operates as a purpose-built virtual-asset regulator, created specifically to govern digital-asset activity in mainland Dubai. FINMA, by contrast, is a full-spectrum financial-market supervisor that has developed a digital-asset posture by extending and adapting existing financial-services law.
VARA publishes activity-specific rulebooks covering advisory, broker-dealer, custody, exchange services, lending, management and investment, and transfer and settlement. Each rulebook carries its own conduct expectations, capital orientation and ongoing supervision obligations. The regime is explicit and granular – which reduces interpretive uncertainty but also means that every planned activity needs to be mapped against a specific rulebook before an application is filed.
FINMA works through a published token taxonomy – distinguishing payment tokens, utility tokens and asset tokens – and routes applicants toward an appropriate licence or authorisation based on that classification. Routes include a fintech licence, a banking licence, or affiliation with a recognised self-regulatory organisation for AML purposes. The classification exercise happens before the regime question, which adds analytical work at the front end. In our practice, operators who have not completed that classification step before approaching FINMA face avoidable delays.
A key geographic note: VARA's jurisdiction covers mainland Dubai and does not extend to the DIFC financial free zone, which runs its own regulatory regime. An operator targeting DIFC substance needs a separate analysis entirely. Switzerland has no equivalent internal carve-out – FINMA supervises nationally.
Licence Categories and Scope: What Each Regime Covers
The breadth of licence categories in each regime determines whether a single authorisation covers your full operating model – or whether you need to stack licences across activities or entities. Under VARA, activity-based licences mean that an exchange operator who also offers custody and lending will typically need coverage across multiple rulebook categories. Each activity carries its own authorisation and ongoing compliance burden.
Under the FINMA framework, the appropriate authorisation route depends first on the token classification and then on the nature of the business. An operator accepting public deposits in the course of its digital-asset business is likely to face banking-licence requirements – a significantly heavier lift than a fintech licence. Operators that structure their model to avoid deposit-taking may access lighter routes, but that structuring decision needs to be made deliberately and documented.
Token issuers face a specific bifurcation. In Dubai, VARA's rulebooks address token offerings and issuance as regulated activities. In Switzerland, FINMA's token classification framework determines whether the offering triggers securities regulation, banking law, or neither. The asset-token category carries the heaviest regulatory treatment under FINMA's guidance. Payment and utility tokens receive differentiated treatment, but the classification is based on substance – the rights the token actually confers – not on what the issuer chooses to call it.
For funds and asset managers, both jurisdictions offer a viable path. VARA's management and investment licence covers collective investment management in the virtual-asset space. FINMA-supervised fund vehicles and asset managers operate under Swiss collective investment law, with the digital-asset layer treated as an asset class within an otherwise conventional supervisory structure.
How Much Substance Does Each Jurisdiction Require?
Both VARA and FINMA require genuine operational substance – but the form that substance takes differs, and the gap between stated policy and practical expectation is wider in some activity categories than others. Regulators we engage with in both jurisdictions are increasingly focused on whether the licensed entity is the actual operational center of the business, not a nominal holding structure with staff and decisions sitting elsewhere.
VARA expects that a licensed entity operates genuinely within Dubai. That means locally based senior management with decision-making authority, physical premises appropriate to the scale of the business, and technology and compliance infrastructure that is not simply a mirror of a parent entity elsewhere. The trend in our cross-border practice is toward greater scrutiny of management-location claims – a regional director who spends most of the year outside the UAE is a structural risk.
FINMA's substance expectations are embedded in its fit-and-proper assessment for key function holders and its ongoing governance requirements. For banking-licence applicants, the substance bar is substantially higher – senior management must be Switzerland-resident or demonstrably available, and the board must include individuals with direct Swiss-market experience. Fintech-licence applicants face a lighter but still genuine substance test.
The cross-border complexity arises when an operator licenses in one jurisdiction but serves customers primarily based in another. Neither VARA nor FINMA authorises an operator to access third-country markets without reference to those markets' own rules. Operators we advise regularly discover – sometimes late – that their Dubai or Swiss entity needs to assess whether its cross-border customer acquisition is caught by EU MiCA passporting rules, by UK FCA financial-promotion rules, or by US federal and state requirements. The licensed entity is a compliance foundation, not a global permission.
To map the substance requirements and the cross-border customer-access question for your specific structure, write to OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis materially.
AML/CFT and the Travel Rule: Practical Divergence
Both regimes implement the Travel Rule – the FATF Recommendation 16 obligation to pass originator and beneficiary data with virtual-asset transfers above the applicable threshold – but the implementation details and supervisory intensity differ in ways that affect compliance architecture.
VARA's AML framework draws on UAE federal AML law and FATF Recommendation 15, which addresses virtual assets and virtual-asset service providers specifically. VARA-licensed entities are subject to Travel Rule obligations and to VARA's own conduct rulebooks on AML compliance. The practical implication is that a VARA-licensed exchange must maintain counterparty VASP screening, Travel Rule data exchange protocols, and transaction monitoring calibrated to the risk profile of its customer base and transaction flows.
Switzerland implements the Travel Rule through FINMA's AML provisions and the associated self-regulatory-organisation framework. The threshold above which Travel Rule data must accompany a transfer varies and should be confirmed against current FINMA guidance – it is a [VERIFY] figure that changes with updated FATF standards. Operators affiliated with a Swiss SRO for AML compliance must meet that SRO's own standards, which can be more prescriptive than the regulatory minimum.
In both jurisdictions, the quality of the compliance program – not merely its formal existence – is a live supervision focus. In our experience advising operators across both hubs, the most common finding in a regulatory review is not the absence of an AML policy but the absence of evidence that the policy was followed: transaction monitoring alerts that were not escalated, counterparty due diligence that was not refreshed, and Travel Rule data exchange that was documented in policy but not in practice.
Tax and Banking: The Interaction Most Operators Miss
A licence does not produce a bank account. This is the practical reality that causes the most friction in cross-border digital-asset operations, and it is more acute in both Dubai and Switzerland than the marketing materials suggest.
Switzerland has a developed domestic banking sector with direct experience of digital-asset businesses – several Swiss banks actively serve crypto-native clients. However, access is selective and depends on the operator's own AML posture, the jurisdictions it serves, and the nature of its token or trading activity. Asset-token issuers and high-volume exchange operators face the most scrutiny. The Swiss fintech licence does not automatically open banking doors; it signals regulatory standing, but the bank's own risk appetite governs access.
Dubai's banking environment has improved materially as VARA's regime has matured, and several UAE-headquartered banks now offer accounts to VARA-licensed entities. International correspondent banking access for a Dubai-licensed crypto business remains a live challenge, particularly for USD settlement. Operators targeting significant USD volume should assume that banking arrangements will require active management and may require accounts in multiple jurisdictions.
Tax treatment in both jurisdictions is favorable relative to many onshore alternatives, but the specifics are jurisdiction-dependent and turn on entity type, activity classification and the tax treatment of digital assets in the jurisdictions where the operator's customers sit. Switzerland applies cantonal and federal tax on corporate income; the effective rate varies by canton and is generally competitive. The UAE introduced a corporate tax regime that applies to businesses operating in the mainland; VARA-licensed entities are subject to that regime and should model their tax position carefully before committing to a structure. Neither jurisdiction's favorable headline treatment eliminates the tax exposure in markets where the operator's users are resident.
If a prior application stalled, a banking relationship closed, or your tax model has not been stress-tested for the jurisdictions you serve, reach our licensing desk at info@oboluslaw.com. A second read of the structure frequently surfaces the reason – and the route forward.
Decision Matrix: Which Profile Points Where
No single jurisdiction is the right answer for every operator. The right choice turns on operator type, target market, existing infrastructure and risk tolerance. The matrix below is a starting point – not a substitute for structured legal advice on your specific facts.
Crypto exchange serving a global retail and institutional book. VARA's exchange licence is purpose-built and relatively explicit in its requirements. Dubai's time-zone position between European and Asian sessions suits a globally operating exchange. The cross-border challenge is managing access to non-UAE markets without triggering licensing obligations in those markets. Switzerland's fintech or banking licence may suit an exchange with a primarily European or institutional client base, but the Swiss framework is more demanding for retail-facing models. Timeline to authorisation in both cases is a matter that varies by activity scope and application readiness; write qualitatively when speaking to a board.
Custodian serving institutional clients. Both jurisdictions have a custody-specific licence or regulated-activity category. VARA's custody rulebook is explicit and increasingly benchmarked against global institutional expectations. FINMA's approach to custody is embedded in its broader financial-institution framework. Operators with a primarily European institutional client base may find that a Swiss authorisation carries stronger immediate recognition with those clients. Operators with a GCC and Asian institutional client focus will find that a VARA licence carries more weight in those conversations.
Token issuer launching a payment or utility token. Switzerland's FINMA token taxonomy provides a clear classification framework, and a payment or utility token that passes the classification test faces a relatively lighter regulatory burden than an asset token. VARA's issuance regime covers token offerings as regulated activities and requires compliance with the applicable rulebook. The choice between regimes depends in part on where the secondary market for the token will be most active and which regulatory signal carries more weight with the intended investor base.
Digital-asset fund or asset manager. Both regimes offer a viable path. Swiss collective investment law is mature and internationally recognized; a FINMA-supervised fund benefits from established investor familiarity. VARA's management and investment licence is newer but is gaining recognition among institutional allocators in the GCC and beyond. For a fund with a genuinely global investor base, the choice of operating jurisdiction should be driven by the domicile of the general partner or manager, not the domicile of the fund vehicle – and those may differ.
Common Mistakes When Choosing Between the Two
The most consequential mistake we see is treating a licence application as a standalone administrative exercise rather than as the output of a structure that has been engineered for the operator's actual business model. Both VARA and FINMA will test the coherence between the licensed activities, the entity's substance and the commercial model. An application that describes a business the entity does not actually operate – or cannot operate within the jurisdiction – will fail on substance grounds, not on documentation quality.
A second recurring error is underestimating the banking timeline. In our cross-border practice, operators regularly assume that the licence will be in hand before they begin the banking conversation. In practice, banking due diligence runs in parallel with licensing and can be the longer track. Starting the banking conversation before the application is submitted – using the regulatory intent, the compliance program documentation and the AML policy – compresses the overall time to operational readiness.
A third error, specific to operators considering Switzerland, is failing to complete the token classification analysis before selecting a licence route. An operator that classifies its token incorrectly and selects a fintech licence may discover mid-application that its token is treated as an asset token requiring a securities dealer or banking authorisation. Correcting that error after an application has been filed is expensive in both time and regulatory-relationship terms.
In a recent licensing matter, an exchange operator had obtained registration in a lighter-touch offshore jurisdiction and proceeded to onboard clients across Europe and the GCC. By the time the operator engaged us, it was facing regulatory inquiries in two EU member states and its primary banking relationship had been suspended. The analysis showed that the offshore registration did not cover the operator's actual client geographies. We worked with the operator to structure a two-entity model – a VARA-licensed entity for GCC and Asian client flows and an EU-established entity for EU passporting – and to rebuild the AML program to the standard required in both jurisdictions. The banking relationships were re-established, though on a longer timeline than the operator had initially planned.
A Common Assumption Worth Challenging
A common assumption among operators at the MOFU stage of a licensing decision is that a single offshore registration is sufficient to serve clients globally. It is not. The concept of "regulatory arbitrage" – placing a nominal entity in a light-touch regime and using it as a permission to access all markets – has been consistently eroded by the FATF virtual-asset standards, by MiCA's market-access rules, by the FCA's financial-promotion regime and by the extraterritorial reach of US federal and state regulators.
Both VARA and FINMA are serious regimes. That is their value. An operator that holds a VARA licence or a FINMA authorisation holds a credential that opens doors with institutional clients, banking partners and market counterparties. But neither credential is a global licence. The operator still needs to assess whether it has access rights – or at minimum a defensible position – in each market where it actively solicits or serves clients. That assessment is not a one-time exercise; it needs to be refreshed as regimes evolve.
Related at OBOLUS:
- Licensing and Registration for Digital-Asset Businesses – how we scope and execute licence applications across 70+ jurisdictions
- Crypto Exchange Licensing in the Bahamas – an alternative offshore hub for exchange and custodian structures
- Regulator AML Audit Defence – managing the compliance burden when a supervisor reviews your program
FAQ
How long does a crypto licence take to obtain?
Timelines vary materially by jurisdiction, activity scope and application readiness. Under VARA, a full licence for a complex activity such as an exchange can take several months from submission to authorisation; simpler scopes may move faster. FINMA's timeline depends on the licence route – a fintech licence is generally shorter than a banking licence. In both cases, pre-application engagement with the regulator and a well-prepared application compresses the timeline. Operators should also account for the parallel banking due-diligence track, which frequently runs longer than the regulatory process.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your operator type, target client geography, substance capacity and risk tolerance. VARA suits operators with a GCC and Asian market focus or those seeking a purpose-built virtual-asset regime. FINMA suits operators with a European institutional client base or complex token-classification questions. Many multi-market operators ultimately maintain licensed entities in both jurisdictions. A structured legal assessment of your specific facts is the only reliable path to the right answer.
Do I need a separate custody licence?
In both Dubai and Switzerland, custody of virtual assets is a regulated activity that typically requires specific authorisation or licence coverage. Under VARA, custody is a distinct rulebook category. Under FINMA, custody services may be caught by banking or securities-dealer requirements depending on the model. An operator that offers custody incidentally to another primary activity – for example, an exchange holding client assets – needs to confirm that its primary licence covers the custody element or obtain separate coverage. Assuming coverage without confirming it is a common and consequential error.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence, banking and tax stack across operating, custody and payment layers before you commit – so the structure is engineered for your actual business, not an idealized version of it. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in cross-border virtual-asset licence strategy across the UAE, Swiss and EU regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.