Operating a crypto business without the right regulatory authorisation is not a gap-in-coverage problem – it is an enforcement trigger. Regulators in Dubai and London are both active, both watching, and both prepared to freeze rails, revoke approvals and refer matters to prosecutors. The question facing a founder or general counsel today is not whether to licence a digital-asset business. It is where – and which regulatory regime best fits the operator profile, the user base and the capital structure. This page sets out a direct head-to-head comparison of the VARA (Virtual Assets Regulatory Authority) regime in Dubai and the FCA (Financial Conduct Authority) regime in the United Kingdom, across the axes that matter to an exchange, custodian, token issuer or fund.
Neither jurisdiction is universally superior. Each regime reflects a different regulatory philosophy, a different supervisory posture and a different commercial ecosystem. The right answer depends on entity structure, user geography, product scope and banking relationships. We map that decision below.
The Regulatory Backdrop: Two Distinct Philosophies
VARA and the FCA represent two philosophies in crypto regulation that are converging on ambition but diverging on method. VARA, established in Dubai in 2022, is a purpose-built, activity-based virtual asset regulator – the first of its kind globally with jurisdiction over an entire emirate. It issues licences tied to specific activities: advisory services, broker-dealer operations, custody, exchange, lending, investment management and transfer/settlement services. A business performing multiple activities requires authorisation for each one. The VARA rulebooks are detailed and prescriptive, covering market conduct, technology governance, AML and consumer protection.
The FCA operates under a different architecture. Crypto businesses in the UK must register under the Money Laundering Regulations (MLR) as a cryptoasset business – an AML/CFT registration, not a full prudential authorisation. Separately, the financial promotion regime governs how crypto can be marketed in the UK, with firm requirements on approvers and communications. Depending on the product, a business may also require FCA authorisation under the Financial Services and Markets Act for broader regulated activities. The UK is moving toward a comprehensive crypto licensing regime, but full implementation is a matter of ongoing legislative work.
In our practice, we regularly advise operators who underestimate the UK's layered approach. A business with a UK MLR registration may still fall foul of the financial promotion rules, the e-money regime or emerging stablecoin requirements – each governed by a different FCA permission set.
Who Needs a Licence in Each Jurisdiction?
The scope of mandatory authorisation differs materially between VARA and the FCA, and getting this wrong is where enforcement exposure begins. Under VARA, any entity carrying out virtual asset activities in or from the Emirate of Dubai – on the mainland, outside the DIFC financial free zone – must hold a VARA licence before commencing operations. The DIFC is governed separately by the FSRA within the ADGM/DIFC framework; VARA's jurisdiction stops at the DIFC perimeter. That boundary matters enormously for structuring.
In the UK, the obligation to register with the FCA as a cryptoasset business applies to firms conducting certain cryptoasset activities by way of business in the UK. The test is not purely territorial – a firm targeting UK users from outside the UK can fall within the perimeter. The FCA has been explicit that overseas operators serving UK retail clients must comply with UK financial promotion rules, regardless of where the business is incorporated.
The cross-border reality, which we see in almost every mandate, is that an operator licensing in Dubai for its core exchange function may simultaneously have UK retail user exposure that triggers FCA obligations independently. A single VARA licence does not immunise a business from UK financial promotion requirements applied to its UK-facing marketing.
VARA's note-to-obtain process – a preliminary approval stage before full licensing – means that businesses must engage VARA before launching in Dubai. The FCA's MLR registration pathway, while shorter in formal process, carries its own due diligence intensity, particularly around beneficial ownership and AML systems.
For a scoped assessment of whether your business requires VARA authorisation, FCA registration, or both, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis materially.
Licence Categories: Activity-Based vs Regime-Based
The structural difference in how each regime carves up the regulated perimeter has direct implications for compliance cost and operational flexibility. VARA's activity-based model means that a business adding a new product line – say, adding lending to an existing exchange – triggers a fresh authorisation application. The upside is clarity: the VARA rulebook for each activity is specific, and a well-advised business knows in advance exactly what governance, capital and conduct obligations apply to each licence it holds.
The FCA's approach is regime-layered. An MLR-registered cryptoasset business has demonstrated AML fitness, nothing more. If that same business issues e-money, it needs EMI authorisation. If it deals in securities tokens, it needs a different FCA permission. If it manages a crypto fund, it may require FCA authorisation as an investment manager. The permissions do not aggregate automatically – each layer requires its own application, its own capital and its own ongoing reporting.
For a custodian specifically: custody is a regulated VARA activity in Dubai requiring its own licence, with specific technology, segregation and safeguarding obligations under the VARA custody rulebook. In the UK, custody of cryptoassets sits within the MLR registration perimeter for AML purposes, but safeguarding requirements may also arise under the FCA's client asset rules if the custodian holds regulated instruments. The analysis turns on what is being held and for whom.
What Does the Application Process Look Like?
Understanding the process – not just the timeline – is where preparation separates businesses that obtain authorisation from those that stall. Both VARA and the FCA require substantial pre-application work. The quality of that preparation determines the outcome more than any other variable.
A VARA application in Dubai typically involves a preliminary registration stage, followed by submission of a detailed business plan, governance documentation, AML/CFT manuals, technology risk assessments and evidence of minimum capital. VARA conducts substantive review of the applicant's key personnel, including fitness-and-propriety assessments. The process is iterative – VARA issues queries, the applicant responds, revisions follow. Timeline varies by activity type and the completeness of the submission, but operators should plan for a process measured in months rather than weeks.
The FCA's MLR registration process requires applicants to demonstrate robust AML/CFT systems, a clear business model and fit-and-proper principals. The FCA has historically had a high rejection and withdrawal rate for cryptoasset MLR applications – a fact it has disclosed publicly. The FCA expects applicants to have implemented, not merely planned, the systems being described. Applications supported by detailed system documentation and a clear AML risk assessment consistently perform better than those submitted as forward-looking plans.
In our cross-border practice, we have seen applicants in both jurisdictions stall at the same point: insufficient substance in the documented compliance framework. Regulators in both hubs now expect to see an operating compliance function, not a promised one.
Economic Substance, Staffing and Tax Interaction
A licensed entity is not merely a regulatory artefact – it is also the vehicle through which revenues flow, taxes are assessed and banking relationships are structured. The substance requirements in each jurisdiction differ, and they interact directly with tax treatment.
VARA-licensed entities operating in Dubai are subject to the UAE's corporate tax regime, which introduced a federal corporate tax that applies to business profits above the applicable threshold. The UAE has no personal income tax. For a business where key principals are willing to relocate – and where the management and control genuinely moves to Dubai – the tax efficiency argument is material. However, substance is not optional: a Dubai entity whose decisions are made elsewhere faces both regulatory risk under VARA and tax risk under transfer-pricing and residency rules in other jurisdictions.
In the UK, a licensed business is subject to UK corporation tax on its profits and, depending on activity, potentially VAT. The UK does not provide the same personal tax environment as the UAE. For most institutional operators, the UK's attractiveness lies in its legal system, its banking infrastructure, its deep talent pool and its access to EU clients via a distribution arrangement – not its tax rate.
The cross-border structuring question we address regularly is whether the optimal answer is a Dubai entity for the operating exchange or custody business and a UK entity for institutional distribution or European-facing compliance. That split structure is legitimate and common – but it requires genuine substance in both places, careful transfer-pricing analysis and coordinated banking.
To map the licence, banking and tax stack for your structure before you commit, write to info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route forward.
AML, the Travel Rule and Ongoing Compliance
Both VARA and the FCA enforce AML/CFT obligations derived from the FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule (the obligation to pass originator and beneficiary information with a transfer above the applicable threshold). The supervisory posture and enforcement intensity differ.
VARA's AML/CFT framework is embedded in its rulebooks and is enforced as part of VARA's ongoing supervision. VARA-licensed businesses must maintain AML compliance functions proportionate to their activity profile and submit to periodic VARA reviews. The UAE's financial intelligence unit and broader UAE AML/CFT framework, which has been subject to international review, interacts with VARA supervision. Businesses should expect Travel Rule compliance to be a material element of VARA's supervisory focus.
The FCA applies the UK's implementation of the FATF Travel Rule to UK-registered cryptoasset businesses. The FCA has made clear that non-compliance with the Travel Rule is a registration ground. The UK regime requires VASPs to collect, verify and transmit originator and beneficiary data – and the FCA has stated publicly that it will use its powers against businesses that fail to implement Travel Rule solutions.
A business operating in both jurisdictions must run parallel Travel Rule compliance programs. The data standards, the sunrise issues – where a UK VASP interacts with a counterpart in a jurisdiction that has not yet implemented the Travel Rule – and the technology integration differ enough that a single compliance solution rarely covers both without customization.
Banking and Payment Rails: The Practical Constraint
Regulatory authorisation and banking access are not the same thing. A licensed crypto business without a functioning bank account cannot operate. Banking for crypto businesses remains constrained globally, and the VARA/FCA choice interacts with banking access in ways that are not always visible at the application stage.
In Dubai, VARA-licensed businesses benefit from the UAE's stated policy of creating a crypto-friendly financial environment. Several UAE banks are open to VARA-licensed clients. However, banking remains selective, particularly for businesses with complex global user bases or high-risk product profiles. Businesses that are licensed but have thin substance – a holding company shell rather than a genuine operating entity – continue to face banking friction.
In the UK, the FCA's MLR registration does not guarantee banking. Several UK banks remain cautious about crypto. A UK-registered business with strong compliance documentation, clear risk controls and an identifiable institutional client base generally fares better. The UK's payment infrastructure – access to Faster Payments, CHAPS and a deep network of EMI-licensed payment service providers – is a material advantage for businesses needing fiat on/off ramp functionality.
In a recent structuring matter, an exchange operator had VARA authorisation but could not open UAE banking due to its European user base profile. We coordinated the banking engagement alongside the regulatory structure, ultimately layering a UK entity with EMI access for European fiat flows while the Dubai entity held the exchange licence. That kind of layered approach is common in our practice – and it begins at the structuring stage, not after licensing.
Decision Matrix: Which Profile Should Choose Which Jurisdiction?
There is no universal answer, and this page does not offer one. What we can offer is a profile-based analysis of where each jurisdiction creates structural advantage.
Operator Profile A: Retail crypto exchange, primarily serving MENA and Asian markets, principals willing to relocate. VARA's activity-based licensing regime, the UAE's tax environment and the regional distribution advantage point toward Dubai as the primary licensing venue. The business should plan for genuine UAE substance, VARA's conduct requirements and a UAE banking engagement running in parallel with the application.
Operator Profile B: Institutional custody provider, serving European and UK family offices and funds. The FCA's MLR registration – combined with strong CASS (client asset) documentation – and the UK's legal infrastructure and institutional trust environment point toward a UK primary licence. VARA may be appropriate for a parallel Dubai vehicle servicing MENA institutional clients if the business scales in that direction.
Operator Profile C: Stablecoin or e-money token issuer targeting European distribution. The primary question is MiCA/ESMA compliance for EU distribution; the UK post-Brexit stablecoin regime is developing separately under the FCA. A UK entity does not provide EU passporting. A VARA licence does not provide EU passporting. Issuers targeting EU distribution must engage with an EU member-state CASP authorisation alongside or instead of these two options.
Operator Profile D: Crypto fund manager or investment manager with institutional LPs. VARA has a management licence. The FCA has established fund-management authorisation. The Cayman Islands and BVI remain common for the fund vehicle itself, with the manager licensed in the appropriate jurisdiction. The choice between VARA and FCA for the manager typically turns on where LPs are domiciled and where marketing is conducted.
Every profile faces the same cross-border reality: licensing in one jurisdiction does not eliminate obligations in others. The user base, the marketing channels, the banking and the product scope each carry independent regulatory tails.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we scope and execute multi-jurisdiction licence applications for exchanges, custodians and issuers
- Economic Substance for Licensed VASPs: The Structuring Angle – the substance requirements regulators and tax authorities apply to licensed VASP entities
- Exchange Disclosure Orders in Germany: BaFin – how disclosure and enforcement intersect with licensed and unlicensed operators in a major EU jurisdiction
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially between jurisdictions, activity types and the quality of the application. Under VARA in Dubai, a well-prepared submission for a single-activity licence typically takes several months from submission to approval; multi-activity applications take longer. FCA MLR registration in the UK has historically taken several months, with complex applications running considerably longer. In both cases, incomplete or inadequate submissions are the primary cause of delay. Preparation quality is the single most controllable variable.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction turns on operator profile, user geography, product scope, banking needs and the principals' willingness to establish genuine substance. Dubai under VARA suits operators targeting MENA and Asia with a genuine UAE presence; the UK suits institutional and European-facing businesses. Most operators at scale engage both. We map the decision across all relevant axes before recommending a primary licensing venue.
Do I need a separate custody licence?
Under VARA, custody of virtual assets is a regulated activity requiring its own VARA licence, separate from an exchange or brokerage licence. In the UK, the position depends on the nature of the assets held and the client type; cryptoasset custody currently falls within the MLR registration perimeter for AML purposes, but additional FCA permissions may apply depending on asset classification and client profile. Operators providing custody should obtain specific advice before relying on a general registration or licence.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the authorisation you obtain reflects the business you are actually building. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when things go wrong. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-jurisdiction digital-asset licensing strategy, VARA applications and FCA regulatory engagement for crypto businesses entering or expanding in the MENA and UK markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.