Crypto exchange setup in United Arab Emirates (VARA, Dubai)

A business looking to operate a crypto exchange in the UAE faces a regulated environment that is among the most structured in the world. Dubai's Virtual Assets Regulatory Authority (VARA) – the dedicated crypto regulator for mainland Dubai – requires a specific activity-based licence before any exchange, brokerage or custody function goes live. Operating without that authorisation exposes the business to enforcement action, immediate banking disruption and the loss of any regulatory standing it has built in other markets. This page sets out the regulated basis, the process for an inbound operator, the cross-border banking and tax interaction, and the decision points that determine whether Dubai is the right first licence or part of a broader stack.

Why the VARA regime is the starting point for every Dubai crypto exchange

VARA is the world's first standalone virtual-asset regulator operating at city level, and its rulebooks cover every material exchange activity from order-matching to custody to margin lending. Any entity that proposes to operate a crypto exchange on the mainland of Dubai – outside the DIFC financial free zone – must obtain a VARA licence before it touches a client order. The VASP registration concept that preceded VARA's activity-based licences has been superseded; operators now apply for a specific licence under VARA's multi-rulebook regime.

The consequence of getting this wrong is not academic. In our licensing practice, we have seen businesses launch on the assumption that a registration in a lighter-touch offshore jurisdiction covers their UAE-resident users. VARA does not accept that position. The regulator has taken a broad view of where a service is "provided," and operators serving UAE residents without a VARA authorisation face an escalating response: a cease-and-desist, freezing of payment rails and, in some cases, referral to the UAE's financial intelligence unit. The loss of banking – a risk every licensed operator already manages carefully – is an immediate consequence.

VARA's activity-based licensing structure means a single entity may need to apply for more than one licence category if it provides exchange, custody and lending services in combination. Understanding that stack before filing the application is essential.

For a scoped assessment of your Dubai licensing position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity's home jurisdiction, the user base, the banking – change the analysis. Map your options.

What activity-based licences does a crypto exchange need under VARA?

VARA issues licences by activity, not by entity type. An operator running a centralized exchange that matches buy and sell orders will require an Exchange Services licence. If it holds client digital assets between settlement, it likely requires a separate Custody Services licence. If it offers margin products or lending against collateral, the Lending and Borrowing Services licence applies. Transfer and settlement functions have their own category.

This architecture has a practical consequence for product design. A business that intends to launch with a simple spot-trading interface and later add staking, yield products or a custody wallet must map each feature to its VARA activity category at the planning stage. Adding a product after licensing means returning to VARA for an amended authorisation – a process that takes time and regulatory goodwill. Operators we advise regularly stress-test their product roadmap against the VARA rulebooks before submitting the initial application, precisely to avoid that bottleneck.

The VARA rulebooks also impose ongoing obligations: minimum capital (which varies by activity category and is subject to VARA's current schedule), governance standards, technology and cybersecurity requirements, and market-conduct rules that are broadly aligned with the expectations of the FCA and MAS. An operator transitioning from a lighter-regulated environment will find the compliance lift significant.

How should an inbound operator structure the entity for a VARA application?

An inbound operator must establish a legal entity in Dubai – either a mainland limited liability company or a VARA-approved free-zone entity – before a licence application can be filed. The DIFC is a separate jurisdiction with its own regulator; VARA does not regulate DIFC-based entities, and vice versa. Choosing between mainland Dubai, a VARA-approved free zone, or the DIFC is itself a material legal and commercial decision.

Most inbound exchange operators we advise choose the mainland or a VARA-approved free zone. The reasons are practical: VARA's rulebooks were written for that environment, the regulator is accessible, and the activity categories match the business model of a retail or institutional exchange better than the DIFC's securities-focused regime.

The entity structure must also address the group level. Where a Dubai entity is part of a broader international group, VARA expects clarity on the group structure, the ultimate beneficial owner, the source of capital and the control relationships between the Dubai entity and any offshore holding companies. A common early-stage mistake is submitting an entity structure that was assembled for tax purposes without regard to VARA's fit-and-proper and source-of-funds expectations. We have seen applications stall for months on precisely this point.

What does the VARA application process look like in practice?

The VARA application follows a multi-stage process: a minimum viable product (MVP) licence, then a full operational licence, with supervisory review at each stage. The MVP phase allows a business to test its product with a limited user base under VARA oversight before receiving full authorisation. The timeline from initial filing to full operational status varies by the complexity of the business model and the completeness of the application; VARA has indicated publicly that it aims to be responsive, but realistic timelines for a complex exchange application run to several months at minimum.

The core application package requires: a detailed business plan, a technology and cybersecurity architecture review, AML/CFT policies aligned with the UAE's FATF-compliant framework, a governance structure with qualified senior personnel, and evidence of minimum capital. Each element is reviewed against VARA's published rulebooks. Incomplete or inconsistent submissions restart the clock.

VARA's rulebooks require alignment with the UAE's broader AML/CFT regime, which implements the FATF Recommendations – including Recommendation 15 on virtual assets and the Travel Rule (the obligation to transmit originator and beneficiary data with transfers above the applicable threshold). An exchange that cannot demonstrate a credible Travel Rule solution – either through a licensed TRISA/OpenVASP participant or a bilateral arrangement – will not clear VARA's AML gateway. In our cross-border practice, we find that operators often underestimate the Travel Rule build time relative to the overall application timeline.

How does banking and payment-rail access work for a VARA-licensed exchange?

Banking is the operational chokepoint for most VARA-licensed exchanges, and it is the area where cross-border structure matters most. UAE retail banks have, in recent years, become more willing to onboard licensed VASPs – particularly where the entity holds a VARA authorisation and can demonstrate a clean compliance posture. That said, correspondent banking relationships for fiat on/off ramps remain a negotiation, not a guarantee. A licence opens the door; it does not close the deal.

The cross-border dimension adds complexity. An exchange that settles in USD via correspondent banking must satisfy both the UAE bank's due-diligence requirements and the US correspondent's OFAC and BSA expectations. Stablecoin settlement routes – using USDT or USDC – are increasingly used as an alternative, but they carry their own regulatory treatment under VARA and require the exchange to have a clear position on how stablecoins are classified under its licence. Tether (USDT) and Circle (USDC) each hold contract-level freeze authority over their issued tokens and will act on law-enforcement or OFAC designations; an exchange that holds client stablecoin balances must factor that operational risk into its custodial structure.

For exchanges with a European or UK user base, MiCA – the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities – creates a separate licence obligation that a VARA authorisation does not satisfy. An operator serving EU residents from a Dubai entity needs either a MiCA CASP authorisation in an EU member state or a passportable licence from an existing EU hub. We regularly advise on the dual-track structure: VARA for the Middle East and Asian markets, a MiCA CASP licence in an EU jurisdiction for European users.

What are the tax and economic-substance considerations for a Dubai exchange?

The UAE's corporate-tax regime introduced a headline rate that applies broadly to taxable persons resident in the UAE, with free-zone entities qualifying for a preferential rate subject to satisfying substance requirements. The specific rates and qualifying conditions are set by the UAE's corporate-tax legislation and should be confirmed against current published guidance, as the regime continues to develop. Operators we advise treat the substance question as inseparable from the licensing question: VARA expects genuine presence – qualified management, real decision-making, a functioning compliance function – and those same facts support a substance claim for tax purposes.

Transfer pricing is a growing concern for exchange groups with a Dubai entity and offshore intellectual property or technology components. Where a UAE entity licences technology from a related offshore company, VARA's governance expectations and the UAE's transfer-pricing rules (aligned with OECD guidelines) both create exposure if the arrangement is not properly structured at inception. Getting the intra-group agreements right before the VARA application is filed avoids a restatement later.

The UAE has no personal income tax. For founders and senior employees relocating to Dubai to satisfy VARA's local-management requirements, that is a material consideration. But it does not eliminate the need for proper employment contracts, sponsored residency and social-insurance compliance for any non-UAE-national staff – details that are routinely underestimated in the rush to file.

A recent licensing and structuring matter

In a recent engagement, an Asia-Pacific exchange operator sought VARA authorisation for a Dubai entity while maintaining its existing MAS-regulated Singapore operation. The group had structured its Dubai entity for tax reasons without consulting licensing counsel, resulting in an ownership chain that VARA's fit-and-proper review flagged at the pre-application stage. We restructured the shareholding to reflect VARA's expectations, coordinated with allied counsel in Singapore to ensure the Dubai application did not create regulatory overlap or adverse disclosure obligations under the MAS regime, and prepared the full VARA application package including the Travel Rule solution documentation. The business received its MVP licence within the timeline the operator had set for its product launch.

Which operator profile should pursue a VARA licence?

Not every exchange operator should lead with a VARA application. The decision turns on the target user base, the product architecture and the capital position.

An operator targeting Middle Eastern institutional clients and high-net-worth retail users, with a product centered on spot trading and custody, is a natural fit for VARA's mainland regime. The regulatory prestige of a VARA licence is significant in that market, banking access for licensed entities is improving, and the activity-based architecture maps well to a custody-plus-exchange model. The capital and compliance costs are material; factor in the ongoing supervisory fee, the technology build for VARA's cybersecurity requirements, and the cost of qualified UAE-resident senior management. Timeline to full operational licence: likely several months to over a year depending on application complexity.

An operator primarily targeting European retail users should begin with MiCA CASP authorisation in an EU hub – Lithuania, Malta or another member state – and add a VARA licence when the Middle East revenue line justifies the cost. Running both structures in parallel from day one is possible but demanding; most early-stage businesses sequence them.

An operator with a DeFi or hybrid on-chain product should take legal advice before assuming VARA applies or does not apply. VARA's published guidance on decentralized protocols is still developing, and the boundary between a regulated exchange service and a non-custodial interface is not yet drawn with precision.

If a prior application stalled or banking was withdrawn, a second read can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com or via t.me/oboluslaw. Map your options.

A common assumption that costs operators time and money

A common assumption in the market is that a single offshore registration – BVI, Cayman or a lightweight EU VASP registration from a prior era – is sufficient to serve a global client base including UAE residents. VARA does not accept that position. The regulator applies a substance-over-form test to where a service is provided and has made clear that a foreign entity directing marketing at UAE residents, onboarding UAE-resident accounts or processing transactions from UAE IP addresses is operating in Dubai regardless of where its servers sit.

The same logic applies to MiCA and to MAS. Each major jurisdiction has taken a territorial view of its licensing obligation, and the days of serving multi-jurisdiction retail users from a single lightly regulated entity are, for all practical purposes, over. Operators we advise now build a licence stack – a primary hub, a secondary authorisation for the next-largest market, and a clear legal basis (or a geo-block with genuine technical controls) for every other market. That stack costs more. It also survives a regulatory inspection.

Related at OBOLUS

Related at OBOLUS

• Licensing and registration for digital-asset businesses – how we scope and manage licence applications across 70+ jurisdictions.
• Economic substance for licensed VASPs: a cross-jurisdiction comparison – substance requirements in UAE, Singapore, Cayman and EU hubs compared.
• Fund manager licensing for regulated entities – where an exchange also manages or administers a digital-asset fund structure.

About OBOLUS

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including the full VARA activity-based licence stack for Dubai – on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. We map the licence stack across operating, custody and payment layers before you commit. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.

FAQ

How long does a crypto licence take to obtain?

Under VARA's process, a realistic timeline from initial application to full operational licence for a complex exchange runs to several months and, for businesses with involved group structures or novel product features, over a year. The MVP phase may be granted sooner. Timelines in other jurisdictions – MAS in Singapore, the SFC in Hong Kong, the FCA in the UK – similarly depend on application completeness and business complexity. Early engagement with counsel to prepare a clean, complete package materially reduces the risk of a drawn-out review.

Which jurisdiction is best for licensing my crypto business?

There is no universal answer. The right licence jurisdiction depends on your target user base, product type, capital position, banking strategy and group structure. Dubai under VARA suits operators targeting Middle Eastern and international institutional clients. Singapore under MAS suits Asia-Pacific-facing businesses. A MiCA CASP authorisation suits operators that need EU passporting. Many businesses ultimately need more than one authorisation. We map those options before a client commits, rather than after a filing that does not fit the structure.

Do I need a separate custody licence?

Under VARA, custody is a distinct licensed activity. An exchange that holds client digital assets between settlement – rather than simply matching orders without taking possession – will in most cases require a Custody Services licence in addition to an Exchange Services licence. The answer depends on the precise operational model: how client assets are held, for how long and by which entity. This is one of the first questions we work through with exchange clients, because the answer shapes both the application and the capital requirement.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in activity-based licensing applications under VARA, MiCA and the MAS Payment Services Act for inbound exchange and custody operators.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.