Digital-asset custody authorisation in Dubai is a regulatory obligation, not an optional enhancement. Any business that holds, safeguards or administers virtual assets on behalf of clients in Dubai mainland must obtain a custody authorisation under the Virtual Assets Regulatory Authority (VARA) regime before commencing operations. Operating without that authorisation exposes the business to enforcement action, termination of banking relationships and a formal bar on client onboarding – risks that arrive faster than most operators anticipate.
VARA, established as Dubai's dedicated virtual-asset regulator, issues activity-based licences across a defined set of regulated functions. Custody is one of those discrete activities. A business holding a VARA exchange licence, for example, does not automatically hold a custody authorisation; the two are separate instruments. Operators that consolidate services under a single VARA entity must apply for each activity they intend to conduct. This page maps the custody authorisation path, the process for an inbound business, the cross-border interactions that shape the structure, and the decision points a general counsel needs to resolve before filing.
What makes custody a regulated activity under VARA?
Custody of virtual assets is a regulated activity under the VARA regime because it creates a fiduciary relationship between the operator and the client's digital assets. The activity encompasses holding private keys, administering wallets, and providing safeguarding services over client virtual assets – regardless of whether the operator also operates a trading platform or acts as an intermediary.
VARA's activity-based licensing architecture means that a business must identify every regulated function it performs and apply for authorisation at the activity level. In our practice, operators frequently underestimate this. A fund administrator that receives and holds stablecoins as part of a subscription process is performing a custody function. A payment processor that retains client tokens between settlement cycles may be performing a custody function. The classification turns on the substance of the arrangement, not its commercial label.
VARA's rulebooks, which sit alongside the overarching Virtual Assets and Related Activities Regulations, set out the obligations that attach to a custody authorisation. These cover, among other matters, asset segregation, safeguarding standards, sub-custody arrangements, technology controls and client disclosure requirements. Operators that come from regulated markets – Singapore's Payment Services Act regime, MAS-supervised entities, or FSRA-authorised firms in ADGM – will find significant overlap in principle, though the specific requirements of VARA's rulebooks differ from those other regimes in important respects.
VARA is the sole licensing authority for virtual-asset activities on Dubai mainland. It does not govern the DIFC financial free zone; businesses operating within DIFC are subject to the DFSA. This geographic distinction is material and is addressed in the cross-border section below.Who needs a custody authorisation in Dubai?
Any business that holds or administers virtual assets on behalf of third parties within Dubai mainland's regulated perimeter requires a VARA custody authorisation, regardless of whether custody is its primary business line or an ancillary service layer.
In practice, the categories of operator most frequently requiring this authorisation are digital-asset exchanges offering wallet services, custodians acting for institutional clients or funds, payment service providers that retain client assets during processing, and prime brokerage operations that hold collateral. Virtual-asset fund managers that retain discretion over client assets – and hold those assets rather than segregating them to an independent custodian – may also trigger the custody activity.
Operators we advise routinely encounter a structural question at this point: should the custody function be held within the main operating entity or ring-fenced into a dedicated special-purpose vehicle? VARA permits both, subject to fitness and propriety standards applying to each entity separately. There are commercial, liability and capital-planning reasons that inform that choice, and the answer differs across operator profiles. That decision is best made at the design stage – before the application is filed – because restructuring after authorisation carries its own regulatory process.
The VARA regime also applies to overseas entities seeking to serve clients based in Dubai. A business incorporated outside the UAE that provides custody services to Dubai-based clients is, in VARA's regulatory framework, subject to the same authorisation requirement as a Dubai-incorporated entity. This has important implications for token platforms and custodians that have expanded into the Gulf market without establishing a formal UAE presence. Operating through a non-UAE entity to serve UAE clients does not provide a safe harbour under the VARA regime.
How does an inbound business apply for a VARA custody authorisation?
An inbound business applies for VARA authorisation in a sequenced process that begins with entity establishment, proceeds through regulatory engagement, and concludes with a supervisory review of the applicant's governance, technology and financial position.
The first stage is entity formation. VARA-licensed businesses must be incorporated in Dubai. That means establishing a Dubai mainland company – typically a private limited liability company (LLC) or a free-zone entity with the correct activity codes – or, for larger groups, a Dubai International Financial Centre entity (though note that DFSA, not VARA, governs activities in the DIFC). Operators choosing between a free-zone structure and a mainland structure need to confirm that their chosen vehicle can hold the VARA licence; free-zone companies in several Dubai free zones can hold VARA licences, but the permitted activities and operational requirements vary by zone.
Once the corporate vehicle exists, the applicant engages VARA. The initial engagement typically involves a preliminary application setting out the proposed business model, the scope of activities sought, and the key individuals who will serve as senior management and compliance officers. VARA evaluates the initial application to determine whether to invite a full application.
The full application involves submission of a detailed business plan, financial projections, a technology risk assessment, AML/CFT policies and procedures, a description of the custody architecture (segregation model, key management approach, sub-custody arrangements if any), and a corporate governance framework. Fit-and-proper assessments apply to directors, controllers and senior managers. VARA may convene a regulatory interview as part of its review.
The timeline from initial application to final authorisation varies by complexity of the proposed activity and completeness of the submission; operators should plan for a period measured in several months, and preparations are best begun well before the intended commercial launch date. We have seen applications stall at the document-quality stage because the technology risk assessment did not meet the standard VARA expects. An incomplete submission resets the clock.Following the grant of in-principle approval, VARA will issue conditions precedent that the applicant must satisfy before the authorisation becomes final. These commonly include capital deployment into the UAE entity, appointment of a local compliance officer, and completion of a technology audit. Only once conditions precedent are satisfied does VARA issue the operational licence.
What AML and Travel Rule obligations attach to the custody authorisation?
A VARA custody authorisation carries a full suite of AML/CFT obligations aligned with FATF Recommendation 15 on virtual assets, including compliance with the Travel Rule – the obligation to pass originator and beneficiary data with a virtual-asset transfer.
VARA-authorised custodians must implement a risk-based AML programme, conduct customer due diligence and enhanced due diligence for higher-risk relationships, maintain transaction monitoring systems capable of identifying suspicious activity, and report suspicious transaction reports to the UAE Financial Intelligence Unit. The AML framework in Dubai is enforced by both VARA and the UAE's national AML supervisor; custodians operate in a dual-supervisory environment and must satisfy both sets of expectations.
The Travel Rule is operationally significant for custodians. Every virtual-asset transfer above the applicable threshold requires the originator's custodian to transmit identifying data to the beneficiary's custodian, and vice versa. In practice, this means that a VARA-authorised custodian must be integrated into a Travel Rule compliance solution – either a proprietary system or a recognised third-party protocol – before it can process transfers at scale. The technical integration of a Travel Rule solution is part of the technology infrastructure review that VARA conducts during the authorisation process. Operators that underinvest in this infrastructure at the application stage face remediation costs after launch.
For operators coming from other flagship regimes, the VARA AML expectations map conceptually onto MAS requirements under Singapore's Payment Services Act or FSRA requirements in ADGM. However, the specific documentation standards, threshold levels and reporting channels differ. Allied counsel in the relevant jurisdiction can assist with mapping the delta between an existing AML programme and VARA's specific requirements.
How do tax and banking interact with a Dubai custody authorisation?
Obtaining a VARA custody authorisation in Dubai solves the regulatory question for Dubai mainland operations, but it does not resolve the banking and tax position of the group as a whole. For most inbound operators, those two elements require equal attention.
On the banking side, UAE banks have, in aggregate, become more accessible to VARA-licensed virtual-asset businesses than they were before the VARA regime was fully operational. A VARA authorisation is frequently a threshold condition for a UAE bank to open an account for a virtual-asset business. However, authorisation alone does not guarantee a banking relationship; banks apply their own enhanced due diligence standards to VASP clients, and the quality of the applicant's compliance programme remains central to that assessment. Operators we advise are consistently told by UAE correspondents that the depth of the AML framework – not the licence certificate – is the determinative factor.
On the tax side, Dubai offers a zero corporate-tax environment for qualifying income, though the UAE's corporate tax regime – introduced in recent years – applies to entities earning above the applicable threshold, and the treatment of virtual-asset income and gains is a jurisdiction-specific question. Operators with group structures spanning the UAE, the EU, and offshore holding layers need to analyse the interaction between the UAE's tax position, any applicable MiCA CASP obligations in the EU, and the substance requirements that apply to each entity. A Dubai entity that holds a VARA custody authorisation but lacks genuine substance in the UAE may face adverse treatment under the applicable tax and substance rules.
The cross-border tension between Dubai as an operating hub and the European client market is a recurring structural challenge in our practice. An operator with EU-based clients may require both a VARA custody authorisation for its Dubai operations and a CASP authorisation under MiCA for its EU-facing activities. Running two regulated entities, each with its own capital, compliance officer and regulatory reporting cycle, is operationally demanding. The structural decision – one entity or two, and where to locate the custody layer – must be made with the full picture of both regimes in view.
For groups that also have a holding or treasury layer in a third jurisdiction – typically BVI, Cayman, or an AIFC structure in Kazakhstan – the interaction between the VARA-licensed operating entity and the offshore or quasi-offshore holding layer raises further questions around inter-company arrangements, fees, asset transfers and the treatment of client assets that pass through multiple group entities. VARA expects that custody arrangements remain transparent and that no structural layer obscures the custodian's direct obligations to clients.
Illustrative engagement: custody structure for a multi-market operator
In a recent engagement, a payments and custody group operating across Southeast Asia sought to establish a UAE presence to serve Gulf-based institutional clients. The group held a Payment Services Act licence in Singapore but had not previously operated in the UAE. We mapped the VARA custody activity requirements against the group's existing technology and compliance infrastructure, identified the gaps in the AML programme that VARA's rulebook would expose, and advised on the choice between a free-zone and mainland entity structure. We coordinated with allied counsel in Singapore on the inter-entity custody agreement and the regulatory notification required under the group's existing MAS authorisation. The group filed its VARA preliminary application within a defined preparation window and obtained in-principle approval before its planned Gulf launch date. The key lesson from that engagement: the preparation phase – entity formation, compliance programme gap analysis, technology audit, and senior-management vetting – takes longer than the regulatory review itself if it is left to the final months before launch.
Common misconceptions operators bring to the VARA custody process
A common assumption among inbound operators is that a single offshore registration – whether from BVI, Cayman, or a legacy EU VASP regime – is sufficient to serve clients in Dubai. It is not. VARA's authorisation requirement applies to the activity of holding client virtual assets in Dubai, and no foreign registration substitutes for a VARA authorisation on Dubai mainland. The VARA regime was designed precisely to capture this class of offshore-first operator that seeks to serve UAE clients without regulatory accountability in the UAE.
A second common misconception is that the Dubai free-zone system creates a route around VARA. It does not. While the DIFC has its own regulatory authority (the DFSA), and while certain activities in specific free zones have historically occupied a grey area, VARA has progressively clarified that custody activities targeting mainland Dubai clients require VARA authorisation irrespective of the operator's corporate location within the UAE.
A third misconception is that capital and technology requirements are modest for a custody business relative to a trading platform. In our experience, VARA's expectations for custody operations – particularly around key management infrastructure, sub-custody controls and technology resilience – are materially demanding. Operators that approach the authorisation as primarily a paperwork exercise, rather than a genuine infrastructure-readiness assessment, tend to encounter the heaviest remediation requirements.
Finally, some operators believe that a VARA authorisation, once granted, provides a passporting mechanism into the wider GCC market. This is incorrect. VARA is a Dubai-specific regulator; its authorisation does not extend to Abu Dhabi (where FSRA under ADGM governs), to other Emirates, or to other GCC states. Each jurisdiction requires its own assessment.
Which operator profile needs what, and when?
Different operator profiles arrive at the VARA custody question from different directions, and the appropriate structure varies accordingly.
A pure-play custodian establishing in Dubai for the first time needs a standalone VARA custody authorisation, a Dubai entity with genuine substance, a full AML programme built to VARA's rulebook, and a Travel Rule-compliant technology stack. The indicative preparation-to-authorisation timeline is measured in multiple months, and the process should begin well before the target client-services launch date. The principal risk at this profile is underprepared technology infrastructure.
An exchange operator that wants to offer custody services to its Dubai clients as an add-on to its trading platform must apply for the custody activity separately, either as an additional activity on an existing entity or through a dedicated custody entity. The risk here is assuming the exchange authorisation covers custody; it does not. The addition of custody to an existing licensed entity may require regulatory consent to vary the existing authorisation.
An institutional fund manager holding a DIFC-based DFSA licence and seeking to offer custody services to mainland Dubai clients encounters a genuine structural choice: establish a VARA-licensed mainland entity or rely on a third-party VARA-authorised custodian for the mainland client base. The latter is frequently the more efficient path for fund managers whose primary regulatory relationship is with the DFSA.
A multi-jurisdiction operator already holding a MiCA CASP authorisation in the EU and seeking to add a Dubai custody capability faces the most complex structure. It must manage two capital requirements, two compliance officer appointments, two regulatory reporting cycles, and the cross-border AML obligations that arise from serving clients across both regimes. The entity structure, inter-company service agreements, and the treatment of client assets that move between the EU and UAE entities require careful legal design before the VARA application is filed.
For a scoped assessment of your custody structure in Dubai, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking and the group structure – change the analysis materially.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – full-spectrum licensing across 70+ jurisdictions, from VASP registration to CASP authorisation.
- VASP licence application in the European Union under MiCA – the CASP authorisation process, passporting, and cross-border structuring for EU market access.
- Fund manager licensing: a cross-jurisdiction comparison – comparing regulatory routes for digital-asset fund managers across the leading financial centres.
If a prior application stalled or a banking relationship was lost, a second-read review can surface the structural reason and the route back. Write to info@oboluslaw.com to arrange a confidential review of your position.
FAQ
How long does a crypto licence take to obtain?
The timeline for a VARA custody authorisation depends on the completeness of the submission and the complexity of the proposed business model. From the initial engagement through to final operational authorisation, operators should plan for a process measured in several months. Preparation – entity formation, compliance programme development, technology audit and management vetting – typically takes as long as, or longer than, the regulatory review itself. Applications submitted with incomplete documentation reset the review clock.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. Dubai under VARA suits operators targeting Gulf institutional clients, seeking a zero-withholding-tax environment, and willing to invest in genuine UAE substance. MiCA in the EU suits operators requiring single-passport access to the European market. Singapore under MAS suits operators with Asia-Pacific distribution and strong AML infrastructure. The optimal structure often involves more than one jurisdiction. The right answer follows from a mapped analysis of your client base, product, banking needs and capital position.
Do I need a separate custody licence?
Under the VARA regime, custody is a discrete regulated activity. Holding a VARA exchange or advisory licence does not authorise the custody of client virtual assets. An operator that holds client assets as part of any regulated function – whether trading, payment processing or fund administration – must obtain a custody authorisation specifically. In other regimes, such as MiCA in the EU, the position is similar: authorisation to provide one CASP activity does not automatically extend to custody. Operators should confirm the activity scope of every licence they hold.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the structure you file is the structure that works. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery is needed. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VARA authorisation strategy and multi-jurisdiction licensing structures for inbound operators entering the Gulf and wider MENA market.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.