Operating a virtual-asset business in Dubai without a current, correctly scoped VARA licence (an authorisation issued by the Virtual Assets Regulatory Authority under Dubai's activity-based regulatory regime) is not a minor administrative oversight. It is a live enforcement risk. VARA supervises virtual-asset activities across mainland Dubai and has made licence maintenance – timely renewal, accurate variation, and prompt notification of material changes – a front-line supervisory expectation. Businesses that miss a renewal window, add an activity without a variation order, or restructure without VARA's knowledge expose their Dubai operation to suspension, public censure, and loss of banking relationships that are already difficult to secure in the UAE market.
This page sets out how renewal and variation work under the VARA regime, where the process typically stalls, and what a cross-border operator needs to consider when its Dubai entity is one node in a wider multi-jurisdictional structure.
What does VARA licence renewal actually require?
VARA licence renewal is a substantive compliance exercise, not a form-filling event. The authority requires the licensee to demonstrate ongoing fitness: updated AML/CFT posture, current audited financials, technology and security attestations, and confirmation that the approved activities are still accurately described by the existing licence. A gap between what the business does and what VARA has authorised is, by itself, a ground for enforcement regardless of whether a renewal application is pending.
In our practice, the businesses that encounter the most difficulty at renewal are those that allowed their operational footprint to evolve after original authorisation without filing an interim notification. An exchange that added a staking product, a custody provider that began offering margin lending, or a broker-dealer that started facilitating OTC derivatives – each of those expansions almost certainly triggers a variation requirement under VARA's activity-based rulebooks. Submitting a renewal application while conducting an unlicensed activity is worse than filing late: it crystallises the discrepancy in a supervised document.
VARA's activity categories are discrete. The regime recognises advisory, broker-dealer, custody, exchange services, lending and borrowing, management and investment services, and transfer and settlement as separately licensable activities. A licensee must hold authorisation for every activity it actually conducts. The renewal process is therefore the right moment to audit the live business against the licensed scope and correct any mismatch before the regulator identifies it independently.
The process begins with the contextual bridge: the standard path is described above. Your facts – the entity, the user base, the banking, the product evolution – change the analysis meaningfully.
To map your renewal obligations before the window opens, contact OBOLUS at info@oboluslaw.com. We assess the gap between your current VARA scope and your live operation so you approach the regulator from a position of accuracy, not exposure. Alternatively, map your options with our team now.
When does a variation order become mandatory under VARA?
A variation order is required whenever a licensee proposes to change any material term of its existing authorisation. Material changes under VARA's rulebooks include – but are not limited to – adding a new regulated activity, removing an activity, changing the approved token or asset classes in scope, altering the legal structure or ownership of the licensed entity, replacing key personnel who hold approved-person status, and material changes to technology infrastructure or custody arrangements.
The threshold for "material" is not always self-evident. VARA has issued guidance that operators are expected to apply a substance-over-form test: if the change meaningfully affects the risk profile of the business as VARA understands it, a notification – at minimum – is required. Many operators we advise treat this conservatively. A notification that is not ultimately required costs very little. An undisclosed material change discovered in a routine supervisory review costs considerably more.
The variation process mirrors the original authorisation in several respects. Supporting documentation must be updated to reflect the proposed change, the business plan must be revised, and in some cases an updated financial projection and technology attestation will be required. Where the variation involves adding a custody activity – one of the higher-risk categories under VARA's framework – the regulator typically requires detailed evidence of safeguarding arrangements, third-party custodian appointments, and client-asset segregation controls.
Cross-border operators face a specific complication. A business licensed by VARA that is also licensed or registered in another jurisdiction – under MiCA in the EU, under the MAS Payment Services Act in Singapore, or under the SFC's VATP regime in Hong Kong – may find that the variation in Dubai interacts with its obligations elsewhere. Adding a lending activity in Dubai that the operator already conducts in a jurisdiction where it is unregulated creates a question about whether the home-jurisdiction regulator will treat the Dubai approval as a disclosure event. We regularly advise on these cross-border notification questions as part of a coordinated multi-hub licence maintenance programme.
How long does the VARA renewal process take, and what documentation is required?
The time from submission of a complete renewal application to a formal renewal decision varies by the complexity of the business and the extent of any disclosures made during the process. Based on our experience in the VARA environment, operators should treat the renewal process as a matter of weeks rather than days for a clean, unchanged business – and potentially longer where changes have occurred during the licence period or where VARA raises queries about the submission.
The documentation set for renewal typically includes audited financial statements for the preceding period, an updated AML/CFT compliance report, technology and cybersecurity attestations, evidence of ongoing minimum capital maintenance, a declaration of material changes since original authorisation, and updated fit-and-proper declarations for approved persons. VARA may also request a compliance attestation from the Money Laundering Reporting Officer (MLRO) and confirmation that the business's current AML programme complies with FATF Recommendation 15, which requires virtual-asset service providers to implement Travel Rule obligations (the requirement to pass originator and beneficiary data with qualifying transfers).
In practice, the documentation assembly phase is where most delays originate. Audited financials require a VARA-accepted auditor and sufficient lead time. Fit-and-proper declarations for key personnel must align with the personnel structure as it actually stands on the renewal date, not as it stood at original authorisation. Where there have been ownership changes – common in Dubai given the pace of consolidation in the regional market – corporate documentation demonstrating the current ownership chain must be provided in full.
Operators who have allowed their compliance programme to drift during the licence period face an additional burden: the renewal process effectively becomes a remediation exercise. VARA will not renew a licence where it has material concerns about ongoing compliance. The regulator has used the renewal window to impose conditions, require third-party audits, or suspend licence operation pending remediation. In the most serious cases, renewal has been refused and the matter referred to enforcement. Starting the renewal preparation cycle early – well before the window opens – is not cautious; it is the only commercially rational approach.
How do renewal and variation interact with banking and tax obligations in Dubai?
Maintaining an active, correctly scoped VARA licence is a prerequisite for banking in Dubai, but it is not sufficient on its own. UAE-based banks that service virtual-asset businesses conduct their own due diligence against the VARA public register and will treat a licence in lapsed or conditional status as a trigger for account review. A renewal submission that is pending while a licence formally lapses – even for a short period – can result in account suspension that persists well beyond the date on which VARA issues its renewal decision.
In our practice, we have seen businesses that treated the renewal filing as the endpoint of the process discover that their bank had already initiated a review based on the public register showing a lapse. The practical lesson is that banking-relationship management must run in parallel with the VARA renewal submission, not after it.
On the tax side, the UAE currently operates without a corporate income tax on qualifying free-zone income for entities in certain structures, and the Dubai mainland does not impose corporate income tax at the rate applicable to onshore non-free-zone entities in the same way – but the tax regime applicable to a specific VARA-licensed entity depends on its legal domicile, its ownership structure, and its activities. A variation that adds a new activity may require a corresponding update to the entity's tax profile, particularly where the business has operations in multiple jurisdictions and the new Dubai activity triggers a permanent-establishment question in a higher-tax location.
For businesses operating a multi-hub structure – a common model in which the VARA entity handles the Middle East and Africa client base while a MiCA-authorised entity handles EU clients and a Singapore MAS-licensed entity handles Asia – a VARA variation also creates a question about whether inter-company service agreements and transfer-pricing arrangements remain accurate. These are not exotic concerns. They are the routine consequences of operating a regulated business across jurisdictions, and they should be addressed at the variation stage rather than discovered in a subsequent tax review.
What are the most common mistakes operators make in VARA renewal and variation?
The most costly mistake is the activity-scope gap: conducting business that falls outside the licensed activities while a renewal or variation application is pending. VARA's approach to enforcement has made clear that the pending status of an application does not insulate the operator from scrutiny of conduct during the review period. Operators should audit their live product set before filing and disclose any scope expansion proactively.
The second most common mistake is treating renewal as a delegable administrative task. Renewal requires substantive input from legal counsel, compliance leadership, the MLRO, finance, and – in technology-intensive businesses – the information security function. Delegating it entirely to an administrator who assembles documents without a senior legal review of the disclosures creates a submission that is technically complete but substantively incomplete. VARA reads submissions carefully.
A third recurring issue involves key-personnel changes. Approved persons – the senior individuals whose fitness and propriety VARA assessed at original authorisation – frequently change roles or leave the business during the licence period. VARA expects to be notified of approved-person changes promptly, not at renewal. A renewal application that reveals multiple undisclosed personnel changes since authorisation is, in VARA's view, evidence of a broader governance deficit.
Finally, operators with multiple regulatory relationships sometimes assume that a communication to one regulator is, constructively, a communication to all. It is not. VARA requires its own notifications, on its own timelines, in its own forms. The fact that a change was disclosed to the FCA, to MAS, or to an EU NCA does not satisfy the VARA notification obligation. Each jurisdiction must be managed independently – but ideally as part of a coordinated multi-jurisdiction programme so that the disclosures are consistent and the legal positions taken in each market do not conflict.
Anonymized matter: variation following a product expansion
In a recent instruction, a digital-asset exchange held a VARA exchange-services licence and had, over the preceding twelve months, added a yield product that involved deploying client assets into third-party protocols. The product had been launched without a formal legal assessment of whether it fell within the custody or lending and borrowing activity categories under VARA's rulebooks. By the time the renewal window approached, the business was conducting an activity materially outside its licensed scope. We were engaged to map the gap, advise on the disclosure strategy, and prepare a combined renewal and variation submission that disclosed the product, characterised it correctly against VARA's activity definitions, and proposed a compliance remediation timeline. The application was submitted in one coordinated filing. VARA issued renewal with a condition requiring completion of the remediation programme within a defined period. The business avoided enforcement and retained its banking relationship throughout.
Self-assessment: is your VARA licence renewal-ready?
Before a VARA renewal window opens, a licensee should be able to answer yes to each of the following questions. If any answer is no or uncertain, the gap requires attention before filing.
- Does the licensed activity scope accurately describe every product and service the business currently offers to clients?
- Are all approved persons current and correctly recorded, with no undisclosed changes since original authorisation?
- Are audited financial statements for the renewal period available from a VARA-accepted auditor?
- Does the business maintain minimum capital at or above the level required for each licensed activity?
- Is the AML/CFT programme current, documented, and capable of producing a compliance attestation from the MLRO?
- Has the Travel Rule implementation been reviewed against VARA's current expectations and FATF Recommendation 15?
- Have all material ownership or corporate-structure changes been notified to VARA on a timely basis?
- Are banking counterparties aware of the upcoming renewal timeline, and is the relationship-management communication plan in place?
A no to any item above does not mean renewal is out of reach. It means the preparation phase must address that item before the submission date, not after.
If a prior application stalled, a licence condition was imposed, or a banking relationship was reviewed in connection with a regulatory lapse, a structured second read can identify the underlying cause and the route back. Write to info@oboluslaw.com or map your options directly.
A common assumption: one UAE licence covers the business globally
A common assumption among operators expanding from Dubai is that a VARA licence, combined with a structurally sound corporate arrangement, provides sufficient regulatory coverage for a global client base. It does not. VARA's jurisdiction extends to activities conducted on mainland Dubai. It does not extend to the EU, Singapore, Hong Kong, or the UK – each of which operates its own regulated-activities regime for virtual-asset service providers, with its own licence requirements, its own enforcement powers, and its own expectations of cross-border operators that access clients in that market.
The VARA licence is a high-quality regulated authorisation. It supports banking relationships, institutional partnerships, and the credibility that comes with operating in a supervised environment. But the decision to use Dubai as a sole licence hub for a multi-regional business requires careful analysis of the jurisdictions in which the business actually solicits clients, holds assets, or operates infrastructure. In our practice, we regularly map the licence stack across operating, custody, and payment layers before an operator commits to a structure – because the cost of building a Dubai-centric model and then discovering that EU, UK, or Asia-Pacific obligations require additional licences is substantially higher than planning for them at the outset.
The cross-border reality is that most serious digital-asset businesses of scale need two to four regulatory relationships, not one. The question is not whether to license in multiple jurisdictions but which combination of jurisdictions best serves the business model, the client base, and the capital efficiency of the operator. Dubai and VARA belong in most serious analyses. They rarely belong alone.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full licensing regime map across 70+ jurisdictions, from initial authorisation to multi-hub maintenance.
- Digital-asset licensing in France: AMF/PSAN – how the French AMF/PSAN regime compares and interacts with VARA for EU market access.
- Tokenised fund structuring in Panama – offshore fund structuring considerations and how they interact with operating licences.
FAQ
How long does a crypto licence take to obtain?
The timeline varies by jurisdiction and activity category. Under the VARA regime in Dubai, the original authorisation process typically runs a matter of weeks to several months depending on the complexity of the business and the completeness of the submission. Renewal of an existing VARA licence – for a clean, unchanged business with complete documentation – is generally measured in weeks. Where VARA raises queries or where a variation is filed alongside renewal, the timeline extends. In all cases, preparation time before filing materially affects the total elapsed period.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on the operator's client base, business model, activity scope, capital position, and banking requirements. Dubai under VARA suits businesses targeting the Middle East and Africa, seeking a well-developed regulatory framework, and needing credibility with institutional counterparties. Operators also active in the EU may need a MiCA CASP authorisation; those targeting Asia may need a MAS or SFC licence. We map the full stack before operators commit to a primary hub, because the interaction between jurisdictions is almost always the deciding variable.
Do I need a separate custody licence?
Under VARA's activity-based regime, custody is a separately licensable activity. A business that holds client virtual assets – even as an operational ancillary to its primary exchange or broker-dealer function – should assess whether that holding constitutes a custody activity requiring a separate authorisation or an amendment to its existing licence scope. The test is functional: does the business have control or possession of client assets? If yes, the custody activity category is likely engaged. The same principle applies across MiCA, MAS, and the SFC regime, making custody analysis a cross-border question for any multi-hub operator.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including the full VARA regime in Dubai – on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit, so the structure you build is the one that holds. Digital assets are the whole of our practice. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in activity-based licence maintenance, renewal strategy and multi-hub authorisation programmes for virtual-asset businesses in the UAE and across the Gulf region.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.