Operating a virtual asset business in Dubai without the correct authorisation from the Virtual Assets Regulatory Authority (VARA) – the emirate's dedicated crypto regulator – exposes a business to enforcement action, involuntary exit from the market and the near-certain loss of banking relationships. VARA's activity-based licensing regime is one of the most detailed in the world, and the consequences of misreading its scope are immediate. This page sets out the regulated perimeter, the licence structure, the application process for an inbound operator, and the cross-border decisions that determine whether a Dubai structure serves the whole of a business or only part of it.
What does VARA regulate, and who needs a licence?
Any business that carries on a virtual asset activity in or from Dubai – on the mainland, outside the DIFC financial free zone – must hold a VARA authorisation before it begins operations. VARA's jurisdiction covers mainland Dubai; operators in the DIFC remain under DFSA supervision, and operators in other UAE free zones fall under their respective free-zone regulators. The boundary matters enormously for inbound businesses that assume a single UAE entity covers the whole country.
Under the VARA regime, regulated activities are defined by function rather than by asset class. The categories include virtual asset advisory services, broker-dealer activity, custody of virtual assets, the operation of a virtual asset exchange, lending and borrowing facilities, virtual asset management services, and transfer and settlement operations. A single business model can touch several of these categories simultaneously – an exchange that holds client assets and offers a lending product, for example, must address three distinct activity heads.
The defining question is not what the business calls itself. It is what the business does. In our practice, we regularly advise operators who assumed their model fell below the threshold for full authorisation, only to discover that client-facing custody or the provision of price quotations triggered registration requirements independent of trading volume. VARA's approach to regulatory perimeter is expansive and deliberately forward-looking.
VARA also extends its reach to marketing. Promoting virtual asset services to persons in Dubai – including digital advertising visible in the emirate – can engage VARA's regime even where the operator has no physical presence. Businesses that rely on global marketing campaigns should treat geographic targeting as a live compliance variable, not an afterthought.
To map whether your business model triggers one or more VARA activity categories before you commit to a Dubai structure, contact OBOLUS at info@oboluslaw.com. The regulated perimeter above describes the standard analysis. Your specific facts – the token types, the user base, the counterparty relationships – change the outcome. Map your options
What are the VARA licence categories and which one applies?
VARA issues activity-based authorisations, meaning a licence is granted for each regulated function rather than as a single universal permit covering all virtual asset work. The seven principal activity categories – advisory, broker-dealer, custody, exchange, lending and borrowing, management, and transfer and settlement – can be held individually or in combination, subject to VARA's assessment of the operator's governance, capital and operational capacity across each activity.
For most commercial operators, the exchange activity and the custody activity are the highest-friction categories. Both carry the most detailed rulebook obligations and, in our experience, the greatest scrutiny at application stage. An operator seeking to run a spot trading platform and hold client assets will typically need authorisation under both heads, with distinct capital, segregation and reporting obligations attaching to each.
The broker-dealer category covers businesses that deal in virtual assets as principal or arrange deals on behalf of clients without operating a full exchange infrastructure. It is a common choice for over-the-counter desks, institutional brokers and asset managers with a trading mandate. Advisory services – covering the provision of recommendations about virtual assets – form a lighter regulatory category, but one that is frequently overlooked by businesses that consider themselves technology providers rather than investment advisers.
VARA applies a separate licensing track for Virtual Asset Issuers – entities that issue virtual assets to the public in Dubai. Token issuance is therefore regulated at source, and a business that issues and then trades its own token may face dual authorisation requirements across the issuer and exchange categories.
How does the VARA application process work for an inbound operator?
The VARA authorisation process runs in sequential stages, and each stage has a defined set of deliverables that, if incomplete, halt progress until they are satisfied. Inbound operators frequently underestimate the documentation burden; in our practice, we have seen applications stall for months at the initial completeness review because the governance and technology submissions did not meet VARA's specific format requirements.
The process begins with the submission of a formal application covering the entity's legal structure, ownership and control chain, business plan, technology architecture, AML and CFT framework, and the professional backgrounds of key senior personnel. VARA conducts a fit-and-proper assessment of all significant controllers and senior managers. Delays in this phase almost always trace to either an incomplete ownership disclosure or a senior officer whose prior regulatory history requires additional explanation.
Following initial assessment, VARA issues a conditional approval or a request for further information. The conditional approval stage requires the operator to demonstrate operational readiness – live systems, functioning compliance infrastructure, banking arrangements and proof of the required minimum capital. Only on satisfaction of those conditions does VARA grant the operative licence.
The total elapsed time from submission to operative licence is not fixed by rule – it varies by the complexity of the applicant's model and the activity categories applied for. Operators should plan for a process that takes a meaningful number of months; building a commercial launch date that depends on VARA approval by a specific day is a risk that experienced Dubai operators avoid.
A Dubai presence is also a precondition. VARA requires that the licensed entity be incorporated and physically established in Dubai. A shelf company with a registered agent address does not satisfy this requirement. The business needs demonstrable substance: a real office, resident senior officers and an operational presence that VARA's supervisory visits can confirm.
What are VARA's AML and Travel Rule obligations?
VARA's anti-money laundering obligations are grounded in the FATF Recommendations, including the Travel Rule – the obligation to pass originator and beneficiary identifying information with each virtual asset transfer above the applicable threshold. The UAE has implemented the Travel Rule through its national AML framework, and VARA-licensed businesses must operate a Travel Rule solution that covers both domestic and cross-border transfers.
In practice, Travel Rule compliance for a VARA-licensed exchange or custodian means integrating with a recognised Travel Rule protocol, maintaining a counterparty VASP due-diligence program, and handling the sunrise problem – the gap between jurisdictions where the rule is in force and those where it is not. VARA's rulebooks are specific about the expectation that licensed firms manage this gap actively rather than treating it as a reason to defer compliance.
The AML framework under VARA also covers customer due diligence, transaction monitoring, suspicious transaction reporting to the UAE's Financial Intelligence Unit, and record-keeping. VARA's supervisory teams review these programs as part of ongoing supervision. A licence is not the end of the compliance conversation – it is the beginning of a regulatory relationship that runs for as long as the business operates.
For businesses arriving from other jurisdictions, the UAE's FATF posture is important context. The UAE was removed from the FATF grey list in 2024, a development that improved correspondent banking access for UAE-licensed entities. Operators who navigated the market during the grey-list period and saw banking friction ease after that decision understand how directly FATF status translates into practical operational capacity.
How does a VARA licence interact with banking and cross-border tax obligations?
A VARA licence is a necessary but not sufficient condition for a functioning Dubai operation. Banking – the ability to hold fiat currency, receive client deposits and execute payments – remains the single most operationally critical question after the licence itself. Dubai's major banks have developed differentiated attitudes toward crypto clients; some actively serve VARA-licensed entities, others decline the sector, and the picture changes as individual institutions adjust their risk appetite.
In our cross-border practice, we regularly advise businesses that secured a VARA licence and then discovered that their preferred banking partner would not onboard them, or would onboard the entity but not extend a full suite of services. The banking analysis must be run in parallel with the licence application, not after it. An operator that reaches conditional approval without a committed banking solution is exposed to a gap period during which the business cannot be commercially launched.
Dubai does not impose a corporate income tax on most qualifying free-zone entities, but mainland Dubai entities are subject to the UAE corporate tax regime that took effect in 2023. The rate applicable to business profits above the small-business threshold requires careful analysis against the specific activity structure – whether the entity is the operating company, a holding vehicle, or a combination. Businesses that structure a Dubai entity primarily for tax efficiency without engaging this analysis are exposed to outcomes that differ materially from their assumptions.
Cross-border tax also arises on the investor and revenue side. A VARA-licensed exchange serving clients in the EU, the UK or Singapore must account for the possibility that those jurisdictions' tax authorities treat the profits or the revenues generated in those markets as subject to local taxation, regardless of where the entity is licensed. Permanent establishment risk – the risk that a business creates a taxable presence in a jurisdiction through its activities there – is a live issue for crypto businesses with a concentrated user base in one country and a licensed entity in another.
If your licensing, banking and tax stack needs to be mapped as a single structure rather than three separate decisions, write to info@oboluslaw.com. A prior application that stalled, or a banking relationship that closed, often reflects a structural issue that a second analysis can surface and address. Map your options
How does VARA compare to other licensing hubs for an inbound operator?
For an operator choosing between Dubai and other primary licensing hubs, the decision turns on four axes: the target user base, the activity scope, the available banking, and the operator's appetite for substance requirements. No single jurisdiction is the right answer for every profile, and a blanket conclusion that one hub is superior to another is not consistent with how licensing decisions are actually made.
Dubai's strengths as a licensing hub are well established. VARA has built a detailed rulebook, a defined process and a supervisory team that engages with applicants on technical questions. The emirate's time zone sits between Europe and Asia, which matters for businesses with users in both regions. The physical-substance requirement, while demanding, also produces a competitive advantage: a VARA licence signals to institutional counterparties that the business has cleared a meaningful regulatory hurdle, not merely a registration formality.
Against those strengths, the substance requirement is the most common friction point for inbound operators. A business that wants a light EU passportable structure may find that a MiCA CASP authorisation through a national competent authority in the EU – passportable across all EU member states – better serves a Europe-first user base. A business focused on Southeast Asian institutional clients may find that MAS licensing in Singapore provides stronger credibility in that market.
For a business that sits between the Gulf and Europe, the structure often becomes a two-entity question: a VARA-licensed entity for the Middle East and, over time, a CASP under MiCA for EU access. Holding both simultaneously requires coordination of the AML, governance and capital obligations across both regimes. In our practice, we have mapped this dual-entity structure for operators at the planning stage and identified the points – particularly Travel Rule counterparty management and consolidated capital – where the two regimes interact.
A business with a predominantly institutional profile, no retail exposure and a strong legal team may conclude that a Cayman Islands VASP registration as an interim step, while pursuing VARA, gives it the operational flexibility it needs during the authorisation period. That interim approach is viable only if the Cayman structure genuinely covers the activity being conducted and does not create an unlicensed-activity exposure in Dubai or in the markets where the business operates.
A practical illustration: exchange authorisation for a multi-jurisdiction operator
In a recent licensing matter, a digital-asset exchange operator came to us after receiving a deficiency notice from VARA following an initial application submission. The operator's model covered spot trading, client asset custody and an OTC desk – three VARA activity categories, each requiring distinct policy documentation and capital demonstration. The original submission had treated the three activities as a single product and presented unified documentation rather than activity-specific governance. We restructured the submission, separated the governance and risk frameworks by activity, addressed the AML Travel Rule gaps that VARA had identified and resubmitted. Conditional approval followed within a defined review cycle. The operator subsequently addressed the banking question with a UAE financial institution that had already onboarded other VARA-licensed exchanges, avoiding the post-approval gap period entirely. The matter illustrated a consistent pattern: the most common reason VARA applications fail or stall is not regulatory rejection – it is incomplete or incorrectly structured documentation at first submission.
Which operator profile is suited to a VARA licence?
Not every operator profile is well matched to a VARA licence as the primary or first licensing step. The right answer depends on the business model, the user base and the operator's readiness to satisfy substance requirements from day one.
An exchange or custody business targeting Gulf institutional clients – family offices, sovereign-aligned funds, regional financial institutions – is the profile for which VARA was most directly designed. For that operator, VARA provides both the legal permission and the market credibility that institutional counterparties in the region require before they transact. The timeline and capital demands are proportionate to the opportunity.
A retail-focused business with a global user base and a lean operational model faces a harder trade-off. VARA's substance requirements and per-activity capital obligations may exceed what the business can support at launch. For that profile, an EU CASP authorisation offering passportable access to a large retail market – with lower initial capital at the smallest tier – may be the more efficient first step, with VARA as a growth-phase addition.
A DeFi protocol or a token issuer seeking primary market access to Gulf investors may find that VARA's issuer regime and advisory category are the relevant entry points, rather than the exchange or custody categories. The compliance burden for those activities differs materially from that of a full-service exchange, and the commercial rationale – access to Gulf capital – maps more cleanly to the advisory and issuance tracks.
A common assumption among businesses considering the UAE is that a single offshore registration – in the Cayman Islands, the BVI or another traditional fund domicile – is sufficient to serve clients globally, including in the UAE. That assumption is incorrect. Operating a virtual asset service for clients located in Dubai without a VARA licence exposes the operator to VARA's enforcement powers regardless of where the entity is incorporated. Offshore registration solves the entity domicile question; it does not address the activity nexus where clients are located.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full licensing practice across 70+ jurisdictions, from first application to ongoing supervision.
- Digital-asset licensing in Poland – EU VASP registration and the MiCA transition for businesses using Poland as an EU entry point.
- AML/CFT policy drafting for established operators – bespoke AML documentation for VARA, MiCA and other leading regimes.
FAQ
How long does a crypto licence take to obtain?
The timeline varies by jurisdiction and activity category. Under the VARA regime in Dubai, the process from submission to operative licence typically takes a meaningful number of months, with the most common delays arising from incomplete documentation or unresolved fit-and-proper questions about senior officers. In other jurisdictions – including EU CASP authorisations under MiCA – timelines similarly vary by the national competent authority and the complexity of the application. We scope realistic timelines at the outset of each engagement so that commercial planning is built on accurate expectations rather than best-case assumptions.
Which jurisdiction is best for licensing my crypto business?
No single jurisdiction is the right answer for every business. The decision depends on the target user base, the activity scope, the available banking in that market, and the operator's capacity to meet substance requirements. Dubai under VARA suits Gulf-facing institutional operators with strong operational depth. An EU CASP authorisation suits businesses seeking passportable retail access across the EU. Singapore's MAS regime suits businesses with a Southeast Asian institutional focus. A dual-entity structure is often the most commercially durable outcome for businesses operating across regions. We map these options against your specific facts before you commit.
Do I need a separate custody licence?
In most leading licensing regimes, custody is a distinct regulated activity that requires its own authorisation or a specific licence endorsement. Under VARA, custody of virtual assets is one of the seven principal activity categories and must be separately addressed in an application if the business holds client assets – even incidentally as part of an exchange or transfer function. Under MiCA and the Singapore Payment Services Act, similar principles apply. An operator that holds client assets without the appropriate custody authorisation faces enforcement exposure even if it holds a licence for another activity. This is one of the most common structural gaps we identify at initial assessment.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including VARA authorisation in Dubai, MiCA CASP structures in the EU and digital payment token licensing under MAS in Singapore. Disputes and on-chain asset recovery across 25+ forums, and the tax, banking and compliance programs that sit around a licensed operation, are equally the whole of our practice. We map the licence, banking and tax stack as a single decision, not three separate ones, before you commit. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in activity-based VASP licensing across the Gulf, EU and Asia-Pacific, with a focus on VARA authorisation structures and cross-border licence stacking.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.