Vara licence application: Legal Counsel for Digital-Asset Firms

Operating a digital-asset business in Dubai without the right authorisation is not a compliance oversight — it is an enforcement event. VARA, the Virtual Assets Regulatory Authority, supervises every virtual-asset activity conducted in mainland Dubai, and its activity-based licence regime requires a separate authorisation for each regulated function a firm performs. A VARA licence application is not a checkbox exercise. It is a structured regulatory submission that must address governance, technology controls, AML/CFT infrastructure, financial resilience and — critically — the firm's cross-border exposure before the first page is filed. This service page explains how OBOLUS advises digital-asset firms through that process.

What VARA Regulates and Why Authorisation Cannot Wait

VARA has jurisdiction over virtual-asset activities conducted from, or marketed into, mainland Dubai. The regime is activity-based: a firm does not receive a single licence to "do crypto." It receives authorisation for each specific function — advisory, broker-dealer, custody, exchange, lending, asset management, or transfer and settlement — and each function carries its own rulebook obligations. Operating any of those activities without the relevant authorisation exposes the business to enforcement action, banking termination, and in serious cases, criminal liability under applicable UAE provisions. The cost of delay is rarely administrative. In our practice, we have seen firms lose their payment rails within days of a regulator issuing a preliminary finding — and rebuilding those relationships can take months longer than the original licence process.

The cross-border dimension compounds the risk. A firm incorporated outside the UAE but serving Dubai-based clients, or holding assets on behalf of UAE persons, sits within VARA's perimeter regardless of where the entity is domiciled. That jurisdictional reach is deliberate. VARA has stated publicly that regulatory arbitrage — maintaining the commercial benefit of access to Dubai's market while avoiding local authorisation — is precisely the conduct the regime is designed to address. For operators in that position, the question is not whether to engage VARA. It is how to structure the application so that the Dubai entity, the offshore holding company and the banking stack are coherent on paper and in practice.

OBOLUS maps the full activity perimeter before advising which VARA licence categories apply. That mapping exercise — entity structure, user geography, asset types handled, and the technical architecture of the platform — determines both the scope of the application and the sequencing of the submission.

For a scoped assessment of your VARA licensing position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity, the user base, the banking — change the analysis. Map your options

Which VARA Activity Categories Apply to Your Business?

VARA's activity-based structure means that a single operating platform commonly requires authorisation across two or more categories. An exchange that also holds client assets and settles its own transfers may need authorisation under the exchange, custody, and transfer-and-settlement categories simultaneously. The rulebook obligations for each category are distinct, and a firm cannot satisfy the custody requirements by relying on its exchange authorisation.

The seven principal activity categories under the VARA regime are:

• Virtual Asset Advisory Services
• Virtual Asset Broker-Dealer Services
• Virtual Asset Custody Services
• Virtual Asset Exchange Services
• Virtual Asset Lending and Borrowing Services
• Virtual Asset Management and Investment Services
• Virtual Asset Transfer and Settlement Services

Operators frequently underestimate how broadly VARA reads "exchange services." The category covers centralised matching of buy and sell orders but also, in certain configurations, OTC desks and peer-to-peer facilitation platforms. We routinely advise clients who assumed their business model fell outside the exchange category and discovered during the pre-application review that their order-routing architecture required it.

A broker-dealer operating on a non-custodial model still needs to assess whether the transfer of value between user wallets during settlement triggers the transfer-and-settlement category. The structural analysis matters as much as the commercial description of the product.

How Does the VARA Application Process Work?

The VARA application process proceeds in defined stages, and the quality of each stage materially affects the timeline of the one that follows. A submission that is incomplete, structurally inconsistent, or that fails to address VARA's technology and AML expectations directly will be returned with requisitions — adding weeks or months to the overall process.

The standard process steps are:

1. Pre-application scoping. Identify the regulated activities, map the entity structure, confirm the corporate establishment requirements within Dubai (a mainland UAE legal presence is required), and verify that the key persons nominated for VARA's fit-and-proper assessment meet the applicable standards.
2. Preparation of the application package. This includes the business plan, the financial projections, the technology architecture documentation, the AML/CFT policies and procedures, the outsourcing framework (where applicable), the data governance documentation, and the governance and ownership structure disclosures.
3. Initial review and VARA engagement. VARA undertakes a completeness review of the submitted package. During this phase, VARA may request clarifications or additional documentation. Firms with a clearly presented, complete submission typically move through this phase faster.
4. Detailed assessment and fit-and-proper vetting. Key persons — senior management, controllers and certain nominated functions — are subject to regulatory vetting. Delays in this phase most commonly arise from incomplete personal disclosures or from nominees who have prior regulatory history requiring explanation.
5. Conditional approval and pre-operational requirements. VARA typically issues conditional approval before the licence is activated. The firm must satisfy any pre-operational conditions — which may include minimum capital confirmation, system penetration testing, and finalisation of certain policies — before the licence takes effect.
6. Licence issuance and ongoing supervision. The issued licence is activity-specific and carries ongoing annual reporting, supervisory fee and rulebook-compliance obligations. Licence conditions must be observed continuously, not only at the point of issuance.

Timeline is qualitative under the current regime because VARA retains discretion over the pace of each stage, and the complexity of the application — particularly the number of regulated activities and the sophistication of the technology architecture — directly affects how long the process takes. In our cross-border practice, we advise clients to plan for a process measured in months rather than weeks, and to build that timeline into their go-to-market planning.

What Are the Most Common Mistakes in a VARA Application?

The most damaging mistakes in a VARA application are structural, not clerical — and they are made before the application is filed, not during the submission itself. Choosing the wrong entity form, nominating key persons who cannot pass fit-and-proper review, or submitting AML documentation that describes controls without evidencing implementation are the errors that stop applications and require rebuilding from the ground up.

The five structural errors we see most frequently are:

• Misidentifying the regulated activities. Firms describe their commercial model rather than their functional architecture. A platform that routes orders, holds collateral and settles in-house may require three authorisations, not one.
• Inadequate AML/CFT documentation. VARA's AML rulebook is detailed. Policies that are generic — copied from an EU template without adaptation to the UAE legal environment and VARA's specific expectations — are consistently requisitioned.
• Weak governance structure. VARA expects a clear separation of functions, documented board oversight of compliance, and a compliance officer with demonstrable relevant experience. A governance structure designed to minimise overhead in an early-stage company typically does not survive regulatory scrutiny.
• Technology documentation gaps. VARA reviews the technical architecture of the platform, including custody arrangements, cybersecurity controls and, where relevant, smart-contract audit evidence. Platforms that treat technology documentation as a secondary concern face extended assessment timelines.
• Banking misalignment. A firm may obtain VARA authorisation but find that its banking partner's onboarding criteria are not met by the entity structure that VARA requires. The banking and licensing workstreams must run in parallel, not sequentially.

In a recent matter, a crypto exchange had filed an initial VARA application independently and received a requisition letter covering all five of the above categories simultaneously. We were engaged to reconstruct the submission — restructuring the entity, rewriting the AML policies, replacing two nominated key persons and coordinating with a UAE banking institution in parallel. The firm received conditional approval in the subsequent cycle.

Cross-Border Considerations: The Dubai Entity Inside a Global Structure

A VARA licence does not operate in isolation. For most digital-asset firms, the Dubai entity is one node in a multi-jurisdiction structure — a holding company in the BVI or Cayman Islands, a technology subsidiary in a lower-cost jurisdiction, a European CASP authorisation under MiCA (the EU's Markets in Crypto-Assets Regulation), and a Singapore entity under the MAS Payment Services Act for the Asia-Pacific book. Each of those layers interacts with the VARA-licensed entity in ways that VARA will scrutinise.

VARA expects the Dubai entity to have substantive presence. A brass-plate entity that routes all economic activity to a parent or sibling company will face questions about whether the regulated activities are genuinely being conducted from Dubai. That expectation applies to people, systems and decision-making — not just legal registration. Firms that are designing the structure at the point of application have the opportunity to build substance into the Dubai entity from the outset. Firms that come to VARA with a pre-existing group structure need to assess honestly whether the Dubai entity has or can acquire the substance VARA requires.

Tax structuring interacts with the substance question. The UAE's corporate tax regime — introduced after a period of no federal income tax — applies to income generated within the UAE. The interplay between the VARA-licensed entity's revenue recognition, transfer-pricing documentation (for intra-group arrangements) and the tax residency of key executives is a structuring question that should be addressed before the application is finalised, not after the licence is issued.

For operators with an existing MiCA CASP authorisation, there is a related consideration: the EU's cross-border notification requirements and VARA's approach to operators with multi-jurisdiction licensing history do not always align neatly. We work with allied counsel in the relevant jurisdiction to ensure that the two regulatory postures are coherent.

If a prior application stalled or banking was disrupted during a licensing process, a second read of the structure can identify the cause and map the route forward. Write to us at info@oboluslaw.com or Map your options.

Decision Matrix: Which Profile Fits Which Approach?

Not every digital-asset firm needs the same VARA strategy. The right approach depends on the business model, the existing corporate structure and the urgency of the go-to-market timeline. The following profiles cover the most common situations we advise on.

Profile A — Greenfield exchange building for the GCC market. The firm has no prior regulatory authorisation and is constructing its entity structure from scratch. The optimal approach is a clean Dubai mainland incorporation, a governance structure designed to VARA's specifications from day one, and concurrent banking engagement. Timeline is driven by the completeness of the founding team's fit-and-proper profile and the sophistication of the technology documentation. Firms in this profile have the most flexibility and typically the smoothest path if counsel is engaged before incorporation.

Profile B — Existing exchange with European or Asian authorisation seeking UAE market access. The firm holds a MiCA CASP, an MAS licence or an SFC registration and wants to establish a VARA-licensed entity for the GCC book. The key risk is entity substance: VARA will review whether the Dubai entity can plausibly be the home of the regulated activity rather than a distribution arm. Engagement with allied counsel in the home jurisdiction to ensure the two regulatory postures are coherent is advisable before submission. Timeline is generally comparable to Profile A but with additional complexity around intra-group arrangements.

Profile C — Firm currently operating in Dubai without authorisation. The business is live, serving clients, and has not yet obtained VARA authorisation. This is the highest-risk profile. Self-reporting and proactive engagement with VARA — before a supervisory referral — typically produces better outcomes than waiting. Counsel should be engaged immediately. The application itself follows the standard process, but the remediation of the operational period requires careful handling of the regulatory narrative.

Profile D — Custody-only or transfer-and-settlement specialist. The firm does not operate a trading platform but provides institutional custody or settlement infrastructure. The VARA custody and transfer-and-settlement rulebooks impose specific capital, technology and operational requirements. Firms in this profile often have deep technology documentation but underdeveloped governance frameworks — the inverse of Profile A. The application strategy prioritises governance build and regulatory narrative over commercial business-plan elaboration.

A Common Assumption: "One Offshore Licence Covers Our Global Operations"

A common assumption among early-stage digital-asset firms is that a single registration — typically in the BVI, Cayman Islands or a low-friction EU member state — is sufficient to serve clients across multiple markets, including the UAE. This assumption is incorrect and, in the VARA context, has produced a consistent pattern of enforcement attention. VARA's jurisdictional reach applies to the conduct of regulated activities directed at Dubai, regardless of where the entity is incorporated. An offshore registration does not shelter a firm from VARA oversight if the commercial substance of the activity is in Dubai or the clients are resident there.

The same logic applies to MiCA passporting. An EU CASP authorisation permits an operator to provide services across EU member states. It does not confer any right to operate in Dubai, the broader GCC, or any jurisdiction outside the EU/EEA. Operators who have invested in a European CASP authorisation and are expanding to the Gulf frequently discover that the VARA process is additive — not a formality that follows automatically from the EU authorisation — and that the substantive requirements do not diminish because the firm is already regulated elsewhere.

Our advice in every multi-jurisdiction mandate is that the licence stack — operating licence, custody authorisation, payment institution registration — must be mapped jurisdiction by jurisdiction, against the actual user geography and asset flows of the business. A structure that is legal everywhere on paper but inconsistent in substance anywhere is a structure that breaks under supervisory review.

Self-Assessment: Is Your Business Ready to Apply?

Before engaging with VARA, a firm should be able to answer the following questions clearly. If any answer is uncertain, that uncertainty is a structuring risk that should be resolved before the application is prepared.

• Have all of the regulated activities the platform performs been identified and mapped to the correct VARA activity categories?
• Does the Dubai entity have or will it have substantive operational presence — staff, systems, decision-making — rather than a registered address alone?
• Are all proposed key persons able to satisfy a fit-and-proper assessment, including disclosure of any prior regulatory history in any jurisdiction?
• Is the AML/CFT framework — policies, procedures, technology, staffing — documented, implemented and tested, or is it still in preparation?
• Has the technology architecture, including custody arrangements and cybersecurity controls, been documented to a standard suitable for regulatory submission?
• Has the banking onboarding workstream been initiated in parallel with the licensing process, and is the proposed banking partner known to onboard VARA-regulated entities in the relevant activity categories?
• Is the corporate structure — holding company, operating subsidiaries, intra-group arrangements — documented and consistent with a Dubai-centric regulated-activity narrative?

Firms that can answer all of the above confidently are ready to begin preparation of the application package. Firms that cannot should treat the unresolved questions as the pre-application workstream.

We map the licence stack across operating, custody and payment layers before advising on the application. That scoping exercise is the starting point for every VARA mandate we accept.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – our full service across 70+ licensing jurisdictions and regimes
• Crypto Exchange Setup in Georgia – an alternative entry-point jurisdiction for operators building toward a multi-hub structure
• Airdrop Legal Structuring in Kazakhstan (AIFC) – AFSA-regulated structuring for token distribution events in a common-law Central Asian hub

FAQ

How long does a crypto licence take to obtain?

Timeline varies by jurisdiction, the number of regulated activities applied for, and the quality of the submission. VARA applications are measured in months, not weeks — the complexity of the activity categories, the fit-and-proper vetting of key persons and VARA's review capacity all affect the clock. Incomplete or structurally inconsistent applications consistently extend the process. Engaging counsel before the application is prepared is the single most effective way to reduce elapsed time.

Which jurisdiction is best for licensing my crypto business?

There is no universal answer. The optimal jurisdiction depends on the firm's user geography, asset types, intended activities, corporate structure and banking needs. Dubai under VARA suits operators targeting the GCC and MENA markets with substantive local presence. Singapore under MAS suits Asia-Pacific businesses with strong AML infrastructure. EU CASP authorisation under MiCA suits operators requiring EU-wide passporting. Most serious operators require licences in two or more jurisdictions. We map the full stack before advising on sequencing.

Do I need a separate custody licence?

Under the VARA regime, custody is a separately authorised activity. A firm authorised as an exchange cannot hold client assets in custody on the strength of its exchange authorisation alone — it requires the custody activity category. The same principle applies to transfer-and-settlement functions. Many platforms that self-custody client assets discover mid-application that they require the custody category in addition to their primary activity authorisation. The activity mapping exercise at the outset of the engagement is designed to surface this before the application is prepared.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We advise on VARA applications from the initial activity mapping through to licence issuance and ongoing supervisory compliance — and we map the full licence stack across operating, custody and payment layers before any client commits to a jurisdiction. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst — specialist in activity-based licence applications across the Gulf, Southeast Asia and the EU, including VARA, MAS and MiCA CASP submissions.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.