Every crypto business in Dubai operates under a VASP (Virtual Asset Service Provider) license issued by VARA — the Virtual Assets Regulatory Authority. The regulator defines eight categories of licensable activity, and the license itself is granted in two stages: first an Initial Approval, then a Full VASP License. Here is how the system works and what it takes to enter it.
What VARA is and what it regulates
VARA (Virtual Assets Regulatory Authority) is the virtual assets regulator of the Emirate of Dubai and the world's first independent, specialised authority of its kind. It oversees the provision, use and exchange of virtual assets in and from Dubai, and its work rests on three principles: economic sustainability, consumer protection and cross-border financial security.
Having a dedicated regulator is a sign of a mature market: the rules are clear in advance, and participants operate in a predictable, well-designed environment. VARA's jurisdiction covers mainland Dubai and the emirate's free zones — with one exception: the DIFC financial centre, which has its own regulator, the DFSA. In every other case, any virtual asset service provider (VASP) operates under a VARA license.
The choice of location within Dubai shapes your operating model, so it is worth thinking through early — we cover how to choose a free zone in the UAE in a separate guide.
The eight categories of licensable activity
VARA licenses eight types of virtual asset activity. Each category describes a distinct kind of service — from advisory to custody and issuance. Here is the full list.
| Category | What it covers |
|---|---|
| Virtual Assets Advisory Services | Advising on virtual assets: strategy selection, product assessment and support for client decisions. |
| Broker-Dealer Services | Intermediating the purchase and sale of virtual assets on behalf of clients or on own account within a brokerage model. |
| Custody Services | Safekeeping of virtual assets and managing access keys on a client's behalf. |
| Exchange Services | Operating the exchange of virtual assets for fiat money or other virtual assets, and running a trading venue. |
| Lending and Borrowing Services | Providing and raising loans denominated in virtual assets. |
| Management and Investment Services | Managing clients' assets and investment portfolios in virtual assets. |
| Transfer and Settlement Services | Transferring virtual assets and settling transactions between parties. |
| Issuance Category 1 | Issuing virtual assets within the first issuance category. |
Alongside these categories, there are separate regimes for related operations. VA Proprietary Trading is possible under a No Objection Certificate (NOC) rather than a full license, while Issuance Category 2 goes through a separate approval.
The two-stage licensing process
A VASP license is granted sequentially, in two stages.
Stage 1 — Initial Approval. At this stage VARA reviews the applicant, its founders and business model, the intended activity categories and overall readiness to operate. Initial Approval confirms that the project meets the regulator's requirements in principle and can move forward.
Stage 2 — Full VASP License. After Initial Approval, the applicant finalises documentation, risk-management policy, capital requirements and operational procedures. Following its review, VARA decides whether to grant the full license, which is what confers the right to provide services.
One point matters here: the license is granted by VARA at its own discretion, based on its own assessment of the applicant. Clearing the first stage does not mean the full license follows automatically — each stage is reviewed on its merits.
Capital and structure requirements
Paid-up capital requirements depend on the activity category and apply to each category separately. For Virtual Assets Advisory Services, for example, the minimum paid-up capital is AED 100,000 (about US$ 27,300). Other categories carry different amounts — the current figures are set out in VARA's rulebooks, and those are what to rely on when budgeting.
Paid-up capital must be held permanently in a trust account with a UAE bank, or provided as a surety bond, as VARA specifies. This is a requirement to maintain capital throughout operations, not a one-off payment at application.
As for structure, foreign companies usually first establish a subsidiary in Dubai — on the mainland or in a free zone — and apply for the license through it. We describe how a company's structure in the UAE is set up and amended in a separate guide.
A special case: Custody
A VASP can apply for several categories at once and combine them under a single license — convenient for projects with a broad, multi-service model. There is one exception to this rule: Custody Services.
Custody activity requires a separate legal entity with its own license. In other words, safekeeping client assets cannot be combined with other categories inside one company — a dedicated entity is created for it. This approach reflects the regulator's heightened attention to the safety of client funds and the consumer-protection logic on which the entire VARA system is built.
Timelines, cost and preparation
According to legal advisers, the licensing process typically takes four to seven months — from filing for Initial Approval to receiving the full license. The exact timeline depends on the activity categories, document readiness and project structure.
The total cost comes in several layers: VARA fees, paid-up capital requirements for each category, company incorporation and operational preparation. There is no single universal figure here — it is defined by the mix of categories and the chosen model, while current fees and capital requirements are published in VARA's rulebooks.
Preparation usually centres on a few steps: choosing a location and incorporating the company, forming the capital and placing it in a trust account, and preparing documentation and policies. Document legalisation is a distinct line of time: incorporation and corporate papers for filing go through attestation and legal translation in the UAE. This work is worth building into the timeline early.
The bottom line
Dubai has built a clear, well-designed framework for regulating virtual assets: the world's first independent dedicated regulator, eight clearly described activity categories and a sequential two-stage process. For a crypto business this means predictable rules of the game — from Initial Approval to the Full VASP License.
The practical route looks like this: identify the categories you need, incorporate the company, prepare capital and documentation, and pass VARA's two stages of approval. Capital, timelines and fees should be checked against VARA's official rulebooks, and your specific scenario worked through with qualified specialists.
This material is for information only and does not constitute legal or financial advice. Current conditions, capital requirements and fees are set by the regulator and published in VARA's rulebooks (vara.ae); the license is granted by VARA at its own discretion. Before making decisions, verify the requirements against primary sources and consult qualified specialists.
