How to Get a VARA License in Dubai: The Complete 2026 Guide

VARA: Dubai’s Virtual Asset Regulator

The Virtual Assets Regulatory Authority (VARA) was established by Dubai Law No. 4 of 2022 and operates as the world’s first standalone regulator dedicated exclusively to virtual assets. VARA’s jurisdiction covers all of the Emirate of Dubai, with the exception of the Dubai International Financial Centre (DIFC), which maintains its own regulatory regime through the Dubai Financial Services Authority (DFSA).

VARA’s regulatory framework, finalized in 2023, consists of a Virtual Assets and Related Activities Regulations (VARAR), a Company Rulebook applicable to all licensees, and eight activity-specific rulebooks that govern the detailed conduct requirements for each category of virtual asset service. This layered structure means that a VARA licensee providing exchange and custody services must comply with the Company Rulebook plus both the Exchange Services Rulebook and the Custody Services Rulebook.

For tokenization platforms, VARA is significant for several reasons: Dubai’s strategic position between European and Asian time zones, the UAE’s tax-free operating environment, the presence of substantial regional capital (including sovereign wealth funds), and VARA’s explicit engagement with asset tokenization as a policy priority.

The 7 VARA Activity Categories

VARA licenses are activity-specific. A firm must apply for authorization for each of the following regulated activities it intends to conduct:

1. Virtual Asset Advisory Services (VAAS) — providing advice, recommendations, or guidance on virtual assets, including investment advice and asset structuring advice. This is the broadest and most commonly required category.

2. Virtual Asset Broker-Dealer Services (VABDS) — acting as agent or principal in buying and selling virtual assets on behalf of clients or for the firm’s own account. Capital: AED 1,500,000.

3. Virtual Asset Custody Services (VACS) — safeguarding virtual assets on behalf of clients, including private key management and cold storage. Capital: AED 700,000. This is the lowest-capital activity and the most common starting point for new entrants.

4. Virtual Asset Exchange Services (VAES) — operating an exchange platform that matches buyers and sellers of virtual assets. Capital: AED 2,000,000. The highest capital requirement reflects the systemic risk profile of exchange operations.

5. Virtual Asset Lending and Borrowing Services (VALBS) — facilitating lending of virtual assets to borrowers or providing borrowing facilities collateralized by virtual assets.

6. Virtual Asset Management and Investment Services (VAMIS) — discretionary or non-discretionary management of virtual asset portfolios on behalf of clients.

7. Virtual Asset Transfer and Settlement Services (VATSS) — providing services for the transfer of virtual assets between persons, including payments infrastructure.

Which categories apply to tokenization platforms? A primary issuance platform issuing tokenized securities or fund interests will typically require VAAS (for structuring advice) and VATSS (for settlement). A secondary trading marketplace requires VAES. A tokenized asset custodian requires VACS. Many platforms require 2–3 categories from the outset.

Minimum Viable Approach: Category Bundling

VARA permits — and in some cases expects — firms to apply for multiple activities simultaneously. The application process is designed to handle multi-activity applications, and the regulatory fees reflect the combined activity scope.

For a tokenization platform entering Dubai for the first time, the minimum viable approach typically involves:

• VAAS as a foundational category (required for any advisory relationship with token holders)
• VACS if the platform holds or manages client assets
• VAES only if the platform operates a matching engine or order book

Avoid applying for activities you do not intend to conduct within 12 months of licensing. VARA monitors whether licensed activities are being conducted and may take supervisory action against firms that hold licenses for activities they are not operationally ready to perform.

Capital Requirements in Detail

Capital must be maintained as liquid assets. VARA requires a capital adequacy statement as part of the quarterly regulatory reporting cycle. Firms that fall below minimum capital must notify VARA immediately and submit a remediation plan.

The Three-Stage VARA Application Process

VARA has designed its licensing process as a sequential three-stage procedure. Each stage has defined inputs, outputs, and timelines.

Stage 1: Initial Assessment (4–8 weeks)

The Initial Assessment is VARA’s front-door process. The firm submits a structured application package covering:

• Business activity description: Which VARA activities are sought; why; target client types
• Corporate structure: Legal entity type, jurisdiction of incorporation, group structure, UBO chart
• Senior management overview: CVs and brief background on key personnel
• Business model summary: Revenue streams, proposed pricing, technology platform overview
• Preliminary AML/CFT posture: Overview of proposed AML framework, not yet the full manual

VARA reviews the Initial Assessment package and makes one of three determinations: (a) proceed to Stage 2 (Provisional Approval), (b) request clarification or additional information, or (c) decline to proceed with a statement of reasons.

The Initial Assessment does not guarantee licensing. It confirms that VARA is willing to undertake the full review. Firms should treat it as a competency screen, not a formality.

Typical outcome timeline: 4–8 weeks from submission of complete Initial Assessment package.

Stage 2: Provisional Approval (3–6 months)

Firms that pass the Initial Assessment enter the Provisional Approval phase. This is the substantive review, requiring a complete application dossier.

VARA assigns a case officer who manages the review and communicates information requests. Case officers are knowledgeable; firms should expect pointed questions about their business model, technology architecture, and AML procedures.

The Provisional Approval, once issued, permits the firm to:

• Establish its Dubai legal entity (if not already done)
• Begin building out its operational infrastructure in Dubai
• Conduct pre-marketing and business development (within limits)
• Continue engagement with VARA toward the Full License

The Provisional Approval is not a trading license. The firm cannot conduct regulated virtual asset activities with clients during this stage.

Typical outcome timeline: 3–6 months from submission of complete Stage 2 documentation.

Stage 3: Full License (2–4 months)

The Full License is issued after VARA completes its final review, including:

• Operational inspection: VARA or its designated auditor reviews the firm’s operational infrastructure, IT systems, and Dubai office
• Personnel assessment: Key personnel interviews may be conducted to verify fit and proper status
• Compliance confirmation: AML manual, transaction monitoring system, and reporting procedures are reviewed in final form

Full License issuance marks the point at which the firm may begin regulated virtual asset activities with clients.

Required Documentation: Complete Checklist

Corporate Documentation

• Certificate of incorporation (UAE entity or group parent)
• Articles of association / memorandum of association
• Group corporate structure chart with UBO disclosure to natural person level
• Register of directors and senior managers
• Board resolutions approving license application

UBO Declarations

VARA applies a 10% ownership threshold for UBO disclosure (stricter than the global 25% AML standard). All persons holding 10% or more of shares or voting rights, directly or indirectly, must be disclosed with:

• Certified passport copies
• Proof of residential address (utility bill or bank statement, <3 months)
• Source of wealth declaration
• Criminal record certificate from home jurisdiction
• CV and professional background

AML Manual

The AML/CFT policy manual is one of the most scrutinized documents in the VARA application. It must address:

• Customer due diligence (CDD) procedures for all client types
• Enhanced due diligence (EDD) trigger criteria and procedures
• PEP identification and management
• Sanctions screening procedures (OFAC, UN, EU, UAE local lists)
• Transaction monitoring rules and thresholds
• Suspicious transaction reporting procedures (to UAE FIU)
• Record-keeping procedures
• Travel Rule compliance (UAE implemented FATF R.16 in 2024)
• Staff AML training program

Generic AML manuals will be rejected. The manual must reflect VARA’s specific requirements and the firm’s actual business model, client base, and transaction types.

Business Plan

• 3-year financial projections with monthly detail for Year 1
• Staffing plan showing UAE-resident compliance and operational staff
• Technology infrastructure description (on-chain architecture, custody solution, key management)
• Third-party service provider agreements (custodians, technology providers, banking partners)
• Marketing and distribution strategy

IT Audit

VARA requires an independent IT security audit from an approved auditor. The audit must cover:

• Network security architecture
• Access controls and authentication systems
• Key management and cold storage procedures (for custody applications)
• Penetration testing results (within 6 months of application)
• Business continuity and disaster recovery testing

Financial Statements

• 2 years of audited financial statements (group level if applicable)
• Bank reference letter confirming financial standing
• Evidence of minimum capital availability (bank statement or auditor confirmation)

Local Presence Requirements

VARA requires genuine operational presence in Dubai. This means:

Physical office: A dedicated office address in Dubai (not a serviced office or virtual address). The office must be staffed and functional. VARA inspectors have been known to visit. The office must be in the Emirate of Dubai proper — offices in the DIFC are subject to DFSA jurisdiction, not VARA.

UAE-resident MLRO: The Money Laundering Reporting Officer must be resident in the UAE and must be a UAE-licensed compliance professional. This person must be a senior employee of the VARA licensee, not a shared service from a group entity or an external consultant.

UAE-resident senior management: At least one director or senior manager with day-to-day operational responsibility must be UAE-resident. VARA’s fit and proper assessment examines whether the firm has genuine local leadership, not merely a brass-plate presence.

Banking: A business bank account with a UAE-licensed bank is required. This has become a significant practical obstacle for virtual asset businesses. Several UAE banks remain reluctant to onboard virtual asset businesses, though this has improved following the Central Bank of the UAE’s 2024 guidance on banking for virtual asset service providers.

ADGM as an Alternative

For platforms that prefer Abu Dhabi as their UAE base, the Abu Dhabi Global Market (ADGM) operates its own digital asset framework under the Financial Services Regulatory Authority (FSRA). The FSRA’s Digital Asset Framework, issued in 2023, provides an alternative licensing pathway for firms that would otherwise apply to VARA.

Key differences: ADGM/FSRA is English common law-based (offering familiar legal structures for international firms), is located in Abu Dhabi rather than Dubai, and has historically been more willing to license sophisticated institutional business models with smaller retail footprints. Capital requirements are broadly comparable to VARA.

For firms targeting the Abu Dhabi sovereign wealth fund ecosystem or international institutional clients, ADGM may be the stronger choice. For firms seeking Dubai’s retail and regional distribution advantages, VARA is the appropriate pathway.

VARA’s 8 Rulebooks: What Compliance Officers Must Know

Every VARA licensee must comply with the Company Rulebook, which establishes baseline governance, record-keeping, client money handling, conflict of interest management, and reporting obligations. Activity-specific rulebooks add conduct requirements on top of the Company Rulebook.

Key requirements across the rulebooks include:

• Client asset segregation: Client virtual assets and fiat must be strictly segregated from firm assets at all times. VARA requires daily reconciliation.
• Cold storage ratios: Custody licensees must maintain a minimum proportion of client assets in cold storage (specific ratios are confidential to licensees but are understood to be 90%+ for most asset types).
• Leverage limits: VARA imposes strict leverage limits for exchange and broker-dealer services, including outright prohibition on offering margin trading to retail clients.
• Market manipulation: VARA’s market integrity rules prohibit wash trading, spoofing, and other market manipulation practices with penalties up to AED 50,000,000.
• Disclosure obligations: Pre-contractual risk disclosures must be provided to clients before any service is provided. Standardized risk disclosure forms are specified in the rulebooks.

The VARA regulations page publishes all current rulebooks in full.

Related Resources

• Licensing Cost Comparison: All Jurisdictions
• AML Framework for Tokenization Platforms
• Travel Rule Compliance: UAE Requirements
• Jurisdictions Database: UAE
• Regulatory Benchmarks