Overview 

Established in March 2022 under Dubai's Virtual Assets Law No. 4 of 2022, VARA is the world's first independent regulatory authority dedicated solely to virtual assets - governing all VASP activity across Dubai's mainland and free zones, with the exception of the DIFC. Cabinet Decision No. 111/2022 reinforces the regime, making it a legal requirement to obtain a licence before commencing any virtual asset activity in the emirate. VARA's framework is built on principles of economic sustainability, cross-border financial security and gold-standard AML/CFT standards, positioning Dubai as the reference jurisdiction for virtual asset regulation globally. 

Scope

VARA's regulatory framework comprises two tiers of rulebooks. Four compulsory modules apply to all licensed VASPs regardless of activity: the Company Rulebook, Compliance and Risk Management Rulebook, Technology and Information Rulebook, and Market Conduct Rulebook. These establish baseline requirements across governance, AML/CFT controls, cyber resilience and market conduct. Eight activity-specific rulebooks then apply on top, governing the precise obligations attached to each licence category. 

Licence Categories

Applicants may apply for one or a combination of eight activity-based licences, each governed by its own dedicated rulebook:

• Advisory Services - Guidance on the acquisition, disposal or investment in virtual assets.
• Broker-Dealer Services - Order solicitation, matching and execution on behalf of clients.
• Custody Services - Safekeeping and segregation of client virtual assets, ring-fenced within a dedicated entity.
• Exchange Services - Operation of matching engines and order books for virtual asset trading.
• Lending and Borrowing Services - Virtual asset-backed loan facilities and staking platforms.
• VA Management and Investment Services - Discretionary portfolio management and collective investment schemes.
• VA Transfer and Settlement Services - On-chain payment rails and settlement infrastructure.
• Virtual Asset Issuance - Token creation and primary issuance activities.

Applicant Profiles

VARA accepts applications from a broad range of entities - including global exchanges, custodians, tokenisation platforms, market makers and emerging Web3 ventures - provided they can demonstrate adequate local substance, fit-and-proper management and capital. Foreign firms are required to establish a Dubai-incorporated entity or branch; overseas licences do not carry passporting rights into the emirate. 

Process 

The approval journey has two formal stages :

In-Principle Approval - Applicants submit an Initial Disclosure Questionnaire, a high-level business plan and headline fees. Well-prepared submissions typically receive an outcome within four to eight weeks.

VASP Licence - The full policy and procedural suite, technology architecture documentation and governance framework are submitted for review. This stage typically runs three to four months, depending on the complexity of the proposed activity set.

Operational go-live is conditional on satisfying all regulatory comments and paying first-year supervision fees in full.

Key Considerations

Capital - Minimum thresholds range from AED 100,000 for pure advisory firms to AED 1.5 million for standalone exchanges, with requirements varying by activity type.

Governance - A board and a number of senior management roles are mandatory. In addition, two locally resident Responsible Individuals - including the Compliance Officer - are required to satisfy VARA's mind-and-management expectations.

Technology - Annual penetration testing, travel-rule compliant messaging and real-time transaction monitoring are mandatory across all licence categories.

Marketing - All marketing materials require VARA pre-clearance and must not contain exaggerated or misleading claims.

Fees - Applicants must account for both application charges and recurring annual supervision levies, as set out in Schedule B of the regulations.

Engage CFC 

CFC's former regulatory specialists have secured multiple in-principle approvals and full licences for exchanges, custodians and tokenisation platforms - compressing timelines through pre-submission gap analysis, rulebook-aligned policy frameworks and regulator-ready technology documentation.  Engage CFC to navigate the nuance, avoid costly rework and accelerate your launch into Dubai’s regulated virtual-asset market.