VARA Licensing in Dubai: Practical Guide for Virtual Asset Service Providers

Who VARA regulates

The Virtual Assets Regulatory Authority (VARA) regulates virtual asset activities in the Emirate of Dubai, including mainland Dubai and its free zones, with the exception of the Dubai International Financial Centre (DIFC). The DIFC has its own regulator, the Dubai Financial Services Authority (DFSA), and is outside VARA's jurisdiction.

Firms carrying on virtual asset activities in or from Dubai outside the DIFC need the appropriate VARA licence for those activities before they begin operating. The precise obligations depend on the activities, the corporate structure and the rulebooks in force at the time of application.

The application flow for new firms

According to VARA's official licensing page, new firms follow two stages:

1. Approval to Incorporate (ATI) - obtained before establishing the entity with the relevant licensing authority (mainland or free zone).
2. VASP Licence - the licence for the specific virtual asset activities applied for.

Preliminary or intermediate statuses, such as an approval to incorporate or an in-principle approval, should not be treated as permission to carry on virtual asset activities. Whether, and to what extent, any activity is permitted before full licensing must be checked against VARA's current rules and the terms of the specific approval.

The rulebooks

All VASPs must comply with the compulsory rulebooks:

• Company Rulebook
• Compliance and Risk Management Rulebook
• Technology and Information Rulebook
• Market Conduct Rulebook

In addition, each VASP must comply with the activity-specific rulebook(s) for each licensed activity. The rulebooks are published and updated by VARA, so the current version should be checked at the time of application.

Scoping your activities

VARA's activity rulebooks cover, among others, advisory services, broker-dealer services, custody services, exchange services, lending and borrowing services, VA management and investment services, VA transfer and settlement services, and VA issuance. An applicant applies only for the activities its business model actually requires. Mapping each product and revenue stream to the relevant activity is usually the first practical step, because the chosen activities determine which rulebooks apply.

Pre-application checklist

• Business model and activity mapping - products, clients, flows of assets and funds, and the corresponding VARA activities.
• Corporate and free-zone setup path - the intended licensing authority and how incorporation fits the ATI stage.
• Governance and fit-and-proper - board, senior management, key individuals and their suitability.
• AML/CFT and compliance framework - risk assessment, customer due diligence, sanctions screening and compliance officers.
• Technology and security - systems, information security, custody arrangements and incident handling.
• Outsourcing and third-party contracts - service providers, technology vendors and their oversight.
• Policies and procedures - aligned with the compulsory and activity-specific rulebooks.
• Financial and capital planning - a high-level view of capital and financial resources against the applicable rulebook requirements.
• Application documentation - complete, consistent and supported by the materials above.

VARA vs DIFC/DFSA

VARA covers Dubai mainland and free zones other than the DIFC. Virtual asset and crypto token activities within the DIFC fall under the DFSA's separate regime. The choice of location therefore determines the regulator, the rules and the licensing process; one regime cannot be assumed to apply to the other.

Official sources

• VARA - Licence applications
• VARA Rulebooks
• VARA - VA Activity Rulebooks
• VARA - Public register

Related services

See our Virtual Assets Licensing (VARA, DMCC, etc.), AML/CTF Compliance and DIFC & ADGM Crypto Asset Regulations services.

Requirements depend on the activity, the structure and the rulebooks in force. This article is general information and not legal advice.