Key takeaways
-
VARA licensing is activity-based, so you must match your business model to the correct regulated virtual asset activity before you apply.
-
Jurisdiction matters: VARA applies across Dubai except DIFC, which follows a different regulatory route.
-
Fees are not “one price”; VARA publishes application and annual supervision fees by activity, and multi-activity applications can trigger extension fees.
-
Timelines are driven by readiness, not form submission, with governance, compliance maturity, and technology controls being the biggest delay factors.
-
Banking must be treated as a parallel workstream, because weak onboarding evidence and unclear flows can block commercial launch even after licensing progress.
-
Avoid oversimplified tax claims: UAE corporate tax outcomes depend on structure and qualifying conditions, even for free zone entities.
Dubai has moved from “crypto-friendly” headlines to an actual licensing framework with clear rules, defined regulated activities, and ongoing supervision. If you want to operate a crypto exchange, custody platform, broker model, advisory service, token issuance project, or an OTC desk in Dubai, you will usually need a VARA licence before you go live.
This guide explains how VARA licensing works, which licence activity applies to your model and what fees to expect. It also explains what documents cause delays, and how to plan the timeline so you’re within budget while awaiting approval.
Important note on jurisdiction. VARA regulates virtual asset activities across Dubai mainland and Dubai free zones. The exception is DIFC, which has its own financial regulator and licensing path.
What is VARA, and what does a VARA licence allow you to do?
VARA is Dubai’s dedicated virtual asset regulator. A VARA licence is the legal authorisation that allows a business to conduct regulated virtual asset activities in or from Dubai, subject to ongoing supervision and compliance obligations. VARA’s mandate is set out under Dubai’s virtual assets law and applies across Dubai mainland and Dubai free zones, excluding DIFC.
In practical terms, a VARA licence is not a generic “crypto licence”. It is an approval for specific regulated activities, and your compliance, staffing, policies, and technology controls are assessed against the rulebook standards for those activities.
VARA vs DIFC vs ADGM, choose the right regulator before you apply
This is one of the most common and most expensive early mistakes. Founders pick a location first, then discover the regulator they actually need is different.
If you are operating in Dubai outside DIFC
You will typically be in VARA territory, assuming your activity is a regulated virtual asset activity.
If you are operating from DIFC
DIFC sits outside VARA’s jurisdiction and follows its own regulatory route, typically through DFSA. If your plan involves having one set of activities in DIFC and another in “onshore Dubai” under VARA, that can be possible, but it must be structured carefully.
Start here for the practical realities: Can you hold both VARA and DIFC licenses for different crypto services?
If you are operating from Abu Dhabi (ADGM)
ADGM is a different emirate with its own regulator and requirements. It can be a strong option for certain models such as custody or investment-focused structures, depending on what you are building and where you want substance. If you are weighing Dubai versus Abu Dhabi, plan the licensing and the company structure together, not separately.
If you are actively comparing the regulatory burden and cost of operating under VARA versus DIFC, this breakdown will help you model it properly.
Comparing VARA licensing costs versus DIFC crypto compliance requirements
Which VARA activity applies to your business model?
VARA fees and requirements are linked to the regulated activity you are applying for. Your first job is to map what you do commercially to how VARA defines activities under its framework, not how crypto companies describe themselves in marketing.
Here is a practical mapping you can use to start.
Advisory services
If you provide investment or market advice on virtual assets, research that informs client decisions, or structured recommendations, you are usually in Advisory Services territory.
Broker-dealer services
If you arrange deals, intermediate trades, execute on behalf of clients, or operate a brokerage model around virtual assets, you typically fall under Broker-Dealer Services.
Exchange services
If you operate a trading venue, match orders, provide an order book, or facilitate buy and sell execution for multiple participants, you are generally in Exchange Services territory.
Custody services
If you hold client assets, control private keys, or provide safekeeping arrangements that place you in control of the assets, you will usually be assessed under Custody Services.
Lending and borrowing
If you facilitate lending markets, interest-bearing arrangements, collateralised borrowing, or similar products, you may fall under Lending and Borrowing Services.
VA management and investment
If you manage portfolios, run a managed strategy, or offer a structured investment service related to virtual assets, you may be in VA Management and Investment Services.
VA transfer and settlement
If your model is about facilitating transfers, settlement rails, or execution and settlement infrastructure, you may fall under VA Transfer and Settlement.
Category 1 VA issuance
If you are issuing a virtual asset or running issuance-related activity, VARA has a dedicated category and fee schedule for Category 1 issuance, with additional scrutiny around disclosures and investor protection.
For niche models like OTC desks, you still need to classify the activity correctly. Start with this guide if you are building OTC in a free zone structure.
Setting up a crypto OTC desk in UAE free zones explained
Also note that some crypto-adjacent businesses are not licensed activities if they do not touch client funds or regulated activity boundaries. If you are unsure, use this checklist first: What crypto activities can operate without VARA licence in Dubai?
Our working hours: Monday to Friday, 9 AM – 6 PM GMT+4
VARA fees and annual supervision fees (official schedule)
VARA publishes a schedule of authorisation and supervision fees by regulated activity, including application fees and annual supervision fees. It also sets out how licence extension fees apply when you add additional regulated activities under one application.
Official VARA authorisation and supervision fees (AED)
| Regulated VA activity | Licence application fee | Licence extension fee (each additional activity) | Annual supervision fee |
|---|---|---|---|
| Advisory Services | 40,000 | 50% of the lower application fee(s) | 80,000 |
| Broker-Dealer Services | 100,000 | 50% of the lower application fee(s) | 200,000 |
| Custody Services | 100,000 | 50% of the lower application fee(s) | 200,000 |
| Exchange Services | 100,000 | 50% of the lower application fee(s) | 200,000 |
| Lending and Borrowing Services | 100,000 | 50% of the lower application fee(s) | 200,000 |
| VA Management and Investment Services | 100,000 | 50% of the lower application fee(s) | 200,000 |
| VA Transfer and Settlement Services | 40,000 | 50% of the lower application fee(s) | 80,000 |
| Category 1 VA Issuance | 100,000 | 50% of the lower application fee(s) | 200,000 |
This fee schedule is only one part of budgeting. You still need to plan for company formation costs, office and substance, compliance hires, policy drafting, audits, and banking onboarding workstreams. For a grounded first-year budget model, use this: Cost planning for UAE company setup and first year
"VARA regulates virtual asset activities across Dubai mainland and Dubai free zones, except DIFC, which has its own financial regulator and licensing path."
How long does VARA licensing take?
Timelines vary by business model and readiness. As a planning range, simpler models can move faster, while exchanges, custody, and complex product stacks typically take longer due to deeper technical and control assessments.
For many operators, a realistic end-to-end window is six to twelve months when you include preparation, drafting, staffing, regulator feedback loops, and remediation. Aston VIP
The biggest timeline drivers are usually not the form submission itself. They are policy maturity, evidence quality, hiring the right senior personnel, and proving how your technology stack protects clients and prevents financial crime.
If you are migrating an existing crypto business into the UAE, factor in extra time for corporate restructuring, UBO evidence packs, and banking continuity planning.
Step-by-step VARA application process
1) Confirm regulator and location
Confirm whether you are operating under VARA or a financial free zone regulator. Do not skip this step. VARA excludes DIFC jurisdictionally, so “free zone” does not automatically mean VARA.
2) Define the regulated activities clearly
Map your commercial model to VARA’s regulated activity list. If you are applying for multiple activities, structure the application intentionally rather than bundling everything by default.
3) Establish a Dubai entity and substance plan
Most applicants need a Dubai entity and a credible operating presence. VARA and banks typically look for an operational story that makes sense, not just a shelf company.
4) Build an approval-grade compliance framework
This is where strong applications separate themselves. You will normally need a coherent package that includes AML and CFT controls, KYC and onboarding standards, transaction monitoring posture, sanctions controls, risk governance, incident management, and internal audit logic.
5) Prepare a technology and security evidence pack
Expect scrutiny around custody controls, key management, cybersecurity, access controls, logging, monitoring, and incident response. Weak or vague “security sections” are a common reason for regulator pushback.
6) Submit and manage the regulator feedback loop
Treat this as a project with owners, deadlines, and evidence quality control. Fast responses help, but quality responses matter more than speed.
7) Align licensing with banking from day one
Banking is not an afterthought for a VARA applicant. In many cases, your ability to operate commercially depends on how well you can evidence source of funds, client flow logic, controls, and compliance maturity.
Get the most relevant information about business life in Dubai
VARA application documents checklist (what serious operators prepare)
A strong application is usually built on four evidence stacks.
Corporate and governance
-
Company registration and group structure chart
-
UBO and ownership disclosures
-
Board and management governance structure
-
Outsourcing and vendor oversight approach
Compliance and financial crime controls
-
AML and CFT policy suite
-
KYC, CDD, EDD methodology
-
Risk assessment methodology and risk appetite statements
-
Sanctions screening and monitoring approach
-
Suspicious activity escalation and reporting logic
Financial and operational readiness
-
Financial model and runway evidence
-
Operational procedures for the activity you are licensing
-
Client terms, product disclosures, complaints handling
Technology, cybersecurity, and resilience
-
System architecture and data flow diagrams
-
Key management and wallet architecture narrative, where applicable
-
Cybersecurity controls, incident response plan, and testing evidence
-
Business continuity and disaster recovery plan
If you operate in a way that triggers travel rule obligations, you should also plan that compliance layer early because it impacts your operational design and vendor selection.
UAE travel rule compliance guide for crypto VASPs
Common reasons VARA applications get delayed (and how to avoid them)
The business model is unclear in regulatory language
Many decks describe what the product does, but not what regulated activity it is, how client assets flow, and where risk sits. Fix this by writing a one-page “regulatory mapping memo” before you draft anything else.
Weak AML posture, especially around onboarding and monitoring
High-level AML statements are not enough. VARA and banks tend to look for operationally credible controls and accountable ownership.
Key personnel are missing or not fit for the scope
If your activity needs senior compliance oversight, MLRO capability, and credible operational leadership, the application will struggle without it.
Banking is treated as a “later” problem
Even if licensing progresses, commercial launch often stalls without bankable flows. If your end goal is an exchange bank account path, start with a proven approach and align your corporate and compliance packs to what banks actually evaluate.
Best route to get a crypto exchange bank account in the UAE today
"VARA licensing is not ‘one and done’."
Tax positioning, do not oversimplify it
Dubai remains highly attractive for global operators, but tax outcomes depend on your structure and compliance. The UAE has a federal corporate tax regime, and Free Zone entities may access 0% corporate tax on qualifying income if they meet the conditions for Qualifying Free Zone Person status.
In other words, “0% in a free zone” is not automatic. Treat tax as a structured workstream alongside licensing, substance, and banking, especially if you have cross-border revenue flows.
Renewal and ongoing compliance
VARA licensing is not “one and done”. A licensed operator is expected to maintain its control environment, update policies, train staff, and handle audits, reporting, and supervision.
Acording to the VARA Rulebook, annual supervision fees apply by regulated activity and are payable in advance of conducting the activity, based on the published schedule.
A practical way to stay ahead is to run internal compliance health checks against your real operating workflows, not your policies as written. This is especially important once you add products, change custody architecture, expand geographies, or modify onboarding.
FAQs
Do I need a VARA licence if I am based in DIFC?
Not usually, because DIFC is outside VARA’s jurisdiction. DIFC has its own licensing and regulatory route, typically through DFSA.
If you want to operate different crypto services under different regulators, read this first.
Can you hold both VARA and DIFC licenses for different crypto services?
What are the official VARA fees?
VARA publishes application and annual supervision fees by regulated activity, including rules for licence extension fees when adding additional activities.
How long does it take to get approved?
Many operators should plan for six to twelve months end-to-end when preparation and regulator feedback loops are included, particularly for exchanges, custody, and complex models. Read our article on VARA licence timeline for crypto exchanges in Dubai.
Can any crypto activity operate without a VARA licence?
Some activities may be outside regulated boundaries if they do not involve regulated virtual asset services, client funds, or transaction facilitation. Use this guide to sanity-check your model before you assume you are exempt.
I am migrating an existing crypto business. What changes?
Most migrations require corporate restructuring, new compliance evidence packs, and a banking continuity plan. A detailed guide is available in our article on how to migrate an existing crypto business to the UAE from another jurisdiction
How Aston VIP supports VARA licensing
Most founders do not fail on ambition. They fail on sequencing. VARA, corporate setup, compliance build, technology assurance, and banking must move as one integrated plan.
Aston VIP supports clients end-to-end, including:
-
Structuring your Dubai setup to match the regulator you actually need
-
Mapping your model to the correct regulated activity
-
Building an approval-grade documentation and evidence pack
-
Coordinating compliance, technology, and operational workstreams
-
Planning banking readiness so launch is commercially viable
If you want a fast clarity check, we can review your business model and tell you which regulator, which activity, and which licensing path is realistic before you spend heavily on the wrong setup.
