Skip to content 
In April–May 2025, Dubai’s Virtual Assets Regulatory Authority (VARA) rolled out sweeping updates to its regulatory rulebook for virtual asset businesses. On 19 May 2025, VARA published Version 2.0 of its activity-based Rulebooks, with all provisions taking effect by 19 June 2025. These revisions strengthen oversight across every licensed crypto activity. From advisory and brokering to custody, exchange, lending, transfer and even token issuance. The new rules harmonize definitions (for terms like “client assets,” “qualified custodians,” and collateral standards) and impose unified risk-management and market-conduct requirements across licenses Licensors have granted licensees a 30-day transition (compliance by 19 June 2025), reflecting Dubai’s push to align crypto rules with global best practices. The net effect is greater clarity in Dubai’s digital asset regulation, good news for virtual-asset companies and entrepreneurs planning to apply for a VARA license in Dubai.
These updates affect every VARA license category. Below we explain what changed and what new obligations apply by license type.
Ready to make your licensing process smoother and fully compliant? Let Aston VIP handle the regulatory groundwork while you focus on building your business. We’ve guided over 60% of all VARA submissions to date now let us help you do it right.
VARA updates rulebook for Trading & Brokerage in 2025 (Exchange, Broker-Dealer, Distribution)
VARA’s updates impose far stricter controls on crypto trading and brokerage. Margin trading is now tightly regulated, as only firms expressly authorized in their licence can offer it, and retail clients are banned from leveraged crypto trading. VARA “tightened leverage thresholds” and mandated clearer collateral standards. In practice, broker-dealers must hold extra capital and margin to cover positions, monitor client collateral daily, and enforce automatic liquidation if margins drop (with clients notified immediately) according to VARA updates. These firms must send monthly margin-account statements to clients. On top of that, they must ensure client assets are segregated with licensed custodians, and keep all margin contracts updated.
Simultaneously, updates to rules on token distribution (initial coin offerings) have been clarified under VARA’s Broker-Dealer Services Rulebook. Licensees conducting token sales must now follow the detailed Licensed Distribution Services section (Part IV). This spells out requirements for upfront approval, disclosures, and conflict management. In short, exchanges and brokerages must upgrade compliance systems to meet standardized “best execution” and disclosure rules. They also have to coordinate closely with issuers on public filings. These changes enhance Dubai crypto compliance by reducing ambiguity. As VARA noted, the updates provide “clearer definitions for collateral wallet arrangements, and harmonised compliance requirements across all licensed activities”.
Stronger custody requirements
Custody licensees (digital asset custodians) face similar tightening. The updated Custody Services Rulebook (effective 19 June 2025) formalizes what counts as “client assets” and who qualifies as a custodian. Under the new framework, custodians must keep client funds completely separate from the firm’s own assets and only allow licensed “qualified custodians” to hold them. In practice, this means multi-signature wallets or insured vault services, rigorous audit trails, and periodic proof-of-reserves. The rulebook also adds a new section on Collateral Wallet Services, clarifying how custodians handle assets pledged as loan collateral (including integration with trading platforms).
In addition, board-level oversight has been beefed up. The Custody Rulebook now includes detailed board and committee requirements (governance, remuneration reporting, etc.) to ensure independent risk oversight. This aligns Dubai custody regulation with global standards: each custodian must implement a full risk-management framework (covering cybersecurity, fraud, etc.) and maintain capital commensurate with its liabilities. These changes give crypto asset managers certainty: they know exactly what security and governance structures are needed for a compliant Dubai custody license.
Our working hours: Monday to Friday, 9 AM – 6 PM GMT+4
Tighter lending and borrowing controls
Crypto lending platforms and services are also under new constraints. The Lending and Borrowing Services Rulebook (effective 19 June 2025) introduces strict lending safeguards. For example, lenders must re-value collateral periodically and report valuations to clients. Risk management and due diligence provisions are now explicit: VARA requires formal credit checks, loan-to-value limits, and stress-testing for all loan portfolios Licensees must maintain robust documentation (loan agreements, collateral receipts, margin calls) and automated systems to enforce margin requirements. Client reporting is emphasized – borrowers and lenders alike must receive clear, timely information on exposures (e.g. monthly statements and notifications on collateral ratios).
In practice, this means any crypto lending company must upgrade its compliance: incorporating standards from broker-dealers (on collateral and liquidation) and from banks (on credit risk). For example, peer-to-peer lending firms must ensure each loan is backed by vetted, segregated collateral, and must trigger repossession or liquidation processes if a borrower’s crypto pledge dips below agreed thresholds. By codifying these controls, Dubai’s updated rules aim to prevent systemic risk and protect both lenders and borrowers in the crypto space.
Advisory services: Formalized client engagement
VARA’s market conduct overhaul affects advisory and consultancy firms too. Under the new Market Conduct Rulebook, all Virtual Asset Service Providers (including advisors) must now have formal, signed client agreements covering every service. Casual or implied arrangements (e.g. platform terms of use) will no longer suffice. Each agreement must define the advisor’s scope of work, duties, fee structure, and risk disclosures. For example, a crypto investment advisor in Dubai must now enter into written contracts for each client, specifying exactly what tokens they can advise on and how disputes are handled.
In addition, advisory licenses must follow the same transparency and anti-manipulation rules as exchanges. The updated Market Conduct Rulebook introduces requirements like insider-trading controls and transaction monitoring for all VASPs (including advisory). Licensed advisors are now explicitly required to keep insider lists of any employees or partners with access to sensitive information. This means a firm giving strategic crypto advice must track and restrict trading by insiders, just as an exchange would.
"Overall, advisory firms will need to bolster compliance: building out compliance teams to ensure all client interactions are documented and audited."
Asset management & Investment services
Digital-asset fund managers and portfolio managers see clearer rules for structuring their products. VARA’s VA Management and Investment Services Rulebook has been updated to harmonize with other areas. Key changes include broader disclosure and risk obligations for fund structures. For instance, any public offering of crypto fund interests likely now falls under the revised Virtual Asset Issuance framework (see below), requiring a formal whitepaper and ongoing audits. In practice, this means that launching a tokenized fund or investment vehicle in Dubai will require the same robust due diligence and capital requirements as direct issuers of tokens.
Managers of self-directed investment products must also comply with cross-license rules: all asset managers must maintain written client agreements, adhere to KYC/AML and travel-rule protocols, and follow the new collateral/securitization standards if they use client funds for lending. These investment licenses will now demand a documented governance structure, just like traditional fund managers. In sum, crypto-asset funds in Dubai will benefit from clearer licensing criteria – but they must also meet the enhanced compliance checks prescribed in VARA’s unified rulebooks.
Get the most relevant information about business life in Dubai
Transfer and settlement (Payment) services
The VA Transfer and Settlement Services license (covering crypto payments, remittances and custody-to-custody transfers) now carries far more explicit obligations. Most notably, VARA has embedded the FATF “Travel Rule” into its AML framework. All firms licensed for transfers must collect and share originator and beneficiary details for every transaction above the applicable threshold (just like banks do). In effect, this means any crypto payment platform must upgrade its systems to attach strict source-of-funds and end-recipient information to large transfers.
More generally, transfer-licensees are subject to the same client-protection measures as other VASPs. They must obtain Customer Due Diligence at onboarding, continuously monitor for suspicious activity, and report large trades. VARA also standardized definitions (e.g. what counts as a “virtual asset transfer”), so firms now have clear rules on which transfers they can process versus what requires a license. Together, these changes close gaps: by unifying compliance, Dubai crypto compliance now aligns closely with international banking standards, reducing uncertainty for cross-border payments.
Virtual asset issuance (Token/Stablecoin) licenses
One of the most transformative updates concerns token issuance and stablecoins. VARA’s Virtual Asset Issuance Rulebook (effective 19 June 2025) now explicitly governs two categories of tokens: Category 1 (fiat-referenced) and Category 2 (asset-referenced) virtual assets. In particular, the rulebook opens the door to real-world-asset (RWA) tokens, a first in the region. Under the new rules, Dubai-authorized exchanges and broker-dealers are expressly permitted to distribute and list Asset-Referenced Virtual Assets (ARVAs). In other words, tokenized real estate, commodities, or investment funds can now be issued and traded onshore.
Issuers of ARVAs must meet concrete requirements. For example, legal experts note that a firm issuing an RWA token needs a VARA Category 1 issuance licence, a detailed whitepaper and risk-disclosure statement, and substantial capital (minimum AED 1.5 million or 2% of reserves). Monthly independent audits and ongoing supervisory reporting are also mandated. These obligations mirror those for high-quality stablecoins in other markets. In short, VARA has moved RWA tokenization from theory to practice – providing a clear, regulated path for “tokenizing real-world assets” in Dubai’s crypto ecosystem.
This clarity extends to stablecoins and crypto-backed funds as well. All virtual asset issuers must now classify their tokens into Category 1 or 2 and follow the corresponding rules. Previously, many firms lacked guidance on issuing global stablecoins or digital securities. With Version 2.0, applicants can see exactly what UAE crypto company license requirements apply to their token projects (capital, disclosures, audits, etc.). This new issuance framework completes the regulatory picture for entrepreneurs aiming to launch tokens from Dubai.
Whether you’re launching a crypto exchange, issuing digital assets, or expanding into lending, getting it wrong is expensive. Aston VIP understands every clause in VARA’s updated rulebooks and translates them into practical action. Let’s build your license the right way, from day one.
"Firms that align with the new rulebooks can better attract institutional investors, secure banking relationships, and streamline the licensing process."
Cross-Cutting compliance enhancements
Beyond individual licence types, VARA’s April–May updates introduce several universal obligations across all crypto firms. First, risk management is now front and center. The Compliance & Risk Management Rulebook adds a new “Risk Management” chapter. Every VASP must maintain an active, enterprise-wide risk framework identifying operational, financial, legal, tech, and reputational risks in real time. Firms should embed risk culture at every level (with board oversight, incident logs, and staff training), not just static manuals. The new rules effectively align VARA licensees with global standards like FATF and major financial regulators, ensuring that risk committees and officers are formally accountable.
Second, mandatory written client agreements apply to all services. Whether you hold a Dubai exchange licence or advise on DeFi strategies, each client relationship must be governed by a signed contract. This contract must spell out services, fees, responsibilities, and dispute processes. Informal or algorithmic terms alone are not acceptable. This change was highlighted by industry experts as a major shift: “every client interaction is documented, governed, and auditable”.
Third, insider-trading and transparency controls have been imposed across the board. All VARA-licensed firms must maintain up-to-date insider lists of anyone with access to non-public strategic information. That means exchanges, broker-dealers and even advisory firms need formal policies to prevent insider trading and market manipulation. These rules (in the Market Conduct Rulebook) bring Dubai in line with stock-market practices, significantly elevating market integrity.
Finally, anti-money laundering has been strengthened. The updated rulebooks reiterate UAE AML laws and fully incorporate the FATF Travel Rule. All VARA license holders must now screen transactions and counterparties rigorously, report suspicious transfers, and enforce travel-rule data-sharing. Compliance officers will need robust transaction-monitoring systems that feed into VARA’s new guidelines. In combination, these cross-cutting changes mean that obtaining a VARA licence in Dubai now involves a higher regulatory bar but also greater clarity on what is required.
Benefits of the new regulatory clarity
For crypto founders and UAE entrepreneurs, the April–May 2025 updates bring long-term advantages. By spelling out duties and harmonizing rules, Dubai’s regulators have created a clearer digital asset regulation framework that reduces legal uncertainty. Firms now know exactly what compliance infrastructure to build for each licence, from board governance to the technical setup of wallets. This clarity lowers the risk of costly compliance gaps or ad hoc enforcement. It also makes the Dubai market more attractive to institutional players who demand strong investor protections.
The unified rulebooks will bolster investor and client confidence in licensed Dubai crypto firms. Clear rules on how margin calls, asset distribution, or token listings must be handled enhance transparency and market discipline. For entrepreneurs, that means pitching a VA offering in Dubai can cite concrete regulatory provisions. It also signals to banks and overseas partners that Dubai takes crypto compliance seriously, paving the way for more banking relationships and partnerships.
In practical terms, applicants will find the licensing process smoother with these updates in place. All compliance requirements for a crypto company license UAE are now consolidated in the official rulebooks (available on VARA’s website). Ambiguity over whether certain activities (like NFT sales or decentralised staking) are permitted has been largely removed. Instead of navigating grey areas, crypto start-ups can align directly with the new standards.
-
The FATF Travel Rule is now embedded in crypto transfer licenses, requiring detailed sender/receiver data for transactions above threshold values.
-
All licensees must use signed client agreements, follow insider trading controls, and establish formal risk-management systems across all activities.
-
VARA’s updates eliminate legal ambiguity, offering clearer rules for license applicants and greater credibility for Dubai’s virtual asset ecosystem.
Next steps for license applicants
Crypto firms preparing a Dubai VARA license application must act quickly. First, review each applicable rulebook and revise your policies and procedures to match the new obligations. This may involve strengthening KYC/AML processes, rewriting client contract templates, or increasing capital buffers. Second, update your internal documents from compliance manuals to risk registers to incorporate the updates. Third, consult experienced advisors who understand the VARA licensing process and these changes. Our team at Aston VIP offers specialized VARA advisory services: see our VARA license Dubai page for support in aligning your business plan with the revised rules. We also provide a comprehensive guide on how to get a VARA license in Dubai that walks through the updated application steps. (Remember: all current license holders must be fully compliant by 19 June 2025.
In summary, VARA’s April–May 2025 rulebook updates impose more detailed obligations across broker-dealer, custody, exchange, lending, advisory, asset management, transfer, and issuance licenses. While the rules are more demanding, they deliver regulatory certainty. Digital asset companies and UAE crypto firms will benefit from this clarity: compliance becomes a matter of meeting known targets rather than guessing expectations. By embracing the new regime, crypto entrepreneurs can ensure their VARA license Dubai application is complete, their operations are robust, and they are well-positioned in a rapidly maturing market.
Whether you’re launching a trading platform, issuing a new token, or restructuring to meet the latest VARA obligations, Aston VIP brings deep regulatory experience and a proven track record. We’ve supported more than 60% of all VARA license submissions to date and we understand exactly what it takes to get through compliance with confidence. Let us handle the documentation, strategy, and regulator engagement while you focus on your business. Get in touch with our team to start your VARA application the right way.
