VARA Crypto License in Dubai

• VARA licenses specific business activities individually rather than the company as a whole. An exchange that self-custodies assets must undergo two separate procedures and maintain capital to satisfy two distinct requirements.
• Paid-up capital requirements range from AED 100,000 for advisory services to AED 1,500,000 for an exchange operating without a licensed custodian. In most cases, a "whichever is higher" rule applies: the requirement is based on either a fixed amount or a percentage of annual overhead costs.
• Funds must be actually deposited—not merely demonstrated—into a trust account at a UAE bank with VARA as the beneficiary, or secured via a surety guarantee.
• The actual timeframe from company registration to obtaining a full VASP license is four to seven months. Complex business models and repeated regulatory inquiries can extend this process further.
• In addition to capital requirements, the company must maintain net liquid assets equivalent to 1.2 months of operating expenses, mandatory insurance coverage, and reserve assets that fully cover client liabilities.
• The license is valid within the Emirate of Dubai, excluding the DIFC. An agreement with the federal regulator allows for operations in other emirates via a registration process, though the license itself remains a Dubai license.

To put it briefly and to the point: a VARA crypto license is an authorization to conduct specific virtual asset activities in the Emirate of Dubai, issued by a dedicated regulator that deals exclusively with digital assets. It is not a blanket license for "cryptocurrency in general." Applicants choose from seven regulated activity categories; a separate permit is issued for each, complete with its own set of rules, capital requirements, and fees. The company must be registered in Dubai, maintain a leased office, have two designated individuals with UAE residency, and hold paid-up capital ranging from 100,000 to 1,500,000 dirhams, depending on the chosen activity. The entire process takes an average of four to seven months.
This approach differs fundamentally from jurisdictions where registration in a service provider registry takes just a few weeks. Dubai does not simply sell status; it verifies a business's readiness to operate according to rules that are meticulously drafted and strictly enforced.

Dubai vs. DIFC: The Most Commonly Confused Boundary

VARA’s authority extends across the entire emirate, covering both the mainland and free zones such as DMCC, DAFZA, Dubai South, and others. The sole exception is the Dubai International Financial Centre (DIFC), which operates under its own legal framework and regulator, the DFSA. A company registered in the DIFC does not deal with VARA at all, and vice versa.
This is no mere formality. The choice of registration venue is made before documents are submitted and determines the set of rules you will operate under for years to come. Reversing this decision later is costly: changing jurisdictions within Dubai entails establishing a new legal entity, submitting a new application, and paying new fees.

Licensing Applies to Activities, Not the Legal Entity

Many clients approach us asking for a "Dubai crypto license" and are surprised to learn that the request must first be broken down into its component parts. Asset exchange, custody of third-party keys, execution of client orders, crypto-backed lending, asset management, transfers and settlements, and advisory services—these all require distinct authorizations.
A typical centralized exchange usually requires at least two, and often three, authorizations simultaneously. Each one adds specific requirements regarding capital, personnel, and reporting. That is why our initial conversation with a client begins not with the budget, but with a description of whose funds and whose keys flow through the product.

Proprietary Trading and the Non-Full-License Regime

A company that trades exclusively with its own capital and has no clients may not need to obtain a full VASP license. Instead, it requires a formal "no-objection letter" from VARA, yet it remains within the regulator's purview and is still subject to reporting obligations.
The line here is finer than it appears. As soon as a single external investor enters the picture and their funds are pooled with the rest, the model ceases to be proprietary. We examined cases where a fund considered itself a proprietary trader right up until the moment it began accepting capital from partners.

Capital: how much must be frozen and in what form

Paid-up capital requirements are set out in Section VI.B of the Company Rulebook. The logic is as follows: the greater the volume of third-party assets passing through the business, the higher the threshold. In almost all cases, the fixed amount represents only the minimum floor.

Minimum amounts by activity type

Based on the current version of the rulebook (figures in UAE dirhams):

• Advisory services — 100,000 (approx. 27,000 USD).
• Broker-dealer services — 400,000 when working via a VARA-licensed custodian, or 600,000 otherwise.
• Asset custody — 600,000 or 25% of annual overheads.
• Exchange services — 800,000 when using a licensed custodian, or 1,500,000 for in-house custody.
• Lending and borrowing — 500,000 or 25% of overheads.
• Asset management and investments — 280,000 with external custody, or 500,000 otherwise.
• Transfers and settlements — 500,000 or 25% of overheads.

The issuance of Category 1 tokens—which includes fiat-backed stablecoins and basket-pegged assets—is a separate matter. Capital and reserve requirements for these are calculated according to the Virtual Asset Issuance Rulebook, and the figures involved far exceed those in this table. It is advisable to verify the exact values ​​at rulebooks.vara.ae before incorporating them into your financial model.

The "higher of the two" rule and why the cost estimate matters more than the table figure

Here is a point that is rarely explained clearly. For most business activities, the capital requirement is defined as the higher of two figures: a fixed threshold or a percentage (15% or 25%) of the company’s fixed annual overhead costs.

Consequently, for a company with a twenty-person staff, office space in Dubai, and a fully staffed compliance department, the actual requirement will easily exceed the baseline figure by 50% to 100%. An application where the business plan projects rapid growth but capital is calculated at the minimum threshold inevitably raises questions from the regulator. We calculate the required capital based on the projected expense budget rather than the other way around; this usually leads to a revised figure during the second meeting with the client.

For a company holding multiple licenses, capital must be maintained for each specific activity, while overhead costs are allocated across them to avoid double-counting and ensure the entire budget is covered. A single dirham cannot be counted twice.

Liquidity, Insurance, and Reserves

Paid-up capital is merely the first layer. Next come net liquid assets: the excess of current liquid assets over liabilities must be at least 1.2 times the monthly operating expenses, with daily reconciliation and monthly reporting. These assets may be held in cash, cash equivalents, or VARA-approved assets pegged to the US dollar or the UAE dirham.

Then there is insurance: professional indemnity, directors and officers (D&O) liability, and crime insurance covering assets held in hot wallets. The insurer must be a regulated entity, and it is prudent to begin negotiations at the initial stage rather than waiting until the rest of the application dossier has already been compiled.

Finally, reserve assets: client liabilities must be covered 100%—on a one-to-one basis—in the identical asset class, subject to daily reconciliation and independent audits twice a year.

Expert Opinion

"Over several years of handling applications in the UAE, we’ve established a simple rule of thumb: the paid-up capital figure is not the project budget, but rather about a third of it. The rest is consumed by a liquidity buffer, insurance premiums, salaries for two designated officers and a full-time compliance officer, office rent, and the annual supervisory fee—which must be paid before even securing the first client. Clients who arrive with funds matching exactly the threshold listed in the regulations almost always stall halfway through the process. That is why we present a full 18-month cost estimate before we even begin preparing the paperwork; if the numbers don't add up, we are upfront about it and suggest a different jurisdiction."

VARA Fees and Cost Structure

The regulator publishes its fees in Annex 2 to the 2023 Regulations. All other costs—such as company registration, rent, salaries, and consultancy fees—are not publicly listed and are calculated on a case-by-case basis.

Payments to the Regulator

The application review fee is either AED 40,000 or AED 100,000 per activity type. The lower rate applies to advisory services and transfer/settlement services, while the higher rate applies to all other activities. The annual supervisory fee ranges from AED 80,000 to AED 200,000, also per activity type.

Additional activity types are charged at 50% of the lower applicable application fee. Half of the fee is invoiced after the initial questionnaire stage, while the remainder—along with the annual supervisory fee—is due at the final stage, prior to commencing client operations. This is a crucial factor for cash flow planning, as a significant portion of payments falls due before any revenue is generated.

Costs Not Found on Any Price List

These include renting a physical office in Dubai, visas and salaries for resident staff, subscriptions for "Travel Rule" compliance solutions, audits, insurance premiums, and the drafting of policies tailored to a specific business model. The total cost depends on the scale of operations, but in our experience, it is comparable to—and sometimes exceeds—the capital requirement itself.

Separate provision should be made for the time and cost associated with banking services. While UAE banks do work with licensed VASPs, the account opening process runs parallel to the licensing procedure and requires its own specific set of documents. Our expertise in banking support and processing proves valuable here, as banks will not open an account without a license, yet a license will not be issued without proof that the required capital has been deposited.

Timelines: what makes up the four-to-seven-month period

The procedure consists of two stages, each with its own logic. The regulator does not publish a standard processing timeframe, so any promises of a "license in two months" should be viewed with skepticism.

Stage One: The Company and the Initial Questionnaire

First, a legal entity is registered through the Department of Economy and Tourism or a Dubai free zone (excluding the DIFC). Next, an Initial Disclosure Questionnaire is submitted, outlining the planned activities, business model, governance structure, and approach to compliance.

The questionnaire is first reviewed by the commercial licensing authority before being forwarded to VARA. This results in the issuance of "approval in principle." This does not authorize client-facing operations; it merely grants admission to the second stage. In practice, the first stage takes between six weeks and three months, with the majority of that time spent preparing the questionnaire itself rather than on the regulator's review.

Stage Two: The Full Dossier

This stage involves compiling a regulatory business plan, anti-money laundering (AML) policies, corporate governance documents, descriptions of the technology architecture and cybersecurity measures, proof of capital placement, compliance assessments for key personnel, and a signed lease agreement.

VARA almost always issues follow-up requests. Responses must be comprehensive and prompt; any incomplete answer triggers further inquiries and adds weeks to the timeline. On-site inspections and interviews with management may also occur. Ultimately, a full VASP license is issued for each approved business activity.

Factors that prolong the process

A non-standard business model that is difficult to fit into existing regulatory frameworks. Key personnel who are only sought out after the application has been submitted. Policies copied from another jurisdiction without being adapted to the Dubai operating model—the regulator spots this immediately. As for the technical component—covering infrastructure, key management, penetration testing, and business continuity plans—many teams find this to be the most challenging section of the dossier.

We typically build a buffer of two to three months into the schedule beyond the best-case scenario, and we explain to the client in advance which stages might face delays and why.

Requirements often underestimated prior to submission

Some conditions may seem secondary until it becomes clear that the application dossier will not be accepted without them.

Personnel

Two designated individuals must be full-time employees with UAE residency and must pass a fitness and propriety assessment covering competence, integrity, and financial solvency. A qualified compliance officer and a money laundering reporting officer (MLRO) are required; in smaller companies, these roles can be combined into a single position.

Finding such individuals in Dubai is neither easy nor cheap. The market is niche, there are few candidates with proven experience in passing the VARA assessment, and their salaries are part of the overhead costs used to calculate capital requirements.

Office and presence

A physical, leased office is required. There is no minimum square footage requirement, but coworking spaces and flexible workspace arrangements are generally not accepted for most types of activities. The lease agreement is part of the second-stage application package.

A presence in Dubai is not merely a formality for the regulator but a condition of operation. Designated individuals must reside in the UAE, reporting must be submitted regularly, and inspections can occur at any time. If the business model relies on a fully remote team not tied to the emirate, this should be discussed openly before starting the process.

Operational obligations post-licensing

The "travel rule" applies to transactions exceeding AED 3,500: sender and recipient data must be collected, verified, and transmitted to the receiving service provider. Registration with the goAML system is mandatory, as is the timely filing of suspicious transaction reports. Anonymity-enhanced coins (privacy coins) such as Monero and Zcash are completely prohibited within the Dubai regulatory perimeter—trading, custody, and transfers are all banned.

Marketing is also regulated, and these rules apply even to companies without a VARA license if the advertising targets a UAE audience. Fines imposed on legal entities for anti-money laundering violations run into the millions of dirhams.

Is Dubai the Right Choice, or Should You Look Further Afield?

VARA is not a one-size-fits-all solution, nor is it the quickest option. It is a tool designed for a specific type of business profile.

When It Makes Sense

If you work with institutional clients and high-net-worth private investors, if your product involves holding third-party assets, or if you plan to raise capital through a regulated structure, the reputational weight of a Dubai license justifies the investment of both time and money. VARA’s agreement with the federal regulator allows you to serve clients across the entire UAE under a single registration, without the need for separate licensing in each emirate.

Predictability is another key factor. The rules are detailed, updates are made public, and the oversight process is transparent. For a business built for the long haul, this is far more valuable than a low barrier to entry.

When It’s Better to Start Elsewhere

For a small exchange service, a startup still testing its hypothesis, or a project with a limited budget, the requirements in Dubai may prove prohibitive. In such cases, we suggest looking atother crypto licensing jurisdictions—such as Hong Kong, Kazakhstan, or Georgia—where the barrier to entry is significantly lower and the operational burden is lighter.

Sometimes, a different strategy works best: start with a "lighter" license to build a track record of verified turnover, then apply to VARA after a year or eighteen months with a proven business history. Regulators view an active business much more favorably than a mere pitch deck.

How We Handle These Projects

Our approach is far from a "cookie-cutter" process, and we are upfront about that.

Analyzing the Model Before Quoting

The first step isn't paperwork; it’s a conversation about the product. We discuss whose assets and keys are involved, who the clients are, the source of funds, and what happens in the event of a system failure. This analysis determines the specific business activities, which in turn dictate the capital requirements, fees, and timeline.

If the analysis reveals that the client’s budget doesn't align with the requirements, we say so immediately and propose alternatives. Charging a fee for an application that is bound to fail is not the way we operate.

Transparency at every stage

The client sees the full cost estimate—including expenses that typically only surface toward the end of the process—as well as a schedule with realistic timelines and markers indicating potential delays. Clients also receive a report after every stage of interaction with the regulator.

We also assist with related tasks, such as company registration in the UAE, securing residency visas for key personnel, and sourcing ready-made licensed solutions when time constraints rule out the standard, longer process. You can discuss your situation using the contact details provided; the initial consultation to review your business model is free of charge.