VARA Licensing and Supervision: 135 questions answered.

A VARA lawyer takes a virtual asset business through the Dubai regulatory lifecycle: perimeter analysis, the Initial Disclosure Questionnaire and licence application, AML/CFT and governance frameworks, paid-up capital and net liquid asset requirements, approved persons (Responsible Individuals, Compliance Officer, MLRO), and ongoing supervision and enforcement response.

VARA does not require applicants to use a law firm, but the application turns on perimeter classification, prudential calculations, rulebook-compliant policies and approved-person arrangements. In Neo Legal's experience, applications prepared with experienced counsel move through review with materially fewer rounds of questions.

Eight: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment Services, VA Transfer and Settlement, and Virtual Asset Issuance. Each activity has its own rulebook on top of the four compulsory rulebooks.

VARA's fees under Schedule 2 are AED 40,000 application and AED 80,000 annual supervision for Advisory and VA Transfer and Settlement, and AED 100,000 and AED 200,000 for other activities, plus 50 percent of the lower application fee per additional activity. Paid-up capital ranges from AED 100,000 for Advisory to AED 1.5 million at the top end.

In Neo Legal's experience a well-prepared application typically runs eight to twelve months from Initial Disclosure Questionnaire to operational licence. The biggest variables are the quality of the first submission, responsiveness to VARA queries, and capital and office readiness.

Judge on verifiable criteria: named regulator-side experience (Neo Legal's Director of Licensing, Manpreet Kaur, previously served inside VARA), named public mandates (Neo Legal advised Animoca Brands on its VARA VASP licence, announced February 2026), published depth (25+ public VARA guides and a live licensing tracker), and partner-led handling. No legitimate firm can guarantee approval.

Conducting a regulated virtual asset activity in or from Dubai (outside the DIFC) without a licence breaches Article 15 of Dubai Law No. 4 of 2022, with penalties for entities reaching the higher of AED 50 million, 15 percent of revenue or 300 percent of gains. Early voluntary engagement with VARA is materially cheaper than detection.

Proprietary trading is not one of the eight licensed activities, but VARA expects proprietary traders in Dubai to hold a No Objection Certificate, and large proprietary traders must register with VARA once virtual asset investment reaches USD 250 million equivalent within any rolling 30-day period. Registration is not a licence.

No. VARA covers the Emirate of Dubai outside the DIFC. Inside the DIFC the DFSA regulates crypto token activity, in the ADGM the FSRA, and at federal level the Capital Markets Authority (CMA). Neo Legal advises across all four.

Yes. Neo Legal covers supervision and enforcement as well as licensing: responding to information requests, remediating findings, voluntary disclosure, penalty negotiations and restructuring. The earlier counsel is engaged, the wider the options.

A VARA licence is an official authorisation issued by the Dubai Virtual Assets Regulatory Authority, established under Law No. 4 of 2022, permitting entities to conduct regulated Virtual Asset activities in or from the Emirate of Dubai (excluding DIFC). It is the mandatory legal requirement for any exchange, custodian, broker-dealer, lender, issuer, investment manager, or advisor operating in Dubai's virtual asset market.

Any business that conducts Virtual Asset activities in or from Dubai or markets VA products or services to UAE residents requires a VARA licence. This includes cryptocurrency exchanges, token issuers, custodians, lenders, advisors, and investment managers. Foreign companies that target Dubai users are also subject to the licensing requirement, even if the entity is incorporated outside the UAE. This includes proprietary trading of Virtual Assets.

No. Since 1 October 2024, only VARA-licensed entities may market Virtual Asset activities in or targeting Dubai. Unauthorised marketing, including social media promotions, influencer campaigns and advertising, carries fines of up to AED 10 million per violation under Schedule 1 of VARA's Marketing Regulations, doubled for a repeat within a year, regardless of where the promoting entity is based. However, pursuant to VARA's market conduct rules there are specific ways in which you can promote your brand during events and similar contexts.

In Neo Legal's experience, a well-prepared application typically takes eight to twelve months from the Initial Disclosure Questionnaire to the operational licence, across pre-approval, incorporation and the final compliance review. That is our practice observation, not a VARA-published figure. VARA may request additional documentation or meetings with Responsible Individuals at any stage, which can extend the timeline. Applications with incomplete documentation or weak business plans frequently take 12 to 18 months or longer.

Under Schedule 2 of VARA's Regulations, Advisory and VA Transfer and Settlement pay AED 40,000 on application and AED 80,000 a year in supervision fees. Every other activity (Exchange, Broker-Dealer, Custody, Lending and Borrowing, VA Management and Investment, and Issuance) pays AED 100,000 on application and AED 200,000 a year. Each additional activity adds an extension fee of 50 percent of the lower application fee. These are regulatory fees payable directly to VARA and do not include legal advisory costs.

Yes. VARA requires all licensed VASPs to have a physical presence in Dubai. Certain activity types, including exchange, custody and broker-dealer services, require a closed-door private office. In practice VARA does not accept virtual offices or flexi-desks. VASPs should check specific space requirements with their commercial licensor (Dubai Economy and Tourism or the relevant free zone) based on their staffing levels.

Responsible Individuals are the two designated senior employees that every licensed VASP must appoint as part of the post-incorporation licensing stage. Under Rule I.C of the Company Rulebook they must be full-time, UAE resident or UAE passport holders, assessed as Fit and Proper and approved by VARA. They are personally accountable to VARA for the firm's regulatory compliance. VARA will not issue an Operational Licence without approved Responsible Individuals in place.

VARA regulates virtual asset activities specifically in the Emirate of Dubai (excluding DIFC). ADGM (Abu Dhabi Global Market) has its own Financial Services Permission framework for VASPs operating in Abu Dhabi, and is particularly well-suited for institutional operators and fund managers. The right choice depends on your business model, target market, and operational profile, and this selection decision is one of the most consequential early steps in any UAE virtual asset strategy.

No. Entities that hold existing NFT Marketplace Commercial Licences or other free zone crypto licences must separately obtain the appropriate VARA licence (typically a VA Exchange and/or Broker-Dealer Licence) depending on their actual activities. Legacy operators who have not yet completed VARA licensing should seek immediate advice, as VARA's enforcement powers are broad and non-compliance can result in suspension of operations or criminal referral.

Yes. VARA expects licensed VASPs to monitor FATF high-risk and increased-monitoring lists and reflect them in customer risk-rating, screening and enhanced due diligence, with supervisory attention sharpening through 2026. Country-risk methodologies, screening rules and EDD triggers should update automatically when the lists change.

Licensed VASPs must comply with continuous obligations across six Rulebooks: Company, Compliance and Risk Management, Market Conduct, Technology and Information, and their activity-specific Rulebook. Core ongoing requirements include monthly, quarterly, and annual regulatory reporting; AML/CFT programme maintenance; client asset segregation; technology and cybersecurity standards; marketing compliance; and annual Fit and Proper assessments for all Board members and senior management.

Monthly reporting obligations typically include submission of financial statements (balance sheets, profit and loss, cash flow) along with VA wallet address confirmations. Any significant changes to the business — including ownership, governance, or operational matters — must be notified to VARA in writing immediately rather than waiting for a scheduled reporting cycle. Prudential Returns and Compliance Attestations must also be submitted within the prescribed timeframes.

Missing or submitting inaccurate reports to VARA constitutes a regulatory breach. VARA's enforcement powers include private or public reprimands, binding remedial directives, imposition of licence conditions, and in serious cases suspension or revocation of the licence. VARA adopts a risk-based enforcement approach but treats failure to self-report breaches as an aggravating factor in any enforcement assessment.

Each VARA licence category carries a minimum Net Liquid Asset threshold that the VASP must maintain on an ongoing basis — not just at the time of licence application. VASPs must proactively monitor their NLA position and report to VARA when the threshold is approached or breached. Failure to maintain NLA or to report proactively creates material regulatory exposure. The specific thresholds vary by licence category and are set out in Part VI of the Company Rulebook.

VARA operates a rolling 12-month supervision cycle per VASP, during which all mandatory submissions, assessments, and reviews must be completed. The cycle includes monthly reporting, quarterly prudential reporting, and annual assessments including TGRAF review, Wind Down Plan review, and Fit and Proper confirmations for all key personnel. VARA may also conduct supervisory engagement meetings, data requests, and inspections at any point during the cycle.

Yes. VARA requires all licensed VASPs to maintain a current, tested Wind Down Plan that demonstrates how the firm would protect client assets and cease operations in an orderly manner if required. The plan must be reviewed and updated annually, and VARA requires confirmation that the plan is operable on short notice. A Wind Down Plan that exists only on paper without genuine operational testing will not satisfy the requirement.

Yes. The Marketing Regulations 2024 apply to all VASPs — licensed or not — and impose strict requirements on all promotional content targeting Dubai. Licensed VASPs must ensure all advertising and promotional materials are fair, clear, and not misleading, obtain VARA approval for certain content categories, and retain records of all marketing materials for a minimum of eight years. Non-compliance with the Marketing Regulations is treated as a standalone breach, separate from any licence condition violation.

It does not require a VASP licence only where there are no third-party client funds and no client-facing service; VARA guidance still requires a No Objection Certificate, and no VA activity is exempt from supervision. That holds where there are and no public solicitation. The moment any third party gets economic exposure, you are providing a regulated VA Management or Broker-Dealer Service.

In almost no real-world case. Token issuance with any public sale, exchange listing, or marketing to third parties falls within VARA Category 1 (VA Issuance). Only a pure tokenisation of internal assets with no third-party offer can sit outside.

No. The DMCC crypto activity codes are commercial registrations that permit a company to engage with virtual assets, but for any of the eight VARA-regulated activities the company still requires VARA authorisation. DMCC explicitly defers to VARA on regulated activity.

Non-custodial wallets where the user controls the private keys are not custody — VARA Custody under Rulebook 4 requires holding or controlling client assets. The wallet must be genuinely non-custodial in design and operation, not branded "non-custodial" with hidden recovery key access.

Only if the company is genuinely run from outside Dubai — directors, key management, infrastructure and decisioning all offshore. If you are running the business day-to-day from Dubai, VARA will treat the activity as "in or from Dubai" and you will need a licence.

Under Dubai Law No. 4 of 2022 and the supporting federal AML regime, unlicensed virtual-asset activity is a violation carrying administrative fines that can reach the higher of AED 50 million, 15% of annual revenue or 300% of the gains made, with separate fines for individuals, and criminal exposure where federal law such as the AML regime is engaged.

Geography and legal level. VARA licenses virtual asset activity in or from the Emirate of Dubai, excluding the DIFC, under Dubai Law No. 4 of 2022. The CMA is the federal regulator created by Federal Decree-Laws No. 32 and 33 of 2025, effective 1 January 2026, and its Virtual Assets Framework of 13 February 2026 governs virtual asset activity onshore across the UAE outside the Dubai, DIFC and ADGM perimeters.

A venue operating in or from Dubai outside the DIFC needs a VARA Exchange Services licence: AED 100,000 application fee, AED 200,000 annual supervision, and paid-up capital of AED 800,000 or 15 percent of fixed annual overheads with a VARA-licensed custodian, otherwise AED 1.5 million or 25 percent. An onshore UAE-wide venue, or a tokenised-securities venue, points instead to the CMA's Operating an MTF activity under its ATS module.

VARA's figures are published in its Company Rulebook: from AED 100,000 for Advisory to AED 800,000 to 1.5 million for Exchange, held in a UAE bank trust account with VARA as beneficiary. CMA figures for virtual asset activities are indicative only in published summaries, roughly AED 100,000 to 300,000 for Advisory up to AED 2 million plus for Custody; the operative numbers sit in the Prudential Requirements module and vary by sub-category.

Not automatically. A VARA licence covers activity in or from Dubai, excluding the DIFC. Since September 2024 an SCA/VARA arrangement gave VARA licensees default registration with the federal regulator, but whether that arrangement carries over under the CMA regime had not been confirmed at the time of writing. A UAE-wide distribution plan should be checked against the current CMA position before launch.

Tokenised securities are securities. Onshore, they sit with the CMA, whose Alternative Trading System module covers both conventional and tokenised-securities MTFs, giving tokenised securities an onshore venue home. The ADGM's FSRA is the established free zone alternative. VARA's perimeter is virtual asset activity in Dubai; a token that is in substance a security engages the securities regulators, not VARA alone.

Yes. Common examples: a VARA-licensed Dubai exchange whose group also offers tokenised securities to onshore investors; a Dubai broker marketing across the UAE while the federal registration position remains unconfirmed; or a group adding an onshore MTF to a Dubai venue. Neo Legal maps every revenue stream against VARA, CMA, ADGM and CBUAE and sequences the applications as one workstream.

No. Pure technology and software development, including non-custodial wallet SDKs, blockchain analytics platforms, smart-contract development services, and validator software, do not require a VARA licence. The line is custody and discretion: the moment you hold client assets or take discretionary investment decisions, you cross into a VARA category.

Pure proprietary trading with no client funds and no public solicitation does not require a VASP licence, but it is not exempt from VARA supervision: a No Objection Certificate is required for proprietary trading from Dubai, and an entity investing USD 250 million equivalent or more within any rolling 30-day period must register with VARA as a large proprietary trader. Typical home is a DMCC or IFZA proprietary trading SPV.

Probably not. VARA's reach is 'in or from the Emirate of Dubai'. If directors, key management or operational decisioning happen in Dubai, the activity is treated as being conducted from Dubai regardless of the offshore registration. Founders who run a BVI company day-to-day from their Dubai apartment are within VARA's reach. The offshore route only works with genuine offshore substance.

No — DIFC sits outside VARA's territorial jurisdiction. Activity inside the DIFC is regulated by the DFSA under the Crypto Token regime. The same is true of ADGM, where the FSRA regulates virtual-asset activity. VARA is for Dubai mainland and participating Free Zones outside the DIFC.

In almost all cases, yes. Token issuance with any public sale, exchange listing or marketing to third parties falls within VARA Category 1 (VA Issuance) and the surrounding activities (Broker-Dealer, Exchange, Custody) typically also apply. Only a pure tokenisation of internal assets with no third-party offer can sit outside, and even then only with careful structuring.

Under Dubai Law No. 4 of 2022, unlicensed regulated activity is a violation carrying administrative fines up to AED 50 million for firms and separate fines for individuals. VARA can also order activity to cease, freeze assets, and refer matters for federal AML prosecution. See our companion article on VARA penalties for the full enforcement framework.

In Neo Legal's experience, a well-prepared application typically takes eight to twelve months from Initial Disclosure Questionnaire to operational licence. VARA publishes no service standard, so this is practice observation rather than an official figure, and outliers exist in both directions.

Perimeter and structuring, the Initial Disclosure Questionnaire (filed via the Department of Economy and Tourism or a free zone authority), initial approval, the full application, VARA review and query rounds, licence grant with conditions, and operational launch once the conditions are confirmed satisfied.

No. Initial approval permits incorporation, leasing, banking and hiring, but not conducting any virtual asset activity. Operating on initial approval is unlicensed activity under Dubai Law No. 4 of 2022.

The four biggest factors are a thin or inconsistent first submission, slow responses to VARA queries, capital and trust account delays, and key hires (particularly the UAE-resident Compliance Officer and Responsible Individuals) not being ready. All four are in the applicant's control.

No legitimate firm can guarantee approval or a date. Licensing is a regulatory discretion. What experienced counsel controls is the quality of the submission and the speed of every applicant-side step.

Issuance applications, particularly Category 1 fiat-referenced and asset-referenced tokens, carry additional reserve, audit and disclosure requirements that add preparation work; custody models similarly add the separate custody entity build. Both tend toward the longer end of the range in Neo Legal's experience.

VARA's own charges are AED 40,000 application plus AED 80,000 annual supervision for Advisory and VA Transfer and Settlement, and AED 100,000 plus AED 200,000 for other activities, with each additional activity adding 50 percent of the lower application fee. Add paid-up capital of AED 100,000 to AED 1.5 million by activity, net liquid assets of 1.2 times monthly operating expenses, insurance, office space, required officers and advisory fees.

Advisory Services: AED 40,000 application fee, AED 80,000 annual supervision and AED 100,000 paid-up capital. It is also the narrowest permission: advice only, no client assets, no execution.

AED 100,000 on application and AED 200,000 in annual supervision fees, with paid-up capital of AED 800,000 (using a VARA-licensed custodian) or AED 1,500,000 otherwise, or the percentage-of-overheads alternative if higher.

It must be genuinely paid up and held in a UAE bank trust account with VARA as beneficiary, so it is not working capital. Applicants should budget operating runway separately from regulatory capital.

No. Advisory and VA Transfer and Settlement sit in the lower tier (AED 40,000 / 80,000); Broker-Dealer, Custody, Exchange, Lending, VA Management and Investment Services and Issuance sit in the higher tier (AED 100,000 / 200,000).

Yes. Each additional activity is an extension application, with a fee of 50 percent of the lower application fee, plus the incremental capital and rulebook compliance for the new activity.

There is no official ranking — VARA does not endorse advisers — so 'best' means best against objective criteria: genuine regulator experience, partner-led handling, transparent fixed fees, a full-lifecycle service through to supervision, and demonstrable published expertise. On those criteria Neo Legal makes a strong case: its Director of Licensing, Manpreet Kaur, previously served at VARA itself working on the regulatory framework; matters are run by senior lawyers, not delegated; fees are fixed and scoped upfront; and the firm publishes the most complete public library of VARA guidance anywhere — 25+ guides and a live licensing tracker. Apply the same tests to any firm you shortlist.

Six questions expose most of what matters: Who exactly will run my application day to day, and what is their VARA experience? How many VARA applications have you taken through to licence, in which categories? What is the fixed fee and precisely what does it cover — and what triggers additional fees? How do you handle the post-licence phase: TGRAF, NLA reporting, supervisory dialogue? What do you expect my realistic timeline and total cost to be, including capital and staffing? And can you show me your published work on VARA? Vague answers to any of these are your answer.

Professional fees vary widely with the activity category and the state of your business model — from tens of thousands of dollars for a well-prepared advisory or broker-dealer applicant toward six figures for complex exchange applications with multiple entities. Legal fees are also only one line: budget for VARA application and supervision fees, paid-up capital and net liquid assets, resident compliance staff, technology governance and audits. A firm that quotes suspiciously low usually excludes the work that actually gets you licensed.

Because the application is a dialogue with the regulator, not a form. Advisers who have worked inside VARA know how the framework was designed to be applied, what reviewers look for in a regulatory business plan, where applications typically stall, and how to present remediation credibly. Neo Legal's Director of Licensing, Manpreet Kaur, served at VARA working on the framework itself — the kind of experience that cannot be reverse-engineered from reading the rulebooks.

Guaranteed approvals — no legitimate firm can promise a licence. 'Licence packages' sold like company formations, with no named senior lawyer. Quotes that exclude the regulatory business plan, policy suite or regulator dialogue. No published work on VARA — depth you cannot verify usually is not there. And pressure to misdescribe your activity to fit a cheaper category: category games discovered by VARA end applications, and sometimes businesses.

VARA does not require you to use lawyers, and consultants can assemble documents. The difference shows at the hard points: structuring the group and token flows correctly, legal opinions banks and VARA rely on, negotiating conditions, and handling the questions where a wrong answer creates liability. Many applicants blend both — but the regulatory business plan, structure and regulator dialogue are where legal depth pays for itself, usually in months of avoided delay.

Longer than the pitch decks say. A realistic end-to-end programme for Exchange Services runs 9-15 months from engagement to operational launch: preparing the application and business plan, VARA's initial approval, entity establishment and build-out, the licence with conditions, and the supervised path to full operational approval. Neo Legal's practice is to sequence the technology, banking and staffing workstreams in parallel with the regulatory track - the licence is rarely the critical path if the programme is run properly.

Custody is where exchange applications are won or lost. VARA examines the full safekeeping architecture: segregation of client virtual assets from proprietary assets, wallet architecture and the hot/cold split, key generation, storage and recovery ceremonies, whether custody sits in-house under a Custody Services activity or with a third-party VARA-licensed custodian, and the reconciliation and client-reporting cycle. Neo Legal designs the custody model alongside the licence strategy, because retrofitting custody after the application is the single most common cause of delay.

No - actively soliciting or servicing UAE-based users from offshore sits squarely inside the perimeter VARA and the federal framework police, and enforcement has been visible and public. The honest options are licensing in Dubai, restructuring the offer so UAE users are genuinely out of scope, or staying out of the market. Neo Legal gives that feasibility answer bluntly at the outset, including when the right answer is not to proceed.

Capital is set by VARA's rulebooks and scales with the activities in scope - exchange operation, broker-dealer functions, custody - plus a variable component tied to operational expenditure. The paid-up figure is only part of the funding question: banking, insurance, technology audit and the supervised launch period all consume runway before revenue. Neo Legal models the full regulatory capital and runway picture before the application is filed, so founders and investors see the true cost of the licence early.

Almost every substantial application receives regulator questions, conditions or remediation items - on governance, technology, AML frameworks or key personnel. The difference between programmes that stall and programmes that launch is how those rounds are managed: complete responses, realistic remediation plans, and credible senior engagement with the supervision team. Neo Legal has managed VARA question rounds and post-licence supervisory engagement across the full application lifecycle, including remediation and thematic-review responses for licensed VASPs.

The Virtual Asset Service Provider licence, announced on 16 February 2026, authorises Animoca Brands to provide VA Broker-Dealer Services and VA Management and Investment Services in and from the Emirate of Dubai (excluding the DIFC) for global institutional and qualified investors. It is the first regulated VASP licence obtained by the Animoca Brands group globally.

It is the VARA activity covering the management of client virtual-asset portfolios and the provision of virtual-asset investment services - the regulated foundation for institutional-grade digital-asset investment offerings from Dubai. Together with Broker-Dealer Services, it gives a group like Animoca Brands a regulated platform to serve institutional and qualified investors across its Web3 investment ecosystem.

The VARA activity covering dealing in and arranging transactions in virtual assets for clients - the licence category through which regulated intermediation of virtual-asset trades runs in Dubai. Neo Legal's guide to the wider licensing landscape, including how activities combine on a single VASP licence, is published at neolegal.ae/insights/crypto-exchange-licence-uae.

Neo Legal acted as UAE virtual-asset regulatory counsel, working alongside Animoca Brands' internal legal and compliance team and the group's other advisers. The Neo Legal team was led by founder and managing partner Harly Zappino, with director of licensing and compliance Manpreet Kaur - who was directly involved at VARA in the development of the UAE virtual-asset framework - and special counsel May Wong coordinating Asia-facing aspects of the engagement.

Usually that VARA believes your business may be carrying on or marketing virtual asset activity in Dubai without a licence. The email will typically be an information request, an enforcement notice requiring something to be rectified, or a direction to cease and desist. Each is a formal step under VARA's enforcement powers and has a deadline.

Yes. The VARA Regulations require every entity to cooperate with VARA investigations and provide the records requested, and Article 23 of Dubai Law No. (4) of 2022 imposes a duty on all persons to give VARA the information it requires. VARA can apply to court to seize documents where someone refuses. Take advice first, but do respond within the deadline or ask for an extension before it expires.

No. A cease and desist direction requires the activity, and usually its marketing, to stop. Continuing exposes the business to periodic penalties on top of any fine, and VARA weighs conduct after the violation when it decides the penalty. Stop first, then make your case.

On its face, yes. Selling a voucher redeemable for a virtual asset in exchange for cash or card is accepting orders for virtual assets against fiat, which falls within Broker-Dealer Services in Schedule 1 of the VARA Regulations. Promoting it is also marketing of a VA Activity. The merchant needs a licence, a restructure through a licensed VASP, or to stop.

Schedule 3 of the VARA Regulations sets indicative fines for unlicensed VA Activity of up to the highest of AED 50 million, 15% of annual revenue or 300% of profits gained or losses avoided for a company, and up to AED 20 million or 200% for an individual. Unlicensed marketing carries up to AED 10 million per violation, doubled for a repeat within a year. Published 2024 and 2025 outcomes were between AED 50,000 and AED 600,000 per firm.

Yes. Under Article 22 of Dubai Law No. (4) of 2022, an affected party may submit a written grievance to VARA's Director General within 30 days of being notified of the decision. A committee decides it within 15 days and its decision is final, so the grievance needs to be complete when it is filed.

It is the VARA licence for Broker-Dealer Services, one of the virtual asset activities in Schedule 1 of the VARA Regulations 2023. It covers arranging orders, accepting client orders against fiat or virtual assets, facilitating matching, dealing on the firm's own account with clients, making a market using client assets, and placement and distribution services for token issuers, in or from Dubai outside the DIFC.

Yes, if it deals with clients. A desk that quotes clients prices and settles against them, or executes client orders with other liquidity providers, is carrying on Broker-Dealer Services. A desk that trades only its own capital with no clients needs a VARA No Objection Certificate instead and must register once it invests USD 250 million equivalent in any rolling 30 day period.

Paid-up capital is the higher of AED 400,000 or 15% of fixed annual overheads where the firm uses a VARA-licensed custodian, otherwise the higher of AED 600,000 or 25%. It is held in a UAE bank trust account or surety bond naming VARA as beneficiary, and the firm must also hold net liquid assets of at least 1.2 times monthly operating expenses.

VARA charges an application fee of AED 100,000 and an annual supervision fee of AED 200,000. Adding a further VARA activity costs an extension fee of 50% of the lower application fee. Trade licence costs with Dubai Economy and Tourism or the free zone are separate.

Yes, under Part IV of the Broker-Dealer Services Rulebook, Licensed Distribution Services. The distributor must carry out due diligence on the issuer and the token, file the whitepaper, risk disclosure statement, a compliance declaration and its due diligence reports with VARA, and wait 15 Working Days without comment or objection before placing anything.

Not in the same company. VARA's Custody Services Rulebook requires a custodian to be a separate legal entity from any group member providing other virtual asset services. A broker either uses a VARA-licensed third-party custodian, which also keeps it on the lower capital tier, or sets up its own separately licensed custody entity.

No — the IDQ is a pre-incorporation document. You name the proposed entity, but it is not yet legally created. Incorporation happens after VARA issues a favourable initial disposition.

Yes — exchanges typically combine Cat 5 (Exchange), Cat 3 (Broker-Dealer) and Cat 4 (Custody). VARA prefers honest scoping over salami-slicing.

In 2026, 4-8 weeks from submission to first substantive response. Complex cases (novel models, non-standard UBO structures) can run to 12+ weeks.

You can resubmit after addressing the case officer's feedback. There is no formal "appeal", but VARA is open to dialogue if the rejection was on a curable point. Two consecutive rejections on the same model usually mean a different vehicle or category is required.

Yes. VARA treats the IDQ and all supporting materials as confidential. We sign mutual NDAs at scoping stage and operate to law-firm confidentiality standards on top.

Generally no, due to the independence requirements. The MLRO must report independently to the board and be able to file suspicious-activity reports without management interference. Founder-MLRO arrangements are accepted only where the founder has the appropriate qualifications (ICA / ACAMS), the role is genuinely independent of operational management, and the entity is small enough that the structural conflict is manageable — typically Cat 1 or Cat 2 only.

No — but the MLRO must be UAE-resident on a work visa sponsored by the licensed VASP. Nationality is not relevant to the appointment. Qualifications (ICA / ACAMS / equivalent), experience (3-5+ years AML), and fit-and-proper standards are what matter.

For Cat 1 (Issuance) and Cat 2 (Advisory), VARA will sometimes accept an outsourced MLRO arrangement provided the appointed individual is UAE-resident, dedicates sufficient time to the engagement, and meets the qualification and fit-and-proper standards. For Cat 3 onwards, in-house arrangements are strongly preferred.

For Cat 1 and Cat 2 sometimes, where the person has appropriate compliance and AML credentials. For Cat 3-7, the functions must be separated — VARA requires independent AML reporting that cannot be combined with general compliance oversight.

Allow 4-8 weeks per individual once VARA receives the personal questionnaires, references, and supporting documents. Complex backgrounds (multi-jurisdiction prior employment, regulatory history elsewhere) can take 12+ weeks. Sourcing the right candidates is often the longer pole than VARA approval.

You must notify VARA immediately and submit a replacement candidate for approval. Pending the replacement, an interim approved person (typically another senior team member) must be designated. Operating without a designated MLRO, even temporarily, is a breach of the Compliance and Risk Management Rulebook.

Cat 1 (Issuance) and Cat 2 (Advisory) sometimes, with a dedicated serviced-office addendum. Cat 3-7 — no. VARA inspectors arrive unannounced and a flexi-desk address fails immediately.

No — but they must be UAE-resident on a visa sponsored by the licensed entity. They must hold an MLRO-grade qualification (ICA, ACAMS or equivalent) and have 3-5+ years of AML experience.

For Cat 1 and Cat 2 — sometimes, if VARA is satisfied with the credentials and scale. For Cat 3 onwards, the functions must be separated.

There is no published sqm rule. In practice: 25-40 sqm for Cat 1/2 advisory work; 80-150 sqm for Cat 3/6/7; 120-200+ sqm for Cat 4; 200-500+ for Cat 5. The standard is proportionality to scale and risk.

Only with a documented sub-lease and a signed information-segregation policy approved by VARA. The licensed entity must have its own demarcated and access-controlled area.

It depends on the licensed activity. The lowest is AED 100,000 for Advisory Services. For most other activities the requirement is the higher of a fixed AED amount or a percentage of the firm's fixed annual overheads (15% or 25%), ranging up to the higher of AED 1,500,000 or 25% of fixed annual overheads for Exchange Services. The amounts are set in Rule VI.B of the VARA Company Rulebook.

Exchange Services require the higher of AED 1,500,000 or 25% of fixed annual overheads. This is reduced to the higher of AED 800,000 or 15% of fixed annual overheads where the exchange uses VARA-licensed custody, or custody otherwise approved by VARA.

Fixed annual overheads are a VASP's recurring annual operating expenses (excluding genuinely variable costs). Because most VARA paid-up capital floors are the higher of a fixed AED amount or 15% to 25% of fixed annual overheads, larger or higher-cost operations must hold proportionately more capital than the headline minimum.

Yes. Under Rule VI.B.2, a VASP licensed for multiple activities must hold the required paid-up capital for each activity separately, calculating fixed annual overheads per activity, and the capital must be mutually exclusive and collectively exhaustive. The same capital cannot be counted twice across activities.

Under Rule VI.B.3, paid-up capital must be held in one of: (a) a trust account with a UAE-licensed bank naming VARA as beneficiary; (b) a surety bond from a UAE-authorised surety company with no end date, naming VARA as beneficiary; or (c) any other manner specified by VARA.

Yes. Paid-up capital is an ongoing requirement, not a one-off at application. VASPs must reconcile their paid-up capital on a monthly basis, and it sits alongside the separate Net Liquid Asset requirement within VARA's prudential framework.

For corporate violations, VARA's penalty schedule allows fines up to the higher of AED 50 million, 15% of annual revenue or 300% of the gains made or losses avoided (for individuals, the higher of AED 20 million or 200%), with federal AML/CFT prosecution on top. VARA-administered administrative fines typically range from AED 20,000 to AED 5 million depending on severity. Where each transaction or counterparty constitutes a separate offence, cumulative exposure can substantially exceed AED 50 million.

Yes. Both Dubai Law 4/2022 and Federal Decree-Law 20/2018 (AML/CFT) extend liability to natural persons who directed, authorised or knowingly permitted unlicensed activity. Maximum imprisonment under federal AML offences is 10 years. Even where no imprisonment is imposed, a personal 'not fit and proper' bar from future UAE financial-services authorisation is common.

Voluntary disclosure rarely eliminates a fine but very substantially reduces the penalty tier. In Neo Legal's experience, voluntary disclosure cases have tended to resolve at materially lower penalty levels than detection-led cases. The cost of voluntary disclosure is, in Neo Legal's experience, materially lower than enforcement-led resolution.

No. If your activity falls within a regulated category, you must stop until authorisation is granted. Operating during the application process is itself unlicensed activity. The only exception is where VARA has expressly granted an Interim Approval (rare; specific use cases) permitting limited continued operation pending full authorisation.

Not in any meaningful way. The corporate veil does not shield individuals here: VARA's penalty schedule sets separate fines for natural persons, and the federal AML framework extends liability to those with decisional involvement. Founders running a Dubai-resident operating model are personally exposed regardless of where the operating entity is incorporated.

If the activity genuinely sits outside all eight VARA-regulated activities (typically pure technology, or activity genuinely conducted outside Dubai), no licence is required and no enforcement attaches. But the perimeter is fact-sensitive and a written perimeter analysis (lawyer's opinion) is materially valuable if VARA later asks. We have provided such opinions where the activity is genuinely outside, and they are accepted.

Even within the regulated framework, issuers have structural choices. The main pathways:

Choose VARA for institutional Dubai virtual-asset operations — particularly exchange, custody and Category 1 RWA tokenisation. Choose ADGM FSRA for asset-management, fund-management or sovereign-orbit Web3 positioning. Choose RAK DAO for DLT Foundation structures, lean Web3 operating models or early-stage tokenisation projects. Many global Web3 groups use multiple frameworks for different activities.

VARA is the dominant Dubai virtual-asset regulator with the deepest activity-category framework and the most mature issuance pathway (Category 1 ARVAs for RWA tokenisation).

ADGM FSRA is a credible alternative for institutional virtual-asset firms with sovereign-orbit positioning and an English-common-law framework.

RAK DAO is the lighter-touch DLT Foundation framework — suitable for foundation structures, lean Web3 operations and early-stage tokenisation projects that don't fit VARA's institutional scope.

These are <strong>different regulators in different emirates</strong> — not interchangeable. The licensed entity must be incorporated in the relevant emirate.

It is a registration trigger: USD 250 million equivalent of virtual asset investment within any rolling 30-calendar-day period requires registration with VARA as a large proprietary trader. Registration is not a licence and does not permit providing services to others.

Only if all the capital traded belongs to one family unit (or one consolidated economic interest) and there are no third-party investors. A "family office" that takes capital from multiple unrelated families is a fund.

Yes — VARA-licensed Cat 5 exchanges welcome high-quality proprietary liquidity. Onboarding will be subject to the exchange's own AML/KYC, which will look at your structure, capital provenance, and trading policy.

Staking your own treasury is proprietary activity and outside VARA. Staking client assets, or pooling third-party assets to stake, is VA Management or Custody and requires a licence.

Yes. Trading profits of a UAE resident company are taxable income at 9% (with Small Business Relief to AED 3M revenue available for tax periods ending on or before 31 December 2029). Proprietary trading income generally does not qualify for the QFZP 0% rate because it is not Qualifying Income under Ministerial Decision No. 229 of 2025 (which replaced MD 265/2023).

Cash, bank balances and short-term instruments readily convertible to cash, net of liabilities falling due. Own-issued tokens, restricted balances and encumbered assets do not count — deliberately, because NLA must remain available in a stress scenario.

The licensee must notify VARA — with an early-warning expectation as coverage approaches the threshold (the 110% pre-alert discipline) — and present a remediation plan. Operating below requirement invites supervisory action, business restrictions or licence consequences.

NLA is a continuous obligation, not a year-end test. Licensees monitor it on a rolling basis, report through VARA’s periodic prudential returns and must escalate immediately when coverage deteriorates — governance should treat it like a bank treats regulatory capital.

Real-world reference assets other than a single fiat currency — gold and commodities, real estate, funds, collectibles such as graded trading cards and memorabilia, or baskets of assets. Referencing one fiat currency makes the token a fiat-referenced token under a different regime.

Only an entity licensed by VARA for the relevant issuance activity, with the ARVA-specific requirements met — including reserve backing and custody of the reference assets, disclosure through a whitepaper, redemption mechanics and ongoing reporting.

It is the regulated pathway for every RWA token in Dubai — the framework that turns tokenised gold, property or collectibles from an unregulated experiment into a supervised financial product that institutions, banks and payment partners can engage with.

Realistically nine to fifteen months from engagement to full licence for most activity categories — spanning initial disclosure, the application proper, in-principle approval, operational build-out and satisfaction of go-live conditions. Timelines vary with activity, readiness and responsiveness.

Advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment services, and transfer and settlement services — when conducted in or from Dubai outside the DIFC. Proprietary-only trading and certain exempt arrangements sit outside the licensing perimeter.

Regulatory fees are only part of the picture. The substantive costs are paid-up capital and the NLA prudential requirement, resident staffing — compliance officer and MLRO — technology governance under TGRAF, insurance and professional fees through the application.

Every VARA-licensed VASP, regardless of activity category. TGRAF is cross-cutting: exchange, broker-dealer, custody, advisory and management licensees all operate their technology under it, scaled to the nature and risk of the business.

Yes. VARA-licensed firms must commission an independent technology audit annually covering the TGRAF domains, report findings to VARA, and remediate weaknesses under supervisory follow-up.

Before applying. The regulatory business plan must describe TGRAF-aligned architecture, and licence conditions typically require the framework to be operating at go-live — retrofitting technology governance after build-out is far more expensive than designing to it.