VARA licenses virtual asset activity in or from Dubai (excluding the DIFC) under Dubai Law No. 4 of 2022, with published fees and capital figures. The CMA, the federal regulator since 1 January 2026, licenses eight virtual asset activities onshore across the wider UAE under its Virtual Assets Framework of 13 April 2026, with capital set in its Prudential Requirements module. Dubai-facing operating businesses default to VARA; UAE-wide onshore reach and tokenised securities point to the CMA; many groups end up with both.
Two regulators, one map
VARA exists under Dubai Law No. 4 of 2022 and regulates virtual asset activity conducted in or from the Emirate of Dubai, excluding the DIFC (which has its own regulator, the DFSA). It has been licensing since 2023, its Rulebooks and fee schedules are published, and its licensee register is long.
The CMA is the successor to the SCA: Federal Decree-Laws No. 32 and 33 of 2025 reconstituted the Securities and Commodities Authority as the Capital Market Authority with effect from 1 January 2026 (background in our note on the new capital markets law). Its Virtual Assets Framework, issued 13 April 2026 and building on Decision No. 4/R.M/2026, replaced the 2023 SCA VASP framework in full. It comprises five modules: General Requirements, Conduct of Business, Alternative Trading System, AML/CFT and Prudential Requirements. Its perimeter is federal: in practice, virtual asset activity in or from onshore UAE falling outside the Dubai (VARA), DIFC (DFSA) and ADGM (FSRA) perimeters, plus the federal securities dimension that reaches everywhere.
So the first question is not "which regulator is better". It is: where is the entity, and where are the clients? A Dubai-incorporated operating business serving clients from Dubai is in VARA's perimeter whether it likes it or not. An Abu Dhabi mainland or northern emirates operation, or a business built around onshore UAE-wide distribution, is looking at the CMA.
Activity coverage
VARA licenses the established VASP activity set: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, and VA Transfer and Settlement Services, alongside issuance rules for fiat-referenced virtual assets (FRVAs) and asset-referenced virtual assets (ARVAs).
The CMA framework defines eight regulated virtual asset activities: Dealing as Principal, Dealing as Agent, Providing Custody, Arranging Custody, Arranging Investment Deals, Providing Investment Advice, Portfolio Management, and Operating an MTF (multilateral trading facility). Two design choices stand out against VARA. The custody function is split into providing custody (holding the assets or keys) and arranging custody (organising it through another provider), a lighter touch for intermediaries. And the ATS module covers both conventional-securities MTFs and tokenised-securities MTFs, which gives tokenised securities an onshore venue home rather than leaving them to the free zones. The full list is analysed in our guide to the CMA's eight virtual asset activities.
Capital and fees, side by side
One caveat before the table, and it is not a throwaway: VARA's numbers below are the published figures from its Regulations (Schedule 2) and Company Rulebook. The CMA virtual asset figures are indicative ranges from published summaries only. The operative CMA requirements sit in the Prudential Requirements module and vary by sub-category, projected assets under custody or management, and risk profile. Never budget a CMA application from the indicative column.
| Point | VARA (Dubai, ex-DIFC) | CMA (federal) |
|---|---|---|
| Legal basis | Dubai Law No. 4 of 2022; VARA Regulations and Rulebooks | Federal Decree-Laws No. 32 and 33 of 2025; Virtual Assets Framework of 13 April 2026 (five modules) |
| Geography | In or from the Emirate of Dubai, excluding the DIFC | Onshore UAE at the federal level, outside the Dubai, DIFC and ADGM perimeters |
| Activities | Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, Transfer and Settlement, plus FRVA/ARVA issuance | Eight: Dealing as Principal, Dealing as Agent, Providing Custody, Arranging Custody, Arranging Investment Deals, Providing Investment Advice, Portfolio Management, Operating an MTF |
| Application / annual fees | AED 40,000 / 80,000 for Advisory and Transfer and Settlement; AED 100,000 / 200,000 for all other activities; each additional activity adds 50 percent of the lower application fee | Set per activity by the CMA fee sheet; budget against the fee sheet directly rather than secondary summaries |
| Paid-up capital | Advisory 100k; Broker-Dealer 400k or 15% of fixed annual overheads with a VARA-licensed custodian, else 600k or 25%; Custody 600k or 25%; Exchange 800k or 15%, else 1.5m or 25%; Lending 500k or 25%; VA Management and Investment 280k or 15%, else 500k or 25%; Transfer and Settlement 500k or 25% (AED, higher of) | Indicative only: Exchange/MTF AED 1.5M to 2M+; Custody AED 2M+ (varies by AUC); Broker-Dealer AED 500K+; Advisory AED 100K to 300K; Portfolio Management AED 500K to 1M+. Operative figures: Prudential Requirements module, by sub-category |
| Where capital sits / liquidity | UAE bank trust account with VARA as beneficiary; net liquid assets of at least 1.2x monthly operating expenses | Per the Prudential module; published summaries add a liquid-resources buffer of six months' operating expenses |
| Custody structure | Custody requires a separate legal entity | Providing Custody and Arranging Custody are separate activities; no published separate-entity rule equivalent to VARA's |
| Staffing | Two full-time Responsible Individuals; UAE-resident Compliance Officer (5 years' experience); MLRO (2 years AML/CFT); only MLRO, CISO and DPO outsourceable | Fit-and-proper approved persons per the General Requirements module |
| Token types | Spot virtual assets; FRVA issuance (capital AED 1.5m plus 2 percent of tokens in circulation); ARVA (higher of AED 1.5m or 2 percent of 24-month average reserves) | Virtual assets plus tokenised securities via the ATS module; dirham payment tokens for mainland payment use sit with the CBUAE, not the CMA |
| Unlicensed activity | Article 17, Dubai Law No. 4 of 2022: fines up to AED 50 million, criminal exposure, director liability | Article 71, Federal Decree-Law No. 33 of 2025: fines up to AED 250 million |
Full VARA cost detail, activity by activity, is in our VARA licence cost guide and VARA paid-up capital guide; the CMA side is built out in our CMA virtual asset licence cost guide.
The structural differences that change your corporate chart
Three VARA rules shape group structures in ways founders rarely anticipate. First, capital is not working capital: it sits in a UAE bank trust account with VARA as beneficiary, on top of the net liquid assets test of 1.2 times monthly operating expenses. Second, custody must live in a separate legal entity, so an exchange that wants first-party custody is building two companies and two licences from day one. Third, the staffing floor is specific: two full-time Responsible Individuals, a UAE-resident Compliance Officer with five years' experience and an MLRO with two years of AML/CFT work, and only the MLRO, CISO and DPO roles can be outsourced.
The CMA framework's equivalents live in its General Requirements and Prudential Requirements modules, and its custody split (providing versus arranging) can make an intermediated custody model lighter to license than under VARA. But because the CMA regime is new and its prudential detail is sub-category driven, the honest structural comparison for any real business is done against the modules themselves, not against summaries, this article included.
The token-type question
The choice of regulator is often made by the asset, not the business model.
- Spot virtual assets (exchange, brokerage, custody of BTC, ETH and the like): VARA in Dubai; the CMA's dealing, custody and MTF activities onshore.
- Tokenised securities: these are securities. Onshore they sit with the CMA, whose ATS module deliberately houses tokenised-securities MTFs; the ADGM's FSRA is the established free zone alternative. A tokenised bond or fund unit does not become VARA business by being on-chain.
- Fiat-referenced and payment tokens: VARA licenses FRVA issuance in Dubai with dedicated capital rules, while dirham payment tokens used for mainland payments sit with the CBUAE. Note also CBUAE Resolution No. 16 of 2026, which lets banks, finance companies, exchange houses and payment service providers enter CMA-regulated virtual asset activity (custody, dealing, ATS), with insurers carved out: the clearest signal yet that the federal side expects traditional institutions in this market.
The open point: does VARA reach the rest of the UAE?
Under an SCA/VARA arrangement in place since September 2024, VARA licensees have benefited from default registration with the federal regulator, which is what made "licensed in Dubai, passported to the UAE" a fair description. Whether that default registration carries over under the CMA regime is, at the time of writing, unconfirmed. Nothing published since the CMA's April 2026 framework squarely restates it. Until the CMA confirms the position, the prudent reading is narrow: a VARA licence covers Dubai, and any onshore UAE-wide distribution plan should be validated against the current CMA position, in writing, before launch. This single unresolved point is doing more work in 2026 structuring decisions than any fee comparison.
Model by model
- Exchange. Dubai-based venue: VARA Exchange Services (capital AED 800,000 or 15 percent of fixed annual overheads with a VARA-licensed custodian, else AED 1.5 million or 25 percent; fees AED 100,000 / 200,000). Onshore UAE-wide venue, or a tokenised-securities venue: CMA Operating an MTF under the ATS module. Our exchange licensing guide covers the build.
- Broker / OTC desk. Dubai flow: VARA Broker-Dealer (AED 400,000 or 600,000 tier depending on custody). Onshore intermediation: CMA Dealing as Agent or Dealing as Principal. See our OTC desk guide for the prop-trading boundary.
- Custodian. VARA Custody Services means a separate legal entity and AED 600,000 or 25 percent capital. The CMA route offers Providing Custody (heavier, indicative AED 2M+ varying by AUC) or Arranging Custody for intermediated models.
- Fund / portfolio manager. VARA VA Management and Investment (AED 280,000 or 15 percent with a licensed custodian, else AED 500,000 or 25 percent) for Dubai management; CMA Portfolio Management onshore; ADGM remains the venue of habit for fund vehicles themselves.
- Adviser. The cheapest seat in both regimes: VARA Advisory at AED 100,000 capital and AED 40,000 / 80,000 fees, or CMA Providing Investment Advice (indicative AED 100K to 300K). Geography of clients decides.
- Promoter / introducer. Pure marketing and referral businesses may not need a VASP licence at all: the CMA's securities-side Category 5 Promotion and Introducing licence (AED 500,000 capital, AED 28,000 in CMA fees) is often the right instrument, with VARA's marketing rules layered on for Dubai-facing campaigns.
When you need both
Groups end up with both regimes more often than the marketing suggests: a VARA-licensed exchange whose group wants to offer tokenised securities to onshore investors; a Dubai broker that will not gamble its UAE-wide client base on the unresolved registration point; a venue operator pairing a Dubai spot exchange with an onshore tokenised-securities MTF. The sequencing then matters, because each regulator will want to understand the other's perimeter in your group chart. Neo Legal advised Animoca Brands on its VARA VASP licence (VA Broker-Dealer and VA Management and Investment Services, the first regulated VASP licence in the Animoca group globally), working alongside Animoca's internal legal and compliance team and the group's other advisers, and runs multi-regulator mappings across VARA, CMA, ADGM and CBUAE as a single workstream: see our four-regulator comparison for the full map, and do I need a VARA licence and do I need a CMA licence for the threshold tests.
Frequently asked questions
What is the difference between a CMA and a VARA virtual asset licence?
Geography and legal level. VARA licenses virtual asset activity in or from the Emirate of Dubai, excluding the DIFC, under Dubai Law No. 4 of 2022. The CMA is the federal regulator created by Federal Decree-Laws No. 32 and 33 of 2025, effective 1 January 2026, and its Virtual Assets Framework of 13 April 2026 governs virtual asset activity onshore across the UAE outside the Dubai, DIFC and ADGM perimeters.
Which licence do I need for a crypto exchange in Dubai?
A venue operating in or from Dubai outside the DIFC needs a VARA Exchange Services licence: AED 100,000 application fee, AED 200,000 annual supervision, and paid-up capital of AED 800,000 or 15 percent of fixed annual overheads with a VARA-licensed custodian, otherwise AED 1.5 million or 25 percent. An onshore UAE-wide venue, or a tokenised-securities venue, points instead to the CMA's Operating an MTF activity under its ATS module.
How does CMA capital compare with VARA capital?
VARA's figures are published in its Company Rulebook: from AED 100,000 for Advisory to AED 800,000 to 1.5 million for Exchange, held in a UAE bank trust account with VARA as beneficiary. CMA figures for virtual asset activities are indicative only in published summaries, roughly AED 100,000 to 300,000 for Advisory up to AED 2 million plus for Custody; the operative numbers sit in the Prudential Requirements module and vary by sub-category.
Does a VARA licence cover the whole UAE?
Not automatically. A VARA licence covers activity in or from Dubai, excluding the DIFC. Since September 2024 an SCA/VARA arrangement gave VARA licensees default registration with the federal regulator, but whether that arrangement carries over under the CMA regime had not been confirmed at the time of writing. A UAE-wide distribution plan should be checked against the current CMA position before launch.
Who regulates tokenised securities in the UAE?
Tokenised securities are securities. Onshore, they sit with the CMA, whose Alternative Trading System module covers both conventional and tokenised-securities MTFs, giving tokenised securities an onshore venue home. The ADGM's FSRA is the established free zone alternative. VARA's perimeter is virtual asset activity in Dubai; a token that is in substance a security engages the securities regulators, not VARA alone.
Can a business need both a CMA and a VARA licence?
Yes. Common examples: a VARA-licensed Dubai exchange whose group also offers tokenised securities to onshore investors; a Dubai broker marketing across the UAE while the federal registration position remains unconfirmed; or a group adding an onshore MTF to a Dubai venue. Neo Legal maps every revenue stream against VARA, CMA, ADGM and CBUAE and sequences the applications as one workstream.
This article is general information as at September 2026 and is not legal advice. VARA figures are as published in the VARA Regulations and Rulebooks at the review date. CMA virtual asset capital figures are indicative ranges from published summaries; the operative requirements sit in the CMA Prudential Requirements module and vary by sub-category. The status of VARA licensees' federal registration under the CMA regime was unconfirmed at the review date.
