- An exchange build-out is a 9–15 month programme across five tracks — regulatory, corporate, technology, banking and people — and the licence is rarely the critical path when the programme is sequenced properly.
- Custody decides applications: segregation, wallet architecture, key ceremonies and the in-house vs third-party custodian call get more regulator scrutiny than anything else in the file.
- Capital is the visible cost; runway is the real one. Banking, insurance, audits and the supervised launch period consume funding long before revenue.
- Every substantial application draws question rounds and conditions. Programmes stall on how those are managed, not on whether they happen.
- Serving UAE users from offshore without a licence is an enforcement case waiting to happen — the feasibility answer should be honest before a dirham is spent.
Start with the perimeter, not the portal
The first decision is not “which form” but “which perimeter.” A trading venue serving UAE users sits with VARA in Dubai under the Exchange Services activity; a platform aimed at institutional clients might belong in ADGM under the FSRA; and anything touching payments or fiat rails brushes the Central Bank. Most retail-facing exchange projects land on VARA — and the scoping question that shapes everything after it is which bundle of activities the business actually needs: exchange operation, broker-dealer functions, custody, staking or lending overlays. Each activity added widens the rulebook load, the capital and the supervisory surface. Neo Legal’s scoping exercise routinely removes activities from founders’ wish-lists — the leanest viable licence is almost always the right first licence.
The application: a business plan the regulator can believe
VARA’s process runs from initial disclosures through detailed application to an initial approval, then a licence — typically with conditions — and finally clearance to launch full operations. What separates credible files: a business plan whose volumes, listing policy and revenue model survive scrutiny; a governance map with real, hireable people in the mandatory roles (senior executives, compliance officer and MLRO who will genuinely be resident and engaged); financial projections that reconcile with the capital and insurance requirements of the rulebooks; and a technology file — architecture, custody, market surveillance, business continuity — that reads like an operating company’s, not a whitepaper. The application is not paperwork ahead of the real work. It is the design of the business.
Custody: where exchange applications are won or lost
Nothing in the file gets interrogated like safekeeping. The decisions that matter: whether client assets sit in-house under a custody activity or with a third-party VARA-licensed custodian; the wallet architecture and hot/cold split and the rationale behind it; key generation, sharding, storage and recovery — who holds what, where, and what happens when someone leaves or dies; segregation of client assets from proprietary assets at both the ledger and legal level; and the reconciliation cycle that proves, continuously, that client balances exist. Retrofitting custody after the application is the single most common cause of delay we see. Design it first, then apply.
Capital is the visible cost — runway is the real one
Paid-up capital under the rulebooks scales with the activity bundle, with a variable component tied to operating expenditure. But the figure that actually determines whether a project survives is runway: banking onboarding (slow, KYC-heavy, and best started at initial-approval stage, not after licensing), professional-indemnity and crime insurance, technology and security audits, mandatory staff hires months before revenue, and the supervised launch period during which the exchange operates with training wheels. A funding plan that only covers the capital requirement is a plan to run out of money with a licence on the wall.
Question rounds, conditions and remediation
Substantial applications draw substantial questions — on governance, AML frameworks, technology, key personnel. Licences arrive with conditions; supervision brings thematic reviews; and occasionally a programme inherits a remediation file from earlier missteps. None of this is failure. It is how the regime works — and it rewards the same disciplines every time: complete answers over fast ones, remediation plans with dates the business will actually hit, and senior people in front of the supervision team rather than consultants reading scripts. Neo Legal manages these cycles as part of the mandate, through licensing and into ongoing supervision — the regulator relationship is an asset the build-out should create, not consume.
The five-track programme plan
Run as one programme, the tracks are: regulatory (scoping, application, question rounds, conditions discharge); corporate (entity, group structure, IP and token-side entities where relevant — often offshore issuers paired with the Dubai operating company); technology (build or buy, custody integration, surveillance, audits); banking and insurance (started early, run in parallel); and people (mandatory roles hired against the licensing timeline, visas and employment in place for approval). The sequencing discipline — what must be true before each gate — is where an experienced adviser earns the fee: the licence is rarely the critical path in a well-run programme.
How long does a VARA exchange licence actually take?
Longer than the pitch decks say. A realistic end-to-end programme for Exchange Services runs 9-15 months from engagement to operational launch: preparing the application and business plan, VARA's initial approval, entity establishment and build-out, the licence with conditions, and the supervised path to full operational approval. Neo Legal's practice is to sequence the technology, banking and staffing workstreams in parallel with the regulatory track - the licence is rarely the critical path if the programme is run properly.
What does VARA require for custody and safekeeping of client assets?
Custody is where exchange applications are won or lost. VARA examines the full safekeeping architecture: segregation of client virtual assets from proprietary assets, wallet architecture and the hot/cold split, key generation, storage and recovery ceremonies, whether custody sits in-house under a Custody Services activity or with a third-party VARA-licensed custodian, and the reconciliation and client-reporting cycle. Neo Legal designs the custody model alongside the licence strategy, because retrofitting custody after the application is the single most common cause of delay.
Can an offshore exchange simply serve UAE users without a licence?
No - actively soliciting or servicing UAE-based users from offshore sits squarely inside the perimeter VARA and the federal framework police, and enforcement has been visible and public. The honest options are licensing in Dubai, restructuring the offer so UAE users are genuinely out of scope, or staying out of the market. Neo Legal gives that feasibility answer bluntly at the outset, including when the right answer is not to proceed.
What capital does a VARA exchange licence need?
Capital is set by VARA's rulebooks and scales with the activities in scope - exchange operation, broker-dealer functions, custody - plus a variable component tied to operational expenditure. The paid-up figure is only part of the funding question: banking, insurance, technology audit and the supervised launch period all consume runway before revenue. Neo Legal models the full regulatory capital and runway picture before the application is filed, so founders and investors see the true cost of the licence early.
What happens when VARA pushes back or imposes conditions?
Almost every substantial application receives regulator questions, conditions or remediation items - on governance, technology, AML frameworks or key personnel. The difference between programmes that stall and programmes that launch is how those rounds are managed: complete responses, realistic remediation plans, and credible senior engagement with the supervision team. Neo Legal has managed VARA question rounds and post-licence supervisory engagement across the full application lifecycle, including remediation and thematic-review responses for licensed VASPs.
