Do I need a VARA licence?

The legal starting point

Dubai's virtual-asset regime is built on Dubai Law No. 4 of 2022, which created VARA, and the VARA Regulations 2023, which define the seven activities that require a licence. The question "do I need a VARA licence?" therefore reduces to one substantive test:

Is what I am doing a Virtual Asset Service within the meaning of the VARA Regulations 2023, conducted "in or from" the Emirate of Dubai (excluding the DIFC)?

If yes, you need a licence. If no, you do not. Every "do I need VARA?" conversation we have eventually resolves to applying that one test to the specific facts.

The seven decision questions

Walk through these in order. A "yes" to any one of them means you need a VARA licence. Only a "no" to all seven puts you in a non-VARA lane.

Question 1 — Do you provide advice to third parties on the merits of buying, selling or holding a virtual asset?

If yes → VARA Category 2 (Advisory Services). Includes investment-advisory work, model-portfolio recommendations, "buy" / "sell" recommendations published to retail audiences, and structured advisory for institutional clients on virtual-asset allocations.

Common false negatives: tax counsel discussing the tax treatment of a virtual-asset position is not VA Advisory; pure legal advisory on the regulatory perimeter is not VA Advisory. Investment-merits advice is.

Question 2 — Do you receive, transmit or execute orders to buy or sell virtual assets on behalf of clients?

If yes → VARA Category 3 (Broker-Dealer Services). Covers OTC desks, retail broker platforms, white-label execution, order routers, and copy-trading platforms where the operator transmits client orders.

Question 3 — Do you hold or control client virtual assets, or the private keys controlling them?

If yes → VARA Category 4 (Custody Services). The most heavily regulated category. Covers regulated digital-asset custodians, custodial wallet providers, and institutional sub-custodians. Note that genuine non-custodial wallets where the user controls the keys do not require Category 4.

Question 4 — Do you operate a multilateral facility matching buyers and sellers of virtual assets?

If yes → VARA Category 5 (Exchange Services). Covers centralised exchanges, spot trading venues, and decentralised exchange frontends with a Dubai operating presence. Even peer-to-peer marketplaces with order-matching functionality fall here.

Question 5 — Do you provide or arrange credit denominated in or secured by virtual assets?

If yes → VARA Category 6 (Lending and Borrowing Services). Includes crypto-backed lending platforms, yield-generating products with credit characteristics, and OTC margin-financing arrangements.

Question 6 — Do you manage virtual assets on behalf of clients, or operate a collective investment vehicle for virtual assets?

If yes → VARA Category 7 (VA Management and Investment Services). Includes discretionary portfolio managers, hedge funds with virtual-asset strategies, and pooled investment vehicles.

Question 7 — Do you provide payment, transfer or settlement rails for virtual assets?

If yes → VARA Category 8 (VA Transfer and Settlement Services). Includes payment processors accepting virtual assets, remittance platforms using virtual assets, and settlement service providers.

The "in or from Dubai" test

VARA's jurisdictional reach is "in or from the Emirate of Dubai" under Article 4 of Law No. 4 of 2022. In practice, you are caught if:

• Your operating entity is incorporated in Dubai (mainland or participating Free Zone), OR
• Your decision-making, infrastructure, or key personnel are physically in Dubai, OR
• Your marketing or solicitation is directed at Dubai-based clients.

The DIFC is explicitly excluded — activity inside the DIFC is regulated by the DFSA, not VARA.

The four legitimate non-VARA lanes

If you answered "no" to all seven questions, or your activity is excluded by the "in or from Dubai" test, you sit in one of four lanes:

Lane 1 — Pure proprietary trading

Trading your own capital, with no client funds and no public solicitation, sits outside all seven activities. Typical home: DMCC, IFZA or Meydan Proprietary Trading SPV. Caveat: at AED 250 million+ daily turnover, VARA expects engagement on systemic-relevance grounds even where formally outside the perimeter (see our $250M threshold article).

Lane 2 — Pure technology / infrastructure

Software development, non-custodial wallet SDKs, blockchain analytics SaaS, validator services for own treasury only, and audit / security services do not require VARA. Typical home: DMCC Tech licence, IFZA Media & Communications, RAKEZ Free Zone.

Lane 3 — DIFC or ADGM

DIFC (DFSA Crypto Token regime) and ADGM (FSRA Virtual Assets Framework) are separate regulatory perimeters. Each requires its own licence, but those licences are not VARA licences. For institutional players who need the credibility of a financial free-zone regulator, these are the appropriate routes — not VARA.

Lane 4 — Genuinely offshore activity

Activity actually conducted from outside Dubai — e.g. a BVI Business Company with non-Dubai-resident directors, non-Dubai infrastructure, non-Dubai key management — is not "in or from Dubai" and falls outside VARA's reach. The trap here is the Dubai-resident-founder pattern: founders who claim offshore status while running the business from a Dubai apartment lose the offshore protection in practice. See our BVI + Cayman hybrid article for the substance test that has to be satisfied.

The two edge cases that catch out the most founders

Token issuance

The act of issuing a new token is not itself one of the seven regulated activities. However, the surrounding activities almost always are: public sale = Broker-Dealer or Exchange characteristics, exchange listing arrangements = Broker-Dealer, advice to investors = Advisory, holding sale proceeds = Custody. Plus VARA's Category 1 VA Issuance approval is a separate gating regime for the issuance itself. Net effect: 95%+ of token issuances need VARA approval in some form.

Staking-as-a-service

Validator services run on your own treasury alone are pure proprietary activity and outside VARA. The moment you pool client assets, take discretion over allocation, or promise yield, you have crossed into VA Management (Category 7), Custody (Category 4), or Lending (Category 6), depending on the design.

The decision matrix at a glance

What to do once you have your answer

If you need a VARA licence, the next step is the Initial Disclosure Questionnaire — VARA's pre-application gate. If you sit in a non-VARA lane, the structuring exercise is choosing between DMCC, IFZA, RAKEZ, ADGM, DIFC or pure offshore depending on banking, substance and tax. Either way, the perimeter analysis should be locked down before any incorporation expenditure — restructuring after the fact is materially more expensive than getting it right at the start.