Setting up a virtual asset company in Dubai means incorporating an entity, then taking it through VARA licensing (or the CMA, ADGM or DIFC route if your model points there): Initial Disclosure Questionnaire, full application, approved persons in seat, paid-up capital of AED 100,000 to 1.5 million in a UAE bank trust account, Dubai office, then the operational licence, typically eight to twelve months end to end.
Step 1: choose the regulator and the activity
Dubai gives a virtual asset founder four doors, and the choice shapes everything downstream. VARA licenses the Emirate of Dubai outside the DIFC across eight activities (Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, VA Transfer and Settlement, and Issuance). The federal CMA covers onshore UAE under its April 2026 framework, and is the natural home for tokenised-securities venues. The ADGM (FSRA) and DIFC (DFSA) offer common law financial free zones. Run the perimeter test first (do I need a VARA licence?), then the venue comparison (CMA vs VARA and the four regulators compared). Scope the licence to what you will actually do in year one: each additional VARA activity adds 50 percent of the lower application fee and its own rulebook, and activities can be added later.
Step 2: form the entity
For a VARA firm, incorporate in mainland Dubai or a non-DIFC free zone; the company can be 100 percent foreign-owned, and no local partner is required. Three structural points earn their fees here. First, custody requires a separate legal entity under VARA's rules, so an exchange or broker planning to hold client assets is a two-entity structure from the start, unless client assets sit with a third-party VARA-licensed custodian (which also lowers the capital tier). Secondly, put a clean holding company above the licensed entity: regulators scrutinise shareholders and ultimate beneficial owners, and restructuring mid-application resets questions. Thirdly, the trade licence activity wording should match the VARA activity you will apply for. The entity exists first and applies second; what it must not do is conduct any regulated activity before the licence is issued, because unlicensed activity is an offence under Article 17 of Dubai Law No. 4 of 2022 (penalties here).
Step 3: the people VARA requires
- Two full-time Responsible Individuals, accountable to VARA for the conduct of the business.
- A UAE-resident Compliance Officer with five years of compliance experience.
- An MLRO with two years of AML/CFT experience.
- Only three roles may be outsourced: MLRO, CISO and DPO. Nothing else.
Hiring is the most common sequencing mistake: sign too early and you carry senior salaries through a year of licensing; too late and the application stalls waiting for named individuals. The workable pattern is named candidates with contracts conditional on approval, converting to full-time as the licence approaches. Detail on the roles is in our approved persons guide.
Step 4: capital and fees
The verified numbers under Schedule 2 of the Regulations and the Company Rulebook:
| Item | Amount |
|---|---|
| Application fee: Advisory; VA Transfer & Settlement | AED 40,000 (annual supervision AED 80,000) |
| Application fee: all other activities | AED 100,000 (annual supervision AED 200,000) |
| Each additional activity | +50% of the lower application fee |
| Paid-up capital: Advisory | AED 100,000 |
| Paid-up capital: Broker-Dealer | AED 400,000 or 15% of fixed annual overheads with a VARA-licensed custodian; else AED 600,000 or 25% |
| Paid-up capital: Custody | AED 600,000 or 25% (separate legal entity required) |
| Paid-up capital: Exchange | AED 800,000 or 15% with a licensed custodian; else AED 1.5 million or 25% |
| Paid-up capital: Lending & Borrowing; VA Transfer & Settlement | AED 500,000 or 25% |
| Paid-up capital: VA Management & Investment | AED 280,000 or 15% with a licensed custodian; else AED 500,000 or 25% |
| Paid-up capital: Issuance (Category 1) | FRVA: AED 1.5 million plus 2% of tokens in circulation; ARVA: higher of AED 1.5 million or 2% of 24-month average reserves |
Capital is held in a UAE bank trust account with VARA as beneficiary, and every licensee must maintain net liquid assets of at least 1.2 times monthly operating expenses (the NLA rule). Budget beyond the regulator: office, salaries, technology and professional fees usually exceed the regulatory minimums. Full budgeting detail in the VARA cost guide and the capital guide. If your model points at the federal regime instead, CMA capital sits in its Prudential Requirements module and varies by sub-category; treat published ranges as indicative only (see CMA licence costs).
Step 5: the application, realistically sequenced
- Initial Disclosure Questionnaire. The IDQ opens the file: the model, the founders, the funding. First impressions here shape the whole review (IDQ guide).
- Full application. Business plan, financial model, AML/CFT and governance frameworks, technology architecture, key personnel files. This is the heavy drafting phase, typically months of work.
- Queries and review. VARA comes back in rounds. Responsiveness and consistency across documents are what move the file.
- Approval and conditions. Approval arrives conditional: capital injected into the trust account, office space taken, approved persons resident and in seat, insurance bound.
- Operational licence and go-live. goAML registration, final checks, and trading. End to end, a well-prepared application typically runs eight to twelve months from IDQ to operational licence (the timeline guide).
Step 6: banking
Start banking the day you incorporate, not the day you are licensed. A virtual asset company needs at least two relationships: an operating account, and the trust account for paid-up capital with VARA as beneficiary. UAE banks will onboard virtual asset firms, but compliance review is slow and documentation-heavy, and the licence application itself is usually the strongest document in the file: banks move faster once VARA's process is visibly under way. Expect enhanced due diligence on shareholders and source of funds, and hold realistic timelines: banking routinely runs as long as licensing and is the failure point founders least expect.
Step 7: after the licence: the obligations begin
The licence is the start of supervision, not the end of the project. From day one the firm carries the net liquid asset requirement (1.2 times monthly operating expenses, monitored continuously, not annually), annual audited financial statements, AML/CFT reporting through goAML, compliance monitoring against the rulebooks, and VARA's supervisory cycle of information requests and reviews. Annual supervision fees (AED 80,000 or 200,000 by activity) fall due each year. The first quarter sets the tone with the regulator: our first 90 days guide maps the diary.
Where applications actually fail
- Misclassified activity. The model is broker-dealer but the application says advisory; every document then contradicts the perimeter. This is the error all others inherit.
- Custody structured inside the main entity when VARA requires a separate legal entity, forcing a mid-application restructure.
- Approved persons on paper only. Candidates who will not relocate, or a Compliance Officer without the five years, discovered at interview stage.
- Capital promised, not evidenced. The trust account and source-of-funds trail should be ready when approval conditions land, not begun then.
- Copy-paste policies. Frameworks that do not describe the actual business read instantly as bought documents and generate rounds of queries.
- Starting activity early. Soft-launching to clients before the operational licence converts a licensing project into an enforcement matter.
For the wider context around this walkthrough, start at the virtual asset firm Dubai landing, the definitional companion what is a VASP?, and, for the federal route, the CMA virtual asset licence page and the CMA application process.
Setting up in Dubai: frequently asked questions
This article is general information as at September 2026 and is not legal advice. VARA figures are as published in the Regulations and Rulebooks at the review date; CMA capital figures were unconfirmed at the review date and should be checked against the Prudential Requirements module.
