Find a Virtual Asset Licensing Lawyer

The first question is not which forms to fill in but which regulator owns the activity. VARA covers virtual asset activity in Dubai — mainland, Dubai free zones and special development zones — but excluding the DIFC, under Article 3 of Dubai Law No. 4 of 2022. The DFSA covers the DIFC and the FSRA covers ADGM, both financial free zones carved out of the federal framework.

Onshore UAE and the ordinary, non-financial free zones in the other emirates fall to the federal Capital Market Authority. Article 3 of Cabinet Resolution No. 111 of 2022 disapplies the Resolution inside financial free zones; Article 6 gives the Authority the function of supervising virtual asset activity conducted inside the UAE including the free zones. Ordinary free zones are inside the federal perimeter, not outside it — a point businesses regularly get backwards. Article 15 lets the Cabinet delegate the Authority's functions to local authorities, which is the statutory hook for the Dubai arrangement.

The Central Bank sits across all of them for payment tokens under the Payment Token Services Regulation, and again for licensed financial activity carried on through DeFi, dApps and protocols under Article 62 of Federal Decree-Law No. 6 of 2025.

VARA's process runs in two stages, and the first document does not go to VARA at all. An applicant submits an Initial Disclosure Questionnaire to Dubai Economy and Tourism or to the relevant free zone, and the licensor screens it and transfers it to VARA. The applicant then provides further documentation, including a business plan and details of beneficial owners and senior management.

On approval the firm receives an Approval to Incorporate, which lets it finalise incorporation and complete operational set-up, including office and employees. VARA states expressly that at this point the firm is not permitted to carry on virtual asset activities — a constraint that belongs in the business plan and the funding runway rather than in a footnote.

Stage two is the licence. The firm submits documentation in line with the guidance VARA issues on receipt of the ATI, receives feedback that may include meetings, interviews and further documentation, and if VARA is satisfied receives a VASP Licence which may be subject to operational conditions. Part IV.B of VARA's 2023 Regulations lets it attach limitations and stipulations, describe an activity more narrowly or more widely, or grant a licence for a specified time.

A four-step sequence — Provisional Permit, then MVP Preparatory, then MVP Operating, then Full Market Product — is still repeated across advisory material and directory pages. It does not appear anywhere in VARA's current published process. A business building its launch timeline and fundraising narrative around those rungs is planning around a ladder that is no longer described.

Nor is there a separately named go-live or no-objection stage after a licence is granted on the primary record. Conditionality now sits in the operational conditions attached to the licence itself, so the real constraint on what a firm may do is in its own licence document — which is where a lawyer should be reading it, and where an investor should be asking to see it.

VARA licenses eight activities: advisory; broker-dealer; custody; exchange; lending and borrowing; management and investment; transfer and settlement; and issuance. There is no blanket virtual asset licence. The four compulsory rulebooks — company, compliance and risk management, technology and information, and market conduct — apply alongside the activity-specific rulebook for each licensed activity.

Issuance surprises people, because only part of it is licensable. Under Part I.C of the VA Issuance Rulebook, Category 1 issuance — fiat-referenced virtual assets, asset-referenced virtual assets, or other virtual assets VARA determines — requires a VARA Licence. Category 2 issuance, meaning any virtual asset that is neither Category 1 nor an exempt virtual asset, does not; but all placement or distribution must be carried out through or by a Licensed Distributor, and the issuer completes a VARA Issuance Approval Form instead.

Proprietary trading is not a licensed activity at all; it runs through a No Objection Certificate, and VARA's FAQ states that proprietary traders exceeding AED 1 billion in monthly volumes must register. The version 2.0 rulebooks announced on 19 May 2025, with full compliance required by 19 June 2025, strengthened controls around margin trading and token distribution services, clarified collateral wallet definitions and harmonised requirements across activities.

Virtual Assets Custody Services under VARA requires segregation as a distinct legal entity — not a separate department, and not a ring-fenced book inside the licensed exchange, but its own company. Groups that model a single entity holding client assets alongside a trading or brokerage business have to redesign before they apply.

That decision runs through the rest of the application: separate capital, separate governance, separate Responsible Individuals, and a group structure presented coherently from the ATI stage onwards. It also feeds the capital calculation, because whether a VASP uses a VARA-approved third-party custody provider changes the percentage applied to its overheads.

VARA's paid-up capital requirement is a higher-of test: the greater of a fixed floor for the activity, or a percentage of fixed annual overheads. The percentage is 15% where the VASP uses a VARA-approved third-party custody provider and 25% where it does not. Advisers quoting a single number are quoting the floor and ignoring the calculation that will usually exceed it.

The floors sit in Part VI.B of the Company Rulebook, in the version dated 19 May 2025 and effective 19 June 2025 — a version date worth citing with any figure, because the figures move when the rulebook moves. By way of illustration only, that version sets AED 100,000 for advisory, AED 600,000 for custody, and AED 800,000 for an exchange using an approved custodian against AED 1,500,000 for one that does not, with Category 1 issuance as specified in the VA Issuance Rulebook.

Separately, a VASP must maintain Net Liquid Assets of at least 1.2 times its monthly operating expenses, reconciled daily and reported monthly. That is a continuing liquidity obligation, and it is the requirement most often missing from a model built around the paid-up capital figure alone.

Rule I.C.1 of the Company Rulebook requires a VASP to appoint two individuals of sufficient seniority who are responsible for the VASP's compliance with all legal and regulatory obligations. Rule I.C.2 requires each to be a full-time employee, a Fit and Proper Person, and a resident of the UAE or a holder of a UAE passport. They are approved by VARA during licensing, changes need prior notification and approval, and their status is validated annually.

The residency requirement attaches to those two people. No equivalent rule for the Compliance Officer, the MLRO or senior management generally appears on the record checked for this page, so a blanket claim that every key person must be UAE-resident is not one to build a hiring map around. Confirm it role by role with a lawyer.

The rest of the governance is its own workstream. Board members must be Fit and Proper Persons approved by VARA. A Compliance Officer is required and, under Rule I.D.5.a, cannot hold Senior Management positions. A Company Secretary is required, independent of Senior Management and reporting directly to the Board under Rule I.E.1. The CISO and MLRO roles may be outsourced under Rule IV.A.3, and the MLRO needs at least two years' AML/CFT experience and reports quarterly to the Board on AML/CFT policy effectiveness and on anonymity-enhanced transactions.

In the DIFC a firm is not licensed to do crypto. It is licensed to carry on Financial Services under GEN Rule 2.2.2, with its Licence endorsed for Crypto Token business, and the crypto-specific requirements sit in Chapter 3A of the General Module. The services that may be carried on in relation to Crypto Tokens include dealing in investments as principal and as agent, arranging deals in investments, managing assets, advising on financial products, arranging and providing custody, operating a clearing house, and operating a multilateral trading facility.

On 12 January 2026 the DFSA moved from a DFSA-led suitability assessment to a firm-led one and stopped prescribing a list of Recognised Crypto Tokens. A firm now documents its own suitability assessment for every Crypto Token on a reasoned and documented basis, against the criteria in GEN Rule 3A.2.1(3): the token's characteristics including purpose, governance arrangements and founders; its regulatory status in other jurisdictions; the size, liquidity and trading history of its global market; the technology used; and whether using it could prevent compliance with DFSA-administered legislation.

The ongoing obligations are what firms underestimate at licensing: re-assessment at minimum every six months under GEN Rule 3A.2.1A(b) with continuous monitoring in between, monthly ePortal reporting within 14 days covering token names, client numbers, transaction counts and USD value under GEN Rule 3A.2.1A(d), and quarterly custodian reporting on unauthorised transfers under COB 15.4.6. The previous gross-asset-value thresholds for Funds investing in Crypto Tokens no longer apply.

Two structural points matter before an application is drafted. Representative Offices may not market Crypto Tokens under GEN Rule 2.26.1(4)(a), and branches are restricted — not prohibited — from carrying on Crypto Token-related services under GEN Rule 7.2.2(8), with the exact current scope not something to assume. This page states no DIFC prudential category mapping, and does not say whether a crypto trading venue needs the Authorised Market Institution route rather than an MTF Licence, because neither is established on the sources checked.

ADGM has no standalone crypto licence and has not had one since February 2020, when the FSRA abolished the bespoke category of operating a crypto asset business, mapped virtual asset business onto the underlying Regulated Activities, and renamed crypto asset to virtual asset to align with FATF. A firm needs a Financial Services Permission covering the relevant activity: dealing as principal, dealing as agent, advising on investments or credit, arranging deals in investments, managing assets, providing custody, or operating a multilateral trading facility.

The token side is self-assessment with a notification attached. COBS Rule 17.2.1 bars an Authorised Person from conducting a VA Regulated Activity with an asset that is not an Accepted Virtual Asset, and COBS Rule 17.2.2 requires the firm itself to assess each asset against seven criteria — traceability and on-chain monitoring capability; security and private-key safeguarding; market profile; availability on suitably regulated exchanges; DLT infrastructure and ecosystem; innovation and efficiency; and practical application and functionality — then notify the FSRA no later than five business days before using it.

There is no central FSRA list. COBS Rule 17.2.6 requires each Authorised Person to maintain on its own website a current list of the Accepted Virtual Assets it uses, with name and symbol, network of operation, smart contract addresses where applicable, and any trading or usage restrictions. The absence of a central list shifts the diligence burden onto the firm and its counsel.

Two things are prohibited outright. Privacy tokens obscure tokenholder details or transaction history through design features that cannot be disabled; algorithmic stablecoins use algorithms as the only or principal means to stabilise price or maintain a peg. Neither can be issued, sold, purchased, transferred or held in custody, on the basis of FSMR section 5A(4), and the 10 June 2025 amendments moved this from supervisory approach into the rules. Capital is activity-specific — providing custody is the higher of a USD 250,000 base capital requirement or six months' annual audited expenditure — and all regulatory capital must be held in fiat form.

The Capital Market Authority replaced the SCA under Federal Decree-Law No. 32 of 2025 and Federal Decree-Law No. 33 of 2025, both effective 1 January 2026, and is its legal successor. Its virtual assets framework — Resolution No. 4/R.M of 2026 of the Chairman of the Authority's Board of Directors, concerning the regulation of virtual assets service providers and the alternative trading system operator — was announced on Monday 13 April 2026, with five core modules and eight regulated activities expanded from three: dealing as principal; dealing as agent; providing custody; arranging custody; arranging investment deals; providing investment advice; portfolio management; and operating a multilateral trading facility.

1 January 2026 is the succession date for the institution, not the commencement date of Resolution 4, whose own effective date is not established on the public record — nor is any repeal it effected, nor any transitional period or grandfathering for firms licensed under the former SCA framework. A business relying on an older onshore licence should treat that as a live question. Separately, CMA Resolution 16/Chairman of 2026, issued 25 June 2026 and in force on issuance, permits Central Bank-licensed entities other than insurance companies to perform CMA virtual asset and alternative trading system activities.

The Central Bank's payment token regime runs on a licence-or-registration split: persons incorporated and located in the UAE apply for a licence, persons outside the UAE register. Article 5 of the Payment Token Services Regulation expressly notes that a person outside the UAE includes a person located in a financial free zone, so a DIFC or ADGM entity is foreign for payment token purposes. Article 2(3) separately prohibits any person from issuing algorithmic stablecoins or privacy tokens, or performing services relating to them, within the UAE or directed to persons in the UAE — including persons otherwise licensed for virtual asset activities.

The relationship between the Dubai licence and the federal perimeter is the question businesses most often get wrong, and it is partly answerable. The CMA’s own Open Data page for virtual asset service providers describes the list as companies licensed by VARA and registered with the federal securities regulator — so the dual structure of a VARA licence plus a federal registration is still how the federal regulator presents it, after the CMA transition and after the April 2026 framework.

Two things temper that, and both are worth knowing before relying on it. The CMA’s page still names the Securities and Commodities Authority rather than the CMA, which tells you the page is current in substance but has not been updated in nomenclature. And the CMA maintains no list of its own — it links through to VARA’s Public Register, which in turn says nothing about federal registration, so there is no federal-side record against which to verify a firm’s federal status. Whether registration remains automatic, and what applies to a firm licensed outside Dubai, is not established on the public record and belongs with a lawyer.