How to Apply for a VARA Licence in Dubai
A VARA licence is the authorisation required under Dubai Law No. 4 of 2022 before a business may carry on a virtual asset activity in Dubai outside the DIFC, granted by the Virtual Assets Regulatory Authority at the end of a two-stage process that starts with an Initial Disclosure Questionnaire filed through Dubai Economy and Tourism or the relevant free zone rather than with VARA itself.
Most published descriptions of the VARA application process are out of date, and the out-of-date parts are the ones that decide what a founder does first. The live process has two stages, not four; the first document does not go to VARA; and a firm holding its Approval to Incorporate is expressly not yet permitted to carry on virtual asset activity. This guide follows the process as VARA sets it out and says where the public record runs out. LEXNOVA is not a law firm — it is a lawyer-matching service, and it does not prepare, submit or assess licence applications, give legal advice, or act as a regulator.
LAST REVIEWED 22 SEPTEMBER 2026
WHO THIS GUIDE IS FOR
Founders, general counsel, compliance leads and investors behind an exchange, broker-dealer, custodian, token issuer, lending platform, advisory business or asset manager intending to operate in or from Dubai outside the DIFC — and anyone holding a plan built around the old four-step VARA ladder who needs to know whether it still describes reality.
What a VARA Licence Is, and Where It Applies
VARA was created by Dubai Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai, published and effective on 28 February 2022, and is a public corporation affiliated with the Dubai World Trade Centre Authority. Its jurisdiction under Article 3 covers Dubai mainland, Dubai free zones and special development zones, but expressly not the DIFC.
Article 15 is the prohibition: no person may conduct the Activity in the Emirate without obtaining a Permit from VARA. Part III.A of the Virtual Assets and Related Activities Regulations 2023 also catches an entity that promotes, offers, or purports to carry on a VA activity. Purporting is enough — the perimeter is not drawn at first revenue.
No amending law to Dubai Law No. 4 of 2022 was found on the record checked for this guide, and whether one exists is not established. Treat the 2022 text as the operative statute and confirm the current position with a lawyer.
The Eight Licensed Activities, and Mapping Your Business
VARA licenses eight activities: Virtual Assets Advisory Services; Broker-Dealer Services; Custody Services; Exchange Services; Lending and Borrowing Services; Management and Investment Services; Transfer and Settlement Services; and Virtual Assets Issuance, which is licensable in Category 1 only.
Mapping is rarely one-to-one. An app letting a user buy, hold and earn on a token plausibly touches exchange or broker-dealer, custody, and lending and borrowing at once. Each activity brings its own rulebook, capital floor and operational expectations, so scoping drives the cost and shape of the whole build.
One structural rule cannot be engineered around: Custody Services requires segregation as a distinct legal entity, not merely functional separation inside one company. A group holding client assets alongside another licensed activity is looking at more than one entity from the outset.
Issuance Splits in Two, and the Licensed Distributor
Part I.C of the VA Issuance Rulebook splits issuance in two, and only one half is licensable. Category 1 covers Fiat-Referenced Virtual Assets, Asset-Referenced Virtual Assets, or other virtual assets VARA determines, and requires a licence. Category 2 covers any virtual asset that is neither Category 1 nor an Exempt VA, and requires none.
The Category 2 relief is narrower than it sounds. All placement or distribution must be carried out through or by a Licensed Distributor, and the issuer completes a VARA Issuance Approval Form instead. A Category 2 project sits inside the regime through a licensed counterparty, which has to be secured before launch.
Proprietary Trading Sits Outside the Licensing Regime
Proprietary trading is not one of the eight licensed activities. It runs instead on a No Objection Certificate — a different instrument with a different process — and should not be described internally or to investors as a licence.
VARA’s published FAQ position is that proprietary traders exceeding AED 1 billion in monthly volumes must register. A desk expecting to grow through that level should plan for the registration point rather than discover it after the fact.
Stage 1 — The Questionnaire Does Not Go to VARA
This is the detail that most reliably trips up a first-time applicant. The Initial Disclosure Questionnaire is submitted to Dubai Economy and Tourism, or to the relevant free zone, not to VARA directly. The licensor screens it and transfers it to VARA. Waiting on VARA for a document it was never sent loses weeks for nothing.
The applicant then provides further documentation, including a business plan and details of beneficial owners and senior management, and the review commences. LEXNOVA states, quotes and collects no charge at any stage. Stage 1 ends with the Approval to Incorporate, allowing the applicant to finalise incorporation and complete operational set-up, including office and employees.
Approval to Incorporate, and the Rule That Catches Firms Out
VARA states expressly that at the Approval to Incorporate stage the firm is not permitted to carry on virtual asset activities. The ATI is permission to build the company — not permission to trade, custody, advise or onboard a single client.
The same line holds at the next visible milestone, and it is one applicants misjudge. VARA’s Public Register lists firms holding an In-Principle Approval alongside fully licensed ones, and describes an In-Principle Approval as a conditional step allowing an applicant to complete the final requirements for a licence. VARA states that applicants holding one are strictly prohibited from initiating operations, conducting virtual asset activities or servicing clients until the full VASP licence is issued. Appearing on the register is not authorisation to trade, and treating it as a soft launch signal is a mistake in both directions — for the applicant, and for anyone checking whether a counterparty is actually licensed.
Commercial pressure runs the other way: the entity exists, an office is being fitted out, staff are hired and a burn rate is running. A soft launch or friendly-user pilot is exactly what the Regulations 2023 perimeter catches, since promoting or purporting is enough. The runway model must carry a period with a cost base and no permitted revenue.
Stage 2 — The Licence and Its Operational Conditions
Stage 2 begins with documentation prepared in line with the guidance VARA issues on receipt of the ATI, and it is iterative rather than a single filing. The applicant receives feedback from VARA, which may include meetings, interviews and requests for further documentation.
It ends with a VASP Licence which, in VARA’s own words, may be subject to operational conditions. Part IV.B of the Regulations 2023 lets VARA attach limitations, specify a narrower or wider description of an activity than the applicant asked for, and grant a licence for a specified time. So the scope granted may not be the scope in the business plan. LEXNOVA promises no approval, no scope and no timeline.
The MVP Ladder Is Not the Live Process
Advisory material still describes VARA licensing as a four-step ladder: Provisional Permit, then MVP Preparatory Licence, then MVP Operating Licence, then Full Market Product Licence. That sequence does not appear anywhere on VARA’s current site and should not be treated as the live process.
This matters because the ladder implies staged commercial permission — a restricted client set, then a wider one. Phasing is instead handled through the operational conditions attached to the licence, and there is no separate named go-live or no-objection stage after grant on the primary record. A plan built around reaching MVP Operating by a given quarter needs rebuilding.
The Rulebooks You Are Signing Up To
Four rulebooks are compulsory for every VASP: Company; Compliance and Risk Management; Technology and Information; and Market Conduct. Eight further rulebooks are activity-specific, one for each licensed activity.
The Company Rulebook runs in eight parts: Company Structure; Corporate Governance; Fit and Proper Requirements; Outsourcing Management; Environmental, Social and Governance; Capital and Prudential Requirements; Insolvency and Wind Down; and Material Change to Business or Control. The Compliance and Risk Management Rulebook runs in seven: Compliance Management; Tax Reporting and Compliance; AML/CFT; Client Money Rules; Client Virtual Assets Rules; Anti-Bribery and Corruption; and Sponsored VASPs.
Version 2.0 was announced on 19 May 2025 with a 30-day transition and full compliance required by 19 June 2025, strengthening controls around margin trading and token distribution services, clarifying collateral wallet definitions, and harmonising requirements across activities. A gap analysis run against a pre-May 2025 copy is analysing the wrong text.
Capital: A Higher-Of Test, Not a Headline Number
Paid-up capital under Part VI.B of the Company Rulebook is a higher-of test: the greater of a fixed AED floor and a percentage of fixed annual overheads — 15% where the VASP uses a VARA-approved third-party custody provider, and 25% where it does not. An adviser quoting a single headline number is quoting the lower half of the test.
The floors come from the Company Rulebook version dated 19 May 2025, effective 19 June 2025, and should always be cited with that version date: Advisory AED 100,000; Broker-Dealer AED 400,000 with an approved custodian or AED 600,000 without; Custody AED 600,000; Exchange AED 800,000 with or AED 1,500,000 without; Lending and Borrowing AED 500,000; Management and Investment AED 280,000 with or AED 500,000 without; Transfer and Settlement AED 500,000; and Category 1 Issuance as specified in the VA Issuance Rulebook. These are regulatory capital requirements, not fees.
Alongside paid-up capital, a VASP must hold Net Liquid Assets of at least 1.2 times its monthly operating expenses, reconciled daily and reported monthly. That is a live operational control, and a firm whose cost base grows sees the requirement grow with it.
Key People, and Who the Residency Rule Binds
Company Rulebook Rule I.C.1 requires two individuals of sufficient seniority responsible for the VASP’s compliance with all legal and regulatory obligations — the Responsible Individuals. Rule I.C.2 requires each to be a full-time employee, a Fit and Proper Person, and a resident of the UAE or a holder of a UAE passport. They are approved by VARA during licensing, changes need prior approval, and status is validated annually.
That residency rule attaches to those two people. No equivalent requirement for the Compliance Officer, the MLRO or Senior Management was found on the record checked, so a blanket claim that every key person must be UAE resident is not supported and should not shape a hiring plan unchecked.
Board members must be Fit and Proper Persons approved by VARA, though board size is not established. A Compliance Officer is required and cannot hold Senior Management positions under Rule I.D.5.a. A Company Secretary is required, independent of Senior Management and reporting to the Board under Rule I.E.1. The CISO and MLRO may be outsourced under Rule IV.A.3, and the MLRO needs at least two years of AML/CFT experience and reports quarterly to the Board on AML/CFT policy effectiveness and on Anonymity-Enhanced Transactions.
Marketing: There Is No Reverse-Solicitation Safe Harbour
The Regulations on the Marketing of Virtual Assets and Related Activities 2024 and their Guidance apply to all entities, domestic and foreign, and cover all marketing of or relating to any virtual asset or VA activity in or targeting the UAE. All such marketing must be carried out by a VARA-licensed VASP for that activity, or on its behalf and with its approval.
An entity escapes only if three conditions hold cumulatively: it is not located in the Emirate; it conducts no VA activity in the Emirate; and it carries out no marketing in or targeting the UAE. All three, not any one. Note the perimeter mismatch — VARA’s substantive jurisdiction is Dubai excluding the DIFC, but the escape condition is framed by reference to the UAE.
There is no reverse-solicitation safe harbour in the Marketing Regulations 2024 or the Guidance; commentary routinely assumes one exists and it does not. Targeting is a multi-factor assessment covering physical presence, GCC-wide campaigns, use of AED, local imagery, UAE celebrities and channels reaching UAE residents — and campaigns targeting Gulf Cooperation Council member states as a whole will by default be deemed to include the UAE. Unlicensed entities should carry a prominent disclaimer that they are not licensed or regulated by VARA. The Guidance exempts journalistic content, educational content, and personal communications reaching fewer than 50 friends, family or colleagues.
Exemptions, Ongoing Obligations, and How LEXNOVA Helps
Exempt Entities are federal or Dubai government entities and their public, non-profit, not-for-profit and charitable entities. Separately, duly registered practising lawyers, accountants and professionally licensed business consultants may conduct VA activities wholly incidental to their professional practice without a licence, provided they hold professional indemnity insurance. Wholly incidental does a great deal of work in that sentence.
A licence is a beginning, not an endpoint. Net Liquid Assets are reported monthly, the MLRO reports quarterly, Responsible Individual status is validated annually, and material change runs through Part VIII of the Company Rulebook. VARA also issues circulars that change obligations without reissuing a rulebook — during 2026 on Qualified Investor onboarding (8 January), high-risk jurisdictions (22 January), Travel Rule requirements implemented (24 February), AML/CFT/CPF requirements (4 March) and AML/CFT business risk assessments (12 June). Enforcement is public, and Article 20 of Dubai Law No. 4 of 2022 authorises fines, permit suspension of up to six months and revocation.
LEXNOVA is a lawyer-matching service, not a law firm. It does not prepare, submit, review or assess a licence application, does not advise on which activities your business falls into, and does not represent anyone before VARA. It helps you describe your position clearly enough to be matched with a lawyer whose practice fits. Every match is reviewed by a person, and the professional relationship is directly between you and the lawyer.
FAQ
LEXNOVA is not a law firm and does not provide legal advice, legal opinions, legal representation, or legal services. Any legal advice or representation is provided directly by the independent legal professional engaged by the client.
A connection or introduction does not constitute a guarantee, endorsement, or assurance of outcome. Users should independently confirm the professional's qualifications, authorization, fees, scope of engagement, and suitability.