Do We Need a VARA Licence for Our Virtual-Asset Activities in Dubai?
A Dubai commercial licence alone does not authorise virtual-asset services; the required permission depends on where you operate and exactly what your business does.
A Dubai commercial licence alone does not authorise virtual-asset services; the required permission depends on where you operate and exactly what your business does.
The answer depends on your activity, location and operating model
A business that carries on a regulated virtual-asset activity by way of business in or from Dubai generally needs a VARA Virtual Asset Service Provider (VASP) Licence before it begins operating. VARA’s jurisdiction covers Dubai mainland, special development zones and free zones, but excludes the Dubai International Financial Centre (DIFC), which falls under a different regulatory framework.
Dubai’s Virtual Assets Law and the Virtual Assets and Related Activities Regulations focus on what a business actually does. They do not rely on labels such as Web3 company, tokenization platform, NFT marketplace, fintech provider or technology firm.
The central test is whether the business performs a regulated activity commercially and with sufficient regularity, scale, continuity or remuneration to be considered carried on “by way of business.”
A limited pilot, small client cohort or indirect revenue model does not automatically fall outside the regime.
Start with the geographic perimeter
The first decision is whether the relevant activity takes place in or from Dubai.
VARA regulates virtual-asset activity across Dubai outside DIFC. This can include a Dubai entity serving overseas clients, a foreign business operating through a Dubai office, or a free-zone company with Dubai-based staff and client-facing functions.
DIFC is excluded from VARA’s statutory jurisdiction. A business operating in or from DIFC may instead need to consider the Dubai Financial Services Authority framework for Crypto Token-related financial services. DIFC is therefore a separate jurisdictional route, not an exemption from regulatory scrutiny.
A sound assessment should identify:
- The legal entity signing contracts and receiving revenue
- Where senior decisions and regulated operations occur
- Where clients are onboarded and supported
- Where private keys, transaction authority and settlement processes sit
- Which jurisdictions receive marketing activity
- Whether the model operates across Dubai, DIFC, other UAE emirates or overseas markets
Incorporation location matters, but it does not settle the licensing question on its own.
Map the customer and asset flow to regulated activities
VARA identifies eight principal licensed activities. A company may require permission for one activity or several, depending on its role in a transaction.
| Business function | Potential VARA activity |
|---|---|
| Giving a client-specific recommendation about virtual assets | Advisory Services |
| Arranging orders, dealing for clients or placing virtual assets | Broker-Dealer Services |
| Holding or safeguarding virtual assets or private keys for clients | Custody Services |
| Operating an exchange, order book or VA-to-fiat conversion service | Exchange Services |
| Facilitating lending, borrowing or similar arrangements | Lending and Borrowing Services |
| Managing virtual assets or investment portfolios for another party | VA Management and Investment Services |
| Transferring virtual assets or handling settlement | Transfer and Settlement Services |
| Issuing certain categories of virtual assets | Category 1 VA Issuance |
A tokenization model can trigger several categories at once. For example, a business may issue a token, arrange its placement, operate a secondary marketplace, support settlement and hold client assets. Each function needs separate analysis.
The same applies to infrastructure businesses. A wallet provider, white-label exchange provider or tokenization technology company may describe itself as non-custodial or software-only. That description is relevant, but it is not decisive. VARA considers the company’s actual authority, control, client commitments, transaction role and commercial involvement.
A provider that only supplies DLT-related technology to other businesses, without carrying on a regulated VA activity, may be eligible for voluntary registration. Once it performs regulated functions, technology status does not remove it from VARA’s perimeter.
Advisory, issuance and marketplace models need particular care
Web3 advisory firms should separate general consulting from regulated personal recommendations.
Strategy work, market research, implementation support and technical advice may sit outside regulated Advisory Services. However, advice directed to a specific client about buying, selling, holding or using virtual assets can fall within VARA’s Advisory Services definition.
VARA provides a Professional Exemption for professionally licensed lawyers, accountants and business consultants in limited circumstances. The VA activity must be wholly incidental to the professional practice, and the firm must retain relevant professional authorisation and insurance. A general consultancy licence does not automatically establish that exemption.
Issuance also has its own route. According to VARA’s licensing FAQ guidance, Category 1 issuance requires a VASP Licence. Category 2 issuance, which may include a new token release or NFT minting, requires VARA’s prior approval and supporting issuer, whitepaper, AML/CFT and technical-control information.
Category 2 approval does not permit a wider set of regulated services. An issuer that also arranges trades, operates a marketplace, holds client assets or makes personal recommendations may need further authorisation.
Approval to Incorporate does not permit regulated operations
New applicants follow a two-stage route: Approval to Incorporate (ATI), followed by a full VASP Licence application.
ATI allows the business to proceed with entity setup and preparation. It does not allow the company to conduct virtual-asset activity. VARA’s licence application process expects evidence covering the business plan, ownership, senior management, governance, financial projections, capital, insurance, technology, compliance arrangements, succession and wind-down planning.
This makes licensing an operating-model programme rather than a filing exercise.
A VASP Licence is also activity-specific. VARA can impose conditions, limit scope or grant a licence for a defined period. Licensed firms must comply with compulsory Company, Compliance and Risk Management, Technology and Information, and Market Conduct Rulebooks, alongside the rulebooks for each licensed activity.
A narrow initial scope can reduce control burden and direct fees. It can also limit the products the business can offer until it obtains a variation or additional permissions.
Published regulatory fees are material, although they are only one part of the commercial commitment. VARA’s fee schedule lists application fees of AED 40,000 for Advisory Services and Transfer and Settlement Services, and AED 100,000 for several other activities, including Broker-Dealer, Custody and Exchange Services. Annual supervision fees apply per licensed activity and sit separately from commercial-licensing, office, staffing, legal, audit, insurance and technology costs.
Marketing can create exposure before launch
A firm should assess marketing separately from the underlying licence position.
VARA’s Marketing Regulations apply to marketing relating to virtual assets or VA activities in or targeting the UAE. The regulations state that marketing of VA activities must be undertaken by, or on behalf of and approved by, a VARA-licensed VASP for the relevant activity.
VARA’s FAQ also refers to circumstances in which an unlicensed VASP may conduct marketing in or from Dubai with a relevant marketing permit, required disclosures and without onboarding Dubai residents. The relationship between this FAQ guidance and the wider Marketing Regulations is not fully resolved in the reviewed materials.
That uncertainty matters for websites, events, social campaigns, partnership channels and lead-generation activity. A prospective entrant should seek fact-specific confirmation before making service claims, targeting UAE audiences or inviting Dubai residents to use a planned VA service.
A practical way to assess the licensing route
Before spending heavily on incorporation, product build or launch activity, document the full operating model in functional terms.
The review should cover:
- Every client-facing service and source of revenue.
- Each step where the company receives orders, influences decisions, controls assets, facilitates transfers or settles transactions.
- The token type, issuance structure and secondary-market role.
- The legal entity, operating location and target markets.
- The role of external custody, technology, compliance and operational partners.
- The marketing claims, channels and intended UAE audience.
- The internal governance, UAE-resident responsible personnel and financial capacity needed for the proposed scope.
This exercise cannot replace jurisdiction-specific legal advice. It does, however, give legal advisers and regulators a coherent factual model to assess.
The key decision is whether your intended service can operate within a defined permission scope and the ongoing controls that scope requires. Clear activity mapping creates a more credible launch plan and reduces the risk of building a commercial model around permissions you do not hold.