A virtual asset licence is the last thing you apply for, not the first

The order you do this in decides most of what it costs, and almost every published sequence has it inverted. Those sequences begin with the company because the company is the thing that can be sold to you in week one, and they place the licence application four or five steps later as though it were a form that follows a formation.

Read the published submission lists instead and the shape reverses. What the pack asks for is evidence about a company that already exists, in premises that are already taken, run by people who are already employed, operating policies that have already been adopted, holding capital that has already moved into a form you cannot spend. Almost nothing in a regulated virtual asset file can be promised. It is evidenced, which means it has to have happened.

So the application is the last event, and everything people call preparation is actually the build.

The sequence you are sold, and the sequence the file imposes

The column on the right is not a stricter version of the column in the middle. It is a different project, and it is the one the regulator is assessing.

What has to exist before the application is a document

Five things. Each is evidenced in the pack, and each depends on something else in the list.

VARA's requirement on the people is the one that most reliably breaks a plan. At the date of review (16 September 2026), a provider must appoint two Responsible Individuals, each a full-time employee of the firm, each fit and proper and approved by VARA, and each a resident of the UAE or a holder of a UAE passport. Those are financial services salaries, paid into a company with no permission and no revenue, for the whole time the file sits with the regulator. ADGM and the DIFC run equivalent approved-person regimes, and the DIFC application is filed with a separate form for each individual who will perform a licensed function.

The premises condition is published in the same plain terms and is easy to underestimate for the opposite reason. VARA requires a physical presence in Dubai to conduct virtual asset activities from Dubai and, for the activities it lists — broker-dealer, custody and exchange services among them — a private office to conduct business, while setting no minimum size or space requirement of its own and sending providers to their commercial licensor to check space against their staffing. So the test is not square metres. It is whether an address exists, is yours, and is the same address on every document that names it. VARA places office space rental inside the approval-to-incorporate stage, before the licence rather than after it, so a plan that treats the lease as a later administrative step is a plan that has not read which documents the address appears on.

Three of the dependencies are circular, and that is where the months go

A list of preconditions looks solvable until you notice that three pairs of them point at each other.

The officers need the entity, and the entity's file needs the officers. Residence follows the company: the entity, then its immigration file, then a permit per person. But the pack asks for named, resident, fit-and-proper individuals. The way through is to incorporate early and accept that the entity burns money before it can earn, which is exactly the cost a formation-first sequence hides by putting incorporation in week one and calling it progress.

The capital depends on the overheads, and the overheads depend on the hires. For most activities, VARA sets paid-up capital on a higher-of basis, and the second limb is a percentage of fixed annual overheads. Hire the compliance function you need in order to be licensed and you raise the capital you must post in order to be licensed. So the capital figure cannot be fixed before the office and the payroll are fixed, and the capital evidence cannot be produced before the figure is. Model this before you sign a lease, not after — virtual asset licensing in the UAE sets out the capital mechanism and the figures with their sources.

The bank needs the licence, and the licence assumes the bank. The Central Bank's guidance to licensed financial institutions separates two products. An operational account — staff and administrative expenses, revenue from services rendered — a bank may open for a provider without submitting a request for non-objection to the Central Bank at all. A transactional account opened to hold client funds is a different instrument: it has to be a suitably protected escrow account, and the bank submits a request for non-objection to open accounts for each provider, case by case, with an attestation from its own compliance department that the required risk management controls have been fulfilled. Your own money is a commercial decision. Your customers' money is a regulatory one, taken by a body you never meet, on a file a bank assembles about you and signs its own name to. Which is why the second item in the sequence above is a conversation and not a payment — banking advisory covers what is actually being tested.

One regulator asks you to submit the sequence itself

The clearest evidence that the order is the work comes from Abu Dhabi. Alongside the General Information for Regulated Activities form and the Virtual Assets Application form, the FSRA asks an applicant for a detailed launch plan reflecting each of the steps it will take to progress from the application phase, through in-principle approval and the Financial Services Permission, to launch. And that plan is not a courtesy attachment. The FSRA considers an application formally submitted, and begins its formal review, only once the completed application, the detailed launch plan and the fees have all arrived — so the sequence is a condition of being read at all.

Read it as a marking scheme. The regulator is not asking when you would like to open. It is asking whether you understand what has to happen in what order, and a plan that puts hiring after approval and capital after licence issue answers the question badly in writing.

Abu Dhabi then writes the same argument into the approval itself. An in-principle approval arrives carrying pre-conditions, and the published ones are a commercial licence from the ADGM Registration Authority, premises secured in ADGM, bank accounts opened and, where relevant, the entity capitalised. Only when all of them are met does the FSRA grant the Financial Services Permission to begin regulated activities. That is the build, restated by the regulator as a condition list — and it is the same shape as Dubai's two stages, which is the point: the sequence is not a local quirk of one authority.

Even the stationery carries the lesson. The forms ADGM publishes are non-editable and for reference only; the editable versions come from the FSRA on request. The first move on the file is a conversation with the regulator, not a download.

Two smaller items make the point from the other direction. The DFSA's published core application form asks for your external auditor by name, with a draft engagement letter where one exists, and its notes for applicants require an applicant for prudential Category 1 or 2, or an insurer, to file a report on its financial projections completed by that auditor — a third party's work sitting inside your own submission, on their calendar. And VARA's published checklist, which VARA itself describes as non-exhaustive, includes the local entity's website, which means the site exists before the licence does. The marketing rules apply to all entities, domestic or foreign, whether or not VARA has authorised and licensed them, and an advertisement, invitation, inducement, solicitation, offer or promotion may qualify as marketing regardless of the medium it travels through. A holding page written for investors during the application can qualify as marketing while it sits in the application file.

The two-stage structure is what makes the order survivable

If everything had to exist before a single form was accepted, nobody would start. VARA's process is built in two stages for that reason.

At the date of review (16 September 2026), the first submission does not go to VARA at all. An Initial Disclosure Questionnaire goes to the Department of Economy and Tourism or to a relevant free zone, with supporting material including a business plan and detail on the beneficial owners and senior management. What follows, on satisfaction, is an approval to incorporate, which exists to let the firm finalise its legal incorporation and complete operational set-up — office space, employee on-boarding, and the rest of it. VARA's note at that point is flat: the firm is not permitted to carry on virtual asset activities. The licence itself comes later, after documentation, feedback, meetings and interviews, and may arrive with operating conditions attached.

Use that interval as the build window rather than as a waiting room. It is when the lease is signed, the officers arrive, the policies are adopted and the capital is placed — and it is also a live test of the two things a plan cannot assert, because a bank conversation and a hiring conversation both either work or do not. For a company whose customers are across the UAE, note also that the federal authority has stated companies operating in the Emirate of Dubai obtain their licence from VARA only, so the Dubai file is the one to assemble.

What a regulator asks for that applicants routinely do not have

The published lists are short. What arrives against them is consistently thinner than the item named, and in a predictable way.

Two of those rows are worth reading twice. The wind-down plan is the item most often treated as a formality and it is the one that tests whether the firm has thought about client assets at all. And the close-links analysis exists because a supervisor's interest in you does not stop at the entity — it reaches the other companies the same people run.

What can run in parallel, and what cannot

The documents half of all this — who produces each item, the state each must arrive in, and what expires while a file waits — is set out in half the documents in a crypto licence file are produced by somebody who does not work for you. The regulator, perimeter and capital questions sit on virtual asset licensing in the UAE. This page is only about the order, because the order is the part that cannot be bought.

Where running this sequence is the wrong answer

Your model touches nobody else's asset. If no client asset and no client order passes through you — you write software, you research, you advise without arranging, you trade your own balance sheet — this sequence is not yours. A commercial trade licence is, and running a regulated build for a business that does not need one is the most expensive mistake available in this market in the other direction.

The perimeter is still an open question. Start the build and you may be building for the wrong permission. Settle that first, in writing, because nothing in the formation paperwork will ever ask you. Which body the answer hands you to — VARA, the FSRA, the DFSA, the federal securities regulator, or none of them — is the question worked through in deciding which crypto regulator applies before anything is filed.

No institution has indicated it will hold client money for the model. A completed file authorising a business that cannot hold client funds is an expensive document. That question is answerable early, cheaply, and by somebody other than a consultant.

You cannot fund the build before revenue. The sequence above is a payroll, a lease and locked capital running against nothing. No adviser controls the regulator's queue or the Central Bank's non-objection, so a plan that needs the licence by a date is a plan with no plan.

Your senior people are a recruitment intention. The officers are a precondition, not a hire you make once the file is accepted.

You are issuing a token rather than providing a service. Then the gate is not an application at all. A Category 2 issuance runs through a licensed distributor whose diligence is the real specification, as set out in somebody else has to sell your token.

You intend to run it from abroad. Resident officers, real premises and local decision-making are conditions here, and they are checked after licensing as well as before.

What to settle before the first invoice

Whose asset and whose order passes through you, in one sentence you would repeat to a supervisor. Which emirate the entity will sit in, because that chooses the regulator rather than the reverse. Who your two senior officers will be, by name, and whether each has agreed. What the office and payroll will cost annually, because that number sets the capital. And whether anyone has yet asked a bank the client money question.

Answer those five and the order of everything else is fixed for you. Get them in the wrong order and the file will still be assembled — just twice.

Frequently asked questions