Half the documents in a crypto licence file are produced by somebody who does not work for you

You have found the list. Every route publishes one, they are shorter than the fee is, and a founder who reads three of them concludes that a crypto licence file is a morning's work with a scanner.

The list is the easy half. What it does not tell you is who produces each item, what state that item has to arrive in, which items expire while the file waits, and which defects send a document back to the beginning of a chain rather than to the step that found the problem. Those four things are the timetable, and they are the reason a pack that looks two weeks long takes two months. The rules themselves — the perimeter, the regulator, the capital, the people — are set out at length on the virtual asset licensing in the UAE page, and this page links to it rather than repeating them. What follows is the documents half.

Sort the pack by who produces each item, not by what each item is called

A document list reads as one job. It is four, and only one of them is yours.

Read the right-hand column as the actual project plan. The two items a founder controls completely are the plan and the policies; everything else is a dependency on a party with no interest in your launch date. Where the application itself belongs in the wider build — late, rather than at the start — is argued on setting up a virtual asset business in Dubai.

What the routes have in common is three questions, and one of them is not a document

Each route publishes a different pack, and the differences are larger than the phrase "the documents required for a crypto licence" suggests. One route's pack is an identity file. Two are an argument about whether you can run the business. One carries a section your auditor completes. The federal authority publishes no equivalent checklist at all and issues its forms on request. The per-route lists sit on the virtual asset licensing in the UAE page, and the zone or authority issuing your licence is the only party whose version of the list counts.

What the regulated routes share is a short spine: who owns this, who runs it, and where the money came from. The third is the one that catches people, because part of the answer is not a document you can write. Proof that capital is paid up, evidence that it is held and unavailable, and a reserve position are arithmetic evidenced after the money has moved. The pack cannot be completed before the capital figure is settled and funded, which means the capital decision sits upstream of the document deadline rather than beside it.

The two documents you write are tested, not read

The business plan is the expensive document, and the reason is stated plainly by one of the regulators: the plan informs its decision about the applicant's fitness and propriety and about its readiness, willingness and ability to meet the conditions for authorisation. That is the standard you are marked against. It is not a description of the business. It is evidence that the business can be run under supervision.

Four things make a plan fail, and none of them is writing quality.

• The financial model does not support the capital limb the chosen activity carries, so the plan and the capital evidence describe two different companies
• The plan describes a product that sits in a different activity category from the one the application names, which reopens the perimeter question in the middle of the file
• The revenue assumes a client type the licence conditions will not permit in year one
• The headcount in the plan does not match the individuals whose forms are in the same pack

The policy set is the second thing you write: risk assessment methodology, client due diligence, enhanced due diligence, monitoring, record keeping, training, technology and information security, custody segregation where it applies, a wind-down plan and a succession plan. Each is mapped to the rulebook that governs it. The failure mode here is a manual bought as a template, describing controls no one in the named organisational structure is resourced to operate.

The documents only a person can produce put your hiring on the critical path

Every regulated route names individuals and evidences each one. A CV, a passport copy, a residential address proof, a job description, and a declaration of fitness and propriety that reaches backwards and outwards: every jurisdiction where the person has held a permission, every application they withdrew, every entity they directed that was wound up, every enforcement action against them or a firm they controlled.

Two consequences follow. The first is sequencing: these documents cannot be assembled before the person has agreed to the role, so a pack cannot be finished while the senior hires are still a conversation. The second is disclosure. A withdrawn application elsewhere that was not disclosed is worse than the withdrawal itself, every time — the file is assessing honesty, and the omission is the evidence.

The documents a third party signs are the ones that slip

A document issued abroad is not a document until it has travelled

This is the item that turns a two-week plan into a two-month one. A corporate shareholder's certificate of incorporation, a parent board resolution, a power of attorney, a degree certificate behind a professional role: each is legalised in the country that issued it, attested through the UAE mission there and by the Ministry of Foreign Affairs, then carried into Arabic by a legally certified translator wherever the authority reading it requires Arabic. An apostille on its own does not make a foreign document usable here.

The property of this chain that costs money is its direction of failure. A defect anywhere sends the document back to the start of the chain rather than to the step that found it, so a name spelled differently on a resolution than on a passport is not a correction — it is the whole journey again. Document attestation and legal translation cover the chain document by document, and the Arabic text is the one that governs explains why the translation is not a formality.

The pack also changes shape depending on who holds the shares, and the difference is larger than one extra document.

Every document has a state, and some have a shelf life

A correct document in the wrong state is a defect. So is a correct document produced too early.

What gets a file sent back

No authority publishes a list of return reasons for a virtual asset application, so the table below is drawn from observed experience rather than from anybody's official criteria. It is a checklist to read your own pack against, not a set of published grounds.

The rules half, in the order worth reading it

The rules are the better-covered half of this subject, and they are covered here in the order they actually bind rather than the order they are published in. Settle the perimeter first — whether you touch somebody else's asset at all, which is decided in what a Dubai crypto licence covers and, activity name by activity name, in VARA has already answered the activity name on your licence. Then the regulator, which geography chooses for you. Then capital and people, which are the year-one cost. Then banking, which is the constraint that decides whether any of it works — banking advisory and getting a business bank account cover what an institution asks of a virtual asset business. The two service pages linked at the top carry the rules in full, with the instruments named.

Where assembling the pack is the wrong work

The perimeter is not settled. If it is still an open question whether your model touches a client's asset, you may be assembling the wrong pack entirely. The identity-file pack for a non-regulated zone licence is short, fast and complete, and nothing on it asks the question that would have stopped you.

No institution has indicated it will bank the model. A complete file authorising a business that cannot hold money is an expensive document. Test the banking before the pack, not after.

The capital is not funded. Three items in a regulated pack are evidence of money that has already moved. Drafting around them produces a file that cannot be submitted.

The senior roles are not agreed. The person-produced documents cannot be built from a job description alone, and a pack assembled before the hires is a pack rewritten after them.

You are working from a template rather than from the authority's live list. Every one of these lists is revised without announcement, and one of the authorities publishes no list at all. A third-party summary is not a substitute for the current page, and an out-of-date template is the most common single cause of a resubmission.

Your real problem is the order of assembly. Identity documents are cheap and can be gathered in week one. The plan has to survive the perimeter and the capital question simultaneously. The capital evidence cannot exist until the overhead figure is settled. A pack built top-to-bottom in list order is a pack written twice — the sequencing argument is made in full on the virtual asset licensing in the UAE page.

What to settle before the first document is requested

• Which route you are on, confirmed against the perimeter rather than against a package price
• Which items on your list are produced by somebody who does not work for you, and when each of them was actually asked
• Which foreign documents exist, and which country's offices they have to travel through
• Whether the capital figure is settled, because three items depend on money that has moved
• Who the named individuals are, and whether each has agreed in writing to the role
• Whose copy of the document list you are working from, and the date it was read

Frequently asked questions