Virtual Asset Licensing in the UAE

What actually kills these ventures

Nearly every enquiry on this subject opens with the same question — what does a crypto licence in Dubai cost — and the licence is the most predictable line in the budget. It has a published fee, a published rulebook and a queue. Money and patience produce it.

What money and patience do not reliably produce is a bank willing to hold money belonging to your customers. That is a separate application, to a separate committee, against a separate rulebook, and it is where virtual asset ventures here quietly stop.

So this page is organised around five gates, in the order they actually close on people rather than the order a consultant would sell them to you.

Gates one and two are answerable in an afternoon and cost nothing. Gates three, four and five cost millions. Working them in that order is the single most valuable thing on this page.

Gate 1 — Perimeter: whose asset, whose order

Before comparing regulators, fees or zones, answer one question honestly: does your business ever take possession of, or control over, a client's asset or a client's order?

If no — you write software, you research, you advise without arranging, you trade your own balance sheet, you build infrastructure that never touches a customer key — you are shopping for a commercial trade licence. Four to eight weeks, an ordinary corporate account, a business a banker understands in one meeting.

If yes, you are shopping for a financial regulator, and the trade licence becomes a formality bolted to the end of a process costing millions and taking the better part of a year.

The most expensive error in this market is buying the first while intending to do the second, and it is not a paperwork gap a later filing corrects. On 7 October 2025 VARA penalised nineteen firms for unlicensed virtual asset activity and breaches of its Marketing Regulations, with fines from AED 100,000 to AED 600,000, alongside cease-and-desist orders and a public warning against dealing with unlicensed operators. A year earlier a comparable notice covered seven entities at AED 50,000 to AED 100,000. The direction of travel is published, and it is one way.

The law defines the asset by what it does, not by what it is called

Dubai Law No. 4 of 2022, issued on 28 February 2022, defines a virtual asset as a digital representation of value that can be traded or transferred digitally, or used as a means of exchange or payment, or for investment. A virtual token is a digital representation of a set of rights that can be offered and traded through a virtual asset platform. Neither definition names a technology, a coin or a chain.

That is deliberate, and it is why Gate 1 asks about function rather than vocabulary. Bitcoin, Ether, Solana and XRP sit inside the definition for the plain reason that each is traded, transferred and held for investment, and so does almost anything else a founder is likely to build a business around. The ledger underneath — a record of transactions kept in agreed copies across many independent computers, with no single intermediary keeping the book — is what lets those assets move without a bank. It is also why the regulator's interest turns on who holds the keys and who carries the orders, rather than on what the asset is called in a pitch deck.

Two consequences follow. Calling a product a utility token, a digital collectible or a reward does not move it outside the definition if it can be traded or held for investment; the closed-loop exception described under Gate 3 turns on non-transferability and redemption inside one system, not on the label. And writing software for a ledger is a different activity from operating a market on it. The first is a commercial licence. The second is a regulator.

Gate 2 — Banking: the constraint to test before you spend

This normally appears at the end of a page like this. It belongs here, because it is the gate that most often closes after the money is gone.

Two accounts, not one

Founders talk about "opening the bank account" as a single event. For a virtual asset business it is two products, assessed by different teams.

Only one of the two needs a Central Bank non-objection — the transactional account, granted case by case — and that single difference is what decides whether the business can hold client money at all.

The Central Bank's guidance to licensed financial institutions on virtual asset risk draws exactly this line. Operational accounts may be opened by a licensed financial institution without submitting a request for non-objection to the CBUAE. For a transactional account — the one that holds client funds — a non-objection certificate from the CBUAE is required, and it is granted case by case.

Read that as a founder. Your operating account is a commercial decision by a bank. Your client money account is a regulatory decision by the Central Bank, taken on a file the bank assembles about you. The person you are persuading in the branch is not the person who decides, and no amount of relationship management compresses that.

two accounts, judged on the same questions

Judged on	The operational account	The transactional account
Whose money it holds	The company's own money	Your customers' money
The bank can open it on its own compliance file	Yes	No
A CBUAE non-objection	Not required to open it	Required before it holds client funds, and granted case by case
When to open it	First, and on its own	Separately, and second
What it asks you to show	A proposition a relationship manager can carry on his own file	Segregated accounts, a reconciliation model, and a compliance officer in the room

The circularity, and the veto behind it

The same guidance expects a bank to conduct extended due diligence on a virtual asset customer: confirm it holds the relevant authorisation, put a written agreement in place, assess reputation and AML controls, and understand the third parties behind it. Activity is expected to be restricted where the customer is not appropriately licensed for what it does.

That produces a circularity nobody warns you about. The bank wants to see the licence. The regulator wants a credible operating plan that assumes banking. Neither moves first, and the way through is sequencing rather than persuasion.

Behind both sits the constraint no one will put in writing. A UAE bank that takes your business inherits your exposure at its own correspondents in New York, London or Frankfurt. The committee weighing your file is weighing a relationship with an institution in another country that will never hear your pitch and cannot be lobbied. That is why banks which publicly welcome the sector still decline compliant applicants.

How to test it before you commit

Four rules, worth more than any list of friendly banks:

Do not budget against a list of names. Institutions move in and out of this sector on a timescale of months, and a bank that cheerfully onboards a non-custodial software company is frequently not one that will hold client fiat for a licensed exchange. A consultant handing you a fixed list is describing last quarter. The number of UAE institutions genuinely comfortable with client-fiat flows for a virtual asset business stays small enough to count, and it is not the same set of names from one year to the next.

Open the client money conversation separately, and second. Conflating the two products in a first meeting wastes the first attempt, and first attempts are the most valuable ones you have. Know which conversation you are in before you start it. A proprietary desk asking for an operating account is a proposition a relationship manager can carry on his own file; an exchange asking for client money needs segregated accounts, a reconciliation model it can demonstrate on demand, and a compliance officer the bank believes in the room. Different applications, different committees, different evidence. Refusals follow the entity.

Use the pre-licensing stage as a real test. VARA's process has an intermediate step precisely so premises, hiring and banking conversations happen before final licensing. Treat it as a live experiment, not a box to clear. It is the last point at which the model is still cheap to abandon, and the only one at which a bank can say no before the capital is locked and the salaries have started. Everything after it is money spent against a decision already taken.

Read the Payment Token Services Regulation before you model settlement. Whether a bank will hold your money is one question; whether the money can move the way your product assumes is another, and the second is answered federally. The Central Bank's regulation restricts which tokens may be accepted as payment for goods and services in the UAE, treats dirham payment tokens differently from foreign ones, and rules out algorithmic stablecoins and privacy tokens. Any plan that assumes a UAE merchant can settle in a foreign stablecoin needs checking against Article 12 before a treasury model is built on top of it.

If no institution will hold client fiat for your model, that is not a delay. That is the business not existing in this jurisdiction, and it is far cheaper to learn in month two than month ten.

Gate 3 — Regulator: geography chooses, you do not

You do not shop between UAE virtual asset regulators the way you shop between free zones. You choose where the entity sits, and the regulator attaches to it, which is why deciding which authority is entitled to read your file comes before anything a step-by-step guide would call step one.

Three consequences follow, and each one costs someone money every year.

A free zone licence is not a regulatory permission. A DMCC, IFZA, Meydan or Dubai South company sitting anywhere in Dubai is inside VARA's perimeter. The free zone licenses the company. VARA licenses the activity. A Dubai crypto company therefore needs two licences, not one, and most advice on the subject names a zone and stops.

Nothing passports between the financial centres. A VARA licence does not permit operation in ADGM. An FSRA permission does not permit operation in Dubai. Serving both means two entities, two capital stacks and two compliance functions.

There is one bridge, and it runs one way. Under a cooperation agreement the SCA and VARA announced on 5 September 2024, a VASP licensed in or from Dubai can be enrolled by default with the SCA to serve the wider UAE, with mutual supervision and coordinated penalties behind it. A firm licensed by the SCA elsewhere does not gain Dubai. For a business with UAE-wide customers, that sequencing matters more than any fee comparison.

What VARA authorises

VARA licenses eight discrete activities, and several may sit under one authorisation. Each is defined more narrowly and more specifically than its name suggests, so the definitions are worth reading against your own product description rather than against the label you would give it. Advisory is advising on transactions or actions relating to virtual assets. Broker-Dealer is the widest of the eight: arranging, soliciting or accepting orders, matching transactions, dealing as principal, market making, and placement or distribution on behalf of an issuer. Custody is safekeeping virtual assets for another person, acting only on instructions it has verified. Exchange is converting between virtual assets and fiat, converting between virtual assets, and matching a buyer's order with a seller's. Lending and Borrowing covers both lending against virtual asset collateral and lending the assets themselves. Management and Investment covers discretionary and non-discretionary portfolio work. Transfer and Settlement is moving and finalising virtual asset transactions. And VA Issuance, Category 1 is issuing fiat-referenced and asset-referenced virtual assets.

Founders routinely land in a different box from the one they expect. A wallet is usually performing custody. A price aggregator that passes an order on is usually broker-dealer work, and so is market making, which few people think of as brokerage at all. The name on the pitch deck is not the name on the licence, and everything the licence does not name needs a permission of its own.

And one of the eight cannot share an entity with the others. Custody must be segregated from the rest, which means running an exchange and holding client assets yourself is two companies and two capital stacks — not one licence with two boxes ticked. That is an architecture decision taken at incorporation, and it is expensive to reverse once premises are leased and people are hired against the wrong structure.

Beneath the Regulations sit compulsory rulebooks — Company, Compliance and Risk Management, Technology and Information Security, Market Conduct — plus one per activity and a separate Issuance Rulebook. VARA published Version 2.0 of the full set on 19 May 2025, compliance required by 19 June 2025, tightening technology governance, third-party risk and custody segregation.

Three things sit outside the licensing perimeter, and each is regularly misread:

Proprietary trading. VARA's published position is that a firm trading only its own funds, with no clients, need not hold a licence at this time — but a No Objection Certificate from VARA is still required, and a proprietary trader with a cumulative rolling thirty-day volume above USD 250 million must be enrolled with VARA and comes under supervisory oversight. "No licence" is not "no filing".

Category 2 issuance. No licence to issue, but placement and distribution must run through a VARA-licensed distributor, who then carries responsibility for your conduct as issuer — which is why distributors are selective about whose token they handle.

Closed-loop tokens. Non-transferable, redeemable in-system credits — loyalty points, in-game currency — generally sit outside, and a newer Exempt category is drawn around exactly that: non-transferable and redeemable within one system. The exemption turns on those two properties, not on what the product is called, so describing such a credit as a token launch invites scrutiny it does not need and does not earn.

And one activity is regularly assumed to sit outside and does not: the NFT marketplace. VARA's published position is that an entity holding an NFT marketplace commercial licence from a free zone must also obtain a VA Exchange licence, a VA Broker-Dealer licence, or both. Minting and selling your own collection is a different question from running the venue where other people's tokens change hands. The venue is an exchange or a broker in the regulator's eyes, whatever the zone printed on the trade licence, and that is Gate 1 applied to a product category the market still describes as unregulated.

What ADGM authorises

The FSRA does not issue a crypto licence. It grants a Financial Services Permission, treating virtual assets as commodities, so the permission runs through existing regulated activity wrappers: operating a Multilateral Trading Facility, dealing as principal or agent, arranging deals, providing custody, managing assets.

The framework spans four asset classes, and which one your product sits in decides which wrapper you apply through and which rules then govern you: Virtual Assets, Fiat-Referenced Tokens, Digital Securities, and derivatives and funds over digital assets. Two products that look identical to a customer — a yield account paying in a stablecoin and one paying in a token representing a share — are in different classes here, and the second is a securities business.

Only Accepted Virtual Assets may be used. Following amendments implemented on 10 June 2025, the FSRA moved from a regulator-approval model to a notification process resting on the firm's own documented self-assessment against criteria the FSRA pre-defines. Faster to execute, and considerably more exposed if the assessment is wrong — the liability moved to you along with the speed.

Some assets are prohibited outright. Privacy tokens, algorithmic stablecoins and any digital asset employing materially similar technology cannot be used in regulated financial services within ADGM. There is no structuring answer to that.

The framework moves fast. The finalised framework for regulated activities involving Fiat-Referenced Tokens took effect on 1 January 2026, widening permitted FRT activities and setting rules for firms holding or controlling client FRTs. On 29 April 2026 the FSRA finalised its framework for the staking of virtual assets — put out for consultation in September 2025 as CP No. 10 of 2025 — limiting rewards passed to clients to Accepted VAs and Accepted Fiat-Referenced Tokens. If staking yield is your revenue model, that document is now the one your plan lives or dies by. The gap between that consultation and the final text carries the more useful lesson: a revenue model that depends on a framework still out for comment has a regulatory dependency nobody can date for you.

The population under all of this is small, and deliberately so. ADGM reports more than twenty firms conducting virtual asset or fiat-referenced token activity — a curated community rather than an open market, and a regulator admitting twenty-odd firms is choosing each of them. Authorisation runs in six stages: consultation with the FSRA, then the formal application, then review and interviews with the proposed approved persons, then in-principle approval, then conditions and capitalisation, and finally issue of the permission. It reads like a bank authorisation because, in law, it very nearly is one.

What the DFSA authorises after January 2026

The DIFC is the one part of Dubai VARA does not reach, and its regime changed materially on 12 January 2026.

The DFSA no longer prescribes a list of Recognised Crypto Tokens. Firms must now determine on a reasoned and documented basis whether each token they engage with meets the suitability criteria, then monitor those assessments and stop dealing in a token that ceases to qualify. A transition period ran to 12 April 2026 for firms to re-paper policies and disclosures. The DFSA retains approval over Fiat Crypto Tokens, usable only where it is satisfied as to stability, backing, governance, transparency and regulatory equivalence; as at 12 January 2026 three were recognised — USD Coin, Euro Coin and Ripple USD.

Note what Abu Dhabi and the DIFC have now done in parallel: both moved token vetting from the regulator to the firm. That is a genuine reduction in waiting time and a genuine increase in the calibre of person you must employ. A regime that trusts the firm is only cheaper for firms that can defend the judgement.

The mainland, the SCA, and what a free zone crypto licence is not

Dubai mainland is VARA territory. A mainland Dubai company conducting virtual asset activity holds a commercial licence from the Department of Economy and Tourism and a VARA licence for the activity. Two authorities, two files.

Everywhere else outside the financial free zones, the SCA is the regulator. Cabinet Decision No. 111 of 2022 makes the Securities and Commodities Authority the federal virtual asset authority across the UAE and its non-financial free zones, with power to delegate — which is how VARA holds Dubai. Article 3 excludes the DIFC and ADGM regimes, and the decision carves out digital securities, digital commodity contracts and payment instruments regulated by the Central Bank.

So an Abu Dhabi mainland entity, a Sharjah or Ajman free zone entity, a RAKEZ entity or a RAK Digital Assets Oasis entity intending regulated activity applies to the SCA — not to the free zone. RAK DAO is misread on this constantly: a genuinely useful zone for non-regulated Web3, DAO, NFT, gaming and protocol work, and a commercial licensor rather than a financial regulator.

Non-regulated NFT work means creating and selling your own tokens. A venue for other people's trades is exactly where Dubai's regulator draws the line, and the SCA should be asked the same question before a RAK DAO licence is treated as the answer to it.

Put plainly: a Dubai company outside the DIFC answers to VARA whatever zone issued its trade licence, a DIFC company to the DFSA, an ADGM company to the FSRA, and an entity anywhere else in the UAE — Abu Dhabi mainland, a Sharjah or Ajman free zone, RAKEZ, RAK DAO — to the SCA. The Central Bank sits across all of them for payment tokens, wherever those are issued or used.

DMCC is unusually straight about its own product, and worth taking literally. A standard DMCC crypto licence covers non-regulated activity — software development, consultancy, research, mining, and proprietary trading in crypto commodities on the company's own balance sheet. It expressly does not cover operating an exchange, brokering for others, custody or payment processing; those require VARA.

Its Crypto Centre is the vehicle for that product — based in Uptown Tower, with a member community now in the hundreds — and it licenses a specific set of things: proprietary trading in crypto commodities, blockchain and distributed ledger software development, mining, consultancy and advisory-adjacent work. The proprietary trading permission explicitly excludes operating an exchange, brokerage for others, custody, payment processing and financial services generally, which is the same boundary stated twice from two directions. Pricing sits where the product does: Crypto Centre packages have run at around AED 31,000 including VAT, promotional and subject to change, against DMCC's standard trading or service licence at roughly AED 20,265 a year before premises. Read both off the live packages page before either reaches a budget — a promotional figure that lapses between the quote and the application is the commonest small surprise here.

IFZA, Meydan, Dubai South, RAKEZ and RAK DAO packages carry equivalent limits. For a real class of business this is exactly the right product at a year-one cost under six figures in dirhams — and the wrong one the instant a client's asset or order enters your systems.

The regimes side by side

The free zone or the Department of Economy and Tourism

• The company itselfEvery Dubai company, whatever activity it intends

VARA

• The activity, inside DubaiDubai mainland and every Dubai free zone except the DIFC
• A No Objection Certificate to trade your own fundsA firm with no clients; supervision above USD 250 million on a rolling thirty-day basis

The DFSA

• The activity, inside the DIFCThe DIFC only, on rules in force since 12 January 2026

The ADGM FSRA

• The activity, inside ADGMA Financial Services Permission, ADGM only

The SCA

• The activity, everywhere else in the UAEAbu Dhabi mainland, Sharjah, Ajman, RAKEZ and RAK DAO

The Central Bank

• Payment tokensWherever a payment token is issued or used
• The account that holds client moneyCase by case, on a file the bank assembles about you

Gate 4 — Capital: the number is not the number

VARA sets paid-up capital per activity on a higher-of basis. These figures come from the Company Rulebook and they are revised without notice.

In dirhams the first limb runs from AED 100,000 for advisory services to AED 1,500,000 for an exchange that does not use VARA-licensed custody, and the percentage beside each figure — 15% of fixed annual overheads where licensed custody is used, 25% where it is not — is the limb that usually decides the number.

Four things founders consistently get wrong about this table.

The second limb is the real number. Anchor on AED 1,500,000 for an exchange and you will be wrong. If fixed annual overheads run at AED 12 million — a modest exchange with twenty people in Dubai — the 25% limb puts you at AED 3 million. Capital scales with your cost base, and it scales before revenue arrives: hiring the compliance team you need in order to be licensed raises the capital you must post in order to be licensed.

Using a licensed custodian nearly halves it. Note how consistently the 15% column undercuts the 25% column. Outsourcing custody to a VARA-licensed custodian is a capital decision as much as an operational one — model both ways before you fix the architecture.

It is not working capital. It must sit in a trust account with a UAE-licensed bank naming VARA as beneficiary, in an open-ended surety bond from a UAE-authorised surety company naming VARA as beneficiary, or in another form VARA specifies on granting the licence. You cannot spend it.

There is a liquidity requirement on top. VASPs must hold current liquid assets whose surplus over current liabilities is worth at least 1.2 times monthly operating expenses, in cash equivalents or — with VARA approval — USD- or AED-pegged virtual assets. A separate, continuously tested number that moves every time your cost base does.

Issuance has arithmetic of its own. The table defers Category 1 to the VA Issuance Rulebook because the second limb changes shape there: for asset-referenced virtual asset issuance, paid-up capital is set at the higher of AED 1,500,000 or 2% of the 24-month average value of the reserve assets. That is a proportion of what you hold for other people rather than a proportion of what you spend, so it grows with adoption instead of with headcount. If the token works, the capital requirement follows the float — a different budgeting problem from every other row in the table, and one worth modelling against your own growth case rather than against a fixed number.

Capital is charged per activity, with fixed annual overheads allocated so the allocation is mutually exclusive and collectively exhaustive. Insurance, a written insolvency plan and a credible wind-down plan sit alongside it.

ADGM works the same way in a different currency. An MTF operator holds regulatory capital equal to six months of operational expenditure plus, unless the FSRA directs otherwise, a buffer of up to six months more. A custodian holds the higher of a USD 250,000 base capital requirement or six months of audited annual expenditure. Virtual asset fees are add-ons to the fee for the underlying regulated activity, and a VA MTF has carried USD 125,000 on application and USD 60,000 a year in supervision, with a sliding-scale trading levy payable monthly on top.

Gate 5 — People: the stage that fails quietly

Every regulated route here turns on individuals, and this is where files stall without anyone telling you why.

VARA requires two Responsible Individuals. Each must be a full-time employee of the VASP, a fit and proper person approved by VARA, and a UAE resident or UAE passport holder. In practice that means a senior executive and a Compliance Officer or MLRO on the ground, permanently, from before the licence is granted. VARA also expects genuine physical presence in Dubai — office space, not a flexi-desk with a nameplate. ADGM and the DIFC run equivalent approved-person regimes with interviews.

Fit and proper is assessed on honesty, competence, financial soundness and reputation, and it reaches backwards and outwards: every jurisdiction you have held a permission in, every application you withdrew, every entity you directed that was wound up, every enforcement action against you or a firm you controlled. A withdrawn application elsewhere that you did not disclose is worse than the withdrawal itself, every time.

The commercial consequence is the line most consistently missing from the spreadsheets we are shown. These are financial services salaries, paid for the months the file sits with a regulator, before a dirham of revenue exists. For most applicants it exceeds capital and authority fees combined.

The file you hand over is a different document at each authority

Everything above decides which route you are on. This decides what the next two months are spent assembling — and the published packs have far less in common than the phrase "the documents required for a crypto licence" implies. One of them is an identity file. Two are an argument about whether you can run the business. One ends with your auditor's signature rather than yours. The fifth authority publishes no equivalent checklist.

The shared spine is short: who owns this, who runs it, where the money came from. Past that point the routes diverge, and the divergence is most of the cost.

Read down a column for one route's published list; read across a row for how differently four authorities treat the same requirement. An empty cell means that route's published list does not ask for the item — not that the item is forbidden.

Item on the published list	DMCC	VARA	ADGM FSRA	DFSA
Passport copies	Yes	Yes		Yes
Proof of home address	Yes
Parent company documents	Yes			Yes
A regulatory business plan		Yes	Yes	Yes
Source of funds evidence		Yes		Yes
A form for each named individual			Yes	Yes
Proof the capital is locked up		Yes
Your own assessment of each token			Yes	Yes

The free zone pack is an identity file, and that is exactly the trap

DMCC publishes what it wants before it will issue a crypto licence, and the list is short: a completed questionnaire supplied by its Crypto Centre team so the zone can advise on the correct business activity, passport copies of all partners in the business, proof of residential address in the country of residence, and parent company documents where there is a parent. It states it may ask for more during formation — and, in the sentence worth reading twice, that regulated virtual asset activity requires an additional licence from VARA, obtained through DMCC.

Nothing in that pack forces you to answer Gate 1. No field on it reads whose asset do you touch. The zone is licensing a company, and the questionnaire is how it selects an activity from its own list — not how a regulator decides whether you sit inside a perimeter. That is the mechanism behind the most expensive error on this page: the paperwork for the wrong licence is short, fast and complete, and it never asks the question that would have stopped you.

Work from each zone's own current list rather than a general one. They differ in detail, they change without announcement, and the zone issuing your licence is the only party whose version of the list counts.

Two formation items sit beside the zone's list, and neither is specific to crypto. Whether a founder's current employer must issue a no-objection letter depends on the zone and on the founder's visa position, not on the activity — our free zone company formation page sets out where it is asked for and where it is not. And the trade name is reserved like any other: it must follow the authority's naming rules, it must not make religious reference or give offence, and it must be available. The rule that bites in this sector is the one on names implying a regulated activity. A company calling itself an exchange, a custodian or a bank while holding a commercial licence for software is the kind of name an incorporating authority queries — and a name is the first thing a customer reads, so if it describes an activity the firm holds no permission for, it is read against the Marketing Regulations as well. The mainland company formation page covers the naming rules in full.

What none of these packs asks is where the owners come from. A free zone company can be wholly foreign-owned, with no local partner or service agent, and UAE law now permits full foreign ownership of mainland companies for most activities, with activities of strategic impact carrying conditions the relevant authority sets. For a virtual asset business, nationality is rarely the question; identity is. Every regulated pack below names the ultimate beneficial owners and asks where their money came from, and owning all of the company means answering for all of it — a sole foreign shareholder is the beneficial owner, the source-of-funds file and, often enough, a Responsible Individual candidate in one person.

VARA's pack is assembled twice, and the first half is not sent to VARA

The first submission goes to Dubai Economy and Tourism or to the relevant free zone, not to VARA: an Initial Disclosure Questionnaire, plus supporting documentation that includes a business plan and details of the firm's beneficial owners and senior management. The routing is the part worth noting: that form is issued and received by your incorporating authority, not by the regulator whose name will be on the licence.

The second pack is the substantial one, and VARA publishes it.

Corporate and governance. Certificate of incorporation, a list of ultimate beneficial owners, fit and proper confirmations, source of funds evidence, an organisational structure, a governance framework, the local entity's website, and for each key person a job description, a CV and a passport copy.

Financial. A regulatory business plan, financial projections, group-level and entity-level financial statements, proof of paid-up capital, evidence that the available capital is locked up, a reserve account report, and insurance certificates.

Continuity. A succession plan, a wind-down plan, and an analysis of close links and associated entities.

Risk, compliance and technology documentation sits alongside all of it, mapped to the rulebooks that govern each. VARA states the list is not exhaustive and that it may require further documentation as the file moves.

Three of those items are not documents you write. Proof of paid-up capital, the locked-capital evidence and the reserve account report are Gate 4's arithmetic evidenced — which means the pack cannot be completed until the overhead figure is settled and the money has actually moved. Budget the sequence, not only the total.

One item surprises almost everyone: the local entity's website. It is a submission item, so it exists before the licence does — and the Marketing Regulations already apply to anything marketed in or into Dubai whether or not VARA has licensed the firm. A holding page written for investors during the application is regulated marketing, and it is sitting in the application file.

ADGM runs on named forms, and one of them is filed per person

The FSRA's application is a set of forms with a plan attached. The General Information for Regulated Activities form is the base; anyone conducting regulated activities in relation to virtual assets also submits the Virtual Assets Application form. Individuals are handled separately — an Approved Person Status form for each person carrying out a controlled function, a Key Individuals form where that applies, and a Principal Representative form for a representative office.

The document doing the work is the regulatory business plan, and the FSRA says plainly what it uses it for: to inform decisions about the applicant's fitness and propriety, and its readiness, willingness and ability to meet the threshold conditions for authorisation. Read that as the standard you are marked against. It is not a description of the business; it is evidence that the business can be run under supervision. Alongside it goes a launch plan setting out each step from application, through in-principle approval and the Financial Services Permission, to launch — plus corporate documents, shareholder declarations and beneficial owner disclosures.

Where you intend to use a virtual asset that is not already accepted, the assessment of that asset is yours to produce and notify, and the FSRA publishes a notification form for precisely that. Since the June 2025 amendments moved token vetting from regulator approval to firm self-assessment, the token dossier became a submission document rather than a request.

One practical note that costs a week when it is missed: the forms published on the ADGM site are non-editable reference versions. Editable copies come from the authorisation team on request.

The DIFC pack is one core form, and your auditor completes part of it

The DFSA's application for a Licence runs on the AUT-CORE form, with an AUT-IND1 filed for each individual who will perform a Licensed Function. Attached to it: a regulatory business plan, the certificate of incorporation, the board resolution approving establishment of the DIFC entity, CVs for board members and controllers, passport copies of the ultimate beneficial owners, the group organisation structure and the parent's own authorisation documents where a parent exists, source of wealth and source of funds evidence for the beneficial owners or the parent's latest financial statements, last audited accounts and last audited group accounts where the firm has traded, financial projections, and evidence of the source of start-up funds. The compliance manual, the anti-money-laundering policies and the risk management procedures go into the same file; for lower-risk business models the DFSA permits these to be self-certified by the firm.

The form also carries a section for an auditor's or reporting accountant's report, completed by your auditor rather than by you. That is a third-party dependency sitting inside your own submission, and it is the item most easily left until the week you intended to file. It is not the only one: half the documents in one of these files are produced by somebody who does not work for you, and each carries its own lead time.

Since 12 January 2026 there is one more, and it appears on no form: the reasoned, documented assessment of every crypto token you intend to deal in, which you must make, monitor and be able to defend. The DFSA moved that judgement to the firm. The file has to show the firm can carry it.

The SCA publishes no equivalent list, and for a Dubai company that is academic

The SCA's public position is that the necessary forms and clarifications are available on its website or obtained through direct communication with it, rather than as a published checklist an applicant can work from in advance. Ask for the current forms directly. A third-party summary of them is not a substitute, and this is one of the places where an out-of-date consultant's template does real damage.

For a Dubai company the question usually does not arise at all. The SCA has stated that companies operating in the Emirate of Dubai obtain their licence from VARA only, and that VARA then informs the SCA so a single UAE-wide record of licensed providers exists. That is the one-way bridge described at Gate 3, seen from the federal side: you assemble one pack, in Dubai, and the federal reach follows it.

Assemble in the order the gates close, not in the order the list prints

Three of these packs contain a business plan, a set of named individuals and a capital position. A pack is coherent or it is not — the plan, the capital table and the CVs have to describe the same company, and where they do not, that difference is what the file gets asked about.

So the order matters more than the checklist does. The identity documents are cheap and can be gathered in week one. The business plan is the expensive document, because it has to survive Gate 1 and Gate 4 simultaneously — the perimeter you claim and the capital that claim commits you to. The capital evidence cannot exist until the overhead figure is settled. And the individuals must have agreed to their roles before their CVs enter a file that asks whether they are fit and proper. A pack assembled top-to-bottom in list order is a pack rewritten twice.

The clock and the bill

VARA's own process runs in two formal stages, and the two packs above map onto them. First, Approval to Incorporate — the first-stage submission through the DET or a free zone, and typically 50% of the licence application fee paid up front. At that point the firm may incorporate and build, but is expressly not permitted to carry on virtual asset activities. Second, the VASP licence itself, after documentation, feedback, meetings and interviews, the balance of the application fee and the first year's supervision fee — often issued with operating conditions attached. Read in that order, the licence is the last thing you apply for: by the time the second pack is accepted the company exists, the premises are taken and the two senior officers are on the payroll.

Schedule 2 of the Regulations sets the fees. Advisory and transfer and settlement services are widely reported at AED 40,000 on application and AED 80,000 a year in supervision; broker-dealer, custody, exchange, lending and borrowing, management and investment, and Category 1 issuance at AED 100,000 and AED 200,000. Additional activities on one licence attract a further fee. Confirm against the live schedule before you budget.

Ranges below combine published schedules with observed market cost as at August 2026. They are indicative, and no two applications cost the same.

Year one for a genuine VARA-regulated operation is rarely under AED 2.5–4 million once capital, people and advisers are counted, and an exchange without a licensed third-party custodian sits well above that. Year one for a non-regulated free zone software or proprietary trading company is usually under AED 80,000 all in. There is very little in between, which is why quotes for "a crypto licence in Dubai" range across two orders of magnitude while each is arguably honest.

Laid end to end rather than listed, the regulated clock has one block in the middle that dwarfs the rest.

End to end that is six to eighteen months against four to eight weeks for a non-regulated free zone licence, and the longest measured block in it is the three to six months of build-out. The two banking items sit outside that scale because they run in parallel with it: eight to twenty-four weeks for the operating account, and a client money account that is the longest item of all and may not arrive.

Early live operation is often restricted to institutional and qualified investors before a retail permission follows. Nobody controls that clock except the regulator, and your burn runs the whole time.

What the licence starts, not what it ends

Expect, permanently: a resident Compliance Officer and MLRO; goAML enrolment and suspicious transaction reporting; Travel Rule compliance, with originator and beneficiary information collected, verified and transmitted on transfers at or above the applicable threshold — AED 3,500 is the figure widely applied across UAE regimes, and examinations now treat Travel Rule implementation as a lead indicator of AML programme quality; penetration testing, key management and incident reporting under the technology rules; market conduct surveillance; audited accounts; ESG disclosure under the Company Rulebook; a maintained wind-down plan; and beneficial ownership filings.

Marketing is separately regulated and routinely tripped over. VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024 took effect on 1 October 2024 and apply to every business marketing in or into Dubai, whether or not VARA licensed it. Three obligations do most of the work. The material must not contain a call to buy. It must carry a prominent and legible disclaimer that virtual assets may lose their value in full, are subject to extreme volatility, and carry no financial protection — and nothing elsewhere in the campaign may contradict it. And a firm VARA has not licensed must state prominently both that it is not licensed by VARA and that it may not conduct virtual asset activities in Dubai. Penalties reach AED 10 million, and marketing breaches sat alongside unlicensed activity in the October 2025 enforcement round. An offshore platform running a Dubai campaign is inside this rule whether or not it holds an entity here, which is the part operators offshore consistently assume does not apply to them.

The report is the last step of an AML programme, not the programme

The list above names who reports and where. It does not say what has to happen before there is anything to report, and that is where VARA's Compliance and Risk Management Rulebook spends most of its length. Its anti-money laundering part operates in accordance with the federal AML laws, and it asks for six things that run continuously — not once, at application.

Two things follow for the application itself. The due diligence procedure is not a policy you write after licensing. It is the document that decides whether the Travel Rule message, the goAML report and the eight-year record can be produced at all, and a file that describes those three without it is describing the output of a process nobody has designed. And the numbers interact: the AED 3,500 that triggers due diligence on an occasional transaction is the same figure widely applied to the Travel Rule, which is a good reason to build the two as one control rather than two.

The federal law underneath has changed. A VASP is supervised against the federal AML regime as well as against VARA's rulebooks. Federal Decree-Law No. 20 of 2018, the law older guidance still cites, has been repealed and replaced by Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation financing, with new executive regulations in Cabinet Resolution No. 134 of 2025. The Travel Rule traces to the FATF standard on virtual asset transfers, which VARA's rulebook adopts by name. A policy manual that still cites the 2018 law is out of date on its face, and an examiner will notice before reading the second page.

Your customers' files are personal data, and a second body of law governs them

A VASP collects more personal data than most businesses of its size: identity documents, addresses, source-of-wealth evidence, transaction histories, and the originator and beneficiary details the Travel Rule obliges it to pass to other firms. All of it is personal data before it is AML evidence.

The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, governs the processing of personal data in the UAE. The two financial centres run their own regimes: the DIFC under its Data Protection Law, DIFC Law No. 5 of 2020, supervised by the Commissioner of Data Protection, and ADGM under its Data Protection Regulations 2021, supervised by the ADGM Office of Data Protection. Which one applies follows the entity, in the same way the regulator does at Gate 3.

The practical collision is between keeping and discarding. The AML rules require records to be kept for at least eight years; data protection law expects personal data to be held securely and only for as long as there is a basis for holding it. The two are reconciled in one written retention policy that names the legal basis for keeping each category of record and the date it goes — not in two policies drafted by two advisers who have never compared them. The Travel Rule adds a second exposure: it makes the firm a sender of personal data to other VASPs, some of them abroad, and transfers outside the UAE are regulated in their own right. If CARF arrives on the timetable set out under tax below, the same customer data will feed tax reporting as well. Design the data model once.

A licence is a conditional permission, and VARA can narrow it or take it back

The October 2025 enforcement round at Gate 1 was about firms with no licence. The powers behind it reach licensed firms too, and VARA's Regulations list them plainly: written reprimands; enforcement notices requiring a breach to be put right within a set period; cease-and-desist notifications; limiting or revising the virtual assets and activities a licence covers; requiring an activity to stop for a specified or indefinite period; suspending or revoking the licence, VARA approvals or the commercial trade licence; and fines under the Regulations' schedule of fines. Fines can be imposed on the individuals responsible within a VASP as well as on the firm, and repeated as periodic penalties while a breach continues.

Read that list against the obligations above. The due diligence file, the record kept for eight years, the Travel Rule message and the disclaimer on a campaign are each a condition of keeping the licence, not only of getting it. And the fit-and-proper consequence at Gate 5 runs forward as well as back: an enforcement action against a firm you controlled is exactly the history the next regulator asks you about.

Tax: three answers that do not agree

Corporate tax. Every UAE entity enrols with the Federal Tax Authority under Federal Decree-Law No. 47 of 2022, whether or not tax is payable. Do not assume a free zone crypto licence delivers 0%: virtual asset services do not appear by name in the Qualifying Activities list under Cabinet Decision No. 100 of 2023 as revised by Ministerial Decision No. 229 of 2025, the list is closed, and regulated fund and wealth management is the nearest adjacent entry. Settle that against your specific activity before modelling on it — our UAE corporate tax page sets out how the Qualifying Free Zone Person test actually works.

VAT, and a point almost nobody raises. Cabinet Decision No. 100 of 2024, effective 15 November 2024, amended the VAT Executive Regulations so that transferring ownership of virtual assets and converting them are exempt financial services — retrospectively for supplies made on or after 1 January 2018. Safeguarding and managing virtual assets became exempt from 15 November 2024, without the retrospection. Exempt is not zero-rated: it restricts input tax recovery. If you have traded in this sector in the UAE for several years, your historic VAT position may be wrong in either direction and may warrant a voluntary disclosure. That is a live remediation question, not a footnote.

Automatic exchange is coming. The Ministry of Finance has signed the multilateral agreement for the OECD Crypto-Asset Reporting Framework, with implementation targeted for 2027 and first exchanges in 2028; the UAE consultation closed on 8 November 2025. If your customers are internationally resident, build the data model now. Retrofitting identification and reporting across a live customer book is materially harder than designing for it.

What you keep personally is a separate answer, and your home country may give a different one

The three answers above are about the company. The founder's own position is simpler in the UAE, and it is the one most often overstated.

No personal income tax. The UAE does not levy income tax on individuals. A salary drawn from the company, and a dividend paid out of profit that has already borne corporate tax, are not taxed again in a UAE-resident individual's hands.

Personal investing sits outside corporate tax; a trading business does not. The Federal Tax Authority treats a natural person's wages, personal investment income and real estate investment income as outside corporate tax. An individual buying and selling virtual assets for their own account, not through a licence and in circumstances that do not require one, is making personal investments. Once the activity is conducted through a licence, or needs one, it is a business, and a natural person's business activities come within corporate tax where their total turnover exceeds AED 1 million in a calendar year. The line is not the size of the portfolio; it is whether what you do is a licensed activity. A company's gains are different again. They sit inside its own corporate tax computation, whatever older material says about the absence of capital gains tax — our note on capital gains sets out where that phrase stops being true.

Money leaves without a UAE deduction. No withholding tax is currently charged on a dividend paid by a UAE company to a foreign shareholder, and no exchange controls restrict sending profit or capital abroad. What actually governs the transfer is whether the company's accounts support the distribution and whether its bank's file on you is current — our note on repatriating profit covers both. For a VASP, whose bank relationship is already the hardest item on this page, the second point is not academic.

Treaties help at the other end. The UAE has concluded a wide network of double taxation agreements. They reduce the other country's tax, not the UAE's, and relief is claimed on evidence of genuine UAE residence, normally a tax residency certificate from the Federal Tax Authority — which is granted on real presence and management, not on the existence of a licence.

Your home country decides the rest. None of this binds the country where you are, or were, tax resident. Many countries tax their residents on worldwide income and some charge on departure, and a UAE address does not end that claim by itself. CARF sharpens the point: once exchanges begin, a UAE VASP's reports on internationally resident customers are designed to reach those customers' own tax authorities, and founders who hold accounts on their own platforms are customers too.

The company's answerThe founder's answer

1. Income and profitCorporate tax under Federal Decree-Law No. 47 of 2022, payable or notNo income tax; a salary and a dividend out of taxed profit are not taxed again
2. Trading gainsInside its own corporate tax computation, whatever older material says about capital gainsPersonal investing sits outside it, until the activity is licensed or needs to be
3. The number that moves itNot on the closed Qualifying Activities list, so a free zone 0% is not automaticAED 1 million of turnover in a calendar year brings a natural person's business in
4. Money leaving the UAENo withholding tax on a dividend to a foreign shareholder, and no exchange controlsTreaty relief cuts the other country's tax, not the UAE's, on real presence
5. ReportingCARF implementation targeted for 2027, first exchanges in 2028Your home country may tax worldwide income; a founder on his own platform is a customer

Where each of these is the wrong choice

We would rather lose the engagement than place you badly.

VARA is wrong if you are still testing the idea. Capital is locked, two senior people are hired before approval, and the burn runs six to eighteen months against no revenue. Prove the model somewhere cheaper and come back.

VARA is wrong if you only trade your own money — but note that "no licence" still means an NOC, and crossing USD 250 million on a rolling thirty-day basis puts you under supervision anyway. Model that threshold before your volumes approach it, not after.

ADGM is wrong if your customers, your staff and your life are in Dubai. Premises and approved persons must be in Abu Dhabi. An ADGM entity run remotely from Dubai satisfies nobody, least of all the FSRA, and it will not survive a supervisory visit.

ADGM is wrong if your asset is a privacy token or an algorithmic stablecoin. Prohibited means prohibited.

The DIFC is wrong if you cannot staff a defensible token suitability function. Since 12 January 2026 the assessment is yours to make, publish, monitor and justify.

A free zone commercial licence is wrong the instant a client's asset or order enters your systems. It is not a lighter VARA licence. It is a different thing, and the gap is enforced with fines and cease-and-desist orders, not a corrective filing.

The SCA route is wrong if your entire market is Dubai. You will end up at VARA regardless; sequence it correctly and take the federal reach that follows.

The UAE is wrong if your model needs UAE retail served with leverage, or UAE merchants settling in a foreign stablecoin. Under the Payment Token Services Regulation, dirham payment tokens require a CBUAE licence and foreign payment tokens must be enrolled with the CBUAE, with foreign token use tied to specified virtual asset transactions rather than general retail payment. Algorithmic stablecoins and privacy tokens are out. Read Article 12 against your own settlement assumptions before either reaches a business plan.

One point lands hardest: a later move is someone else's decision. Between two free zones, company law offers no general route, and whether a move exists turns on both zones' own regulations. Between a free zone and the mainland, the company can transfer only where both authorities' systems allow it and both approve, and a move into or out of ADGM or DIFC rests on controls the law leaves to the Cabinet. Regulatory permissions do not passport, a refused bank application follows the entity, and a fit-and-proper failure follows the individual across all of it. Choosing correctly the first time is the cheapest decision on this page by a wide margin.

Who should not attempt this at all

Harder still, and we would rather say it before the invoice than after.

If you cannot fund eighteen to twenty-four months of full burn before revenue, do not start a regulated application. No consultant can compress that, because none of us controls the regulator's queue or the Central Bank's non-objection.

If you cannot name your Compliance Officer today, you are not ready. VARA wants two named, fit-and-proper, UAE-resident individuals who have agreed to the role — not a recruitment plan for after in-principle approval.

If there is anything in your regulatory history you are hoping not to mention, stop. A refused or withdrawn application elsewhere, a wound-up entity, an enforcement action, a bank exit — disclosed early these are usually survivable; discovered later they are usually fatal, here and in every jurisdiction you apply to afterwards.

If your token has already launched and you are seeking retrospective cover, you need legal advice, not an application. Applying while a live issue sits outside the perimeter puts that issue in front of the regulator with your name attached.

If the answer to "whose money is it" changes depending on who is asking, the model is not ready to be regulated. Client money segregation is the first thing a supervisor tests and the last thing an unprepared firm can evidence.

If your plan is to obtain a permission and sell it, changes of control require regulatory approval in every one of these regimes. A licence is not an asset you can quietly transfer.

If you intend to run this from abroad and visit quarterly, choose a different country. Physical presence, resident senior staff and local decision-making are conditions here, not preferences, and they are checked.

What to bring to the first conversation

Five things, and we can place you from them: whose assets you touch and when; whether you will hold client fiat; where your two senior people will actually live; which emirate your customers are in; and how many months of burn you can fund without revenue.

From that we can tell you which of the five regimes you fall under, whether the cheapest permission is in fact the correct one, and — before you commit capital — whether the banking outcome your model needs is realistic. If a regulated licence is not worth what it costs you, we will say so. That conversation is free, and it is a great deal shorter than the alternative.

Banking advisory · DMCC · ADGM · DIFC · RAKEZ · Free zone company formation · Mainland company formation · UAE corporate tax

Frequently asked questions