Answered plainly
Before you apply for anything, decide which authority is entitled to read your file. The wording on your licence is the output of that decision, not the way you make it.
Step-by-step crypto licensing guides start at the wrong end.
You have a business plan, a quote from a free zone whose package looked reasonable, and a list of documents someone has told you to assemble. The list looks like the beginning of a process. It is the end of one, and the part that was supposed to come before it has not happened yet.
The determination that decides everything about a virtual asset business in the UAE is made before any application exists: which authority is entitled to read your file. There are five possible answers, one of them is that no financial regulator applies at all, and the answer is not chosen. It is produced, by two facts about the business, in an order that most guides invert.
Getting it wrong is not a paperwork gap that a later filing corrects. Operating under a commercial licence while conducting an activity that needed a regulator is unlicensed activity, and Dubai's regulator publishes its enforcement against exactly that — including against the marketing of such activity, separately from the activity itself.
Two facts settle it, and only one of them is about geography
The first fact is what happens to somebody else's asset or order. Dubai Law No. 4 of 2022 defines a virtual asset functionally: a digital representation of value that can be digitally traded or transferred, or used as a means of exchange or payment, or for investment. A virtual token is a digital representation of a set of rights offered and traded through a virtual asset platform. Neither definition names a coin, a chain or a technology, and that is deliberate. The perimeter is drawn around conduct — whose asset you hold, whose order you carry — rather than around vocabulary.
The second fact is where the entity sits. Once the first fact puts you inside a perimeter, the address decides which one. That half is set out with its instruments in virtual asset licensing in the UAE, and it is not the half founders get wrong.
What they get wrong is the order.
Run it the other way and each step narrows the next. Establish what happens to a client's asset and order. That fixes whether a financial regulator is engaged. That fixes the set of addresses the entity may sit at. That fixes the words you ask the licensing counter for. The activity name arrives last, as a consequence — which is why treating it as a menu choice at step two is the error the rest of this page is about.
two facts, taken in the order that produces the answer instead of assuming it
- Establish what happens to a client's asset and to a client's orderThe perimeter is drawn around conduct, not around vocabulary
- Read the address only once that first fact is settledThe address decides which perimeter, and it is not the half founders get wrong
- Does anything of a client's, an asset or an order, pass through the business
- It doesA perimeter applies, and the entity's address then fixes which authority is entitled to read the file
- It does notThe largest branch and the least written about: an ordinary commercial licence and an ordinary bank conversation
- The words you ask the licensing counter forThey arrive last, as a consequence, which is why treating them as a menu choice is the error
Five answers, and the fact that produces each
The fourth row carries one asymmetry worth knowing before you choose an address: a firm licensed in or from Dubai has a published route to serving the wider country, and a firm licensed elsewhere does not gain Dubai. So the sequence of jurisdictions matters as much as the choice, and it is settled at formation.
The activity name is an output of the decision, not an input to it
A free zone's activity catalogue and a regulator's perimeter are drawn for different purposes, and our page on what VARA has already answered about the activity name on your licence works through the specific names where the regulator has published a direct answer that contradicts what the catalogue implies. Take that as read. What this page adds is the general test, which is the verb.
Read that column of verbs and the drafting instruction writes itself. The wording on the licence should describe what the business actually does, in terms that would survive a supervisor reading it alongside your website and your app. A line chosen because it was cheap, broad or available is a line you will be held to on your worst day.
The corollary is the one people resist. A licence wording that understates what you do does not protect you; it evidences that you knew what to avoid saying. And a wording that overstates it invites a regulator into a business that did not need one.
What it gets youWhat it costs you
- Chosen because it was cheap, broad or availableCheap, broad, available nowA line you will be held to on your worst day
- Understating what you actually doNothing at all, because it does not protect youIt evidences that you knew what to avoid saying
- Overstating what you actually doA permission wider than the businessIt invites a regulator into a business that did not need one
- Describing what the business actually doesIt survives a supervisor reading it beside your website and your appIt cannot be drafted until the determination is made
The "none" answer is the largest branch and the least written about
Most people reading a crypto licensing guide do not need a financial regulator. They write software, they build infrastructure that never holds a customer key, they research, they advise without arranging, they mine for their own account, they accept tokens as payment in an unrelated business. Each of those is an ordinary commercial licence and an ordinary bank conversation — the position set out in being paid in crypto does not make you a crypto business and, for mining, in mining is an industrial decision before it is a crypto one.
"None" is a real and legitimate answer. It is not a synonym for unregulated. For a board at an ordinary company that has simply started holding, accepting, trading or issuing tokens alongside its real business, the question sorts by the verb rather than by the sector, which is how does my company need a crypto licence works through it.
The practical point of that table is that "we are not a virtual asset service provider" answers one question. It does not answer whether any other regime reaches the product, and payment tokens are the boundary that catches people most often: a product built to move money is a payments business whether or not a token is involved.
A determination is a document, and four parties ask to see it later
Founders make this decision in a conversation and then cannot reproduce it. It should be a short written note, dated, that states what the business does with a client's asset and order, which perimeter that places it in, which authority follows from the address, the words the licence will carry, and what would change the answer.
Four parties ask for that reasoning afterwards, each for their own purpose. A bank, whose compliance function is expected to confirm you hold the authorisation appropriate to what you actually do and to restrict activity where you do not — which is why the account conversation goes badly when your explanation and your licence diverge. A licensed distributor, if a token is ever placed, because it answers for your conduct. A counterparty's onboarding team, which reads the licence wording against your product pages. And a supervisor, at the point where the question has stopped being hypothetical.
| Who asks | What they read it against | Why they ask |
|---|---|---|
| A bank | What you actually do, beside the authorisation you hold | Its compliance function is expected to restrict activity where those two diverge |
| A licensed distributor | The token, if one is ever placed | It answers for your conduct |
| A counterparty's onboarding team | Your product pages | It reads the licence wording against them before it deals with you |
| A supervisor | The period you traded in, not the period you are in | By then the question has stopped being hypothetical |
Writing it down also fixes the thing that makes this decision decay: it records the assumptions, so that a later product change can be tested against them.
None of those changes generates a filing. Every one of them can move the answer. That is the argument for a dated note rather than a remembered conversation, and for re-reading it whenever the product roadmap moves.
Where making this determination is the wrong use of your time
If your product already holds client assets and is live, the determination is not the priority. You have a live exposure, and the sequence is legal advice first, then remediation, then licensing. Reading a comparison of regulators is not the next thing to do.
If the business plan is a token sale that funds the company, the perimeter question is the second one. The first is who is lawfully allowed to sell it, and in Dubai the answer is generally not you.
If the honest answer is that the model cannot be banked here, no regulator choice fixes it. A business that needs to hold client fiat and cannot find an institution to hold it has not been delayed; it does not exist in this jurisdiction. Test that early rather than after a licence — getting a business bank account for a UAE entity covers what the file actually has to survive.
If you are comparing fees between zones, you are comparing the wrong column. The zone's price is the smallest figure in a regulated model and irrelevant in an unregulated one. What differs between the answers in this article is the capital, the people and the year, not the licence fee.
And if what you need is what each licence permits, this is the wrong page. It deliberately does not restate the taxonomy. Virtual asset licensing in the UAE sets out what each authority authorises, what it costs and what it requires; a crypto company in Dubai needs two licences, not one sorts the models by who supervises them.
- Your product already holds client assets and is liveYou have a live exposure, and reading a comparison of regulators is not the next thing to do
Legal advice, then remediation, then licensing
- The plan is a token sale that funds the companyIn Dubai the answer is generally not you
Who is lawfully allowed to sell it
- The model needs client fiat no institution will holdA business nobody will hold the fiat for has not been delayed; it does not exist in this jurisdiction
An early bankability test
- You are weighing one zone's package against anotherThe zone's price is the smallest figure in a regulated model and irrelevant in an unregulated one
The capital, the people and the year
- What you need is what each licence permitsThis page deliberately does not restate it
The pages that set out the taxonomy
What we would need to make the determination with you
Five things, and none of them is a preference. A plain description of what happens to a client's asset and to a client's order, written without marketing language. A diagram of where the money and the tokens actually move, including anything a third party holds on your behalf. Who your customers are and where they are. Whether anything in the product is used to make payments. And your roadmap for the next four quarters, because the features that move the answer are usually already on it.
From those we can name the authority, the set of addresses that follow, and the words to ask for. What we will not do is start with a free zone quotation, because every answer in this article except one makes that quotation the least significant number in the project.
Frequently asked questions
Can I start with a cheap free zone licence and add the regulator later?
You can hold both, and many licensed firms do. What you cannot do is conduct the regulated activity in the interval, and that interval is where the enforcement notices come from. The sequence that works is the determination first, then the address that follows from it, then the licence wording — not a licence bought on price with the perimeter question deferred until a customer asks it.
Does it matter which free zone, if VARA covers all of Dubai?
Less than the packages imply for the regulatory answer, and more than you would like for everything else — premises, the activity wording the zone will actually issue, and how the zone routes your file. It does not change which authority reads it.
My activity name came from the zone's own list. Is that not authoritative?
It is authoritative about what the zone will license. It says nothing about what a regulator's perimeter reaches, because the two documents were drafted for different purposes. The zone's list tells you what it is willing to print; the perimeter tells you what somebody is entitled to read your file, and only the second one decides whether you may trade.
I only trade my own money. Do I need anything?
In Dubai, no licence at this time and still a filing, with supervisory oversight once activity passes a published level. "No licence" and "nothing to do" are different statements. And the answer is fragile: the moment a second person's money joins the balance sheet, or users are able to trade with each other on your interface, you have moved to a different branch of the same question.
Is the DIFC a way into Dubai without VARA?
It is a different jurisdiction inside the same city, with its own regulator, its own duties around which tokens you may deal in, and no reach into the rest of the emirate. Dubai is four jurisdictions and the licence names one covers why that keeps surprising people.
Can I fix a wrong activity name by amending the licence?
The wording, usually yes. The trading you did under the old wording is not amended with it, which is the part that matters if a supervisor or a counterparty looks back at the period. An amendment also reopens more of the file than founders expect, and what each crypto licence actually covers sets out which permissions a change puts back on the table.
Begin with a clear conversation
Tell us what you intend to build.
A consultant will map the structure, jurisdiction, approvals and likely cost against what you actually described — not against a package.
