VARA has already answered the activity name on your licence

You are sitting with a free zone adviser and a list of activity names. One of them says NFT Marketplace. Another says DLT Services. There is a Metaverse line, and a Crypto Trading line, and the fee is the same for most of them. You pick the one that describes what you are building, you pay, and the licence arrives with that phrase printed on it.

Almost every argument that follows — with a bank, with an auditor, eventually with a supervisor — is about whether that phrase means what you assumed it meant.

Here is the shortcut nobody offers. For several of those names, Dubai's virtual asset regulator has already published a direct answer, in plain language, to the exact question you are about to pay a consultant to speculate about. It is worth reading before anyone quotes you anything.

A zone's activity list and a regulator's perimeter are drawn for different purposes

A free zone activity catalogue is a commercial taxonomy. It exists so a company can be matched to a fee, an office size and a visa quota, and it is written in the language of products because that is the language applicants arrive speaking. It is a good catalogue for its purpose.

A regulatory perimeter is drawn around functions — holding something for someone, matching two people's orders, moving value on instruction. It does not care what the product is called, and it was never designed to line up with a zone's price list.

DMCC is unusually candid about the gap. Its own crypto ecosystem page says a standard DMCC crypto licence covers non-regulated activities such as crypto software development, consultancy and trading, and states in the same place that regulated virtual asset activity requires an additional VARA licence, obtained through DMCC. Read alongside that, the activity names the same page lists are worth noticing: crypto software development, crypto consulting, crypto trading and crypto mining sit beside virtual asset advisory, virtual asset management and virtual asset investment services. The last three are, word for word, the names of things VARA licenses. A zone can print a name on a licence that a regulator uses for a permission, and the printing is not the permission.

So the question is never what does my licence say. It is what have the authorities said about what my licence says.

Four names, and four answers with no single rule connecting them

VARA publishes answers to a set of questions that begin, almost identically, "I currently hold a [something] commercial licence, do I need a VARA Licence?" The answers do not follow one pattern, which is precisely why reasoning by analogy from one to another goes wrong.

Four names sold from adjacent lines of the same catalogue. One is a hard yes, one is conditional, one is a soft and heavily qualified no, and one is a requirement that is neither a licence nor nothing. Taken together they say something more useful than any of them says alone: there is no default. The answer for your name is the answer for your name.

The NFT answer is the one people are most confident about, and most wrong

VARA's published position is that entities holding an NFT Marketplace commercial licence from a free zone must obtain a VA Exchange Licence and/or a VA Broker-Dealer Licence from VARA, depending on the exact activities of the marketplace.

Read that as a founder who has just paid for an NFT Marketplace licence. The zone sold you a name. The regulator's answer is not "it depends on how big you get" or "once you have users". It is that the commercial licence is the starting document and the regulatory permission is a separate one, and the only open question is which permission — exchange, broker-dealer, or both.

The clause carrying all the weight is depending on the exact activities of the marketplace. That is not softening. It is the regulator saying it will look past the word "marketplace" at what your contract and your code actually do: whether you match a buyer to a seller, whether an order passes through you, whether the asset rests anywhere you control before it reaches its new owner. Two products that look identical to a user can land on different sides of that.

This matters beyond NFTs, because "marketplace" is the most over-used word in this sector. A tokenised-anything platform, a launch venue, a secondary trading venue for game items — all of them describe themselves as marketplaces, and all of them inherit this answer to the extent they do the same things.

The DLT answer is conditional, and the condition is a list you have to read

For a Distributed Ledger Technology commercial licence, VARA's published answer is that DLT service providers are required to hold a VARA licence if they are providing or carrying out any of its virtual asset activities — and it then lists them: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and Category 1 issuance.

This is the answer most people stop reading too early, because the first half sounds like relief. It is a genuine carve-out and a real one: infrastructure, tooling, node operation, protocol engineering and integration work sit outside, and a DLT licence is the right purchase for a great many teams.

But the condition is a list, and two entries on it catch software companies that do not think of themselves as financial firms. Custody is safekeeping an asset for someone else — and VARA treats it as the one activity that must be segregated from everything else, requiring a distinct legal entity with a standalone licence. A wallet product where the user holds their own keys is a different thing from one where you hold a recovery shard on their behalf, and the difference is a sprint. Transfer and settlement reaches products whose whole pitch is moving value on a customer's instruction, which is what a payments-shaped integration is.

The DLT answer does not protect a product. It protects a set of functions, and your product is welcome to grow out of it.

Three hedges in one sentence, and all of them can move

The metaverse answer is the one to read most slowly, because it is written to be revisited: at the first instance, entities offering metaverse services are generally not required to hold a VARA licence at this time — and if such entities conduct VA activities regulated by VARA in or from Dubai, excluding the DIFC, a Virtual Asset Service Provider Licence will be required.

At the first instance. Generally. At this time. Three qualifiers in one published sentence, each doing separate work, and none of them accidental.

There is a way to use a sentence like that and a way to misuse it. Using it well means recognising that a regulator has told you, in writing, that this category is currently outside and is under review — which is exactly the information a two-year product roadmap needs. Misusing it means treating "generally not required at this time" as a settled classification, building a treasury, an in-world exchange and a cash-out rail on top of it, and discovering that the qualifiers were load-bearing.

Note also what the second half already does. It is not a warning about a possible future rule. The regulated activities are regulated now, inside a metaverse product as much as outside one. The soft answer covers the wrapper, not the contents.

The issuance answer that a good deal of the market has backwards

Ask around and you will be told that a Category 1 issuance — fiat-referenced and asset-referenced tokens — needs a licence, and that a Category 2 issuance, being everything else, needs nothing. The first half is right.

VARA's published answer to whether an entity can issue a Category 2 VA without approval from VARA is one word: no. Entities in the emirate seeking to carry out a Category 2 issuance must obtain prior approval from VARA. Its licensed activities page sets out what that involves — a VARA Issuance Approval Form, a whitepaper, demonstrated anti-money-laundering and counter-terrorist-financing compliance, and technical and security controls — and states plainly that anonymity enhanced tokens are prohibited. The same page carries a sentence worth pinning above a desk: no virtual asset activity is exempt from regulatory supervision.

An approval is not a licence, and the distinction is real — the burden, the cost and the timeline are all different. But "not a licence" has been repeated until it arrived at "nothing to do", and the gap between those two is a launch conducted without a permission the regulator says is required beforehand. Prior is the operative word. It is not a filing you make afterwards.

The approval is also only half of a token launch. Who is permitted to market and distribute the thing once it exists is a separate question again, and somebody else has to sell your token sets out the categories, the Licensed Distributor rule and the marketing permission that go with it.

What flips the answer is a feature, not a rebrand

Every one of these answers turns on function, which has an uncomfortable consequence: the classification you bought is a snapshot of the product on the day you bought it.

The pattern repeats across the sector. A non-custodial wallet adds social recovery and now holds a key shard. A marketplace adds an escrow so buyers stop getting scammed, and now the asset rests with the platform. A game makes its in-world credit transferable outside the game because the community asked, and a closed-loop credit becomes an issued asset. A dashboard adds a swap button as a convenience, and starts routing orders. Each of those is a sensible product decision, championed by someone who has never read a rulebook, shipped in a fortnight.

None of them is a rebrand. Not one requires a new licence to be bought before it ships, which is exactly the problem — the licensing consequence arrives silently and stays invisible until something goes looking.

The practical answer is unglamorous. Whoever writes the roadmap needs to know the eight function names, not the product categories, and the review question is does this feature put us in possession of, or in control of, something belonging to a customer, or of a customer's order? Asked at design time it costs an hour. Asked afterwards it is a remediation. What each of the licensed activities permits once you are inside the perimeter, and what sits outside every one of them, is set out in what a Dubai crypto licence covers.

There is a mirror-image error worth naming too. VARA's position is that proprietary traders using their own funds, with no clients, are not required to hold a licence at this time — but a No Objection Certificate is still expected, and a cumulative thirty-day rolling volume above USD 250 million puts the firm on VARA's record and under supervisory oversight. Confirm that threshold directly rather than from any article. Firms that assume "own money, no licence" means "own money, nothing at all" have read half of a two-part answer, which is the same reading failure as the DLT one, pointed in the opposite direction.

Where working the perimeter is the wrong purchase

We would rather say this than sell the analysis.

It is the wrong exercise if you already know a client's asset or order passes through you. You are not near a line, you are past it, and time spent characterising the activity is time not spent on the application. Our virtual asset licensing page sets out what that costs, including who should not attempt it.

It is the wrong exercise if the product is still hypothetical. These answers turn on specific functions. A perimeter analysis of a product that has not been designed yet produces a document that expires the first time an engineer makes a decision.

It is wrong if what you actually want is a lower answer. Structuring a product to stay outside a perimeter is legitimate; wording a description to sound as though it is outside is not, and the phrase depending on the exact activities exists to defeat exactly that. A description that does not match the code is worse than no analysis, because it is evidence.

It is wrong if your customers, or your entity, are in the DIFC, in ADGM, or outside Dubai. Everything on this page is Dubai's answer, outside the DIFC. The other authorities answer their own perimeters and this article makes no claim about how they treat the same product. Which authority is entitled to read your file at all is the decision that comes before any of this, and it is worked through in deciding which crypto regulator applies.

And it is wrong as a substitute for the banking question. A clean answer that you sit outside the perimeter still leaves you needing an account, and for crypto-adjacent revenue that conversation is its own project. Banking advisory covers what is actually being tested.

What to establish before you buy the activity name

Three things, and none of them costs money.

Find out whether the regulator has already published an answer for your exact activity name, and read it whole rather than to the first comma — several of these answers reverse in their second half. Write down which of the eight functions your product performs today, in the regulator's words rather than your own, and hand that list to whoever owns the roadmap. Then decide which planned feature would change the list, and put a date on the conversation rather than on the launch.

If the honest answer is that you are outside the perimeter and can stay there, we will say so and the engagement is a short one. If it is that you crossed the line two releases ago, we would rather establish that now than have a supervisor establish it for you.

Frequently asked questions