A Dubai crypto licence covers named activities, and everything it does not name needs a separate permission

Someone has quoted you for a crypto licence in Dubai, or you already hold one, and the question in front of you now is narrower than the one the quotation answered. Can you hold the coin as well as quote the price on it? Can you pay a yield? Can you run the marketing campaign the investor deck already promises?

Those questions have answers, and none of them is a general answer about Dubai. A virtual asset permission here is granted activity by activity, and the activities not printed on the document are not included in it. That one mechanism explains most of the expensive surprises in this sector, and it is what a page headed "what a crypto licence covers" ought to say first.

A permission is a schedule of activities, not a status

VARA grants eight discrete activities: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and issuance inside the licensed category. More than one can sit under a single authorisation. What they cannot do is imply one another. Each carries its own rulebook, its own paid-up capital limb, its own systems and often its own named people, and each is applied for, priced and supervised on its own terms.

The practical test takes a minute. Read the activities printed on your licence, then write down what your product actually does. Where the second list is longer, the difference is not a grey area to be argued in a meeting. It is an application. Additional activities attract a further fee under the schedule, and they reopen the capital calculation rather than leaving it where it was.

Beneath the Regulations sit compulsory rulebooks that reach every licensee — company, compliance and risk management, technology and information security, market conduct — with one rulebook per activity above them and a separate rulebook for issuance. Version 2.0 of the full set was published on 19 May 2025, with compliance required by 19 June 2025. That matters for a second reason: what your licence obliges you to do can move because a rulebook moved, with nothing at all happening to the licence.

The table below reads activity by activity. Its third column lists what the market habitually assumes travels with an activity, and it is written as the question to put to the regulator rather than as a ruling.

Three models sit outside the perimeter, and one sits inside despite what the market says

Proprietary trading with no clients does not require a licence at this time, and it does require a No Objection Certificate from VARA, with a rolling volume threshold above which the firm must be enrolled and comes under supervisory oversight. No licence is not no filing, and that threshold is a figure to obtain from the authority rather than from a consultant's slide.

A Category 2 token can be issued without an issuance licence, but placement and distribution must run through a VARA-licensed distributor, who then answers for your conduct as issuer. Why distributors are selective about whose token they touch is worked through in somebody else has to sell your token. Closed-loop, non-transferable in-system credits — loyalty points, in-game balances — generally sit outside the perimeter altogether.

And the NFT marketplace, which much of this market still calls unregulated, sits inside it. VARA's published position is that an entity holding an NFT marketplace commercial licence from a free zone must also obtain a VA Exchange licence, a VA Broker-Dealer licence, or both. Where the regulator has already published an answer for the exact activity name a zone sold you, that answer is the one that counts, and four of those published answers are set out in VARA has already answered the activity name on your licence.

Six permissions a virtual asset licence does not include

This is the part the quotation never contains. Each row below is a separate permission with a separate owner, and each is triggered by something a virtual asset business routinely does on an ordinary Tuesday.

Two of those deserve a line of their own. The marketing rule is the one tripped over most, because it does not depend on your licence status at all: material must carry a prominent statement that virtual assets may lose their value in full, are subject to extreme volatility and carry no financial protection, nothing elsewhere in the campaign may contradict it, and a firm VARA has not licensed must say so prominently. Penalties under the Regulations run to AED 10 million.

The payment token boundary is the other. A permission to transfer and settle virtual assets says nothing about a token designed to settle payment, and that line is drawn federally by the Central Bank rather than by the emirate that issued your licence.

Where the licence stops, geographically

A Dubai virtual asset licence reaches the Emirate of Dubai, including its free zones and excluding the DIFC, which runs the DFSA's crypto token regime. Nothing passports: a Dubai permission does not authorise ADGM, and an ADGM permission does not authorise Dubai. There is one route outwards to the wider UAE that starts from a Dubai licence, and nothing equivalent running inwards. The regulator map is set out in full on the virtual asset licensing in the UAE page, and the general version of the same problem in your licence is an emirate licence, not a UAE one.

The conditions are part of the coverage, and they are not printed on the activity list

A licence is a conditional permission. Conditions attached at issue can restrict which clients you may serve, which assets you may deal in, which systems must be live before a function opens, and what has to be demonstrated before a limit lifts. In practice, early live operation is frequently confined to institutional and qualified clients while a retail permission follows later, and that sequencing is an observed pattern rather than a published standard.

The effect is that two firms holding the same activity name can hold materially different permissions, and the difference sits in the conditions rather than in the licence. VARA also holds enforcement powers that include suspending or revoking a licence, which makes the coverage you have the coverage you continue to satisfy.

Adding an activity later reopens more of the file than founders expect

Products move. A broker adds custody, an advisory firm starts taking orders, a venue decides to lend. None of that is an administrative change of wording.

What the amendment asks you to produce, who has to produce each item, and which defects send a file back are set out in half the documents in a crypto licence file are produced by somebody who does not work for you.

Where buying a licence is the wrong answer

Your model never touches a client's asset or a client's order. Software development, analytics, research, consultancy and trading your own balance sheet sit outside the licensed perimeter, and a non-regulated free zone licence is the correct and far cheaper product for them. Buying a regulated permission for work that does not need one funds a compliance function against no revenue. Settling that question first is the whole subject of deciding which authority is entitled to read your file.

You want the licence as a credential. A permission is read by counterparties as a scope statement rather than as a quality mark, and the scope is exactly what they check — six parties read a different line of your trade licence sets out who reads what.

No institution has indicated it will bank the model. If client money cannot be held anywhere, the licence authorises a business that cannot operate. Test that in month two rather than month ten.

Your product is a payment token. The permission you need is federal and sits with the Central Bank. No amendment to a virtual asset activity list reaches it.

You accept tokens from customers in an ordinary business. That is not a crypto business, and what it actually changes is your accounting classification, your free zone tax status and your bank's view of the money — being paid in crypto does not make you a crypto business.

You are mining for your own account. The constraints there are industrial rather than regulatory: premises use, a power tariff set by category, customs clearance and heat. Mining is an industrial decision before it is a crypto one prices it out.

What to establish before you buy a permission

Six answers, in writing, before anything is paid.

• Which of the eight activities your product performs, named in the regulator's words rather than in your product language
• Whether any part of the plan involves a token used to settle payment, which moves the question to the Central Bank
• What conditions the authority is likely to attach at issue, and what those do to year-one revenue
• Whether an institution will hold client money for the model, tested before the application
• Which activity you expect to add in year two, and what that does to the capital figure
• Who owns the marketing material that already exists, and whether it complies today

Frequently asked questions