Guide · updated 08.09.2026 · 12 min read · Lucent Legal team

VARA Licence in Dubai: What It Actually Costs and What You Need in 2026

"We already have a DMCC crypto licence, we don't need VARA" — that sentence usually opens the conversation that ends in a fine or a shut-down platform. VARA (Virtual Assets Regulatory Authority) is the only regulator that decides whether a Dubai business can legally take clients' crypto — exchanging it, custodying it, lending against it, managing a portfolio of it. Here's what the licence categories actually are, what the process really costs beyond the application fee, how long it takes in practice, and what gets a licence pulled.

Who actually needs a VARA licence

The rule is simple, with no informal exceptions: a Dubai business that provides virtual asset services to third parties needs a VARA licence — taking crypto deposits, holding client keys, running an exchange, lending against crypto, managing someone else's portfolio, or running an NFT marketplace. Mainland or free zone makes no difference: VARA has jurisdiction over the whole emirate of Dubai, almost every free zone included.

The one exception is the DIFC (Dubai International Financial Centre), which runs its own regulator, the DFSA (Dubai Financial Services Authority), with a separate virtual-asset framework — VARA's authority stops at the DIFC's border. If your business sits in or ties to the DIFC, licensing goes through the DFSA, not VARA — a different conversation entirely. The second carve-out is payment tokens and stablecoins, which the Central Bank licences separately, so a VARA licence alone will not cover them — see the CBUAE licence for crypto and payment firms.

Worth knowing: VARA and the federal regulator hold a mutual-recognition arrangement, so VARA licensees get a federal registration number without a separate federal licence. Since 1 January 2026 that federal register is kept by the CMA (Capital Market Authority), which replaced the SCA. How that plays out for a given business model, and for activity in other emirates, is a lawyer's question — the broader regulatory picture is covered in our guide on whether crypto is legal in the UAE.

VASP activity categories

VARA splits virtual-asset business into specific licensed activity categories, and it issues a licence per activity — a company can hold one or several at once:

VA Issuance (token issuance) and NFT Marketplace stand as separate categories — structurally similar to the ones above, but outside this "core seven" and assessed by VARA under their own rules.

Getting licensed: the two-step process

VASP licensing is strictly two steps, and you can't skip the first:

1. Initial Approval. The company submits an Initial Disclosure Questionnaire (IDQ) through Dubai Economy and Tourism (mainland) or the relevant free zone, attaches a base document set, and pays 50% of the category's application fee. VARA then issues an Approval to Incorporate (ATI) — permission to register the company, not yet permission to do virtual-asset business.
2. VASP Licence. Within 12 months of Initial Approval, the company files Part 2 — detailed policies and procedures, named responsible individuals, compliance documentation — and pays the remaining 50% plus the first year's annual supervision fee. After review, which can include meetings with VARA, the VASP Licence issues, often with operating conditions to meet before the business can fully launch.

Companies already handling virtual assets before full regulation kicked in can apply for a Legacy Operating Permit (LOP) — a temporary 12-month permit with reduced fees and capital requirements. It's not an alternative to the VASP Licence, just a bridge to it.

What it actually costs: fees, capital, office, compliance

The one-off application fee is AED 40,000 for Advisory and Transfer/Settlement, AED 100,000 for the other categories (Broker-Dealer, Custody, Exchange, Lending, Management). Renewing or adding a category costs roughly 50% of the lower fee tier.

The annual supervision fee is AED 80,000 for Advisory and Transfer/Settlement, AED 200,000 for the rest — payable every year starting from the first year of the licence.

Minimum paid-up capital ranges from AED 100,000 (Advisory) up to AED 1,500,000 (top end for Exchange) — by category, it's either a flat amount or 15-25% of annual operating expenses, whichever is higher. On top of that, companies must hold liquid "expense-based" capital of at least 1.2x monthly operating expenses, in a UAE bank trust account or as a surety bond.

Beyond the official fees and capital, a realistic budget also covers a physical office in Dubai (VARA requires genuine physical presence, not a mailbox), compliance staff salaries (a compliance officer, and often an MLRO — money laundering reporting officer — as a separate role from the director), audit, and legal work on the application.

Independent estimates put the all-in first-year budget for a single category well over AED 500,000-1,000,000, even for lower-tier categories like Advisory and Transfer — the real number depends heavily on the specific business, so pin it down with a consultant before you file, not after.

Realistic timelines

Independent consultant estimates put the full path — from filing the Initial Disclosure Questionnaire to holding the VASP Licence — at roughly 4-8 months, if the documentation is complete and nothing drags. VARA publishes no fixed review deadline for Part 2; the only hard cutoff is filing Part 2 within 12 months of Initial Approval, or the whole process starts over.

In practice, timing rides on how ready the compliance documentation is (AML/CFT policies, the technology architecture required under the Technology & Information Rulebook) and on how many rounds of questions and meetings VARA calls — the more complex categories (Exchange, Custody) draw more scrutiny than Advisory.

Grounds for VARA revoking a licence

VARA can suspend or revoke a licence, or impose fines, when the company or its responsible individuals stop meeting the "fitness and properness" criteria — not a one-time check at licensing but an ongoing obligation for the entire life of the licence. A separate ground is repeated failure on the rulebook requirements, especially technology governance and cybersecurity (the Technology & Information Rulebook), where violations are named outright as grounds for suspension or revocation alongside financial penalties.

Our sources don't give an exhaustive list of every ground for revocation — that sits in the full text of VARA's Company Rulebook and Compliance and Risk Management Rulebook. Facing a warning, suspension, or a compliance notice? Bring in a lawyer who specialises in VARA compliance rather than parsing the wording yourself.

VARA vs. free-zone "crypto licence": the marketing trap

The most common trap when choosing a jurisdiction: a free zone sells a "crypto licence" (DMCC, IFZA, and similar), and the regulatory question looks settled (a detailed comparison of the options sits in our guide crypto licences in the UAE: VARA, DIFC, free zones). Usually it's a licence for blockchain development, consulting, or Web3 work — it doesn't authorise working directly with client virtual assets.

The moment a business takes client deposits, holds third-party private keys, or runs exchange or lending activity, it needs a separate VASP Licence from VARA — whatever free zone the company is registered in (except the DIFC, on its own DFSA framework). A free-zone licence and a VARA licence aren't "either/or" — often it's "both": the entity registers in a free zone, but the regulatory permission to serve clients comes from VARA separately.

Selling a free-zone "crypto licence" as a turnkey solution for an exchange or custodian is a marketing distortion — sometimes from ignorance, sometimes because a bundled package sells easier than the gap explains. Before paying to register a company around a specific virtual-asset business model, ask a consultant straight: does this licence actually cover VASP activity, or only the supporting work around it?

A related question is how this activity gets taxed: the 0%/9% corporate tax rules and mandatory FTA registration apply to VASP companies exactly like any other Dubai business — covered in detail in our guide on UAE corporate tax.

Topic: Crypto & Digital Assets in the UAE 2026

This material is for information only and is not legal advice. UAE law changes — a lawyer will assess how it applies to your situation.