Guide · updated 31.07.2026 · 12 min read · Lucent Legal team

VARA Licence in Dubai: What It Actually Costs and What You Need in 2026

"We already have a DMCC crypto licence, we don't need VARA" - that sentence is usually how the conversation starts that ends in a fine or a shut-down platform. VARA (Virtual Assets Regulatory Authority) is the only regulator that decides whether a business in Dubai can legally take clients' crypto - exchanging it, custodying it, lending against it, managing a portfolio of it. Here's what the licence categories actually are, what the whole process really costs (not just the application fee), how long it takes in practice, and what gets a licence pulled.

Who actually needs a VARA licence

The rule is simple and has no informal exceptions: if a Dubai business provides virtual asset services to third parties - taking crypto deposits, holding client keys, running an exchange, lending against crypto, managing someone else's portfolio, or running an NFT marketplace - it needs a VARA licence. It doesn't matter whether the company is mainland or free zone: VARA has jurisdiction over the whole emirate of Dubai, including almost every free zone in it.

The one exception is the DIFC (Dubai International Financial Centre): it has its own regulator, the DFSA (Dubai Financial Services Authority), with its own separate virtual-asset framework - VARA's authority stops at the DIFC's border. If your business is set up in or tied to the DIFC, licensing runs through the DFSA, not VARA - a different conversation entirely.

Worth knowing: VARA and the federal Securities and Commodities Authority (SCA) reportedly have a mutual-recognition arrangement, so VARA licensees register with the SCA without needing a separate federal licence. Exactly how that plays out for a given business model, and for activity in other emirates, is a question for a lawyer - the broader regulatory picture is covered in our guide on whether crypto is legal in the UAE.

VASP activity categories

VARA splits virtual-asset business into specific licensed activity categories, and a licence is issued per activity - a company can hold one or several at once:

VA Issuance (token issuance) and NFT Marketplace exist as separate categories - structurally similar to the ones above, but outside this "core seven" and assessed by VARA under their own rules.

Getting licensed: the two-step process

VASP licensing is strictly a two-step process, and there's no skipping the first step:

1. Initial Approval. The company submits an Initial Disclosure Questionnaire (IDQ) through Dubai Economy and Tourism (mainland) or the relevant free zone, attaches a base document set, and pays 50% of the category's application fee. VARA then issues an Approval to Incorporate (ATI) - permission to register the company, not permission to actually do virtual-asset business yet.
2. VASP Licence. Within 12 months of Initial Approval, the company files Part 2 - detailed policies and procedures, named responsible individuals, compliance documentation - and pays the remaining 50% of the fee plus the first year's annual supervision fee. After review, which can include meetings with VARA, the VASP Licence is issued, often with operating conditions that have to be met before the business can fully launch.

Companies that were already operating with virtual assets before full regulation kicked in can apply for a Legacy Operating Permit (LOP) - a temporary 12-month permit with reduced fees and capital requirements. It's not an alternative to the VASP Licence, just a bridge to it.

What it actually costs: fees, capital, office, compliance

The one-off application fee is AED 40,000 for Advisory and Transfer/Settlement, AED 100,000 for the other categories (Broker-Dealer, Custody, Exchange, Lending, Management). Renewing or adding a category costs roughly 50% of the lower fee tier.

The annual supervision fee is AED 80,000 for Advisory and Transfer/Settlement, AED 200,000 for the rest - payable every year starting from the first year of the licence.

Minimum paid-up capital ranges from AED 100,000 (Advisory) up to AED 1,500,000 (top end for Exchange) - depending on category, it's either a flat amount or 15-25% of annual operating expenses, whichever is higher. On top of that, companies must hold liquid "expense-based" capital of at least 1.2x monthly operating expenses, either in a UAE bank trust account or as a surety bond.

Beyond the official fees and capital, a realistic budget also has to cover: a physical office in Dubai (VARA requires genuine physical presence, not a mailbox), compliance staff salaries (a compliance officer, an MLRO - money laundering reporting officer, often required as a separate role from the director), audit, and legal work on the application. Independent estimates put the all-in first-year budget for a single category well over AED 500,000-1,000,000, even for the lower-tier categories (Advisory, Transfer) - the real number depends heavily on the specific business, and it's worth pinning down with a consultant before you file, not after.

Realistic timelines

Independent consultant estimates put the full path from filing the Initial Disclosure Questionnaire to getting the VASP Licence at roughly 4-8 months, assuming the documentation is complete and nothing drags. VARA doesn't publish a fixed review deadline for Part 2; the only hard cutoff is that Part 2 has to be filed within 12 months of Initial Approval, or the whole process starts over.

In practice, timing depends heavily on how ready the compliance documentation is (AML/CFT policies, the technology architecture required under the Technology & Information Rulebook) and on how many rounds of questions and meetings VARA requests - the more complex categories (Exchange, Custody) tend to draw more scrutiny than Advisory.

Grounds for VARA revoking a licence

VARA can suspend, revoke a licence, or impose fines if the company or its responsible individuals stop meeting the "fitness and properness" criteria - this isn't a one-time check at licensing, it's an ongoing obligation for the entire life of the licence. A separate ground is repeated failure to meet the rulebook requirements, particularly around technology governance and cybersecurity (the Technology & Information Rulebook), where violations are explicitly named as grounds for suspension or revocation alongside financial penalties.

Our sources don't give an exhaustive list of every ground for revocation - that's set out in the full text of VARA's Company Rulebook and Compliance and Risk Management Rulebook. If you're facing a warning, suspension, or a compliance notice, it's worth bringing in a lawyer who specialises in VARA compliance rather than trying to interpret the wording yourself.

VARA vs. free-zone "crypto licence": the marketing trap

The most common trap when choosing a jurisdiction: a free zone sells a "crypto licence" (DMCC, IFZA, and similar), and it looks like the regulatory question is settled (a detailed comparison of the options is in our guide crypto licences in the UAE: VARA, DIFC, free zones). In practice it's typically a licence for activity like blockchain development, consulting, or Web3 projects - it doesn't authorise working directly with client virtual assets.

The moment a business starts taking client deposits, holding third-party private keys, or running exchange or lending activity, it needs a separate VASP Licence from VARA - regardless of which free zone the company is registered in (except the DIFC, which runs on its own DFSA framework). A free-zone licence and a VARA licence aren't "either/or" - often it's "both": the entity is registered in a free zone, but the regulatory permission to serve clients comes from VARA separately.

Selling a free-zone "crypto licence" as a turnkey solution for an exchange or custodian is a marketing distortion - sometimes from ignorance, sometimes because it's easier to sell a bundled package than explain the gap. Before paying to register a company around a specific virtual-asset business model, it's worth asking a consultant directly: does this licence actually cover VASP activity, or only the supporting work around it?

A related question is how this activity gets taxed: the 0%/9% corporate tax rules and mandatory FTA registration apply to VASP companies exactly like any other Dubai business - covered in detail in our guide on UAE corporate tax.

This material is for information only and is not legal advice. UAE law changes — a lawyer will assess how it applies to your situation.