Dubai has quickly become one of the most active crypto hubs in the world. Exchanges, brokers, custodians, OTC desks, and investment platforms are building here not because of a slogan, but because VARA offers something most jurisdictions do not: a dedicated virtual-asset regulator with a clear rulebook, activity-based licensing, and a public register of licensed firms that banks and institutional counterparties can actually check.
A VARA licence signals that your business is authorised to conduct specific virtual-asset activities in Dubai, subject to capital, governance, custody, technology, and market-conduct requirements. It is not a generic “crypto registration.” It is an activity-specific authorisation that defines what you can do, how you must operate, and what you must maintain.
Protegra maps your business to the right VARA activities, structures the Dubai entity and custody model around them, and takes you from first application to a licence that is ready for real operations.
A VARA application is not won by choosing a free zone and submitting a generic policy pack. It is won by aligning the activity scope, entity, capital, custody model, technology, governance, and local operating structure before VARA tests the application.
We turn a VARA application into a Dubai business that can operate after approval.
Start your applicationnot a licence selected from a price list. We work across advisory, broker-dealer services, custody, exchange, lending and borrowing, management and investment, transfer and settlement, virtual-asset issuance, AML/CFT, technology, market conduct, and banking readiness.
Your commercial description may be “exchange,” “broker,” or “crypto platform.” The regulatory answer depends on what the business actually does: does it match buyers and sellers, solicit or execute client orders, control client wallets, hold or segregate customer assets, lend or facilitate borrowing, manage client portfolios, issue a virtual asset, or transfer and settle virtual assets? We map the real activity before the capital requirement and application architecture are fixed.
Custody is not simply another feature added to an exchange licence. VARA’s capital framework treats custody separately, and custody arrangements require their own governance, controls, safeguarding, reconciliation, and operational analysis. Where the business combines activities, we confirm whether custody must be separated or supported by an approved external custodian.
VARA expects more than incorporation and named directors. The business needs a credible AML/CFT programme, compliance ownership, risk management, technology controls, market-conduct procedures, customer disclosures, and local accountability. We build those controls around the product you will actually operate.
VARA’s register lists dozens of active virtual-asset firms — exchanges, brokers, custodians, and investment platforms — and has more than doubled in under two years. New licences continue to be added as the market matures.
VARA was created in 2022 under Dubai Law No. 4 of 2022 as a standalone regulator for virtual assets in Dubai (outside DIFC). It runs its own rulebooks, licensing regime, and supervision specifically for crypto and digital-asset businesses.
VARA’s framework is built around eight core activities: advisory, broker-dealer services, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and Category 1 virtual-asset issuance. Firms are licensed for the activities they actually perform, not a single generic “crypto licence.”
Dubai’s value is not simply that it has a dedicated virtual-asset regulator. It is that the regulatory framework is organised around the activity the business performs.
VARA allows businesses to apply for one or more regulated activities, but the capital, governance, custody, and operational requirements change with the scope. VARA regulates eight principal virtual-asset activities: advisory, broker-dealer services, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and Category 1 virtual-asset issuance. The correct question is not “Which licence do crypto companies get?” It is: what will your company actually do with virtual assets, client orders, wallets, and customer funds?
Broker-Dealer Services may cover OTC desks, order-execution businesses, and non-custodial trading models.
The capital requirement depends on whether the business uses an approved VARA-licensed custodian or another custody arrangement approved during licensing. The relevant requirement may also be calculated by reference to fixed annual overheads.
Custody Services apply where the business holds or controls customer virtual assets, wallets, private keys, or equivalent client-asset arrangements.
Custody requires a dedicated control framework covering segregation, access rights, key management, reconciliation, transaction approval, incident response, and customer-asset protection.
Custody should not be treated as an informal feature of another activity. Its legal structure and relationship with other licensed activities must be confirmed before incorporation.
Exchange Services cover platforms that facilitate the exchange or matching of virtual assets, including platforms with multilateral trading functionality.
Where the exchange uses a VARA-licensed custodian or another custody arrangement approved during licensing, the stated capital floor is AED 800,000 or 15% of fixed annual overheads, whichever is higher under the applicable framework. Other structures may require higher capital.
VARA capital is only one part of the Dubai licensing project. A realistic Year 1 estimate includes activity scope, entity setup, registered office, VARA application and supervision fees, paid-up capital, board and key personnel, AML/CFT, technology, custody, insurance, accounting, audit, banking, and ongoing operations.
VARA licensing is structured around the activity scope, Dubai entity, capital, local substance, operating model, and evidence submitted to the regulator. On timing: VARA publishes no processing times. Firms that announced both stages took about three months from the Initial Disclosure Questionnaire to Approval to Incorporate, then a median of about six more to the full licence: roughly nine months from filing and ten from our first conversation. Sources: VARA licence application process and public licensee announcements, checked 23 September 2026. The timings below are indicative, not a promise.
We map the business against VARA’s activity categories:
We also confirm that the entity will operate in Dubai outside DIFC and identify whether a DFSA route would apply instead.
The Dubai entity structure is established through the appropriate mainland or free-zone route.
We prepare:
The initial application and disclosure materials are prepared around one consistent business model.
This includes:
Where applicable, the company progresses through the Dubai incorporation and VARA approval process before completing the full operating structure.
The business must not begin regulated virtual-asset activity before the relevant licence is granted.
We prepare the detailed application package:
We manage regulator communication, meetings, interviews, document revisions, and requests for information.
The objective is to keep the business model, policies, technology, governance, and financial evidence consistent throughout the review.
Once VARA approval is granted, the company completes the remaining operational conditions:
A VARA licence begins an ongoing supervisory relationship. A VARA licence is the beginning of supervised Dubai operations—not the end of our work together.
Customer-risk review, transaction monitoring, sanctions controls, suspicious-activity escalation, and policy updates.
Wallet and key controls, cybersecurity, incident response, vendor oversight, reconciliation, resilience testing, and evidence maintenance.
Review of marketing, token listings, customer disclosures, complaints, conflicts, suitability, and changes to the service model.
Monthly capital reconciliation, fixed-overheads testing, reporting, licence-condition tracking, and material-change notifications.
VARA’s activity-based structure gives businesses flexibility, but it also creates several points where a licence can become misaligned before submission.
See how we workAn exchange may also be a broker, custodian, transfer provider, or issuer. Applying for too little can leave the company unable to operate the product it has built. Applying for too much can increase capital, fees, policies, and operational burden unnecessarily.
VARA covers Dubai mainland and Dubai free zones other than DIFC. DIFC is governed by the DFSA. Incorporating in the wrong zone means preparing for the wrong regulator.
Custody creates a distinct risk and control perimeter.
VARA’s capital rules may require the higher of a fixed minimum and a percentage of fixed annual overheads.
No. An application or preliminary incorporation approval is not the same as a full VASP licence.
No. Token admission, issuance, marketing, custody, and distribution may involve separate analysis. Some tokens may be restricted or subject to additional requirements.
Select a challenge to see how a Dubai virtual-asset project moves from an initial business idea to a VARA-ready operating structure.
“We thought we needed an exchange licence. Once the product was mapped, we realised it also involved custody, transfers, and client-order execution.”
“The activity scope was defined before we committed capital. We knew which services belonged in the application and which controls each one required.”
“We had designed the wallet architecture before deciding whether custody would be in-house or outsourced.”
“The custody model was selected before the application was submitted. Capital, governance, technology, safeguarding, and client disclosures all followed the same structure.”
“We chose a Dubai address without checking whether it was inside DIFC. We later discovered that VARA was not the applicable regulator.”
“The zone and regulator were confirmed before incorporation. The entity, licensing strategy, and operating model were designed together.”
Reference: Dubai (VARA) in the Licensing Atlas: regulators, licences and laws.
Leave your details and we will map your business to the VARA activity categories, confirm the Dubai jurisdiction, and identify the first steps toward authorisation.
Poland used to be one of Europe’s most active crypto markets. Its virtual-currency register contained 1,841 businesses, ranging from small peer-to-peer operators…
The AFM published its MiCA expectations before applications opened. What Dutch CASP licensing really takes: two regulators, real substance, class choice.
Brussels reopened MiCA on 20 May 2026, months after its transition ended, while Brazil writes its first crypto rulebook. What both mean for 2026 plans.