Virtual Assets Regulatory Authority · Dubai
Your VARA licence, mapped to a clear path.
You know your model. What's unclear is which VARA activity it maps to, what it demands in capital and controls, and how to clear the review without stalling. That's the part we own — from perimeter analysis to approval, and the compliance that follows.
Confidential & non-binding · Same-day response in UAE hours
Speak With a VARA Licensing Expert
Licensed activities
The eight activities VARA licenses.
Established in 2022 under Dubai Law No. 4, VARA is the world's first regulator built specifically for virtual assets. It licenses eight VA activities under a principles-based framework — and the heavier the activity, the heavier the scrutiny. Picking the right one, then evidencing the controls behind it, is where most applications succeed or fail.
VA Advisory Services
Personal recommendations to clients on virtual-asset transactions.
VA Broker-Dealer Services
Executing and arranging VA transactions on behalf of clients.
VA Custody Services
Safeguarding client virtual assets, including custodial staking.
VA Exchange Services
Operating a VA trading venue — including derivatives under the 2026 rulebook.
VA Lending & Borrowing Services
Providing VA credit and financing arrangements.
VA Management & Investment Services
Discretionary and advisory VA portfolio management.
VA Transfer & Settlement Services
Moving and settling virtual-asset positions.
VA Issuance
Issuing fiat- and asset-referenced tokens (Category 1).
The market · Verified on VARA's public register
The world's biggest are already licensed here.
VARA passed its 50th VASP licence in 2026, and the firms on its public register read like a map of the global industry. In March 2026 it went further — codifying a world-first, enforceable framework for virtual-asset derivatives (futures, options, perpetuals and CFDs). Dubai isn't an experiment any more; it's where serious operators build.
Why Dubai
Dubai isn't the only door. It's the one built for this.
Operators weighing a virtual-asset base compare a handful of routes worldwide. The trade-off is consistent: the lighter the oversight the thinner the credibility, and the harder it gets to bank, partner and scale. Here's how Dubai sits against the EU, Singapore and the usual alternatives.
Dedicated VA regulator
Financial regulator; crypto a sideline
Pan-EU crypto framework
MAS under the PS Act
Light-touch registration
50+ VASPs; Binance, OKX
Strong TradFi name
Passports 27 states
Elite, highly selective
Higher counterparty risk
8 activities + derivatives
Narrower token list
CASP; no derivatives yet
Cautious on retail
Limited passporting
Two-stage, ~6 months
Moderate timeline
Varies by member state
Slow, very selective
Fastest to launch
UAE presence unlocks banking
Excellent within DIFC
Strong EU banking
Strong but hard to open
Banking is the bottleneck
Capital
Capital is not one number. It's a structure.
VARA treats capital as an ongoing prudential requirement, not a one-time filing threshold. For most activities the base capital sits in a VARA-beneficiary trust account or surety bond — ringfenced, not spendable as working capital. It's a runway question, not just a filing one. Select an activity to see the layers.
VARA capital requirements — full 2026 breakdown
Every activity, base capital and prudential layer in one PDF, sourced from the VARA Company Rulebook.
Process
The VARA route has a step others skip.
Unlike single-application regimes, VARA front-loads scrutiny across two stages: you earn approval to incorporate before the full licence review begins — so problems surface early, not after you've built.
Perimeter
We confirm your model sits inside VARA's regulated perimeter and map it to the correct VA activity before a dirham is spent.
IDQ & Plan
Submit the Initial Disclosure Questionnaire and business plan via DET or your Dubai free zone. Initial fees paid.
ATI Approval
VARA clears you to incorporate the Dubai entity and appoint two Fit-&-Proper Responsible Individuals. No VA activity yet.
Build-out
Physical Dubai office, full AML/CFT, risk, governance and technology & cyber control package, plus key hires.
Review
VARA reviews the submission, holds interviews, and may set operational conditions you must satisfy before issuance.
Licence
Balance of application and first-year supervision fees settled; licence granted — and your live obligations begin.
You're authorised to operate — live compliance obligations begin from day one.
Most applicants lose months in Stage 2 — underestimating the documentation and control evidence VARA expects. Preparing that package properly, the first time, is the core of what we do.
Where applications stall
The four things VARA pushes back on most — and the four we harden before you file.
Weak governance
Boards and Responsible Individuals without genuine VA or financial-services track record.
Capital proof
Bank evidence that doesn't cleanly meet the required paid-up capital floor.
Generic AML/CFT
Off-the-shelf policies not tailored to your specific activity and risk profile.
Tech & cyber gaps
Infrastructure and controls below VARA's technology and resilience standard.
Requirements
What a VARA licence actually asks of you.
The activity sets your capital. But approval turns on a wider set of requirements — the ones applicants most often underestimate. Here's the full checklist, in VARA's own terms.
Legal entity in Dubai
An LLC or Free Zone company, or a registered branch — sole proprietorships aren't accepted. A commercial licence from your licensor (DET or a Free Zone) sits alongside the VARA licence.
Capital, held the right way
The paid-up floor for your activity plus net liquid assets ≥ 1.2× monthly opex. Paid-up capital sits in a UAE trust account with VARA as beneficiary, or a surety bond — ringfenced, not working capital.
Two Responsible Individuals
Each a full-time employee, fit-and-proper, and a UAE resident or passport holder, approved by VARA. Your senior team must also cover Compliance Officer, MLRO and — given VARA's technology focus — a CISO.
Physical office in Dubai
Genuine local substance is expected: a real Dubai office, secured as part of satisfying your In-Principle Approval conditions — not a flexi-desk afterthought.
Fit & Proper test
Directors, controllers and key role-holders must pass VARA's fit-and-proper assessment — qualifications, experience and integrity. VARA screens the people, not just the paperwork.
Governance, systems & controls
An adequate governance framework, clear division of responsibility, conflicts-of-interest management and internal controls proportionate to your scale and complexity — evidenced, not asserted.
AML/CFT & conduct
Compliance with VARA's Compliance & Risk Management and Market Conduct rulebooks: AML/CFT procedures, the FATF Travel Rule, sanctions screening, client-money segregation and conduct obligations.
Technology & cybersecurity controls
VARA regulates VASPs as technology-intensive institutions. Its Technology & Information Rulebook demands wallet-key controls, penetration testing, business-continuity and incident-response — with insurance (PII, D&O, crime) on top.
The KOLL Group difference
Most advisors stop at the application. We don't.
Getting the licence is one thing. Staying licensed — with compliance that holds up to supervision and security that holds up to attack — is another. We're the only Dubai advisor that carries all three in-house, so nothing gets handed off and dropped.
End-to-end application handling
We don't coach from the sidelines. We run the whole file — perimeter analysis, entity, capital structuring, the full VASP dossier and every round of VARA questions — through to approval.
VerifiX — our RegTech
AML/KYT screening, transaction monitoring and regulatory reporting on our own platform — so the controls you're approved on are the controls you actually run, not a slide deck.
ITSEC — security assurance
VARA scrutinises technology and cyber resilience hard. Our sister firm ITSEC delivers the penetration testing, cyber controls and audit evidence in-house — a capability no other licensing advisor has.
Three disciplines competitors outsource to three vendors. With KOLL Group it's one engagement, one accountable team — advisory, RegTech and cybersecurity under one roof.
How we help
From perimeter analysis to approval.
Scope & perimeter
We map your model to the correct VARA activity and confirm what is — and isn't — in scope before you commit capital or time.
Application, policies & live obligations
We prepare the application, AML/CFT policy pack and Responsible-Individual documentation, defend it through review — then keep you compliant after approval: AML, KYC, governance, reporting and audit.
Cybersecurity built in, not bolted on
VARA regulates VASPs as technology-intensive institutions. As part of ITSEC, we bring wallet controls, penetration testing, CISO and incident-response into the application from day one — where others outsource it later.
The lighter path
Some models take a lighter path — if you read it right.
VARA's rule is that no virtual-asset activity is exempt from oversight — but not all of it needs a full VASP licence. Two routes sit alongside the eight licensed activities, and mistaking one for the other is a common, costly error.
VA Proprietary Trading
Trading your own book — with no clients — is not a licensed VA activity. It proceeds under a VARA No Objection Certificate, routed through your commercial licensor (Free Zone or DET) with an Initial Disclosure Questionnaire.
Category 2 VA Issuance
Issuing a Category 1 token (fiat- or asset-referenced) requires a full VARA licence and the Issuance Rulebook's capital and reserve regime. But a Category 2 issuance — utility-type tokens — needs prior approval via a VARA Issuance Approval Form and a compliant whitepaper.
After approval
A licence is the start of an obligation.
VARA runs a progressive enforcement model. It escalates rather than jumping straight to revocation. Its tools include:
- Formal warnings
- Financial penalties
- Remediation orders
- Public enforcement notices for significant breaches
Appeals are heard by the VARA Grievance Committee, which issues final decisions within 15 days — and may publish its decision as an enforcement notice. Staying ahead of obligations is cheaper than answering for them.
Where KOLL takes it from here
Licensing is one part of the engagement. We also handle regulatory and compliance advisory across the application, RegTech implementation for KYC, transaction monitoring and reporting, cybersecurity assurance for licensed firms, and ongoing compliance after your licence. Where models are involved, see AI governance in UAE regulated activities.
FAQ
VARA licensing questions.
Which VARA licence do I need?+
It depends on which activity you carry out. VARA licenses eight VA activities — advisory, broker-dealer, custody, exchange, lending & borrowing, management & investment, transfer & settlement, and Category 1 VA issuance — each with its own capital and control requirements. Some models instead take a No Objection Certificate or prior-approval route rather than a full licence. We confirm the right path in a perimeter analysis before anything is filed.
Does VARA regulate crypto inside the DIFC?+
The DIFC sits under the DFSA, a separate financial regulator. VARA is Dubai's dedicated virtual-asset authority outside the DIFC. We help you confirm which regime actually applies to your model.
What are VARA's capital requirements?+
Capital floors are set per activity, from AED 100,000 for advisory up to AED 1.5 million for exchange services, plus ongoing prudential layers like net liquid assets and insurance. See the capital section above for the full breakdown.
What is the Information Disclosure Questionnaire?+
It's the initial submission VARA uses to assess your model and controls before Approval to Incorporate. We prepare it as part of Stage One of the application.
Do I need a VARA licence for proprietary trading?+
Not if you're trading only your own book with no client proceeds — that runs under a No Objection Certificate instead, unless your 30-day rolling volume crosses USD 250 million, which triggers mandatory registration.
Do I need a physical presence in Dubai?+
Yes. VARA expects genuine local substance — a real office and two UAE-resident Responsible Individuals — as part of your In-Principle Approval conditions.
How long does VARA licensing take?+
Typically 6–12 months end-to-end across both stages — faster, around 4–7 months, for well-prepared applicants with documentation and controls ready to go.
What is a VARA licence?
A VARA licence is the authorisation Dubai's Virtual Assets Regulatory Authority grants a firm to carry out a virtual asset activity in the Emirate, outside the DIFC. VARA licenses eight activities — advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and Category 1 virtual asset issuance — each with its own capital and control requirements. Some models take a No Objection Certificate or prior-approval route instead of a full licence.
How do you get a VARA licence in Dubai?
The route runs in two stages. Stage one begins with the Information Disclosure Questionnaire, which VARA uses to assess your model and controls before granting Approval to Incorporate. Stage two is the build-out: satisfying In-Principle Approval conditions, which include genuine local substance — a real Dubai office and two UAE-resident Responsible Individuals — along with the policies, capital and operational controls for your specific activity. A perimeter analysis comes first, to confirm which activity you are actually carrying out before anything is filed.
Building trust in a decentralised world
Map your VARA licence in one conversation.
Bring us your model. In one confidential call we'll tell you which activities it triggers, whether any part takes the lighter NOC route, the realistic capital and timeline, and the exact next step — before you spend a dirham.