Virtual Assets Regulatory Authority · Dubai
You know your model. What's unclear is which VARA activity it maps to, what it demands in capital and controls, and how to clear the review without stalling. That's the part we own — from perimeter analysis to approval, and the compliance that follows.
Confidential & non-binding · Same-day response in UAE hours
Start Your VARA License Application
Licensed activities
Established in 2022 under Dubai Law No. 4, VARA is the world's first regulator built specifically for virtual assets. It licenses eight VA activities under a principles-based framework — and the heavier the activity, the heavier the scrutiny. Picking the right one, then evidencing the controls behind it, is where most applications succeed or fail.
Personal recommendations to clients on virtual-asset transactions.
Executing and arranging VA transactions on behalf of clients.
Safeguarding client virtual assets, including custodial staking.
Operating a VA trading venue — including derivatives under the 2026 rulebook.
Providing VA credit and financing arrangements.
Discretionary and advisory VA portfolio management.
Moving and settling virtual-asset positions.
Issuing fiat- and asset-referenced tokens (Category 1).
The market · Verified on VARA's public register
VARA passed its 50th VASP licence in 2026, and the firms on its public register read like a map of the global industry. In March 2026 it went further — codifying a world-first, enforceable framework for virtual-asset derivatives (futures, options, perpetuals and CFDs). Dubai isn't an experiment any more; it's where serious operators build.
Why Dubai
Operators weighing a virtual-asset base compare a handful of routes worldwide. The trade-off is consistent: the lighter the oversight the thinner the credibility, and the harder it gets to bank, partner and scale. Here's how Dubai sits against the EU, Singapore and the usual alternatives.
Capital
VARA treats capital as an ongoing prudential requirement, not a one-time filing threshold. For most activities the base capital sits in a VARA-beneficiary trust account or surety bond — ringfenced, not spendable as working capital. It's a runway question, not just a filing one. Select an activity to see the layers.
Every activity, base capital and prudential layer in one PDF, sourced from the VARA Company Rulebook.
Process
Unlike single-application regimes, VARA front-loads scrutiny across two stages: you earn approval to incorporate before the full licence review begins — so problems surface early, not after you've built.
We confirm your model sits inside VARA's regulated perimeter and map it to the correct VA activity before a dirham is spent.
Submit the Initial Disclosure Questionnaire and business plan via DET or your Dubai free zone. Initial fees paid.
VARA clears you to incorporate the Dubai entity and appoint two Fit-&-Proper Responsible Individuals. No VA activity yet.
Physical Dubai office, full AML/CFT, risk, governance and technology & cyber control package, plus key hires.
VARA reviews the submission, holds interviews, and may set operational conditions you must satisfy before issuance.
Balance of application and first-year supervision fees settled; licence granted — and your live obligations begin.
You're authorised to operate — live compliance obligations begin from day one.
Most applicants lose months in Stage 2 — underestimating the documentation and control evidence VARA expects. Preparing that package properly, the first time, is the core of what we do.
Where applications stall
The four things VARA pushes back on most — and the four we harden before you file.
Boards and Responsible Individuals without genuine VA or financial-services track record.
Bank evidence that doesn't cleanly meet the required paid-up capital floor.
Off-the-shelf policies not tailored to your specific activity and risk profile.
Infrastructure and controls below VARA's technology and resilience standard.
Requirements
The activity sets your capital. But approval turns on a wider set of requirements — the ones applicants most often underestimate. Here's the full checklist, in VARA's own terms.
An LLC or Free Zone company, or a registered branch — sole proprietorships aren't accepted. A commercial licence from your licensor (DET or a Free Zone) sits alongside the VARA licence.
The paid-up floor for your activity plus net liquid assets ≥ 1.2× monthly opex. Paid-up capital sits in a UAE trust account with VARA as beneficiary, or a surety bond — ringfenced, not working capital.
Each a full-time employee, fit-and-proper, and a UAE resident or passport holder, approved by VARA. Your senior team must also cover Compliance Officer, MLRO and — given VARA's technology focus — a CISO.
Genuine local substance is expected: a real Dubai office, secured as part of satisfying your In-Principle Approval conditions — not a flexi-desk afterthought.
Directors, controllers and key role-holders must pass VARA's fit-and-proper assessment — qualifications, experience and integrity. VARA screens the people, not just the paperwork.
An adequate governance framework, clear division of responsibility, conflicts-of-interest management and internal controls proportionate to your scale and complexity — evidenced, not asserted.
Compliance with VARA's Compliance & Risk Management and Market Conduct rulebooks: AML/CFT procedures, the FATF Travel Rule, sanctions screening, client-money segregation and conduct obligations.
VARA regulates VASPs as technology-intensive institutions. Its Technology & Information Rulebook demands wallet-key controls, penetration testing, business-continuity and incident-response — with insurance (PII, D&O, crime) on top.
The KOLL Group difference
Getting the licence is one thing. Staying licensed — with compliance that holds up to supervision and security that holds up to attack — is another. We're the only Dubai advisor that carries all three in-house, so nothing gets handed off and dropped.
We don't coach from the sidelines. We run the whole file — perimeter analysis, entity, capital structuring, the full VASP dossier and every round of VARA questions — through to approval.
AML/KYT screening, transaction monitoring and regulatory reporting on our own platform — so the controls you're approved on are the controls you actually run, not a slide deck.
VARA scrutinises technology and cyber resilience hard. Our sister firm ITSEC delivers the penetration testing, cyber controls and audit evidence in-house — a capability no other licensing advisor has.
Three disciplines competitors outsource to three vendors. With KOLL Group it's one engagement, one accountable team — advisory, RegTech and cybersecurity under one roof.
How we help
We map your model to the correct VARA activity and confirm what is — and isn't — in scope before you commit capital or time.
We prepare the application, AML/CFT policy pack and Responsible-Individual documentation, defend it through review — then keep you compliant after approval: AML, KYC, governance, reporting and audit.
VARA regulates VASPs as technology-intensive institutions. As part of ITSEC, we bring wallet controls, penetration testing, CISO and incident-response into the application from day one — where others outsource it later.
The lighter path
VARA's rule is that no virtual-asset activity is exempt from oversight — but not all of it needs a full VASP licence. Two routes sit alongside the eight licensed activities, and mistaking one for the other is a common, costly error.
Trading your own book — with no clients — is not a licensed VA activity. It proceeds under a VARA No Objection Certificate, routed through your commercial licensor (Free Zone or DET) with an Initial Disclosure Questionnaire.
Issuing a Category 1 token (fiat- or asset-referenced) requires a full VARA licence and the Issuance Rulebook's capital and reserve regime. But a Category 2 issuance — utility-type tokens — needs prior approval via a VARA Issuance Approval Form and a compliant whitepaper.
After approval
VARA runs a progressive enforcement model. It escalates rather than jumping straight to revocation. Its tools include:
Appeals are heard by the VARA Grievance Committee, which issues final decisions within 15 days — and may publish its decision as an enforcement notice. Staying ahead of obligations is cheaper than answering for them.
Where KOLL takes it from here
Licensing is one part of the engagement. We also handle regulatory and compliance advisory across the application, RegTech implementation for KYC, transaction monitoring and reporting, cybersecurity assurance for licensed firms, and ongoing compliance after your licence. Where models are involved, see AI governance in UAE regulated activities.
FAQ
It depends on which activity you carry out. VARA licenses eight VA activities — advisory, broker-dealer, custody, exchange, lending & borrowing, management & investment, transfer & settlement, and Category 1 VA issuance — each with its own capital and control requirements. Some models instead take a No Objection Certificate or prior-approval route rather than a full licence. We confirm the right path in a perimeter analysis before anything is filed.
The DIFC sits under the DFSA, a separate financial regulator. VARA is Dubai's dedicated virtual-asset authority outside the DIFC. We help you confirm which regime actually applies to your model.
Capital floors are set per activity, from AED 100,000 for advisory up to AED 1.5 million for exchange services, plus ongoing prudential layers like net liquid assets and insurance. See the capital section above for the full breakdown.
It's the initial submission VARA uses to assess your model and controls before Approval to Incorporate. We prepare it as part of Stage One of the application.
Not if you're trading only your own book with no client proceeds — that runs under a No Objection Certificate instead, unless your 30-day rolling volume crosses USD 250 million, which triggers mandatory registration.
Yes. VARA expects genuine local substance — a real office and two UAE-resident Responsible Individuals — as part of your In-Principle Approval conditions.
Typically 6–12 months end-to-end across both stages — faster, around 4–7 months, for well-prepared applicants with documentation and controls ready to go.
Building trust in a decentralised world
Bring us your model. In one confidential call we'll tell you which activities it triggers, whether any part takes the lighter NOC route, the realistic capital and timeline, and the exact next step — before you spend a dirham.
