VARA License in UAE

Is Your Virtual Asset Business a Fit for Dubai VASP Licensing?

Potential Fit
A client profile involving regulated customer services in or from Dubai outside DIFC, such as brokerage, exchange or custody.

Separate Assessment Needed
Software-only models and own-account trading require assessment of the actual activities. Company registration alone does not authorize regulated services. The territorial scope excludes DIFC.

Which Permissions Should Your VARA License Cover?

Your license must cover every regulated service you provide. Several activities can share one license, but custody requires a separate company and a standalone license.

These arrangements follow the requirements for combining activities and separating custody.

Which Virtual Asset Activities Match Your Business?

These VASP business models map to the service activities in Schedule 1.

Token issuance is assessed separately under the VA Issuance Rulebook. Category 1 issuance requires a license. Other categories have different conditions. Tokenization requires assessment of the token’s rights and structure alongside any service permissions.

What Will Gofaizen & Sherle Handle?

VARA application support covers four workstreams:

1. Regulatory assessment: map the business model, transaction flows and target markets to required permissions.
2. Document preparation: prepare application documents using client records and identify gaps in the submission.
3. Compliance framework: prepare anti-money laundering and counter-terrorist financing (AML/CFT) policies and governance documentation tailored to the business model.
4. Regulator communication: support responses, document revisions and additional submissions during review.

Clients provide business assumptions and financial data, appoint personnel, fund operations and implement controls for launch readiness. The agreed scope identifies which documents Gofaizen & Sherle drafts or reviews. Licensing decisions remain with the regulator.

What Determines the VARA License Cost?

The cost estimate depends on the activities, company structure and preparation required. Agree the service scope before work begins.

Capital and liquidity requirements must be assessed separately from fees. The official fee schedule sets regulatory charges, while professional fees depend on the agreed work.

How Does the Application Process Work?

The VARA licensing process has two application stages for new firms:

1. Approval to Incorporate. The applicant submits an Initial Disclosure Questionnaire through Dubai Economy and Tourism or the relevant free zone. Gofaizen & Sherle supports preparation. Approval allows incorporation and operational setup, but not regulated operations.
2. License Application and Decision. The applicant submits detailed documents and readiness evidence. Our team supports submission and follow-up responses. The regulator reviews the file, may request interviews or additional documents, and decides whether to issue a license with operating conditions.

What Must You Prepare?

VARA license requirements depend on the activities and business model. For our initial assessment, provide your proposed services, target markets, ownership information and existing client documents.

The application file typically addresses:

• Ownership and management: corporate documents, beneficial owners, group structure, CVs and fit-and-proper evidence.
• Business and finances: business plan, financial forecast, funding sources, capital and liquidity arrangements.
• Governance: responsibilities, conflicts of interest, succession and wind-down plans.
• Risk and compliance: risk assessments, internal controls, AML/CFT policies and record keeping.
• Technology and continuity: cybersecurity, wallet security, data protection, business continuity and recovery plans.
• External relationships: outsourcing arrangements, customer terms and marketing controls, including target-country restrictions.

The official application checklist is non-exhaustive. Supporting policies must reflect actual operations and providers. A template alone does not demonstrate that controls are implemented.

What Determines the Licensing Timeline?

The VARA license timeline depends on three work periods:

1. Document Preparation. Gofaizen & Sherle prepares the agreed documents using your business information. Missing records or inconsistent financial assumptions can delay completion.
2. Operational Setup. Your company recruits staff, arranges funding and implements systems and controls. Timing depends on what is already ready.
3. Regulatory Assessment. The regulator reviews the file and may request interviews, explanations or revised documents. These requests affect the application timeline independently of preparation.

What Makes Up the VARA Regulatory Framework?

The Dubai virtual assets regime combines the Virtual Assets and Related Activities Regulations 2023 with mandatory rulebooks and activity-specific rulebooks.

The four compulsory VARA rulebooks are:

• Company Rulebook
• Compliance and Risk Management Rulebook
• Technology and Information Rulebook
• Market Conduct Rulebook

The 2024 Marketing Regulations separately govern relevant promotions.

What Is the Current Regulatory Status?

The requirements are operative. As checked on September 24, 2026, the current Company Rulebook, Compliance and Risk Management Rulebook, and VA Issuance Rulebook show an effective date of June 19, 2025. Applicants must also check subsequent regulatory notices before filing.

Where Does Each Regulator Apply?

VARA jurisdiction covers Dubai mainland and free zones outside DIFC. Other locations require a separate regulatory assessment.

What Does Ongoing Compliance Require?

VARA compliance involves ongoing obligations under the Compliance and Risk Management Rulebook, including:

• AML/CFT controls, customer due diligence and sanctions screening.
• Transaction monitoring, suspicious-transaction reporting and applicable Travel Rule duties.
• Governance, audits, regulatory reporting and record keeping.
• Client-asset safeguards, outsourcing oversight and updated policies.

What Are the Consequences of Non-Compliance?

VARA enforcement powers include:

• Orders to remedy breaches or stop activities.
• License restrictions, suspension or revocation.
• Fines and additional supervision.

To manage regulatory risk, check permissions and outstanding conditions before launch or expansion.

How Should You Compare Alternative Routes?

For VARA vs ADGM or DIFC, compare how each framework treats your services and assets.

Compare entity setup, capital, staffing and controls for the proposed business in each location.

A license does not automatically authorize every activity throughout the UAE or abroad.