- Dubai — VARA Licensing Framework
Crypto Activities Regulated by VARA
A practical guide to the virtual asset activities regulated by VARA in Dubai — what each activity covers, how the licensing perimeter works, and why getting the activity classification right at the outset is critical to capital, compliance, and execution strategy.
VARA Activities — At a Glance
📋
8 regulated VA activity categories — each carries its own licence, capital, and rulebook obligations
💰
Capital ranges from AED 100K (Advisory) to AED 1.5M (Exchange without approved custody arrangement)
⚠️
No activity may commence without prior VARA authorisation — even for a single service
🔗
Multi-activity models require stacked capital for every licensed activity — planned carefully
🏷️
A token's label does not determine its issuance category — function and mechanics do
Activity-Based Licensing — How VARA Works
What Requires a VARA Licence — and Why Classification Matters
VARA adopts an activity-based licensing framework. A firm must obtain authorisation for each regulated VA Activity it intends to conduct, and no activity may lawfully commence unless the relevant VARA authorisation has been secured. The selected activity determines capital, rulebooks, and the full compliance burden that follows.
The activity definitions sit in Schedule 1 — VA Activities, which functions as the starting point for regulatory perimeter analysis in Dubai. Before any application preparation begins, the correct activity classification must be confirmed — because misclassification creates consequences that are difficult and expensive to unwind.
Getting the activity classification wrong can lock up more capital than necessary, trigger avoidable rulebook obligations, extend regulatory review cycles, and create post-licensing enforcement or remediation risk. That is why regulatory perimeter analysis must happen before drafting begins — not after the business has already built around the wrong assumptions.
⚠️
Critical Reality: Misclassification can create unnecessary capital burden, longer review cycles, and potential scope issues after licensing is granted. Early classification is not optional — it is the foundation of the entire structuring strategy.
Why Activity Classification Determines Everything
- The Legal Scope of the Licence
Each activity defines the precise legal boundary of what the VASP is authorised to do. Operating outside that boundary — even marginally — creates regulatory exposure.
- The Paid-Up Capital Threshold
Each activity carries a specific minimum PUC — from AED 100,000 for Advisory to AED 1,500,000 for an Exchange without approved custody arrangements.
- Which Rulebooks Apply
All VASPs must comply with the four baseline rulebooks, but each licensed activity adds an activity-specific rulebook with its own prudential, technology, AML, and conduct requirements.
- Governance and Safeguarding Standards
Activities involving custody, exchange operations, or lending carry significantly higher governance, board composition, and client-asset protection expectations than advisory-only models.
🗂️
8 Activities
Regulated VA activity categories under VARA — each requiring separate authorisation
💰
AED 100K–1.5M
Minimum paid-up capital range across activities — stacked for multi-activity licences
📋
4 + Activity Rulebooks
Every VASP must comply with 4 baseline rulebooks plus the activity-specific rulebook(s)
🔐
1:1 Reserve
Reserve assets equal to 100% of client VA liabilities must be held at all times
The Core Regulated VA Activities
VARA's 7 Core Regulated Virtual Asset Activities
Before VA Issuance — which has its own three-category framework — VARA regulates seven core virtual asset activities. Each carries a distinct definition, capital threshold, and rulebook obligation. The correct activity for any given business model depends on what the business actually does — not what it is labelled.
VA 01
💡
Advisory Services
Offering or agreeing to provide a personal recommendation to a client regarding one or more actions or transactions involving virtual assets. The definition expressly links advice to the client's knowledge and experience, investment objectives, risk tolerance, time horizon, and financial circumstances.
Typical Business Models
- Investment advisory and token strategy consulting
- Transaction structuring and research-led recommendation models
Min. PUC
AED 100,000
BEST SUITED FOR: advisory-led businesses that do not execute transactions or hold client assets
VA 02
🤝
Broker-Dealer Services
Arranging or accepting orders, facilitating transaction matching, dealing on own account, making a market using client assets, or providing placement, distribution, or issuance-related services. One of the broadest licensing categories under VARA.
Typical Business Models
- OTC desks, brokerage models, and liquidity provision
- Token placements and institutional execution businesses
Min. PUC
Higher of AED 400,000 or 15% of FAOs (with approved custody) — otherwise higher of AED 600,000 or 25% of FAOs
BEST SUITED FOR: firms facilitating execution or intermediation without operating a venue
VA 03
🔐
Custody Services
Safekeeping virtual assets for or on behalf of another entity and acting only on verified instructions. Only VASPs that segregate each client's assets in separate VA wallets qualify for a Custody Services licence, unless otherwise permitted by the Custody Rulebook.
Typical Business Models
- Institutional custody and wallet administration
- Client-asset safeguarding and integrated platforms holding client VAs
Min. PUC
Higher of AED 600,000 or 25% of FAOs
⭐ Required for any lawful control over client wallets and private-key environments
VA 04
⚡
Exchange Services
Conducting an exchange, trade, or conversion between virtual assets and fiat, between one or more virtual assets, matching orders between buyers and sellers, or maintaining an order book in support of those activities.
Typical Business Models
- Exchange operators and order-book trading venues
- Conversion platforms and order-matching engines
Min. PUC
Higher of AED 800,000 or 15% of FAOs (with approved custody) — otherwise higher of AED 1,500,000 or 25% of FAOs
⭐ Highest capital threshold — does not include Custody automatically
VA 05
🏦
Lending and Borrowing Services
Carrying out a contract under which a virtual asset is transferred or lent from one or more lenders to one or more borrowers, with a commitment to return the same asset during or at the end of the agreed term.
Typical Business Models
- Crypto lending desks and collateralised borrowing products
- Yield-linked lending structures and VA-backed financing arrangements
Min. PUC
Higher of AED 500,000 or 25% of FAOs
BEST SUITED FOR: firms offering structured credit, collateral, or yield products involving VAs
VA 06
📈
VA Management and Investment Services
Acting as agent, fiduciary, or otherwise taking responsibility for the management, administration, or disposition of another entity's virtual assets. May include investment management and staking management.
Typical Business Models
- Managed portfolios and discretionary investment strategies
- Mandate-based rebalancing and managed staking programmes
Min. PUC
Higher of AED 280,000 or 15% of FAOs (with approved custody) — otherwise higher of AED 500,000 or 25% of FAOs
BEST SUITED FOR: managers making or implementing investment decisions on behalf of clients
VA 07
🔄
VA Transfer and Settlement Services
The transmission or transfer, and/or settlement of virtual assets from one entity to another entity, or from one entity to another VA wallet, address, or location. This is not a light-touch permission — the dedicated Rulebook imposes significant ongoing operational obligations.
Typical Business Models
- Remittance rails and transfer infrastructure
- Wallet-to-wallet transmission and settlement layers
- Payments-adjacent crypto models
Key Rulebook Requirements
- Written rectification procedures and client authorisation controls
- Public disclosures and Travel Rule compliance
- Default Rules reviewed and tested at least annually
- Compliance with CBUAE requirements where applicable to payments or remittances
Min. PUC
Higher of AED 500,000 or 25% of FAOs
BEST SUITED FOR: firms whose core model is the movement or settlement of VAs — not trading, custody, or portfolio management
VA Issuance — Three Distinct Categories
VA Issuance Under VARA: Category 1, Category 2, and Exempt VAs
VARA's VA Issuance Rulebook breaks issuance into three categories — and the distinction is critical, because not every issuance category is licensed in the same way. A token's label does not determine its category. Function, transferability, and reserve mechanics determine classification.
Category 1 — Licensed Activity
🏛️
Category 1 VA Issuance
Issuance of Fiat-Referenced Virtual Assets (FRVAs), Asset-Referenced Virtual Assets (ARVAs). This is a licensed VA Activity — no entity may carry out Category 1 issuance without VARA authorisation.
Illustrative Examples
- USD-backed stablecoin — cash or cash-equivalent reserves
- EUR-backed stablecoin — redeemable at par against reserves
- Gold-backed token — claim linked to physical gold or gold reserve value
- Multi-asset reserve token — basket of fiat, government instruments, commodities
- Treasury-backed settlement token — low-risk reserve asset pool
⚠️
⭐
Category 2 — No Issuer Licence Required
🔗
Category 2 VA Issuance
Issuance of any virtual asset that is not a Category 1 VA or an Exempt VA. No VARA licence is required for the issuer itself, but all placement and distribution must be carried out through or by a Licensed Distributor — who assumes responsibility for validating issuer compliance.
Illustrative Examples
- Exchange utility token — discounted fees or platform benefits
- Governance token — voting rights over protocol or treasury decisions
- Ecosystem incentive token — network participation, staking, developer rewards
- Gaming token with external transferability — tradeable outside closed platform
- Access token with market trading functionality — freely transferable and tradable
- Creator / fan token — community participation or rewards in media or sports
📋
Distribution must be through a VARA-Licensed Distributor — VARA does not deem Category 2 assets “approved”
Exempt VAs — No Prior VARA Approval
🔒
Exempt VA Issuance
Issuances that fall into one of the exempt classes: a Non-Transferable Virtual Asset, a Redeemable Closed-Loop Virtual Asset, or any other VA VARA may determine. No prior VARA approval required — but general issuance standards and VARA supervision still apply.
Illustrative Examples
- Non-transferable loyalty token — cannot be sold, transferred, or traded externally
- Closed-loop merchant token — redeemable only within a single platform or merchant
- Cinema / entertainment redemption token — redeemable for tickets or in-platform services only
- Employee reward token (non-transferable) — internal company benefits only
- Single-platform utility credit — access to premium content, no external transferability
- Closed-loop gaming credit — in-game only, not tradeable on external exchanges
✔
🔴
Important Warning — Labels Do Not Determine Categories: Calling something a “utility token” does not stop it from being Category 2. Calling something “closed-loop” does not make it exempt if it is actually transferable. Calling something a “stablecoin” does not by itself confirm Category 1 treatment — reserve and redemption mechanics govern the classification. Token classification must be assessed on substance, not label.
Quick Rule-of-Thumb Summary
Issuance Category
Licence Required?
Whitepaper Required?
Typical Token Types
Category 1
Yes — VARA licence mandatory
yes
USD/EUR-backed stablecoin, gold-backed token, basket-backed reserve token
Category 2
No issuer licence — Licensed Distributor required
yes
Utility token, governance token, transferable gaming token, ecosystem incentive token, fan token
Exempt VA
No prior approval required
No
Non-transferable loyalty token, closed-loop merchant token, internal reward token, platform credit
Structuring for Multi-Activity Models
Combination Models, Stacked Capital, and Prudential Expectations
Multi-activity businesses must be structured carefully. Where a VASP is licensed for more than one VA Activity, it must hold the paid-up capital required for each activity — with fixed annual overheads allocated across those activities and reconciled monthly. A phased licensing strategy is often more efficient.
Combination Models — Why Structuring Matters
Exchange + Custody
More than just an exchange model — Custody is separately regulated with its own structural and capital expectations. Both PUC thresholds must be held and reconciled independently.
Management + Custody
Carries the full capital burden of both activities. VA Management and Investment firms that hold client assets directly also require a Custody licence — they cannot rely on the Management licence alone.
Broker-Dealer + Transfer & Settlement
Can create significantly wider operational, conduct, and AML exposure across both activity rulebooks — with cumulative compliance and capital obligations that may make a phased approach preferable.
💡
Phased Strategy: A phased licensing strategy is often more efficient where the business can lawfully separate launch stages — starting with a single activity and adding permissions as operations scale, rather than building the full stack from day one.
Prudential Expectations Across All VARA Activities
- Net Liquid Assets (NLA)
VASPs must maintain Net Liquid Assets of at least 1.2× monthly operating expenses — reconciled daily and reported monthly.
- Reserve Assets — 1:1 Client Backing
Reserve assets equal to 100% of liabilities owed to clients, held one-to-one in the same VA as the client liability — reconciled daily and independently audited every 6 months.
- Regulated Insurance
Insurance adequate to the size and complexity of the VASP's operations — including professional indemnity, D&O, and commercial crime coverage as applicable.
- Daily and Monthly Monitoring
Prudential monitoring obligations run daily (NLA reconciliation, reserve reconciliation) and monthly (capital reconciliation, regulatory reporting). Any shortfall must be immediately notified to VARA.
Paid-Up Capital — Quick Reference Across All Activities
Activity
Min. PUC
(with approved custody)
Min. PUC
(without approved custody)
Advisory Services
AED 100,000
AED 100,000
Broker-Dealer Services
Higher of AED 400,000 or15% of FAOs
Higher of AED 600,000 or 25% of FAOs
Custody Services
—
Higher of AED 600,000 or 25% of FAOs
Exchange Services
Higher of AED 800,000 or 15% of FAOs
Higher of AED 1,500,000 or25% of FAOs
Lending & Borrowing
—
Higher of AED 500,000 or 25% of FAOs
VA Management & Investment
Higher of AED 280,000 or 15% of FAOs
Higher of AED 500,000 or 25% of FAOs
VA Transfer & Settlement
—
Higher of AED 500,000 or 25% of FAOs
Category 1 VA Issuance (FRVA / ARVA)
FRVA: AED 1,500,000 + 2% of circulating supply &
ARVA: Higher of AED 1,500,000 or 2% of Reserve Assets.
⚠️
VARA's Review Focus Areas
What VARA Will Scrutinise in Practice
Understanding what VARA tests during its review — across both the application process and ongoing supervision — is as important as understanding the licensing requirements themselves. These are the areas where VARA applies the deepest scrutiny and where applications are most commonly challenged.
- Correct Activity Classification
Whether the activity classification accurately reflects what the business actually does — and whether the operating model stays inside the requested licence perimeter after grant.
- Capital and Liquidity Sustainability
Whether paid-up capital and NLA levels are sustainable over time — not just satisfactory at submission. VARA may require additional capital depending on size, scope, and geographic exposure.
- Source and Form of Funds
The origin of the paid-up capital, the source of operating funds, and the form in which reserve assets are held — particularly for exchange and custody models with significant client asset exposure.
- AML/CFT and Travel Rule Readiness
The completeness and operational maturity of the AML/CFT framework — including CDD, EDD, transaction monitoring, and Travel Rule compliance — specifically calibrated to the licensed activities.
- Client-Asset Protection and Wallet Architecture
How client virtual assets are segregated, safeguarded, and reconciled — including the hot/warm/cold wallet architecture, key management procedures, and access controls for custody-related activities.
- Cross-Border Legal Permissibility
Whether the services proposed are legally permissible in the target markets — particularly where the VASP intends to serve clients across multiple jurisdictions from the Dubai entity.
- Governance and Escalation Structures
Whether the board, senior management, compliance function, and escalation procedures are adequate for the activities licensed — with particular depth for exchange and custody models.
- Policy–Practice Alignment
Whether the policies and procedures submitted during licensing accurately reflect how the business will actually operate — VARA tests for gaps between documented controls and real operating models.
How We Help
VARA Activity Classification & Licensing Support — What We Deliver
We help businesses map their operating model to the correct VARA licence scope, plan prudential capital, build the Regulatory Business Plan, and structure the control framework needed for approval — from first activity classification through to full VARA authorisation.
🗺️
Activity Classification & Perimeter Advice
We analyse the operating model against VARA's Schedule 1 — VA Activities definitions to determine which activities are in scope, confirm the correct licence type, identify combination risks, and produce a regulatory perimeter memo before any application preparation begins.
💰
Capital Planning & Prudential Modelling
We model the paid-up capital, NLA, reserve, and insurance requirements across the proposed activity combination — including overhead-based thresholds, monthly reconciliation obligations, and the prudential impact of adding or phasing activities over time.
📊
Regulatory Business Plan Drafting
We draft the Regulatory Business Plan — the primary narrative document in the VARA application — presenting a complete, credible, and commercially coherent picture of the business written for a VARA regulator, not an investor or commercial audience.
🏗️
Governance & Compliance Framework Design
We design the governance structure, board composition, compliance function, and control framework aligned to the specific activities licensed — including Responsible Individual appointments, committee structures, and the escalation architecture VARA expects.
🛡️
AML and Travel Rule Implementation
We design and implement the complete AML/CFT programme aligned to VARA's Compliance and Risk Management Rulebook — including CDD, EDD, transaction monitoring, sanctions screening, Travel Rule compliance, and the MLRO function — calibrated to the specific activities licensed.
🔐
Custody, Wallet & Settlement Architecture Advisory
For businesses with custody or exchange permissions, we advise on wallet architecture, hot/warm/cold segregation, key management controls, client-asset safeguarding procedures, and the reconciliation frameworks that VARA requires for custody and reserve compliance.
End-to-End VARA Licensing — From Activity Classification to Full Authorisation
- We confirm the correct activity classification and licensing perimeter before any application or structuring work begins
- We model the prudential capital stack — PUC, NLA, reserves, and insurance — across the proposed activity combination
- We draft the Regulatory Business Plan, compliance frameworks, and full application package to VARA's approval standards
- We manage the full VARA file through authorisation — from submission through Q&A, interview preparation, and conditions closure
Activity classification is the foundation of the entire VARA licensing strategy. Getting it right at the outset is the single most important structuring decision a VARA applicant makes.
FAQs
Frequently Asked Questions — VARA Activity Licensing
Yes. VARA’s framework is activity-specific, and each licensed activity carries its own capital threshold, rulebook obligations, and governance expectations. A VASP licensed for Exchange Services is not automatically authorised for Custody, Broker-Dealer, or Transfer & Settlement — each requires separate authorisation, and operating any activity without the relevant VARA authorisation is unlawful. Where a VASP is licensed for multiple activities, it must hold the required paid-up capital for each activity, with fixed annual overheads allocated across activities and reconciled monthly.
No. Custody is separately regulated under VARA and has its own structural, capital, and rulebook expectations. An Exchange licence does not authorise the VASP to safekeep client virtual assets — that requires a separate Custody Services licence. Exchange operators that hold client assets in their own wallets are effectively providing custody without authorisation unless they also hold the Custody licence or operate through a VARA-licensed custody provider approved as part of the exchange licensing arrangement. This is one of the most common structuring errors in VARA applications.
Yes — and in many cases, a phased approach is the more efficient strategy. Starting with a single activity licence and adding permissions as the business scales can reduce the initial capital burden, simplify the first application, and allow the compliance infrastructure to develop in line with operational growth. However, each added activity increases paid-up capital obligations, extends the applicable rulebook scope, and expands governance and compliance requirements — so the phasing strategy must be planned carefully from the outset to avoid structural problems when the second activity is added.
Category 1 covers fiat-referenced and asset-referenced VAs — these require a VARA licence and carry the highest prudential and disclosure obligations. Category 2 covers transferable VAs that are not Category 1 — the issuer does not need a VARA licence, but all distribution must go through a VARA-Licensed Distributor who takes responsibility for regulatory compliance. Exempt VAs are non-transferable or closed-loop tokens — no prior VARA approval is required, but the general issuance rules still apply and VARA retains supervision and enforcement powers. The key determinant across all three categories is function and transferability — not the label applied to the token.
Because the selected activity determines everything that follows — the legal scope of the licence, the minimum paid-up capital threshold, which rulebooks apply, and the full prudential, technology, AML, conduct, and safeguarding requirements that attach. Misclassification can lock up more capital than necessary, trigger avoidable rulebook obligations, extend regulatory review cycles, and create post-licensing enforcement or remediation risk. Regulatory perimeter analysis must happen before drafting begins — not after the business has already built around incorrect assumptions. Restructuring after submission is expensive, time-consuming, and damaging to the application timeline.
Ready to Confirm Your VARA Activity Scope?
Book a VARA Activity Structuring Call
Whether you are mapping your business model for the first time or reviewing an existing structure, correct activity classification is the foundation of every efficient VARA licensing strategy. Let us confirm your perimeter before drafting begins.