The VARA Licensing Process for New Firms: From IDQ to VASP Licence

For most founders, the VARA process looks simple at first glance.

You see a licence page.
You see an application path.
You hear about ATI.
And it is tempting to think the whole journey is just a formal version of:

• set up the entity,
• file the documents,
• get approved,
• launch the business.

That is not how the process really works.

Under the VARA framework, the licensing journey for new firms is a staged regulatory pathway. VARA’s official Licence Applications page says that any firm seeking to carry on Virtual Asset activities in or from Dubai, excluding DIFC, must be licensed before commencing operations. For new firms, VARA states that applying for a VASP Licence is completed in two stages: first, application for an Approval to Incorporate (ATI) to establish the legal entity and commence operational setup; then, application for the full VASP Licence.

That two-stage structure is the heart of the process.

It means the real licensing journey is not:

“file once and wait.”

It is:

“qualify to set up, then prove you are ready to operate.”

That is why the process feels heavier than many founders first expect. By the time you reach final approval, VARA is not just assessing a product idea. It is assessing whether a real business, with real governance, controls, capital, documentation, and operating discipline, should be allowed to function as a regulated Virtual Asset Service Provider (VASP) in Dubai.

This guide explains that journey in practical terms:

• what the IDQ is and why it matters,
• what ATI actually means,
• what happens in the full application stage,
• what final approval really looks like,
• and what new firms most often misunderstand on the way from first disclosure to VASP licence.

1) The process starts before the first form: define the right activity scope

Although VARA officially presents the process as two stages, serious applicants usually discover that there is a hidden earlier phase:
readiness.

That is because the application only makes sense once the business has correctly identified which VA Activity or activities it is actually seeking to carry on. The Rulebook says all entities wishing to carry out one or more VA Activities in the Emirate must seek authorisation from VARA prior to conducting any VA Activity, and must apply for, obtain, and maintain a licence for each VA Activity they will conduct. VARA’s public materials also make clear that the framework is activity-based rather than one generic “crypto licence.”

This matters because the chosen activity scope affects everything that follows:

• the IDQ narrative,
• the ATI-stage credibility assessment,
• the full application documents,
• the rulebooks that apply,
• the fee category,
• the capital requirement,
• and the kinds of questions VARA is likely to ask. VARA’s rulebook framework shows that each activity can have its own activity-specific rulebook, layered on top of the compulsory rulebooks for all VASPs.

So before the first formal filing, the most important internal question is not:

“How fast can we apply?”

It is:

“What exactly are we asking VARA to license?”

If that question is not answered properly at the start, the rest of the process becomes slower, more expensive, and more difficult to defend coherently.

2) Stage 1 begins with the Initial Disclosure Questionnaire (IDQ)

For new firms, VARA says the process begins with submission of an Initial Disclosure Questionnaire (IDQ) to Dubai Economy & Tourism (DET) for mainland firms or to the relevant Dubai free zone for free-zone firms. The IDQ is the formal starting point of the licensing journey for new applicants.

That sounds administrative, but the IDQ is more important than many founders realise.

At this stage, the business is effectively telling VARA:

• what it wants to do,
• where it wants to do it,
• who owns it,
• who will run it,
• and why it belongs inside the regulated perimeter rather than outside it.

VARA’s public page says the applicant must also provide additional documentation as required at this stage, including a business plan and details of the firm’s beneficial owners and senior management.

This tells you something important about the IDQ phase.

It is not just:

• a name check,
• a reservation step,
• or a soft registration.

It is the first regulatory filter.

The business is not yet proving full operating readiness, but it is proving enough seriousness and structure for VARA to decide whether it should be allowed to move into legal establishment and operational setup.

3) What VARA is really assessing at the IDQ stage

VARA’s public materials do not frame the IDQ as a full merits review, but they make clear that ATI may be refused if the proposed firm’s activities fall outside the regulatory perimeter or if the firm may not meet appropriate standards to be regulated.

That means the IDQ stage is already testing some core questions:

• Does the proposed business model appear to involve one or more licensable VA Activities?
• Is the entity structure plausible for the activity being proposed?
• Are the beneficial owners and senior management sufficiently clear at the outset?
• Does the business plan suggest something that could, in principle, become a regulated VASP?
• Does the proposed activity belong inside VARA’s perimeter at all?

This is one reason the earliest scoping work matters so much. If the firm describes the business too vaguely, too optimistically, or in a way that hides the real regulated function, the process may already become more difficult at Stage 1. The IDQ is not the final test, but it is the point at which the regulator first checks whether this proposed applicant should even be allowed to progress.

So the smartest applicants treat the IDQ as a credibility submission, not just a preliminary form.

4) Stage 1 also involves initial fees

VARA’s licensing page says that, during Stage 1, the applicant must pay the initial fees required to commence application review, typically 50% of the licence application fee.

That detail matters because it reinforces that ATI is part of the formal licensing process, not merely a free pre-screening conversation.

The financial commitment starts early. And it also means founders should not think of ATI as “no real process yet.” Once you are filing the IDQ, providing supporting information, and paying the first portion of the application fee, you are already inside the regulated licensing pathway.

This is one reason the IDQ stage should be approached seriously.
It is already a live regulatory application step.

5) Approval to Incorporate (ATI): what it actually means

If the Stage 1 review is successful, VARA says the applicant receives an Approval to Incorporate (ATI). VARA explains that ATI allows the firm to finalise legal incorporation and complete operational setup, including office space rental, employee onboarding, and similar preparatory steps.

This is a meaningful milestone.

ATI means the regulator has allowed the applicant to move from:

• proposed business,
  to
• actual legal and operational setup.

In practical terms, ATI is the point at which the firm can stop being a concept on paper and start becoming a real Dubai operating entity. It is what allows the business to:

• complete local legal formation,
• set up the office,
• build the team,
• and develop the operating structure that will later be examined in full during Stage 2.

So ATI is important.
But it is important in a specific way.

It is approval to incorporate and prepare, not approval to conduct regulated activity. VARA says that directly on its public licensing page.

6) What ATI does not mean

This is the most important practical distinction in the whole process.

VARA’s licensing page contains a clear note under Stage 1:

“At this point, the firm is not permitted to carry on Virtual Asset activities.”

That means ATI does not mean:

• the business is now fully licensed,
• the VASP licence is effectively done,
• the firm can begin providing regulated services,
• or the company can market itself as a fully approved VA operator.

This distinction is critical because ATI is one of the most frequently overstated milestones in the whole Dubai process. Founders, investors, and commercial partners sometimes hear “approval” and assume “authorisation to operate.” Under VARA, that is not the case. ATI is approved to establish and prepare for the full licensing review.

So the safest internal and external interpretation is:

ATI means the regulator has allowed the business to establish itself as a candidate regulated entity.
It does not mean the business can conduct VA Activity yet.

That is the point founders must keep firmly in view.

7) Why VARA separates ATI from the full VASP licence

The two-stage structure is deliberate.

VARA is effectively asking two different questions at two different times.

Stage 1 question

Should this proposed firm be allowed to establish itself and move into setup as a candidate regulated VASP?

Stage 2 question

Is this now-established firm actually ready to operate as a licensed VASP under VARA supervision?

That separation matters because legal incorporation and operational setup are not the same thing as regulatory readiness.

A firm may be:

• properly incorporated,
• properly staffed,
• and commercially interesting,

but still not be ready to operate as a supervised VASP.

That is why VARA lets firms move through ATI into setup first, then tests the completed operating model in the full application stage. This makes sense when you read it alongside the Rulebook’s broader licensing requirements, which require authorisation before conducting VA Activity and compliance with all licence conditions, regulations, rules, and directives once licensed.

So ATI is the bridge between:

• concept and setup,
  not
• setup and automatic operation.

8) Stage 2: the full VASP application begins after ATI

VARA’s public licensing page says that, following receipt of ATI, the firm can apply for a full VASP Licence by:

1. preparing and submitting documentation in accordance with VARA’s guidance,
2. receiving feedback from VARA, which may include meetings, interviews, and further documentation requests,
3. paying the remaining portion of the application licence fee and the first year’s supervision fee,
4. and, if successful, receiving a VASP Licence, which may be subject to operational conditions.

This is the stage where the licensing process becomes much more substantive.

During Stage 2, the applicant is no longer merely asking:

• “May we establish ourselves?”

It is asking:

• “Are we ready to operate as a licensed VASP?”

That is a much heavier question.

And because VARA expressly says meetings, interviews, and additional documentation may form part of the review, applicants should treat Stage 2 as a regulator dialogue, not as a static upload exercise.

9) The full application is really a readiness examination

The best way to understand Stage 2 is to look at the published document burden.

VARA’s Licence Applications page gives a non-exhaustive list of materials across:

• Corporate Structure and Governance
• Risk and Compliance
• Technology
• Other. The published list includes items such as:
  • UBO lists,
  • fit and proper confirmations,
  • source of funds,
  • organisational structure,
  • governance framework,
  • Regulatory Business Plan,
  • financial projections,
  • proof of paid-up capital,
  • insurance certificates,
  • succession plan,
  • wind-down plan,
  • compliance materials,
  • customer journey workflows,
  • technology architecture,
  • information security,
  • and penetration testing results.

That list makes the nature of Stage 2 obvious.

This is not simply “submit the incorporation documents.”
It is a full review of whether the business can operate as a licensed institution.

That is why serious applicants usually spend a great deal of time between ATI and Stage 2 building:

• governance,
• compliance,
• prudential support,
• technology controls,
• and the wider documentary framework the regulator expects to see.

So if ATI is the setup milestone, Stage 2 is the regulatory-readiness milestone.

10) Final approval: what the VASP licence actually is

If the Stage 2 review is successful, VARA says the firm receives a VASP Licence. But final approval is not necessarily a simple “yes exactly as requested.”

The Rulebook’s section on VARA’s Licensing and Authorisation Powers says VARA may:

• grant a licence for one or more VA Activities to which the application relates,
• specify the permitted VA Activities in the manner it considers appropriate,
• incorporate limitations and stipulations into the licence,
• specify a narrower or wider description of a VA Activity than that applied for,
• and even grant a licence only for a specified time.

That means final approval may be:

• broad,
• narrow,
• conditioned,
• time-limited,
• or otherwise tailored by VARA.

This is important because founders often assume the final licence will necessarily mirror the initial request exactly.

VARA’s own rulebook says otherwise.

So the right way to think about final approval is:
the regulator grants the licence it considers appropriate on the basis of the information provided and the wider circumstances of the application.

That is a more accurate and more useful way to understand the outcome.

11) Final approval is not the end of the regulatory journey

Another thing new firms often miss is that final approval is the start of regulated life, not the end of the work.

The Rulebook says VASPs must comply with any and all licensing conditions communicated by VARA in the licence or otherwise from time to time, and that those conditions include compliance with the Regulations, Rules, and Directives. It also says that if a VASP carries out a VA Activity outside the Emirate for which it is licensed in the Emirate, it must still comply with VARA’s framework as a minimum standard, and meet the higher of the applicable regulatory standards at all times.

That means once the VASP licence is granted, the firm is now inside an ongoing supervisory relationship. This is reinforced by VARA’s public register page, which says VARA maintains a public list of VASPs that are fully licensed or hold In-Principle Approval, including the services they are authorised to offer.

So the licence is not a trophy.
It is an operating permission inside a continuing supervisory regime.

That is the right mindset to carry out final approval.

12) Two important special points: exemptions and registration are not the same as licensing

The Rulebook also makes two important distinctions that new firms should understand.

First, there is a Professional Exemption. The Rulebook says duly registered practising lawyers, accountants, and certain professionally licensed business consultants may not need a licence where any VA Activity carried out is wholly incidental to their professional practice, provided conditions are met.

Second, the Rulebook draws a distinction between registration and licensing. For example, large proprietary traders and some other market participants may be required or permitted to register with VARA, but the Rulebook expressly states that such registration does not permit the entity to carry out VA Activities and does not constitute authorisation or a licence.

This is relevant because founders sometimes hear about:

• registration,
• public register status,
• ATI,
• or legacy permissions,

and confuse them with a full VASP licence.

The Rulebook and VARA’s public materials consistently distinguish these concepts. So applicants should be careful to use the right term for the right stage.

13) The biggest mistakes new firms make in the process

By now, the pattern should be clear.

The most common mistakes are:

Mistake 1 — Treating the IDQ like a formality

It is the first regulatory filter and sets the tone for everything that follows.

Mistake 2 — Treating ATI like final approval

VARA expressly says the firm cannot carry on VA Activities at the ATI stage.

Mistake 3 — Starting Stage 2 without real readiness

The published document burden is broad, substantive, and non-exhaustive.

Mistake 4 — Assuming meetings or information requests mean something has gone wrong

VARA’s public process page makes clear that feedback, interviews, and additional-document requests may be part of normal Stage 2 review.

Mistake 5 — Assuming the final licence will necessarily be granted exactly as requested

VARA reserves discretion to shape the licence, its scope, and its conditions.

Mistake 6 — Treating licensing as the end of the process

Final approval is the start of supervised regulated life, not the end of the compliance burden.

These are the issues that most often turn the licensing journey into something more difficult than it needed to be.

Final takeaway

If you want the cleanest practical answer to:
“What is the VARA licensing process for new firms?”

it is this:

For new firms, the process runs from IDQ to ATI to the full VASP application and finally to the VASP licence if VARA is satisfied. VARA’s public licensing page sets out that two-stage process explicitly: first Approval to Incorporate (ATI) to establish the entity and begin setup, then the full VASP Licence application. The Rulebook confirms that no entity may carry out VA Activities without authorisation and licensing from VARA.

In practical terms:

• IDQ is the first disclosure and early regulatory filter.
• ATI allows incorporation and operational setup, but not VA activity.
• Stage 2 is the full regulatory readiness review.
• Final approval is the grant of the VASP licence, potentially with conditions, limitations, or tailored activity scope.

That means the smartest applicants do not ask only:

“When do we file?”

They ask:

“How do we become ready enough that the regulator will let us move from disclosure, to setup, to full approval, to supervised operation?”

That is the real new-firm licensing question in Dubai.

How CRYPTOVERSE Legal Can Help

At CRYPTOVERSE Legal Consultancy, we help founders, exchanges, token issuers, brokers, custodians, managers, lenders, and other digital asset businesses navigate the full VARA new-firm licensing process from IDQ to ATI to full VASP approval. Our support includes activity classification, IDQ-stage strategy, ATI readiness, Regulatory Business Plan support, governance and compliance buildout, prudential-planning guidance, and end-to-end VASP application strategy.

If you want tailored guidance on the VARA licensing process for new firms — from IDQ to VASP Licence — contact CRYPTOVERSE Legal Consultancy to discuss your regulatory pathway.

FAQs