- Dubai — VARA Licensing Perimeter
Do You Need a VARA Licence?
If you are offering, facilitating, safeguarding, issuing, promoting, or transmitting virtual assets in or from Dubai, the answer may well be yes. This guide helps founders, exchanges, token issuers, brokers, custodians, and Web3 businesses determine when a VARA licence is required, when marketing alone can still trigger VARA rules, and where the real perimeter lines sit.
⚖️
It is not whether you are "in crypto" — it is whether you carry on a regulated VA Activity in or from Dubai
📋
8 regulated VA Activities — from Advisory to VA Issuance — and your model may touch more than one
📣
Marketing alone can trigger VARA rules — even without a licence and even for foreign entities
🔀
Many businesses are hybrid — Exchange + Custody, Broker-Dealer + Transfer — and prudential burden stacks
⚠️
Labels don't determine the perimeter — function does. "Utility" or "closed-loop" are not exemptions
We help businesses determine whether their model falls inside the VARA perimeter, which VA Activity applies, what capital is required, and how to structure the application or redesign the model before regulatory risk becomes expensive.
The Short Answer
You Generally Need a VARA Licence If You Are Conducting a Regulated VA Activity in or from Dubai
The Wrong Question
"Are we a crypto company?"
This framing misses the point. VARA's perimeter is activity-based, not entity-based.
The Right Question
"Are we carrying on a regulated VA Activity in or from Dubai, or targeting the UAE in a way that triggers VARA's rules?"
VARA's framework is activity-based. If your business model falls within one or more regulated VA Activities, you will generally need the relevant authorisation for that activity. The legal issue is not whether you are "in crypto" — it is whether what you do fits one of the regulated categories in substance.
This distinction matters because many businesses assume their model sits outside VARA's reach based on how they describe themselves, rather than what they actually do. Labels do not determine the perimeter — function does.
💡
Key Principle: VARA’s jurisdiction covers Dubai, including Special Development Zones and Free Zones. DIFC is excluded from VARA’s remit and regulated separately by the DFSA. Make sure you understand which regulator governs your intended domicile before building the operating model.
Three Ways the Licensing Question Gets Triggered
🏢
Operating a Regulated VA Activity
📣
Marketing to the UAE
🌐
Offshore Access by UAE Users
Being domiciled offshore does not automatically exclude you if you are targeting the UAE or if regulated activities are being carried on in or from Dubai.
📋
8 Activities
Regulated VA Activity categories under the VARA framework
🌍
All Dubai
VARA's jurisdiction — including SDZs and Free Zones, excluding DIFC
📣
Marketing Too
Marketing Regulations 2024 apply to foreign entities targeting UAE — no licence required to be caught
⚠️
Function Wins
Labels don't determine the perimeter — what you actually do in substance determines VARA's reach
What Counts as a Regulated VA Activity
The 8 Regulated VA Activity Categories
VARA's framework is activity-based. If your business model falls within one or more of these categories, you will generally need the relevant authorisation for that activity. Each category has its own dedicated VARA rulebook, and many hybrid business models touch more than one.
VA Activity 01
💬
Advisory Services
Providing personal recommendations tied to a client's circumstances — on buying, selling, holding, or using virtual assets. This is regulated activity, not merely content creation or general education.
VA Activity 02
🔀
Broker-Dealer Services
Arranging or facilitating crypto transactions — receiving orders, routing them, soliciting transactions, helping place tokens, or standing between clients and execution.
VA Activity 03
🔒
Custody Services
Holding or controlling client virtual assets — safeguarding client assets or operating wallets on behalf of clients where assets are segregated and held subject to instruction.
VA Activity 04
🏛️
Exchange Services
Operating a trading venue or conversion platform — matching buyers and sellers, maintaining an order book, or converting between fiat and virtual assets or between virtual assets.
VA Activity 05
💰
Lending & Borrowing Services
Offering crypto lending, borrowing, or yield structures — where a borrower takes VAs from a lender with an obligation to return them.
VA Activity 06
📊
VA Management & Investment Services
Managing virtual assets for clients — acting as fiduciary, agent, or investment manager with discretion or responsibility over another person's virtual assets.
VA Activity 07
🏦
VA Transfer & Settlement Services
Moving virtual assets from one person or wallet to another — transmitting, transferring, or settling VAs from one entity to another entity or wallet. VARA's dedicated rulebook makes this a standalone regulated activity.
VA Activity 08
🟡
Category 1 VA Issuance
Issuing certain virtual assets — specifically Category 1 VAs such as FRVAs (Fiat-Referenced Virtual Assets) or ARVAs (Asset-Referenced Virtual Assets). Licensing is expressly required for this activity.
You Likely Need a VARA Licence If…
8 Scenarios Where a Licence Is Almost Certainly Required
These are the most common business models and activities that fall squarely within VARA's regulatory perimeter. If your business resembles any of the following, a perimeter assessment should be your first step — not product development, not branding, and not marketing rollout.
01
You advise clients on buying, selling, holding, or using virtual assets
⚖️ Advisory Services
02
You arrange or facilitate crypto transactions
🔀 Broker-Dealer Services
03
You hold or control client virtual assets
🔒 Custody Services
04
You operate a trading venue or conversion platform
🏛️ Exchange Services
05
You offer crypto lending, borrowing, or yield structures
💰 Lending & Borrowing Services
06
You manage virtual assets for clients
📊 VA Management & Investment Services
07
You move virtual assets from one person or wallet to another
↔️ VA Transfer & Settlement Services
08
You are issuing certain virtual assets
🪙 Category 1 VA Issuance
The Marketing Problem
You May Still Have a VARA Problem Even If You Think You Do Not Need a Licence
This is where many businesses get caught. Even where your core activity may be arguable, your marketing conduct can expose you to VARA scrutiny independently. VARA's Marketing Regulations 2024 create a separate regulatory risk layer that applies before — and regardless of — the licensing question.
Marketing Can Trigger VARA Rules Even Without a Licence
VARA's Marketing Regulations 2024 apply to all marketing of or relating to Virtual Assets or VA Activities in or targeting the UAE — including by foreign entities and including entities that are not licensed by VARA.
VARA defines "Marketing" very broadly and assesses the overall campaign — not just a single post or ad. The regulations capture intent, reach, and commercial effect — not merely the legal form of the communication.
⚠️
Common Scenarios — Frequently Misunderstood
"We are offshore, but UAE users can access our platform."
"We are just building a wallet."
"We are just issuing a token."
"We are just educating users."
When the Answer May Be "Not Yet" or "Not in This Form"
Models That May Fall Outside the Strict Licensing Perimeter
There are models that may fall outside the strict licensing perimeter — depending on how they are structured. But this is where founders often make expensive mistakes. Labels do not determine the perimeter. Function does. A model described as "utility," "closed-loop," or "education" can still fall inside VARA's framework if the real-world design says otherwise.
Models That May Sit Outside the Perimeter
✔
Purely Internal or Closed-Loop Token Models
Where the token genuinely does not leave the controlled ecosystem and cannot be transferred or traded outside of it — subject to structural verification.
✔
Genuinely Non-Transferable Virtual Asset Use-Cases
Where the underlying asset is technically and contractually non-transferable and where no secondary market or exchange function exists.
✔
Software-Only Tools With No Custody, Execution, or Intermediation
Pure infrastructure or developer tooling where no client assets are held, no transactions are executed, and no intermediation layer is present.
✔
Genuine Journalism or Non-Promotional Content
Content that genuinely fits the relevant exemption — without commercial purpose, without promotion of a VA or VA Activity, and without tied commercial benefit.
Where Founders Make Expensive Mistakes
"Utility token" that is transferable, tradeable, and held by third parties
"Closed-loop" system that connects to external wallets or exchanges
"Education" content that promotes a specific token or platform
"Software tool" that holds keys or executes instructions on behalf of users
"Offshore" business that actively targets UAE residents or markets
⚡
What If I Need More Than One Licence?
Hybrid Models — Many Crypto Businesses Are Multi-Activity
This is common. Many crypto businesses are hybrid models that touch more than one regulated VA Activity. VARA rulebooks apply cumulatively where multiple activities are licensed, and the prudential burden — capital requirements, compliance scope, governance obligations — can increase significantly with each additional activity.
Exchange Platform
Exchange Services + Custody Services
A platform that both matches trades and holds client assets requires authorisation for both activities. The custody layer is not a byproduct of the exchange licence — it is a separate regulated activity with its own obligations.
OTC Desk
Broker-Dealer Services + Transfer & Settlement Services
An OTC business that facilitates bilateral trades and also moves VAs between counterparties may require both broker-dealer and transfer and settlement authorisations — including the standalone Transfer and Settlement rulebook obligations.
Token Ecosystem
Category 1 Issuance + Distribution + Marketing Controls
A token ecosystem that issues, distributes, and markets a VA may require issuance authorisation, distribution authorisation, and full compliance with VARA's Marketing Regulations 2024 — as three separate compliance obligations.
Managed Product
VA Management & Investment Services + Custody Services
A managed VA product where the operator exercises discretion over client assets and holds those assets on behalf of clients requires both management and custody authorisation — each carrying its own prudential and compliance requirements.
📋
The Cost of Getting This Wrong
What Happens When Businesses Build Under the Wrong Assumption
If you build under the wrong assumption — that you do not need a licence, or that your model sits outside VARA's perimeter — the consequences emerge at the worst possible moment: when capital has been deployed, the product is live, and commercial commitments are in place.
⏱️
Delayed Launch
The product is ready but cannot be commercially launched until licensing is resolved. The delay can be months — and in that time, commercial relationships, investor commitments, and team morale suffer.
📄
Re-Papering of Customer Agreements
Client agreements, terms of service, and commercial contracts built without regulatory clarity may need to be entirely renegotiated or rewritten once the licensing picture becomes clear — creating legal exposure and commercial disruption.
🔄
Reclassification of the Operating Model
VARA may reclassify the activity, requiring a different licence category than originally assumed — forcing a restructure of the business model, governance framework, and potentially the entity structure itself.
💰
Higher Capital & Fee Exposure
Capital requirements, licence fees, and ongoing supervision fees may be higher than originally planned — particularly for multi-activity models where the combined prudential burden was not modelled at the outset.
📣
Marketing Breaches Before Platform Launch
VARA's Marketing Regulations 2024 can be breached before the platform ever launches. Promotional activity in the UAE — influencer campaigns, events, targeted social — may trigger enforcement regardless of whether a licence has even been applied for.
🏛️
Avoidable Regulator Questions & Reputational Damage
An unlicensed business that comes to VARA's attention before filing creates a different regulatory relationship than one that approaches VARA proactively. Avoidable queries and enforcement attention can damage the licensing application itself.
🎯
How We Help
We Help Founders, Boards, Investors & Operators Answer the Licensing Question Properly
Our support is focused on one goal: determine early whether you need a VARA licence, which one, and why — before you commit capital or go to market. Every engagement is structured around the specific operating model, not a generic advisory framework.
🗺️
Activity-by-Activity VARA Perimeter Analysis
We map your operating model against each regulated VA Activity — assessing whether your business falls inside or outside the licensing perimeter for each category, and identifying the activities where the answer is clear versus where it is arguable or structure-dependent.
🔍
Model Mapping Against Regulated VA Activities
We analyse the proposed business model — including product design, customer journey, asset flows, custody arrangements, and technology stack — against VARA's regulated VA Activity definitions to determine where the perimeter lines sit in substance.
⚖️
Licensing, Marketing, Issuance — or All Three
We identify whether the issue is a licensing question, a marketing compliance question, an issuance question, or a combination of all three — and advise on the sequencing of regulatory action required before commercial launch.
🏗️
Structuring Advice — Inside or Outside the Perimeter, Intentionally
Where the model can be legitimately structured to sit inside or outside the VARA perimeter, we advise on the structuring options — ensuring the business reaches its regulatory position intentionally rather than by accident or assumption.
💰
Capital & Prudential Impact Analysis
Where a licence is required, we analyse the capital and prudential implications — modelling the paid-up capital requirement, NLA, reserve assets, and insurance obligations — so the board understands the financial commitment before the application architecture is designed.
🚀
Launch-Readiness Advice for Dubai & Wider UAE Targeting
We advise on the regulatory steps required to launch a compliant business in Dubai — covering licensing, marketing compliance, issuance frameworks, and entity structuring — mapped to the commercial timeline and launch strategy.
The Goal Is Simple — Determine Early Whether You Need a VARA Licence, Which One, and Why
- We conduct the activity-by-activity VARA perimeter analysis — mapping your model against every regulated VA Activity in substance, not by label
- We identify whether the issue is licensing, marketing, issuance, or a combination — and advise on sequencing before commercial commitments are made
- We provide structuring advice to keep the business inside or outside the licence perimeter intentionally — with full awareness of the prudential implications
- We deliver launch-readiness advice mapped to the specific Dubai or UAE targeting strategy — covering every regulatory layer that applies before the first user onboards
FAQs
Frequently Asked Questions — VARA Licensing Perimeter
Not automatically. You need to assess whether your model falls within a regulated VA Activity in or from Dubai. The question is not whether you are a crypto company — it is whether what you do in substance fits one of the 8 regulated VA Activity categories under the VARA framework. Many businesses that deal with crypto do not automatically cross the licensing threshold. But many others do — and frequently underestimate it by focusing on labels rather than function.
Yes. VARA’s Marketing Regulations 2024 apply to foreign entities marketing VAs or VA Activities in or targeting the UAE — whether licensed or not. This means a company based entirely outside the UAE can still breach VARA’s marketing rules by running campaigns, using influencers, holding events, or otherwise targeting UAE residents with VA-related promotions. The marketing perimeter is separate from the licensing perimeter — and can be triggered independently.
Potentially yes. Marketing rules can apply even where the licensing question is separate. VARA defines “Marketing” broadly and assesses the overall campaign — not just individual posts or advertisements. If the marketing targets UAE residents, promotes a VA or VA Activity, or involves influencers operating in the UAE market, VARA’s Marketing Regulations 2024 may apply regardless of whether the underlying activity requires a VARA licence or not.
If it falls within Category 1 VA Issuance — such as certain FRVA (Fiat-Referenced Virtual Asset) or ARVA (Asset-Referenced Virtual Asset) structures — then yes, licensing may be required. Category 1 VA Issuance is expressly treated as a regulated VA Activity under VARA’s framework. Even where the issuer may not require licensing in the same way as an exchange or custodian, the issuance may still sit within VARA’s issuance framework and distribution controls — and VARA’s marketed materials relating to that issuance will still be subject to Marketing Regulations.
Because the selected activity determines everything that follows — the legal scope of the licence, the minimum paid-up capital threshold, which rulebooks apply, and the full prudential, technology, AML, conduct, and safeguarding requirements that attach. Misclassification can lock up more capital than necessary, trigger avoidable rulebook obligations, extend regulatory review cycles, and create post-licensing enforcement or remediation risk. Regulatory perimeter analysis must happen before drafting begins — not after the business has already built around incorrect assumptions. Restructuring after submission is expensive, time-consuming, and damaging to the application timeline.
VARA rulebooks apply cumulatively where multiple activities are licensed — meaning the compliance obligations, governance requirements, and prudential standards of each applicable activity-specific rulebook all apply simultaneously. The prudential burden — in particular the capital requirements — can increase significantly with each additional licensed activity. Multi-activity applications require careful structuring to ensure that the combined compliance scope is understood and that the prudential plan is correctly modelled for the full licence stack before the application architecture is designed.
Ready to Get Clarity on Your VARA Position?
Book a VARA Perimeter Assessment Call
Whether you are pre-launch, already operating, or rethinking your Dubai market entry strategy, the first step is always a proper regulatory perimeter assessment — not branding, not product naming, and not marketing rollout.