- Dubai — VARA Licensing Roadmap
Step-by-Step Guide to Getting a VARA Licence in Dubai
A practical, end-to-end roadmap for founders, exchanges, custodians, brokers, token issuers, and Web3 businesses — from activity scoping and readiness planning to ATI, full submission, regulator review, and final go-live.
8-Step Licensing Journey — At a Glance
01
Define the exact regulated activity — the foundation every other step depends on
02
Sharpen the Axe — complete readiness before the formal VARA process begins
03
Build the core licensing architecture — governance, capital, AML, technology
04
Submit IDQ → ATI → Full application → VARA review → FMP licence
05
Go-live readiness — licence issuance is the start of regulated life, not the end
Why a Step-by-Step Approach Matters
A VARA Licence Is Not Won by Filing Early — It Is Won by Filing Well
Dubai's virtual asset regime is activity-based, prudentially serious, and documentation-heavy. The success of the application depends not just on what the business wants to do — but on whether it can demonstrate the correct regulatory perimeter, governance substance, capital readiness, technology maturity, and a document set that is internally consistent and regulator-ready.
The best licensing strategy is a sequenced one. Each of the eight steps in the VARA journey builds on the previous — and cutting corners at an early step creates compounding problems later in the process. The activity classification at Step 1 determines the capital at Step 3, the documentation at Step 6, and the questions VARA asks at Step 7.
Firms that invest in the readiness phase before filing consistently produce better applications, generate fewer regulator queries, and move through the review process more efficiently than firms that file early without preparation.
💡
The Core Principle: A VARA licence is not won by filing early — it is won by filing well. Document quality, internal consistency, and prudential readiness are decisive at Stage 2. These things must be built before submission, not promised after.
What a Strong Application Must Show VARA
- The correct regulatory perimeter
The right VA Activity is identified and the application is scoped precisely around what the business actually does — not over-licensed or under-licensed.
- Governance and management substance
Real management presence in Dubai, credible control function appointments, and a governance framework that reflects the complexity of the licensed activity.
- Capital and liquidity readiness
Paid-up capital available in the required form, NLA modelled and ring-fenced, reserve assets in place, and insurance confirmed before submission.
- Technology and AML maturity
Technology controls and AML framework evidenced as operational — not described aspirationally — and calibrated specifically to the business model being licensed.
- Internally consistent documentation
Every document tells the same regulatory story — no contradictions between the RBP, fund flows, AML framework, governance structure, and technology policies.
🗂️
8 Steps
From activity scoping to go-live — each step builds on the last and shapes every step that follows
🪓
Sharpen First
Readiness phase before formal VARA process — where application quality is determined
📊
RBP = Core
The Regulatory Business Plan ties together every document — and exposes weaknesses across all of them
🚀
Go-Live = Start
Licence issuance is the beginning of regulated life — not the end of the compliance journey
The Complete VARA Licensing Roadmap
The 8-Step VARA Licensing Journey
Every VARA licence application follows the same eight-step journey. Steps 1 and 2 (activity definition and readiness) determine the quality of every step that follows. Steps 6 and 7 (full submission and regulator review) are where well-prepared applications pull decisively ahead of underprepared ones.
ST 01
🎯
Define the Exact Regulated Activity
The first step is determining what licence scope the business actually needs. If the activity is scoped incorrectly, the rest of the application is built on the wrong foundation — with consequences that compound through every subsequent step.
VARA Authorises These Specific VA Activities
- Advisory Services
- Broker-Dealer Services
- Custody Services
- Exchange Services
- Lending and Borrowing Services
- VA Management and Investment Services
- VA Transfer and Settlement Services
- Category 1 VA Issuance
The Selected Activity Determines
- Which rulebooks apply — baseline and activity-specific
- The paid-up capital threshold — and overhead-based calculation
- The application fee and annual supervision fee
- The control framework and documentation scope expected
⭐
Step 1 is the most consequential decision in the licensing strategy — everything else flows from it
ST 02
🪓
Complete a Readiness Phase Before Filing (Sharpen the Axe)
Before entering the formal VARA stages, serious applicants should complete a pre-submission readiness phase — what we call Sharpen the Axe. This focused preparation stage is designed to make the application regulator-ready before it reaches VARA. It reduces avoidable gaps, improves file consistency, and puts the applicant in a stronger position to respond to VARA requests quickly and confidently.
What This Stage Typically Includes
- Activity and perimeter analysis — rulebook mapping
- Governance and ownership structuring
- Capital and prudential planning
- Regulatory Business Plan drafting
- AML and Travel Rule framework design
- Technology and wallet documentation planning
- Document matrix creation and submission tracker
⭐
Sharpen the Axe is how serious applicants avoid looking unprepared once VARA starts asking real questions
ST 03
🏗️
Prepare the Core Licensing Architecture
Once the business model is scoped, the next step is to build the core regulatory architecture behind the application. This is the structural layer that VARA will evaluate at Stage 1 and probe more deeply at Stage 2.
Architecture Components
- Corporate structure and UBO disclosures — full ownership transparency
- Board and senior management appointments — Fit & Proper ready
- Control function readiness — CO, MLRO, CISO in place
- 5-year financial model and projections
- Prudential capital confirmation — PUC in approved form
- Operational model mapping — customer journey, fund flows
- Outsourcing logic and third-party controls
- Technology and information security structure
Prudential Clarity Required at This Step
- What paid-up capital is required — and the overhead-based calculation
- What Net Liquid Assets must be maintained — and in what form
- Whether reserve assets apply — and how they will be held
- What insurance coverage is expected — types and levels
ST 04
📤
Submit the Initial Disclosure Questionnaire (IDQ)
For new firms, the formal VARA journey begins with the Initial Disclosure Questionnaire. The IDQ is the gateway into the licensing process and is submitted alongside initial information on the business, ownership, and management structure.
IDQ Submission Details
- Submitted to Dubai Economy & Tourism (DET) or the relevant Free Zone
- Accompanied by initial business, ownership, and management information
- Triggers the commencement of the formal VARA review process
- The quality of IDQ documentation signals application readiness from day one
📋
The IDQ is the formal entry point — a well-prepared Sharpen the Axe phase means the IDQ submission is already near-complete before this step begins
ST 05
🏛️
Obtain Approval to Incorporate (ATI)
After IDQ submission, preliminary documentation, and payment of the initial 50% of licence fees, the applicant may receive Approval to Incorporate (ATI) / In-Principle Approval (IPA). ATI is a setup approval — not an operating licence.
What ATI Allows
- Incorporate the legal entity where not yet registered
- Lease office space and secure UAE bank accounts
- Onboard employees and build out the team
- Establish systems, infrastructure, and technology
- Complete operational setup ahead of Stage 2
What ATI Does NOT Allow
✕ Commencing any regulated Virtual Asset Activities
✕ Client onboarding or VA transaction execution
✕ Soft launches or limited platform access for users
ST 06
📁
Prepare and Submit the Full VASP Application
Once ATI/IPA is granted, the applicant moves into the full submission stage. This is where the complete licensing file is assembled and submitted across four documentation categories. VARA expressly states the document list is non-exhaustive — additional materials may be requested at any point.
4 Core Documentation Categories
- Corporate & Governance: incorporation docs, UBO list, Fit & Proper, source of funds, org structure, governance framework, key personnel, RBP, financial projections, capital proof, insurance, succession, wind-down plan
- Risk & Compliance: enterprise risk framework, compliance manual, AML/CFT policies, outsourcing policy, conflicts, insider lists, customer journey workflows, client agreements, privacy policy, marketing policy, records management
- Technology: infrastructure design, risk assessment, BCM/DR plan, wallet and key management policy, public keys and wallet addresses, information security policy, penetration testing results
- Additional (where applicable): whitepaper, proprietary trading information, DeFi support materials, VA payment supporting information
ST 07
🔄
Manage VARA Review, Questions & Remediation
After the full application is submitted, VARA may request further information, hold meetings or interviews, ask for clarifications, or request remediation and additional evidence. This is the stage where weak applications slow down — and well-prepared ones move through efficiently.
Typical Review Friction Points
✕
Unclear transaction flows
✕
Weak prudential assumptions
✕
Underdeveloped AML controls
✕
Insufficient governance support
✕
Incomplete or inconsistent policies across the document set
📋
The faster and better you respond to VARA queries, the smoother the pathway to approval. Every response must strengthen — not reopen — settled issues in the application
ST 08
🚀
Secure the Licence and Prepare for Go-Live
Once VARA is satisfied with the application, the applicant pays the remaining 50% of licence fees and the first year's supervision fees — and may receive the VASP FMP Licence, potentially subject to operational conditions. Licence issuance is not the end of the regulatory process. It is the start of regulated life.
Go-Live Readiness Checklist
- Governance in place — board and management operational
- Compliance function active — CO, MLRO, CISO functioning
- Prudential thresholds maintained — PUC, NLA, reserves confirmed
- Policies implemented operationally — not just documented
- Systems and reporting tested — BCDR and incident pathways live
- Escalation pathways ready — for prudential and incident notifications
✔
The business should be genuinely ready to operate compliantly from day one of the licence — not still building systems when regulated activity begins
What Documents Matter Most
The Three Document Areas That Carry the Most Weight
While every part of the file matters, the strongest VARA applications place particular emphasis on three document areas — the Regulatory Business Plan, prudential evidence, and the control framework. These three areas are the ones most scrutinised by VARA and most commonly incomplete in weaker applications.
📊
The Regulatory Business Plan
The RBP is the document that ties together every other element of the application. It is the primary narrative document — and the one VARA reviewers use to test whether the governance, capital, AML, and technology frameworks actually match the business being described. Weak RBPs create weak applications across every other category.
- What the business does and why it fits the requested VA Activity
- How customers are onboarded, serviced, and offboarded
- How funds and Virtual Assets flow through the model
- What systems, controls, and third parties are involved
- How capital, liquidity, insurance, and reserves support the model
- How the firm will operate compliantly after licensing
- Revenue logic and 5-year financial projections
- Governance structure and risk framework narrative
🏦
Prudential Evidence
VARA requires demonstrable financial readiness — not a commitment to capitalise after approval. The prudential evidence package must show that capital is available in the right form, NLA is modelled against the right operating expense base, insurance is in place, and reserves are addressed for the specific business model.
- Proof of paid-up capital — held in trust account or surety bond, VARA as beneficiary
- NLA modelling — eligible assets mapped against operating expense projections
- Insurance positioning — PI, D&O, commercial crime confirmed with a regulated insurer
- Reserve asset methodology — 1:1 client liability coverage where applicable
- 5-year financial projections — capital adequacy demonstrated over the projection period
🛡️
Control Framework Documents
The AML, compliance, outsourcing, risk, marketing, and technology documents must all match the actual business model being proposed. Control framework documents that are generic, template-based, or inconsistent with the RBP are the single most common source of extended VARA query rounds.
- AML/CFT programme — EWRA, CDD/EDD, transaction monitoring, Travel Rule, sanctions screening
- Compliance manual and monitoring programme — calibrated to the licensed activities
- Outsourcing policy and agreements — all material outsourcing relationships documented
- Technology documentation — architecture, BCDR, cybersecurity, penetration testing results
- Marketing policy — VARA Marketing Regulations 2024 compliant, with sample materials
- Customer journey workflows — end-to-end, consistent with fund flow diagrams and RBP
How We Help
Full VARA Licensing Support — What We Deliver Across All 8 Steps
We guide applicants through each step of the VARA journey — from the Sharpen the Axe readiness phase through to the FMP licence and go-live readiness — managing every workstream as part of an integrated strategy, not as isolated deliverables.
🎯
Activity-Scope & Perimeter Analysis (Step 1)
We confirm the correct VA Activity classification, identify all applicable rulebooks across baseline and activity-specific obligations, map the combination risks for multi-activity strategies, and produce the regulatory perimeter memo that anchors the entire licensing strategy before any other work begins.
🪓
Sharpen the Axe Readiness Stage (Step 2)
We run the 4–8 week readiness phase — building the document matrix, identifying all applicable rulebooks, scoping the activity perimeter, and ensuring the application is regulator-ready before a single document is filed with VARA. This is where application quality is determined and where the most efficient licences are won.
🏗️
ATI/IPA & Stage 2 Filing Strategy (Steps 4–6)
We prepare the IDQ submission, manage the ATI process, and design the Stage 2 filing strategy — sequencing the document build for maximum review efficiency and ensuring the complete file is assembled, checked for consistency, and submitted in the format VARA expects.
📊
Regulatory Business Plan Drafting (Step 3 + 6)
We draft the complete Regulatory Business Plan — tying together the business model, governance, customer journey, capital assumptions, risk framework, and technology stack into a single, coherent, commercially grounded narrative that is written for a VARA regulator, not an investor.
💰
Prudential Capital & Liquidity Planning (Step 3)
We model paid-up capital, NLA, reserve assets, and insurance requirements — including the overhead-based PUC calculation — integrate the prudential plan into the RBP and financial projections, and produce the board-ready capital confirmation that VARA expects to see at submission.
🛡️
Governance, AML & Technology Documentation (Steps 3 + 6)
We prepare the complete governance framework, AML/CFT programme, and technology documentation — ensuring internal consistency between every document in the file and calibrating each control to the specific activities and operating model being licensed.
📋
Document Matrix & Submission Management (Step 6)
We build and maintain the document matrix and submission tracker across all four documentation categories — tracking completion status, managing dependencies, coordinating specialist input, and ensuring nothing is missing when the full application is filed with VARA.
🔄
Regulator Response & Go-Live Support (Steps 7–8)
We manage all VARA interactions throughout the review process — drafting query responses, managing the issue log, coordinating VARA meetings and management interviews — and carry the file through IPA conditions and operational readiness checks to FMP licence issuance and go-live compliance support.
From Activity Scoping at Step 1 to Go-Live at Step 8 — End-to-End VARA Licensing
- We define the right activity scope and run the Sharpen the Axe readiness phase before the formal VARA process begins
- We build the core licensing architecture — governance, capital, AML, technology — and draft the Regulatory Business Plan
- We manage the ATI submission, Stage 2 filing, and all VARA interactions through the review and query phase
- We carry the file to FMP licence issuance and support go-live readiness — because the licence is only the beginning of regulated life
A VARA licence is not won by filing early — it is won by filing well. Every step in the journey must be built correctly before the next one begins.
FAQs
Frequently Asked Questions — VARA Licensing Process
For new firms, the first formal regulatory step is the Initial Disclosure Questionnaire (IDQ), submitted to Dubai Economy and Tourism (DET) or the relevant Free Zone. However, we strongly recommend completing the Sharpen the Axe readiness phase before the IDQ is submitted — so that by the time the formal VARA process begins at Step 4, the governance framework, regulatory business plan, capital structure, and document matrix are already substantially built. Filing a strong IDQ is significantly more efficient than filing a weak one and attempting to remediate during the formal review process.
Yes. For new firms, ATI (Approval to Incorporate) must be obtained before the full Stage 2 VASP licence application can proceed. ATI is the formal output of the Stage 1 process — IDQ, preliminary documentation, and payment of the initial 50% of licence application fees — and permits the firm to incorporate its legal entity, secure office space, open bank accounts, onboard employees, and establish operational infrastructure. It does not permit the commencement of regulated VA activities, which can only begin after the full VASP FMP Licence is granted at Stage 2.
No. ATI allows incorporation and operational setup only. Regulated VA Activities may only begin after the full VASP FMP Licence has been issued. This prohibition applies to all VA activities within the licence scope — including soft launches, limited beta access for external users, client onboarding, and VA transaction execution. Operating regulated activities before the FMP Licence is granted is a regulatory breach regardless of the business’s operational readiness or the proximity to final licence issuance.
No. VARA expressly states that the published documentation list is non-exhaustive and that additional materials may be requested at any point during the licensing review. This means the application should be approached as a dynamic regulatory process — not a closed checklist exercise where submission of the listed documents guarantees the completion of the information request phase. The quality and internal consistency of the initial submission directly determines how many additional requests VARA will make during Step 7, which is why the Sharpen the Axe and document matrix phases are commercially important — not just procedurally so.
The RBP is the document that ties together every other element of the application. VARA reviewers use the RBP to test whether the governance framework, capital structure, AML programme, technology architecture, and customer journey workflows described elsewhere in the file actually match the business model being proposed. Where the RBP is underdeveloped, inconsistent with the fund flow diagrams, or commercially unconvincing, it exposes weaknesses across every other document category — generating query rounds on governance, compliance, capital, and technology simultaneously. A strong RBP, written for a VARA regulator rather than an investor, is the single most efficient investment in application quality.
Ready to Start Your VARA Licensing Journey?
Book a VARA Licensing Strategy Call
Whether you are at Step 1 — defining your activity scope — or ready to build the full document file, a strong VARA licence starts with the right strategy, the right preparation, and the right regulatory partner.