VARA Custody Licence in Dubai: Licensing, Capital, and Compliance Requirements

If there is one VARA licence category that founders regularly underestimate until surprisingly late, it is custody.

Why?

Because many businesses think of custody too narrowly. They assume custody only applies if they are:

• a “pure custodian,”
• a bank-style safekeeping business,
• or a large institutional vault provider.

Under VARA, that is too simplistic.

The real question is whether the business is safeguarding virtual assets for or on behalf of another entity and acting only on verified instructions from or on behalf of that entity. That is how Custody Services is defined in Schedule 1 of the Regulations, and VARA’s public licensed-activities page separately identifies Custody Services as a regulated VA Activity that requires a licence before it can be carried on in or from Dubai.

That means custody can become relevant much earlier than founders expect:

• exchange businesses that want to hold client assets,
• wallet businesses that control keys,
• infrastructure businesses that sit closer to client asset control than they admit,
• and broader crypto platforms that discover their “product feature” is actually a regulated custody function.

So if you are searching for:

• VARA custody licence
• custody licence Dubai
• VARA custody services
• crypto custody licence Dubai
• VARA capital requirements custody
• custody compliance Dubai

then this guide is built for you.

The most important point to understand at the start is this:

Custody under VARA is not just another add-on activity. It is a distinct, higher-risk regulated activity with its own rulebook, its own prudential burden, and its own operational discipline requirements. The Custody Services Rulebook states that it applies to all VASPs licensed by VARA to carry out Custody Services in the Emirate, and VARA’s public activity page confirms that firms must apply for and receive a licence before offering that activity in or from Dubai.

1) What are Custody Services under VARA?

The starting point is the activity definition itself.

Schedule 1 of the Regulations defines Custody Services as:
“safeguarding Virtual Assets for or on behalf of another Entity, and acting only on verified instructions from or on behalf of such Entity.”

That definition matters because it is wider and more functional than many founders assume.

It means the real licensing question is not:

“Do we call ourselves a custodian?”

It is:

“Are we safeguarding VAs for another person or entity, and do we act on instructions in relation to those assets?”

If the answer is yes, you are already very close to the licensing threshold for custody.

This is why custody analysis matters for businesses that describe themselves as:

• wallet providers,
• exchange platforms,
• embedded-asset solutions,
• execution venues with asset holding,
• or institutional infrastructure.

A softer commercial label does not change the underlying regulated function. VARA regulates the activity by substance, not by branding.

2) When is a VARA custody licence required?

A VARA custody licence is required when the business wishes to carry on Custody Services in or from Dubai outside DIFC. VARA’s public licensing page says any firm seeking to carry on Virtual Asset activities in or from Dubai must be licensed before commencing operations, and the Custody Services Rulebook says it applies to all VASPs licensed by VARA to carry out Custody Services in the Emirate.

That means the right threshold question is not:

“Are we a custody company?”

It is:

“Are we actually performing a custody function in or from Dubai?”

In practice, that can include businesses that:

• hold client assets,
• control access to client wallets,
• manage keys or signing authority,
• or otherwise sit in the asset-control chain on behalf of another person or entity.

This is especially important for exchanges and other multi-function businesses. A company may start by thinking of itself as:

• an exchange,
• a broker,
• or a platform,

and then later discover that the way it handles client asset control independently triggers the need for Custody Services licensing as well. VARA’s public activity page explicitly says that VASPs licensed to undertake multiple activities must meet the requirements for each activity in full.

3) Custody is a distinct activity, not just a feature

One of the biggest mistakes founders make is treating custody as a background feature of a broader crypto product.

VARA’s framework does not treat it that way.

The Rulebook portal lists Custody Services Rulebook as one of the standalone VA Activity and Other Rulebooks, separate from Exchange, Broker-Dealer, Lending and Borrowing, and other activities. That means custody is not just part of another licence class; it is a distinct licensed activity in its own right.

This matters because once custody is triggered, the business is no longer dealing only with:

• general licensing questions,
• or the rulebook for another primary activity.

It is also dealing with:

• the Custody Services Rulebook,
• the Company Rulebook,
• the Compliance and Risk Management Rulebook,
• the Technology and Information Rulebook,
• and the Market Conduct Rulebook. VARA’s Rulebook portal identifies those four as compulsory rulebooks applicable across the framework, with the activity-specific custody rulebook layered on top.

That is why custody should be treated as a major regulatory architecture decision, not as a technical detail.

4) Why custody is treated as a higher-risk activity

The reason custody receives this distinct treatment is straightforward: custody sits very close to the actual control of client assets.

That means it raises immediate regulatory questions around:

• safekeeping,
• asset segregation,
• key control,
• client instructions,
• loss, theft, or misappropriation risk,
• operational resilience,
• and client protection.

You can see that seriousness in the structure of the Custody Services Rulebook itself. The current rulebook includes sections dealing with:

• custody arrangements and controls,
• client VA wallets,
• key and wallet governance,
• technology and DLT standards,
• reconciliations,
• client treatment,
• and special features such as Staking from Custody Services, which is allowed only where explicitly authorised by VARA and expressly stated in the licence.

That last point is particularly revealing.

It shows that even once a VASP is licensed for custody, it does not automatically get to use client assets for staking or related purposes. The Rulebook page on Staking from Custody Services says that a custody VASP may only provide that service if it is explicitly authorised by VARA and that the authorisation is expressly stipulated in the licence. It also notes that incremental licensing and/or supervision fees apply for that regulated activity.

That is a strong sign of how carefully VARA treats custody-related risk.

5) Capital requirements: what is the paid-up capital for custody?

One of the first practical founder questions is:
What is the paid-up capital for a VARA Custody licence?

The clearest answer comes from Rule VI.B – Paid-Up Capital in the Company Rulebook.

For Custody Services, the required paid-up capital is:
the higher of (i) AED 600,000; or (ii) 25% of fixed annual overheads.

This is a serious prudential threshold.

It tells you two things immediately:

1. custody is not one of the lightest licence classes; and
2. The capital burden may rise above AED 600,000 if the firm’s fixed annual overheads are high enough that 25% of those overheads exceed the flat minimum.

That means founders should not budget only around the headline AED 600,000 number. The “higher of” formula means the actual capital requirement depends partly on the scale and cost base of the business.

And the paid-up capital must be held and maintained on an ongoing basis, not just shown once during the application. The Company Rulebook makes clear that Part VI is part of the continuing prudential framework for VASPs.

6) Paid-up capital is only one part of the prudential burden

A common founder mistake is to treat the paid-up capital number as the full cost of prudential readiness.

It is not.

Part VI of the Company Rulebook includes not only Paid-Up Capital, but also:

• Net Liquid Assets (NLA),
• Insurance,
• Reserve Assets,
• and related notification obligations.

That means a custody applicant should not ask only:

“Can we meet the paid-up capital threshold?”

It should also ask:

• Can we maintain sufficient liquid resources?
• Can we obtain and maintain the required insurance?
• Do our client-asset obligations trigger reserve-asset consequences?
• Can we support the wider prudential architecture of the custody business?

This is especially important because custody is one of the activities where the broader prudential framework is likely to matter operationally, not just legally.

7) Compliance requirements: custody does not sit outside AML and control obligations

Custody VASPs are not regulated only by the custody rulebook.

They also sit inside the broader Compliance and Risk Management Rulebook, which VARA identifies as one of the compulsory rulebooks applicable across the licensing framework.

That means custody applicants should expect requirements around:

• compliance management,
• risk management,
• AML / CFT,
• Travel Rule relevance where appropriate,
• books and records,
• reconciliation,
• reporting,
• and internal control discipline.

This matters because many founders initially think of custody as a mainly technical or wallet-control issue.

Under VARA, it is not.

It is also a compliance-intensive activity because a licensed custodian is handling:

• client assets,
• client instructions,
• operational risk,
• and financial crime exposure in a highly sensitive environment.

So the practical question is not:

“Can we secure the assets technically?”

It is also:

“Can we run the custody function inside a full regulatory control environment?”

That is a much bigger question.

8) Technology requirements: custody is deeply tied to systems, keys, and controls

Custody is one of the clearest examples of why VARA’s technology rulebook matters.

The Technology and Information Rulebook is one of the compulsory rulebooks, and the custody rulebook itself contains concepts and rules around:

• custody wallet structure,
• key and wallet governance,
• DLT standards,
• and client wallet controls.

This matters because a custody business cannot be assessed properly without understanding:

• who controls the keys,
• how signing authority is structured,
• how wallets are segregated,
• how operational access is governed,
• how incidents are managed,
• and how the custody environment is secured and audited.

A business that says:

• “our tech team handles that,”
  or
• “the wallet setup is proprietary”

is not yet answering the regulatory question.

For VARA, the custody proposition must be explainable, governable, and supportable as part of the licensed environment.

That is why custody applicants often face a heavier technology and operational-documentation burden than lighter activity classes.

9) Client asset use is constrained: staking from custody requires separate authorisation

One of the most commercially important points for founders thinking about custody economics is that custody does not automatically give the business freedom to use client assets for related yield strategies.

VARA’s rulebook page on Staking from Custody Services says that a VASP licensed to carry out Custody Services may only provide staking from custody if:

• it is explicitly authorised by VARA to do so, and
• that authorisation is expressly stipulated in its licence. It also states that the VASP will be subject to incremental licensing and/or supervision fees to undertake that regulated activity.

This is a very important practical restriction.

It means founders should not assume:

• “We’ll get the custody licence first, then we can layer in staking economics later.”

Under VARA, that additional step requires separate express authorisation.

That is another sign that custody is regulated as a client-protection-heavy activity, not as a free platform for experimenting with client-asset usage.

10) Multi-activity businesses: custody can widen the whole regulatory burden

Many businesses do not begin by planning to become pure custodians. They plan to be:

• exchanges,
• broker platforms,
• or broader crypto service providers.

But once those models involve actual safeguarding or control of client assets, custody may need to be licensed as a separate activity as well. VARA’s public licensed-activities page says VASPs licensed to undertake multiple activities must meet the requirements for each activity in full.

That has major implications.

If custody is added to the scope, the business may also need to budget for:

• the custody application and/or extension-fee impact,
• the custody paid-up capital threshold,
• wider governance requirements,
• wider technology and control explanation,
• and the operational discipline expected of a client-asset holder.

This is why exchanges and other platforms should not treat custody as a side issue. It can materially reshape the licensing strategy.

11) What founders most often underestimate about custody

By now, a pattern should be clear.

The most common founder mistakes around custody are:

They think custody only applies to standalone custodians

In reality, it can arise anywhere the business is safeguarding or controlling client VAs or wallet access.

They focus only on paid-up capital

But the prudential framework is broader and includes NLA, Insurance, Reserve Assets, and other requirements.

They treat custody as a technology issue only

But custody also triggers governance, compliance, conduct, and prudential requirements.

They assume client-asset use can be expanded later without separate approval

But staking from custody expressly requires additional VARA authorisation.

They discover too late that their broader product actually includes custody

This is especially common for exchanges, broker models, and wallet-heavy platforms.

These are exactly the kinds of misunderstandings that make custody licensing feel heavier than founders expected — not because the framework is unclear, but because the business model was not analysed carefully enough early on.

12) The real practical takeaway

If you strip the issue down to its essentials, a VARA Custody Licence means three things.

First, it is a distinct regulated activity

Custody is not just a feature of another licence. It has its own activity rulebook and its own licensing significance.

Second, it carries a meaningful prudential burden

The paid-up capital is the higher of AED 600,000 or 25% of fixed annual overheads, and that sits within the wider Part VI prudential framework.

Third, it requires serious operational and compliance discipline

A custody applicant must be ready to explain and support:

• client asset protection,
• wallet and key governance,
• custody arrangements,
• technology controls,
• AML and compliance architecture,
• and any enhanced features such as staking from custody.

That is the practical reality of custody under VARA.

Final takeaway

If you want the cleanest practical answer to:
“What does a VARA Custody Licence in Dubai involve?”

it is this:

A VARA Custody Licence is required where a business is safeguarding virtual assets for or on behalf of another entity and acting on verified instructions in relation to those assets, in or from Dubai outside DIFC. It is a distinct regulated activity under the VARA framework, with its own Custody Services Rulebook, and it sits inside a broader set of compulsory rulebooks covering company governance, compliance, technology, and market conduct.

Its capital burden is already significant:
the higher of AED 600,000 or 25% of fixed annual overheads, before accounting for the wider prudential framework.

That means custody is not just another feature of a crypto product. It is one of the clearest examples of a high-trust, high-control, high-compliance regulated activity under VARA.

How CRYPTOVERSE Legal Can Help

At CRYPTOVERSE Legal Consultancy, we help founders, exchanges, brokers, wallet businesses, and institutional digital asset operators assess whether their model triggers Custody Services under VARA and what that means for licensing, capital, and operational structuring. Our support includes activity classification, custody-perimeter analysis, capital and prudential planning, governance and compliance framework review, wallet and key-control regulatory mapping, and broader VARA licensing strategy.

CTA: If you want tailored guidance on whether your business needs a VARA Custody Licence in Dubai, and what the real licensing, capital, and compliance burden looks like for your model, contact CRYPTOVERSE Legal Consultancy to discuss your regulatory strategy.

FAQs