VARA Lending and Borrowing Licence: What Crypto Financing Businesses Must Know

If there is one VARA licence category that crypto founders often underestimate until very late in the structuring process, it is Lending and Borrowing Services.

Why?

Because many businesses still describe themselves in softer, more commercial language:

• yield platform,
• earn product,
• treasury optimisation,
• collateralised liquidity solution,
• credit layer,
• financing protocol,
• structured return product.

Under the VARA framework, those labels do not answer the legal question.

The real question is whether the business is carrying on Lending and Borrowing Services in or from Dubai outside DIFC. VARA’s public licensing page says that any firm seeking to carry on Virtual Asset activities in or from Dubai, excluding DIFC, has a legal obligation to be licensed before commencing operations. VARA’s public Licensed Activities page separately lists Virtual Assets Lending and Borrowing Services as one of the regulated activity categories that require licensing before operations can begin in or from Dubai.

That matters because a crypto financing model may look commercially familiar and still be heavily regulated in Dubai.

This guide explains:

• what the VARA Lending and Borrowing Licence covers,
• when a crypto financing business is likely to trigger it,
• how it fits into the wider VARA framework,
• what capital and fee burdens apply,
• what compliance and prudential issues matter most,
• and what founders most often get wrong about this licence class.

1) What is the VARA Lending and Borrowing Licence?

At the highest level, the VARA Lending and Borrowing Licence is the licence required to carry on Lending and Borrowing Services in or from Dubai outside DIFC.

VARA’s public Licensed Activities page identifies Virtual Assets Lending and Borrowing Services as a regulated VA Activity. The Lending and Borrowing Services Rulebook confirms that it is issued pursuant to, and forms part of, the Virtual Assets and Related Activities Regulations 2023, and that it applies to all VASPs licensed by VARA to carry out Lending and Borrowing Services in the Emirate.

That means the legal question is not:

“Do we call ourselves a lending platform?”

It is:

“Are we, in substance, carrying on lending or borrowing activity involving virtual assets in or from Dubai?”

That is the threshold issue that matters.

And because lending/borrowing models often evolve out of other product categories — exchanges, treasuries, DeFi-adjacent products, institutional liquidity offerings — this is one of the easiest areas in which founders drift into licensable territory without initially realising it.

2) Why founders get this category wrong

There are a few reasons why this licence class is commonly misunderstood.

First, many founders assume that if a product is described as:

• “earn,”
• “yield,”
• “liquidity access,”
• or “capital efficiency,”

then it somehow sounds less like regulated lending.

Second, a lot of crypto financing businesses begin as product features attached to something else:

• exchange margin functionality,
• treasury deployment,
• institutional liquidity programmes,
• collateralised borrowing,
• or customer asset monetisation.

Third, many founders still think the main VARA licence categories are:

• exchange,
• custody,
• broker-dealer,
• token issuance.

That leaves financing businesses wrongly thinking they sit in a secondary or less developed part of the perimeter.

But VARA’s framework does not treat Lending and Borrowing as a side issue. It has its own activity-specific rulebook, sits in the higher-fee band, carries meaningful paid-up capital requirements, and operates inside the same broader compulsory rulebook environment as other major activity classes.

That is a strong signal that Dubai sees crypto financing as a serious regulated activity, not merely a product add-on.

3) The Dubai nexus: “in or from Dubai” still controls the analysis

Like the rest of the VARA framework, the activity analysis is not only about what the business does, but also where it is carried on.

VARA states that it is the sole authority regulating virtual assets across Dubai mainland and free zones except DIFC, and its licensing page says the legal obligation applies to firms carrying on VA Activities in or from Dubai. VARA’s licensed-activities page also says the listed activities may be offered to customers resident in the Emirate or to global customers from Dubai where the activity is permissible.

That means the key question is not:

“Are our users in Dubai?”

It is:

“Are we carrying on Lending and Borrowing Services in or from Dubai?”

This is especially relevant for:

• offshore groups using Dubai as an operating base,
• financing businesses serving global institutional clients from Dubai,
• firms with Dubai management and execution teams,
• and businesses that think offshore incorporation solves the VARA issue.

It usually does not.

The more important issue is the functional and geographic nexus to Dubai.

4) What kinds of crypto financing businesses are likely to trigger this licence?

In practical terms, the following kinds of businesses should examine the Lending and Borrowing perimeter carefully:

• crypto lending platforms,
• borrowing products secured by virtual assets,
• yield / earn products built around lending deployment,
• margin-style financing structures,
• treasury lending programmes,
• institutional crypto credit businesses,
• products involving repo- or reverse-repo-style VA financing,
• and businesses using customer or counterparty VAs in financing structures.

The older 2023 Regulations extract makes this clearer by showing that the category includes entering into lending, borrowing, repurchase, or reverse repurchase transactions in respect of a Virtual Asset for legitimate trading purposes, and transactions involving the provision of a Virtual Asset as collateral in certain contexts. That wording helps show how broad the financing concept can be under the VARA regime.

That is why founders should not ask only:

“Do we call this lending?”

They should ask:

“Does the product, in substance, involve lending, borrowing, repo-style financing, or collateralised VA financing?”

If yes, the licensing analysis is likely serious.

5) Why “yield” language does not avoid the trigger

One of the biggest mistakes in crypto financing is to assume that changing the commercial label changes the legal substance.

A platform may call the product:

• “earn,”
• “yield,”
• “rewards,”
• “treasury optimisation,”
• or “capital efficiency.”

But if the mechanics involve lending out VAs, borrowing against VAs, or using VA collateral to support financing transactions, then the legal analysis does not stop at branding.

VARA’s public activity list does not regulate labels. It regulates activity. And the presence of a dedicated Lending and Borrowing Services Rulebook makes clear that financing structures around virtual assets are a recognised, licensable category.

This is especially important for founders building products that start as treasury features and later become client-facing revenue models. What begins as:

• an internal yield programme,
  or
• a private liquidity arrangement

can become licensable once it is offered as a real service in or from Dubai.

6) The public licensing path: how a lending/borrowing business enters VARA’s system

A Lending and Borrowing applicant enters the same broad licensing process as other VASPs.

VARA’s public Licence Applications page says new firms apply through a two-stage process:

1. Approval to Incorporate (ATI)
2. full VASP Licence application. VARA also notes that ATI allows the firm to complete legal incorporation and operational setup, but not to carry on Virtual Asset activities yet.

That means a lending/borrowing applicant should expect to:

• define the activity scope clearly,
• build the business and regulatory narrative,
• pass through ATI,
• then prepare and submit the full application materials,
• and engage with VARA through review, meetings, interviews, and possible requests for more documentation during Stage 2. VARA’s public page expressly says Stage 2 may involve meetings, interviews, and requests for additional documentation.

For financing businesses, this matters because the regulator is likely to want clarity on:

• who is lending to whom,
• what assets are involved,
• how collateral works,
• how risk is managed,
• how exposures are monitored,
• what client protections exist,
• and whether the model interacts with other activities such as custody or brokerage.

Those are not light questions.

7) Rulebook layering: the lending/borrowing licence does not sit alone

A Lending and Borrowing VASP does not comply only with the activity-specific rulebook.

The Lending and Borrowing Services Rulebook says it applies in addition to all other requirements in the Regulations and that VASPs licensed for Lending and Borrowing must also comply with the rulebooks applicable to all VASPs, including:

• Company Rulebook
• Compliance and Risk Management Rulebook
• Technology and Information Rulebook
• Market Conduct Rulebook.

And where the VASP is licensed for additional VA Activities, it must also comply with the activity-specific rulebooks for those activities.

That means the regulatory environment for a crypto financing business is layered:

Layer 1 — The Regulations

The overarching legal framework.

Layer 2 — The compulsory rulebooks

These create the baseline around governance, compliance, technology, and market conduct.

Layer 3 — The Lending and Borrowing Services Rulebook

This adds the activity-specific rules for crypto financing businesses.

This matters because many first-time applicants read only the activity-specific rulebook and underestimate the baseline burden. Under VARA, the business is not just being allowed to offer financing. It is being required to operate as a regulated institution that can offer financing safely and credibly.

8) Capital requirements: what is the paid-up capital for Lending and Borrowing?

One of the first practical founder questions is:
What is the paid-up capital requirement for a VARA Lending and Borrowing Licence?

The answer comes from Rule VI.B – Paid-Up Capital in the Company Rulebook.

For Lending and Borrowing Services, the required paid-up capital is:
the higher of (i) AED 500,000; or (ii) 25% of fixed annual overheads.

That tells founders two things immediately:

1. this is not one of the lightest licence classes from a prudential standpoint; and
2. The actual capital burden may rise above AED 500,000 if 25% of fixed annual overheads exceeds the flat minimum.

This is why budgeting purely around the flat headline figure can be misleading. A more ambitious operating footprint can increase the paid-up capital requirement materially.

9) Fee profile: this is a higher-tier activity class

Under VARA’s public fee structure, Lending and Borrowing Services sits in the higher fee band.

VARA’s fee schedule places Lending and Borrowing Services alongside:

• Broker-Dealer,
• Category 1 Issuance,
• Custody,
• Exchange,
• and VA Management and Investment Services,

with:

• AED 100,000 application fee
• AED 200,000 annual supervision fee.

That is another useful signal.

Even before the capital and compliance analysis, the fee profile tells you that VARA treats crypto financing businesses as a serious supervised category rather than a light ancillary product class.

And as always under VARA, the visible filing fee is only part of the real economic burden.

10) Prudential burden: paid-up capital is only the beginning

A major founder mistake is to treat paid-up capital as the whole prudential story.

It is not.

The Company Rulebook’s Part VI – Capital and Prudential Requirements includes:

• Paid-Up Capital
• Net Liquid Assets
• Insurance
• Reserve Assets
• and further notification and prudential obligations.

That means a serious Lending and Borrowing applicant should not ask only:

“Can we meet AED 500,000?”

It should also ask:

• Can we maintain sufficient liquidity?
• Can we support the insurance requirements?
• Does the structure create reserve-asset implications?
• Can we maintain prudential resilience on an ongoing basis?

This matters because financing businesses can create concentrated exposures very quickly:

• borrower default risk,
• collateral volatility,
• liquidity mismatch,
• and wider counterparty or operational concentration.

Those realities are exactly why the prudential framework matters in this licence class.

11) Compliance requirements: this category is inherently control-heavy

All licensed VASPs must comply with the Compliance and Risk Management Rulebook, and this is especially important for lending and borrowing businesses. VARA’s rulebook update page shows the rulebooks were updated in September 2025, reinforcing that applicants should work from the current rulebook set.

For a financing business, the regulator is likely to focus heavily on:

• compliance governance,
• risk management,
• AML/CFT,
• source-of-funds and source-of-wealth logic where relevant,
• client due diligence,
• suspicious activity monitoring,
• books and records,
• and how collateral, counterparties, and client exposures are tracked.

This is one reason a financing platform cannot be treated as just a product or engineering project. The control environment is central to whether the model looks licensable.

The existence of a dedicated Lending and Borrowing rulebook plus the compulsory Compliance and Risk Management Rulebook shows clearly that VARA expects a strong control culture around crypto financing.

12) Notifications and prudential stress: VARA expects early warning discipline

One particularly important clue about the seriousness of this activity class comes from the rulebook content surfaced in search results. The rulebook portal notes that:
VASPs providing Lending and Borrowing Services must notify VARA immediately if certain requirements in the rulebook are not met, or may not be materially met in the foreseeable future.

That is a strong sign of regulatory posture.

It means VARA is not expecting financing businesses to wait until failure is complete before engaging. It expects early warning, forward-looking prudential awareness, and escalation discipline.

That matters because lending and borrowing models can deteriorate quickly when:

• collateral values fall,
• borrower exposures widen,
• liquidity tightens,
• or market conditions change abruptly.

A business that cannot identify and escalate those problems early is unlikely to inspire confidence as a licensed financing VASP.

13) Key legal issues: collateral, rehypothecation, and client expectations

Even without quoting the entire activity rulebook, the nature of this licence class makes several core legal issues unavoidable:

Collateral structure

If borrowing is secured by virtual assets, the documentation and operational handling of collateral become central legal issues.

Client disclosures

Users must understand:

• what risks they are taking,
• what happens in default or liquidation scenarios,
• whether assets may be rehypothecated or reused,
• and how returns or obligations are generated.

Product characterisation

A product may be marketed as:

• yield,
• rewards,
• treasury enhancement,
• liquidity provision,
  while in substance operating as a lending or borrowing facility.

Boundary with other activities

The model may also touch:

• custody,
• broker-dealer,
• management/investment,
• or transfer and settlement,

depending on who holds assets, who routes transactions, and how collateral or settlement flows operate.

These are exactly the areas where founders often discover that what sounded like one neat product category is actually a multi-activity regulated model.

14) Technology and operational controls matter just as much as legal drafting

Crypto financing businesses are often built on:

• automated collateral engines,
• liquidation logic,
• treasury routing,
• oracle-dependent pricing,
• wallet and settlement integrations,
• or smart-contract-based risk mechanics.

That means the Technology and Information Rulebook is not peripheral. It is central.

A lending/borrowing VASP must be able to explain:

• how pricing works,
• how collateral is monitored,
• how liquidation or enforcement logic works,
• how system failures are handled,
• how incidents are escalated,
• and how the technology stack is governed.

This is one reason financing businesses can feel more complex in licensing than their founders initially expect. They are not simply commercial arrangements. They are also operational and systems-intensive regulated businesses.

15) The biggest founder mistakes in this category

By now, the pattern should be clear.

The most common mistakes in the VARA Lending and Borrowing category are:

Treating “yield” as different from lending

Branding does not determine the legal classification.

Assuming the model is lighter because it is not an exchange

Lending/borrowing is a standalone higher-tier activity class.

Budgeting only for the application fee

The prudential burden is broader than the visible fee line.

Ignoring the wider rulebook stack

The compulsory rulebooks still apply.

Underestimating cross-activity overlap

A financing business may also trigger custody, transfer/settlement, or management/investment issues.

Treating the model as a simple product feature

VARA is licensing a regulated financing business, not just approving a UI feature.

Those are exactly the errors that make this licence class feel heavier than expected.

Final takeaway

If you want the cleanest practical answer to:
“What must crypto financing businesses know about the VARA Lending and Borrowing Licence?”

it is this:

A VARA Lending and Borrowing Licence is required where a business is carrying on regulated crypto financing activity in or from Dubai outside DIFC. It is a distinct licensed activity under the VARA framework, governed by its own Lending and Borrowing Services Rulebook, and it sits on top of the compulsory Company, Compliance, Technology, and Market Conduct Rulebooks.

Its paid-up capital requirement is:
the higher of AED 500,000 or 25% of fixed annual overheads.

Its visible fee burden is:
AED 100,000 application fee and AED 200,000 annual supervision fee.

But the real regulatory burden goes beyond that. Founders also need to think about:

• collateral structure,
• prudential resilience,
• compliance and AML/CFT,
• technology governance,
• client disclosure,
• and whether the financing model overlaps with other regulated VA Activities.

How CRYPTOVERSE Legal Can Help

At CRYPTOVERSE Legal Consultancy, we help founders, yield platforms, treasury products, institutional crypto lenders, borrowing platforms, and other digital asset financing businesses assess whether their model triggers Lending and Borrowing Services under VARA and what that means for licensing, capital, compliance, and structuring. Our support includes activity classification, financing-perimeter analysis, product-characterisation review, prudential-planning guidance, compliance and disclosure review, Regulatory Business Plan support, and broader VARA licensing strategy.

CTA: If you want tailored guidance on whether your business needs a VARA Lending and Borrowing Licence, and what the real legal and regulatory burden looks like for your crypto financing model in Dubai, contact CRYPTOVERSE Legal Consultancy to discuss your regulatory strategy.

FAQs