When Is a VARA Licence Required? Understanding the Licensing Threshold in Dubai

If you are planning a crypto business in Dubai, one of the most important legal questions is also one of the most misunderstood:

When is a VARA licence actually required?

A lot of founders ask the question in the wrong way.

They ask:

• “Are we a crypto company?”
• “Are we only a platform?”
• “We are not an exchange, so are we outside?”
• “We are offshore, so do we still need a licence?”
• “We are only marketing for now — does licensing even matter yet?”

Under the VARA framework, those questions are often too vague to give a safe answer.

Because Dubai does not regulate businesses based on how they describe themselves in commercial language. It regulates them based on whether they are carrying on one or more regulated VA Activities in or from Dubai outside DIFC. VARA’s official licensing page says any firm seeking to carry on Virtual Asset activities in or from Dubai, excluding DIFC, has a legal obligation to be licensed by VARA before commencing operations. The Rulebook states the same point even more directly: all entities wishing to carry out one or more VA Activities in the Emirate must seek authorisation from VARA before conducting any VA Activity, and must apply for, obtain, and maintain a licence for each VA Activity they will conduct.

That means the right threshold question is not:

“Are we in crypto?”

It is:

“Are we carrying on one or more regulated VA Activities in or from Dubai?”

That is the real legal trigger.

This article explains:

• when a VARA licence is required,
• how the licensing threshold actually works,
• what kinds of businesses usually trigger it,
• why some businesses wrongly assume they are outside the perimeter,
• how marketing can create exposure even before licensing is complete,
• and what founders should do when the answer is not obvious.

If you are searching for:

• when is a VARA licence required
• do I need a VARA licence
• who needs a VARA licence
• VARA licence Dubai
• crypto licence Dubai
• licensing threshold VARA
• can I operate a crypto business in Dubai without a licence

then this guide is built for you.

1) The short answer

The short answer is:

A VARA licence is required when an entity wishes to carry out one or more regulated VA Activities in or from Dubai outside DIFC. VARA says firms seeking to carry on Virtual Asset activities in or from Dubai must be licensed before commencing operations, and the Rulebook requires authorisation before conducting any VA Activity.

But that short answer is not enough on its own.

To apply it properly, you need to know:

• what counts as a VA Activity,
• where the Dubai perimeter begins and ends,
• what “in or from Dubai” means in practical terms,
• and why business labels like “platform” or “infrastructure” often do not answer the question safely.

That is where the real analysis begins.

2) The first key point: the threshold is activity-based, not branding-based

One of the most important features of the VARA regime is that it is built around activities, not general industry labels.

The Rulebook defines “VA Activity” by reference to the activities listed in Schedule 1 of the Regulations, and VARA’s public licensed-activities page identifies the core regulated activity categories. The same page says any VASP seeking to offer those services must apply for and receive a licence before it can begin virtual asset activities in Dubai.

This matters because a lot of businesses describe themselves using commercial shorthand such as:

• platform,
• wallet solution,
• infrastructure provider,
• ecosystem,
• market gateway,
• DLT service provider,
• token project,
• crypto payments layer.

Those labels may be useful for customers or investors. They are often not useful enough for regulatory analysis.

VARA wants to know what the business actually does.

Its public materials identify the regulated buckets as:

• Advisory Services
• Broker-Dealer Services
• Custody Services
• Exchange Services
• Lending and Borrowing Services
• VA Management and Investment Services
• VA Transfer and Settlement Services
• Category 1 VA Issuance.

So the threshold question becomes:

• Are you giving personalised virtual asset recommendations?
• Are you arranging or routing transactions?
• Are you safeguarding or controlling client VAs?
• Are you operating a trading venue or matching orders?
• Are you lending or borrowing VAs?
• Are you managing VAs for others?
• Are you transferring or settling VAs?
• Are you issuing a Category 1 token?

If the answer is yes to one or more of those, the licensing threshold may already be crossed.

3) The second key point: the Dubai perimeter matters

A VARA licence is not required for every crypto activity everywhere. The location and operating base matter.

VARA says it regulates and oversees the provision, use, and exchange of virtual assets in and from the emirate of Dubai, and that it is the sole authority regulating virtual assets across Dubai’s free zones and mainland, except within DIFC.

That means the threshold question only makes sense once you ask:

Are we operating in or from Dubai outside DIFC?

If the answer is yes, then the VARA regime is directly relevant. If the business is based in Dubai mainland or a Dubai free zone outside DIFC, or if the regulated activity is being carried on from Dubai, the licensing requirement can arise. VARA’s public licensing page uses that exact phrase: in or from Dubai.

This is why a lot of founders get the analysis wrong early. They think:

• “We are offshore, so Dubai rules should not matter.”
• “We only plan to serve global clients, not Dubai clients.”
• “We are incorporated elsewhere, so VARA is not relevant.”

Those statements can be misleading if the activity is still being carried on from Dubai.

The threshold is not limited to businesses serving Dubai residents only. VARA’s licensed-activities page says the relevant services may be offered in or from Dubai, including to global customers from Dubai where permissible.

4) The clearest cases where a VARA licence is required

Some business models are squarely inside the licensing threshold.

Exchanges

If the business exchanges or converts fiat and virtual assets, exchanges one VA for another, matches orders between buyers and sellers, or maintains an order book, it is likely in Exchange Services territory and will generally need a licence.

Broker-style businesses

If the business receives, arranges, routes, solicits, or intermediates virtual asset transactions, it may fall within Broker-Dealer Services, even if it does not look like a full exchange.

Custodians

If the business safeguards, holds, or controls client virtual assets or wallet access, it is likely in Custody Services territory and licensing becomes very likely.

Transfer and settlement providers

If the business transmits or transfers VAs from one entity to another, or from one entity to another wallet, address, or location, it may be carrying on VA Transfer and Settlement Services and therefore need a licence.

Lending and borrowing platforms

If the business lends or borrows VAs, or operates products that amount to those functions even if marketed as “yield” or “earn,” licensing may be required.

VA management and investment businesses

If the business manages or administers VAs for others, that can trigger VA Management and Investment Services licensing.

Personalised advisory businesses

If the firm gives client-specific advice on virtual assets, as opposed to broad public education or commentary, Advisory Services can be triggered.

Category 1 token issuers

If the business is issuing a Category 1 token, that can itself be a licensable activity under the issuance framework. VARA’s public materials list Category 1 VA Issuance as one of the regulated activity categories.

In those cases, the threshold is usually not subtle. The main task is correctly identifying the activity and structuring the application.

5) Traditional-economy businesses can also cross the threshold

A common mistake is to assume that only “crypto-native” startups need VARA licences.

VARA’s licensed-activities page says not only VASPs, but also traditional economy entities seeking to offer the listed services must apply for and receive a licence before beginning those activities in Dubai.

That means a firm does not avoid the threshold simply because it thinks of itself primarily as:

• a fintech,
• a software company,
• a payments business,
• a consulting business,
• or an infrastructure provider.

If the actual function performed falls inside one of the regulated VA Activity categories, the threshold can still be triggered.

This is one reason why a careful functional analysis matters more than the company’s preferred branding.

6) DLT providers are not automatically outside the perimeter

Another common assumption is:

“We are just a DLT provider, so we should be outside the licensing regime.”

VARA directly addresses this on its licensed-activities page. It says that no virtual asset activity is ‘exempt’ from regulatory supervision, and that any virtual asset service or activity, including but not limited to that offered by DLT service providers, may require a VARA licence.

That is a very important line.

It means infrastructure status does not automatically place a business outside the threshold.

If the DLT provider is actually:

• controlling wallet flows,
• facilitating transfers,
• routing transactions,
• enabling execution,
• or otherwise performing a regulated VA Activity,
  then the activity analysis still applies.

So the safer question for a technical or infrastructure business is not:

“Are we only a DLT provider?”

It is:

“Does our infrastructure actually perform or control a regulated VA Activity?”

That is the real threshold analysis.

7) Offshore incorporation does not automatically avoid the licensing threshold

A lot of businesses ask the same question in a different form:

“We are incorporated offshore — do we still need a VARA licence?”

The important phrase in VARA’s public materials is in or from Dubai. Any firm seeking to carry on VA activities in or from Dubai outside DIFC must be licensed before commencing operations.

That means offshore incorporation is not, by itself, a safe answer.

If the business is:

• operating from Dubai,
• using Dubai as its base,
• or carrying on the regulated activity in or from Dubai,

then the VARA threshold may still be triggered, regardless of where the holding company or wider group is incorporated.

So the practical threshold question is not:

“Where is the parent company incorporated?”

It is:

“Where is the regulated activity actually being carried on from?”

That is what matters for licensing analysis.

8) The threshold can arise before a business feels “fully operational”

One of the biggest mistakes founders make is assuming that licensing only matters once the business is fully live.

VARA’s Rulebook says entities must seek authorisation prior to conducting any VA Activity. VARA’s public licensing page says firms must be licensed prior to commencing operations.

That means the threshold is not:

• after growth begins,
• after revenue begins,
• after scaling,
• or after the business has been operating for a while.

It arises before the regulated activity starts.

This matters because many businesses drift into threshold activity gradually:

• soft-launching features,
• onboarding users informally,
• facilitating test transactions,
• or moving from “pilot mode” into real activity without clearly marking the point at which the regulated function actually begins.

That is risky in Dubai.

A business does not need to wait until it looks large to need a licence. The question is when it begins carrying on the regulated activity.

9) Marketing can create exposure before full licensing is in place

Another nuance founders often miss is that even before the full licensing analysis is settled, the marketing framework can create regulatory exposure.

VARA’s marketing materials state that businesses are not permitted to offer regulated virtual asset services or activities in Dubai without receiving VARA approval or confirmation of no objection. The 2024 Marketing Regulations also say no entity may carry out marketing of or relating to any Virtual Asset or VA Activity in or targeting the UAE unless it complies with those regulations, and marketing of VA Activities must only be carried out by, or on behalf of and approved by, a VASP licensed by VARA for that activity.

Guidance for exhibitors and unlicensed entities goes even further: unlicensed firms marketing at events should include a prominent disclaimer that they are not licensed or regulated by VARA and are not permitted to conduct VA Activities in the Emirate of Dubai.

This is important because some businesses say:

• “We are not operational yet.”
• “We are only building awareness.”
• “We are just marketing for now.”

That can still create real risk if what is being marketed is a regulated VA Activity in or targeting Dubai/UAE.

So even where the answer to “do we need a licence?” is still being finalised, a firm should already be careful about how it presents itself publicly.

10) When the answer may be “not necessarily”

It is also important not to overstate the threshold.

Not every crypto-adjacent business automatically needs a VARA licence.

A business may potentially fall outside the threshold if it is genuinely not carrying on a regulated VA Activity in or from Dubai. Depending on the actual facts, that may include:

• purely technical tools with no regulated function,
• software that does not intermediate, safeguard, transfer, or advise,
• non-transferable or internal arrangements that do not amount to regulated activity,
• or structures that genuinely remain outside the listed activity categories. The key legal test still comes back to whether the business is carrying on one or more VA Activities in the Emirate.

But this is where many businesses become overconfident.

They say:

• “We’re just software.”
• “We’re only infrastructure.”
• “We don’t touch funds.”
• “It’s only a utility token.”
• “We’re not an exchange.”

Those statements might be true. Or they might simply be commercial labels hiding a regulated function.

So the safer approach is:
being outside the threshold depends on actual structure and function, not on optimistic description.

11) The practical signs that the licensing threshold is likely triggered

For founders doing a first-level internal assessment, the following signs usually mean the VARA threshold is likely relevant:

• The business is operating in or from Dubai outside DIFC.
• The model fits one or more of the regulated activities on VARA’s licensed-activities page.
• Customer instructions, VAs, wallet access, or transfers are passing through the service in a meaningful way.
• The firm is not just publishing neutral information; it is advising, broking, safeguarding, exchanging, lending, managing, transferring, settling, or issuing Category 1 assets.
• Dubai is being used as the business base, even if the customer base is international. VARA’s public materials expressly contemplate activities offered from Dubai to global customers where permissible.
• The firm is already marketing regulated VA services in or targeting the UAE without having properly settled the licensing analysis.

If several of these are true, the prudent next step is usually a proper perimeter and activity analysis, not a wait-and-see approach.

12) Why this threshold question matters before launch

The question “When is a VARA licence required?” is not just an academic legal issue.

It affects:

• whether the entity should even be set up in its planned form,
• what activity scope the business should seek,
• what capital and prudential requirements may apply,
• how governance should be structured,
• what AML / Travel Rule architecture needs to exist,
• how technology and customer flows should be designed,
• and how carefully the business should market itself before launch. VARA’s licensing framework, activity framework, and marketing rules all point to that same conclusion.

The businesses that answer the threshold question early usually make better decisions.

The businesses that postpone it often discover the answer only after:

• the operating model has become more expensive to change,
• the marketing has gone too far,
• or the regulator is already asking questions the founders should have answered internally months earlier.

That is why this threshold analysis matters so much.

13) Final takeaway

If you want the shortest accurate answer to:
“When is a VARA licence required?”

it is this:

A VARA licence is required before an entity carries on one or more regulated VA Activities in or from Dubai outside DIFC. The trigger is not whether the business calls itself crypto, Web3, or infrastructure. The trigger is whether the business is actually performing a regulated function within the VARA activity perimeter.

That means the real threshold question is not:

“Are we in crypto?”

It is:

“What regulated VA Activity are we actually carrying on, where is it being carried on from, and does that place us inside the VARA perimeter?”

That is the question serious founders should answer early.

And in Dubai, answering it correctly can save a great deal of time, cost, and avoidable regulatory risk.

How CRYPTOVERSE Legal Can Help

At CRYPTOVERSE Legal Consultancy, we help founders, exchanges, token issuers, brokers, custodians, transfer businesses, DLT providers, and digital asset operators determine when the VARA licensing threshold is triggered for their specific business model. Our support includes regulatory perimeter analysis, activity classification, jurisdiction and structuring review, marketing-risk assessment, token-issuance analysis, and broader VARA licensing strategy so that clients can identify early whether a VARA licence in Dubai is required — and if so, what the correct activity scope should be.

If you want tailored guidance on when a VARA licence is required for your business in Dubai, and how the licensing threshold applies to your specific model, contact CRYPTOVERSE Legal Consultancy to discuss your regulatory strategy

FAQs