How to Get a Dubai Virtual Asset License From VARA

By Owen ThurmPublished November 13, 202611 min read

Quick answer. File an Initial Disclosure Questionnaire with Dubai Economy and Tourism or a non-DIFC Dubai free zone for Approval to Incorporate. Then submit the full VASP license application covering every activity you will run, with security evidence. You cannot operate until licensed.

Watch: How to Get a Dubai Virtual Asset License From VARA 1:45

Video transcript

Dubai virtual asset firms outside the DIFC cannot operate until VARA licenses each activity. Here is the route, and the evidence each stage needs.

Stage one is an Initial Disclosure Questionnaire, filed through Dubai Economy and Tourism or your free zone. It ends with an Approval to Incorporate. Stage two is the full license application.

The Approval to Incorporate lets you form the company and hire staff. It does not permit virtual asset activity.

VARA licenses eight activities, and each one you run needs authorization. Custody needs its own legal entity and standalone license.

Security evidence follows the Technology and Information Rulebook. Each rule needs a policy plus dated proof the control works. Material cyber events go to VARA within 72 hours.

Independent third parties must pentest at least yearly and before any new system. Smart contract audits apply where relevant. Results must be available to VARA.

VARA publishes no end-to-end approval period, so treat any timeline as an estimate. Testing needs working systems, so scope it early.

Likely delays, in our analysis: a CISO who is also the compliance officer, policies without dated proof, pentests on systems that changed, and an untested continuity plan.

Read the full guide. Guardian's compliance assessments test applications, APIs and infrastructure, audit relevant contracts and review key management mapped to VARA's rules. Licensing decisions stay with VARA and your advisers.

Who Needs a VARA License

Any firm carrying on virtual asset activity in or from Dubai, outside the DIFC, needs VARA authorization before it operates. It must be licensed for each activity it carries on. Virtual Assets Regulatory Authority

VARA's activities page says no virtual asset activity is exempt from its supervision.

This guide follows that route and the evidence behind each step. Fees and capital sit in our Dubai crypto license cost guide.

Mainland firms apply through Dubai Economy and Tourism (DET). Free zone firms apply through their Dubai free zone, which cannot be the DIFC.

The DIFC has its own regulator. The DFSA authorizes crypto token activities in or from the DIFC. Dubai Financial Services Authority

Serving the rest of the UAE is a separate question. A September 2024 SCA and VARA agreement said Dubai VASPs could be registered by default with the SCA for that. UAE Capital Market Authority (formerly SCA)

On January 1, 2026, the SCA became the Capital Market Authority (CMA), its legal successor. UAE Capital Market Authority

VARA's register still pairs 2026 licenses with CMA registration numbers, including licenses issued April 16 and November 9, 2026.

We found no CMA or VARA statement since then that confirms or changes that default registration. Confirm it with the regulator before relying on it.

A VARA license does not answer every UAE question. Payment, deposit or credit functions may also raise issues under the new CBUAE law.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

Licensed Activities

VARA licenses the eight activities listed below, each defined in Schedule 1 of its Regulations. Virtual Assets Regulatory Authority

Every applicant follows four rulebooks: Company, Compliance and Risk Management, Technology and Information, and Market Conduct.

Each activity adds its own rulebook. A firm running several must meet each one in full, at all times.

Custody stands apart. VARA says a custodian must be a distinct legal entity with a standalone license.

Proprietary trading cannot sit under a licensed activity. VARA requires a separate company for it.

Apply only for the activities you will run. Schedule 2 charges application and yearly supervision fees by activity.

Advisory services
Broker-dealer services
Custody services
Exchange services
Lending and borrowing services
VA management and investment services
VA transfer and settlement services
Category 1 VA issuance

The Two Application Stages

Stage 1 starts with an Initial Disclosure Questionnaire (IDQ), filed through DET or your free zone. A business plan and details of owners and senior managers go with it. Virtual Assets Regulatory Authority

An initial payment, part of the application fee, starts VARA's review. Approval ends Stage 1 with an Approval to Incorporate (ATI).

The ATI lets you form the company, rent an office and hire staff. It does not let you carry on virtual asset activity.

Stage 2 is the full license application. Expect feedback cycles, meetings and interviews with VARA.

You then pay the rest of the application fee and the first year's supervision fee. The license may carry operational conditions.

VARA can refuse at either stage if your activities fall outside its perimeter or your firm falls short of its standards.

The document list covers incorporation, owners, fit and proper confirmations, source of funds, governance, key staff files, business plan, financials, capital, reserves, insurance, succession, wind-down and close links. VARA calls it non-exhaustive.

Legacy operators that missed the Application Acknowledgment Notice deadline should apply at once for a Legacy Operating Permit, VARA's FAQ says. It lasts 12 months and cannot be renewed.

Permit holders must file the full license application 90 days before the permit expires.

Stage	You submit	You receive	Can you operate?
1: IDQ and ATI	IDQ, business plan, owner and management details, initial fee	Approval to Incorporate	No
2: Full license	Full document set, meetings, interviews, remaining and supervision fees	VASP license, possibly with operational conditions	Yes, within its conditions

Technology and Information Evidence

When checked on November 13, 2026, VARA's page showed no items under its Technology and Risk and Compliance headings. VARA calls the list non-exhaustive and may request further documents. Virtual Assets Regulatory Authority

One adviser's checklist lists technology items such as infrastructure design, a key and wallet management policy, an information security policy and penetration testing results. It is not VARA's own list. Cryptoverse Legal Consultancy

Back each document with the Technology and Information Rulebook, in force in its current version since June 19, 2025.

Each rule needs a policy and a dated record showing the control works. The table pairs them.

Our crypto incident reporting requirements matrix sets VARA's clock beside other regulators'.

Rule	Requirement	Evidence to have ready
I.D Keys and wallets	No single point of failure; backups stored apart from primary keys	Key ceremony records, signer map, backup locations
I.D Access	Each change of key access logged; quarterly audits of access removal	Joiner and leaver records, latest quarterly review
I.E Testing	Independent yearly pentests; smart contract audits where relevant	Dated reports with scope, findings and retests
I.H Continuity	BCDR plan implemented, tested and updated yearly	Plan, last test record, fixes made
I.I CISO	Experienced CISO, separate from the compliance officer	CV, appointment letter, reporting line
I.K Notification	Material cyber events reported within 72 hours of detection	Incident procedure and VARA notice template

Audits, Pentests and Custody

Rule I.E requires a qualified, independent third party to run vulnerability assessments and pentests. They run at least yearly and before any new system, application or product. Virtual Assets Regulatory Authority

The cycle includes smart contract audits, to the extent relevant to your business. Whether yours are relevant is a call for you, counsel and VARA.

Results must be documented and available to VARA on request. VARA may also require threat-led penetration testing.

Our guide to VARA penetration testing and smart contract audit rules covers each rule in detail.

Custody evidence is just as concrete. Reserves must equal 100% of client liabilities, held one to one in the same virtual asset.

They are reconciled daily and audited independently at least every six months.

VARA's October 6, 2026 circular, issued after a review of 2025 proof-of-reserve reports, sets minimum expectations for that audit. See our reserve assets audit circular guide.

Transfer flows carry federal duties too, set out in our UAE Travel Rule guide.

Pentest customer apps, APIs, cloud and signing services on the build you will launch, and retest every fix.
Audit each smart contract that holds, moves or accounts for client assets.
Map every key, signer, backup location and quorum, and show no one person can move assets.
Run and record a quarterly access-removal review.
Test the BCDR plan with a key-compromise scenario and keep the record.
Reconcile chain balances against client ledgers daily, and keep every day's record.
Name the CISO and the person who sends VARA's 72-hour notice.

Timeline

VARA publishes no end-to-end approval period. Treat any quoted timeline as an estimate, not a commitment. Virtual Assets Regulatory Authority

What you control is the order of work. Plan it as the six steps below.

The build and test steps overlap. Testing needs working systems, so scope it before the ATI arrives.

Scope: choose activities, entity structure, and DET or a free zone.
Stage 1: file the IDQ and core documents, and pay the initial fee.
Build: after the ATI, incorporate, take an office, and hire the CISO and key staff.
Test: pentest, audit and exercise the BCDR plan on the systems you will launch.
Stage 2: file the full application, answer VARA's questions and pay the remaining fees.
Launch: only after the license issues, and within any conditions.

Common Delays

The list below is our analysis of gaps the rules make likely, not VARA data.

Each is cheaper to fix before Stage 2 than during VARA's feedback cycles.

Activities on the application that do not match the business plan or the systems built.
Custody bundled into a multi-activity entity instead of a standalone one. Virtual Assets Regulatory Authority
A CISO who is also the compliance officer.
Policies with no dated proof that the control operates.
Pentests run on systems that changed before launch, which triggers the pre-launch test again.
Key backups held with primary keys, or one person able to move assets.
A BCDR plan that has never been tested.
Slow answers to VARA's follow-up questions and document requests.

Frequently Asked Questions

How long does a VARA license last?

One year. VARA's FAQ says licenses are annual and each renewal runs 12 months. VARA issues renewal notice 90 days in advance, and the yearly supervision fee is paid at renewal. Virtual Assets Regulatory Authority

What must a VARA cybersecurity incident notice include?

Under Rule I.K.1, the nature, scope and impact of the event, the steps you are taking or will take to mitigate it, and whether other authorities were notified. It covers material cybersecurity events and BCDR triggers that materially affect operations. Virtual Assets Regulatory Authority

Does proprietary trading need anything beyond a separate company?

Yes. VARA says VA proprietary trading needs a No Objection Certificate from VARA, confirming it can run with regulatory oversight without a VA license. Proprietary trading above certain volumes must also be registered with VARA. Virtual Assets Regulatory Authority

Can VARA charge more than its published fees?

Yes. Schedule 2 lets VARA add supervision fees based on a firm's risk profile, on top of the activity-based application, extension and yearly supervision fees. Virtual Assets Regulatory Authority

Sources

Prepare the Security Evidence VARA Will Ask For

Guardian's compliance assessments test applications, APIs and infrastructure, audit relevant contracts and review key management, with evidence mapped to VARA's rules. Licensing decisions stay with VARA and your advisers.

Talk to Guardian Explore the service