VARA License Cost in Dubai: Fees, Capital and Compliance
Quick answer. VARA charges AED 100,000 to apply, half the lower application fee per extra activity, and AED 200,000 a year per activity. Advisory and transfer and settlement pay AED 40,000 and 80,000. Capital floors: AED 100,000 to 1.5 million.
Video transcript
VARA charges 100,000 dirhams to apply for most licenses, and 200,000 a year per activity. Capital, insurance and security testing come on top.
Advisory and transfer and settlement pay 40,000 to apply and 80,000 a year. Other activities pay 100,000 and 200,000. Each extra activity adds half the lower application fee.
Fees are due when you file and are not refunded if you withdraw or are denied. Supervision is paid yearly in advance, and VARA may add more for your risk profile.
On our arithmetic, Exchange plus Custody means 150,000 dirhams due on filing, then 400,000 a year in supervision.
Capital is separate. Floors run from 100,000 dirhams for advisory to 1.5 million for an exchange, or a share of fixed overheads, whichever is higher.
Security starts before you file, since pentest results are an application document. Once licensed, you need independent pentests and, where relevant, smart contract audits every year and before new systems.
VARA publishes no price for this work. Scope sets the number: apps, APIs, cloud, signing systems and each smart contract.
Guardian maps your activities to the licenses that reach them, writes the security sections of your application, and maps its pentest and audit reports to VARA's rules.
Read the full article for the budget template. Or talk to Guardian to scope the security line of your VARA file.
Dubai's Virtual Assets Regulatory Authority (VARA) publishes its license fees. They sit in Schedule 2 of its Virtual Assets and Related Activities Regulations 2023, current version dated May 19, 2025.
Fees are only part of it. Capital, liquidity, insurance, audits, security testing and staff based in the UAE all follow from VARA's rulebooks.
Only fees and capital floors come with published numbers. Here they are, with a template for the rest.
This article explains the technical and security side of VARA's Regulations and Rulebooks for VASP licensing. It is not legal advice; confirm how it applies to you with counsel.
VARA's Fee Schedule
Schedule 2 sets one fee to apply, then a yearly fee per activity.
| Activity | Application fee | Yearly supervision fee |
|---|---|---|
| Advisory Services | AED 40,000 | AED 80,000 |
| VA Transfer and Settlement Services | AED 40,000 | AED 80,000 |
| Broker-Dealer Services | AED 100,000 | AED 200,000 |
| Custody Services | AED 100,000 | AED 200,000 |
| Exchange Services | AED 100,000 | AED 200,000 |
| Lending and Borrowing Services | AED 100,000 | AED 200,000 |
| VA Management and Investment Services | AED 100,000 | AED 200,000 |
| Category 1 VA Issuance | AED 100,000 | AED 200,000 |
Each extra activity in the same application adds a license extension fee of “50% of lower Licence Application Fee(s)”.
At the Central Bank of the UAE's rate of AED 3.6725 per dollar (September 2026 table), AED 100,000 is about $27,200 and AED 200,000 about $54,500.
How the fees work
- Paid on filing. VARA will not process an application until the fees arrive.
- Not refunded if an application is denied or withdrawn (Regulation IV.B.4.a).
- Paid yearly, in advance. Supervision fees are due before you operate, then at each 12-month renewal (VARA FAQ).
- Open to increase. VARA may add supervision fees based on your risk profile.
- Separate. Other authorities' fees, in or outside the UAE, come on top.
Your entity also needs a commercial licensor: Dubai's Department of Economy and Tourism (DET) or a free zone outside the DIFC. VARA may also charge token issuers for approvals and whitepapers.
A worked example
Take a firm applying for Exchange and Custody Services together. Below is our arithmetic from Schedule 2.
| Fee | Amount |
|---|---|
| Application, Exchange Services | AED 100,000 |
| Extension, Custody Services | AED 50,000 |
| Due on filing | AED 150,000 (about $40,800) |
| Supervision, each year | AED 400,000 (about $108,900) |
Capital, Liquidity and Insurance
Company Rulebook Rule VI.B.1 sets paid-up capital by activity. You hold the floor or a share of fixed annual overheads, whichever is higher.
| Activity | Floor | Overheads share |
|---|---|---|
| Advisory | AED 100,000 | None |
| Broker-Dealer | AED 600,000 (AED 400,000) | 25% (15%) |
| Custody | AED 600,000 | 25% |
| Exchange | AED 1,500,000 (AED 800,000) | 25% (15%) |
| Lending and Borrowing | AED 500,000 | 25% |
| VA Management and Investment | AED 500,000 (AED 280,000) | 25% (15%) |
| VA Transfer and Settlement | AED 500,000 | 25% |
Figures in brackets apply where you use a VARA-licensed custodian, or VARA approves the setup at licensing.
On our arithmetic, a custodian with AED 4 million of fixed annual overheads holds AED 1 million, not AED 600,000. Fiat-referenced token issuers hold AED 1.5 million plus 2% of available supply (VA Issuance Rulebook, Annex 1, Rule III.F.1).
- Per activity: each licensed activity carries its own capital, reconciled monthly (Rule VI.B.2).
- How it is held: a UAE bank trust account or surety bond naming VARA, or as VARA specifies (Rule VI.B.3).
- Liquidity: net liquid assets of at least 1.2 times monthly operating expenses, reconciled daily (Rule VI.C).
- Reserves: client assets backed one to one, in the same asset (Rule VI.E).
- More on request: VARA may require more of any of these (Rule VI.F.4).
Rule VI.D requires professional indemnity, directors' and officers' cover, and crime cover for all virtual assets in hot wallets. It sets no amounts: cover must be “adequate to the size and complexity of the business”.
Security Testing and Audits
The security line starts before you file. VARA's list of application documents includes these under Technology.
- Technology infrastructure design.
- Technology risk assessment framework and methodology.
- Business continuity and IT disaster recovery plan.
- Key and wallet management policy, for certain activities.
- Information security policy.
- Penetration testing results.
After licensing, this work recurs.
| Work | How often | Rule |
|---|---|---|
| Third-party vulnerability assessments and pentests | Yearly and before new systems | Technology I.E.1 |
| Smart contract audits, where relevant | Yearly and before new systems | Technology I.E.1 |
| Vulnerability assessments | Quarterly, expected in guidance | Technology Schedule 1 |
| Threat-led pentest by an external tester | If VARA notifies you | Technology I.E.5 |
| Financial statements audit | Yearly | CRM I.G.1 |
| Reserve assets audit | At least every six months | Company VI.E.3 |
| Internal audit work | At least quarterly, where applicable | CRM I.G.2 |
Rule-by-rule detail: our guide to VARA penetration testing and smart contract audit rules. For the six-month audit, see VARA's reserve assets audit circular.
What it costs
VARA publishes no price for this work, and no estimate we found matched its rulebooks.
For public price points, see what a Web3 pentest costs. Scope drives the number: apps, APIs, cloud, signing systems and each smart contract in use.
People and Premises
VARA sets the roles. Several must be full-time, and UAE residents or UAE passport holders.
- Two Responsible Individuals: full-time, fit and proper, UAE residents or passport holders, approved by VARA (Company Rule I.C).
- A Compliance Officer: five years in compliance, full-time, UAE resident or passport holder, reporting to the Board (CRM Rule I.C.1).
- An MLRO: two years of AML/CFT experience (CRM Rule III.A.1).
- A CISO: a separate person from the Compliance Officer (Technology Rule I.I.1).
- A Data Protection Officer: may be the same person as the CISO (Technology Rule II.B.2).
- A private office in Dubai: required for every activity except advisory, VARA's FAQ says.
VARA sets no salaries for these roles.
A Budget Template
Quotes fill the blanks.
| Line | When | Amount or basis |
|---|---|---|
| VARA application | On filing | AED 40,000 or 100,000, plus extensions |
| VARA supervision | Yearly, per activity | AED 80,000 or 200,000, plus any risk add-on |
| Commercial license | Per your licensor | Set by DET or the free zone |
| Capital and liquidity | At all times | Capital floor or overheads share; 1.2x monthly operating expenses |
| Insurance | While licensed | Indemnity, D&O, hot wallet crime cover |
| Pentests and smart contract audits | Yearly and before new systems | Quote, by scope |
| Financial and reserve audits | Yearly; every six months | Quote |
| Officers | Ongoing | Two Responsible Individuals, CO, MLRO, CISO |
| Office | Ongoing | Private office, except advisory |
To keep it down, license only the activities you will run. Each adds a supervision fee and its own capital.
For the EU, see our MiCA license cost guide.
How Guardian Helps
Guardian's regulatory readiness assessment maps your activities, entities and customer locations to the licenses that reach them. It lists each provision with the control that meets it and the evidence that proves it.
Guardian writes the ICT, security, custody and continuity sections of an application from the system as built.
Its pentests cover infrastructure, web apps, APIs, browser extensions, SDKs and offchain automation, each closed out with a retest. Guardian maps its pentest and smart contract audit reports to VARA Rule I.E.1.
Guardian does not publish pentest prices; it scopes from your system. Vanguard returns half the package cost as credits toward Guardian's offchain assessments.
Frequently Asked Questions
How much does a VARA license cost?
VARA charges AED 100,000 to apply for most activities, or AED 40,000 for advisory or transfer and settlement. Supervision is AED 200,000 or AED 80,000 a year per activity. Capital floors run from AED 100,000 to AED 1.5 million.
Are VARA license fees refundable?
No. Regulation IV.B.4.a says no fees are refunded if an application is denied or withdrawn. The application and extension fees are due when you file, and VARA will not process the application until it receives them.
How often do you pay the VARA supervision fee?
Every year, for each licensed activity, before you carry it on (Schedule 2). VARA's FAQ says the license runs 12 months and the fee is paid at renewal. VARA may add fees based on your risk profile.
Does a VARA license require a penetration test?
VARA lists penetration testing results among the technology documents for an application. Once licensed, Rule I.E.1 requires a qualified, independent third party to run vulnerability assessments and pentests at least yearly and before any new system, application or product.
Sources
- VARA: Virtual Assets and Related Activities Regulations 2023, Schedule 2, Supervision and Authorisation Fees (current version dated May 19, 2025)
- VARA: Virtual Assets and Related Activities Regulations 2023, full text including Regulation IV.B.4 (May 19, 2025)
- VARA: Company Rulebook, Part VI.B Paid-Up Capital (version dated May 19, 2025)
- VARA: Company Rulebook, Part VI.C Net Liquid Assets (version dated May 19, 2025)
- VARA: Company Rulebook, Part VI.D Insurance (version dated May 19, 2025)
- VARA: Company Rulebook, Part VI.E Reserve Assets (version dated May 19, 2025)
- VARA: Company Rulebook, Part I.C Responsible Individuals (version dated May 19, 2025)
- VARA: Compliance and Risk Management Rulebook, Part I.C Duties of the Compliance Officer (version dated May 19, 2025)
- VARA: Compliance and Risk Management Rulebook, Part I.G Audit (version dated May 19, 2025)
- VARA: Compliance and Risk Management Rulebook, Part III.A Money Laundering Reporting Officer (version dated May 19, 2025)
- VARA: Technology and Information Rulebook, including Schedule 1 guidance (May 19, 2025)
- VARA: Virtual Asset Issuance Rulebook, Annex 1 FRVA Rules (version dated May 19, 2025)
- VARA: Licence Applications, application documentation list (accessed November 6, 2026)
- VARA: Frequently Asked Questions (accessed November 6, 2026)
- Central Bank of the UAE: Exchange Rates against UAE Dirham, September 2026
- Guardian: Blockchain Penetration Testing Cost: Web3 Pentest Prices
- Guardian: Regulatory & Compliance Assessments
Budget the security line of your VARA file
Guardian writes the technology sections of your application and runs the pentests and smart contract audits VARA asks for.