Question 1

Which UAE regulator licenses my virtual-asset business?

Accepted Answer

Three primary regulators issue VASP licences in the UAE. The Virtual Assets Regulatory Authority (VARA) — established under Dubai Law 4 of 2022 — licenses virtual-asset activities in mainland Dubai (excluding the DIFC). The ADGM Financial Services Regulatory Authority (FSRA) licenses regulated activities under its 2018 Crypto Asset framework, including OTC, exchange, custody and crypto-asset management. The DIFC Financial Services Authority (DFSA) licenses crypto-token activities under its 2022 framework. The federal Central Bank of the UAE regulates payment-token issuance (stablecoins) under its 2024 Payment Token Services Regulation. The right regulator is determined by the activity type and the geography of operations — not by client preference. We map activity-by-activity at the structuring stage.

Question 2

What activities require a VARA licence?

Accepted Answer

Seven categories under the VARA Regulations 2023: (1) advisory services; (2) broker-dealer services; (3) custody services; (4) exchange services; (5) lending and borrowing services; (6) virtual-asset management and investment services; (7) virtual-asset transfer and settlement services. Each requires its own licence with discrete capital, governance and operational requirements. Issuance of virtual assets is separately regulated under the VARA Issuance Rulebook, with specific carve-outs for category-1 (fiat-referenced) and category-2 (commodity-referenced) tokens.

Question 3

How long does VARA licensing take and what does it cost?

Accepted Answer

Realistic timeline is 9-15 months from initial engagement to operational licence — comprising Initial Approval (typically 3-5 months), build-out of the operational and governance environment (3-6 months), and Final Operational Approval (3-4 months). Application fees range from AED 40,000 to AED 200,000 per category, with annual supervision fees typically AED 100,000-300,000 depending on category combination and AUM. Compliance and legal build-out (policies, procedures, technology integration, AML/CFT framework, market-conduct framework) typically runs AED 500,000-2,500,000 outside fees, depending on the activity scope.

Question 4

What is the Travel Rule obligation in the UAE?

Accepted Answer

Both VARA and the federal AML regime (Cabinet Decision 24 of 2022, Article 16 bis) impose Travel Rule obligations on virtual-asset service providers — for transfers above the AED 3,500 threshold, originator and beneficiary information must travel with the transaction. UAE VASPs must use a compliant Travel Rule protocol (TRP, Sygna, Notabene, Shyft and similar). The obligation extends to inbound transfers from non-VASP counterparties, where additional risk-based due diligence is required if the counterparty cannot provide compliant information.

Question 5

Can a foreign exchange operate in the UAE without a local licence?

Accepted Answer

No — and VARA has been actively enforcing this. The 2023-2025 enforcement actions against unlicensed offshore exchanges marketing into Dubai included public censures, fines and (in some cases) criminal referrals. A foreign exchange seeking UAE clients must either: (a) obtain a VARA exchange licence (full activity authorisation); (b) operate via a regulated UAE-licensed introducing-broker arrangement; or (c) implement geofencing and active customer-rejection processes that demonstrably exclude UAE residents. The third route requires evidence of operational discipline that goes beyond simple geo-IP blocking.

Question 6

What happens if VARA opens an enforcement file?

Accepted Answer

VARA enforcement typically begins with a formal information request under the Compliance and Risk Management Rulebook. The standard sequence is: information request → on-site inspection (announced or unannounced) → preliminary findings letter → written representations window (typically 21 days) → final decision (warning, fine, condition variation, suspension or revocation). VARA has also exercised a public-statement power for unlicensed-activity cases. Critical first decisions on receipt of an information request: scope of response, privilege markings, internal investigation parallel-track, board notification, and (where listed parent or investor disclosure obligations exist) external-stakeholder notification.

Question 7

How does the CBUAE Payment Token regime interact with VARA?

Accepted Answer

The CBUAE Payment Token Services Regulation 2024 covers issuance, conversion and custody of fiat-referenced payment tokens (stablecoins). For dirham-referenced tokens, only entities licensed by CBUAE may issue, and only authorised institutions may distribute. Foreign-currency-referenced tokens (USD, EUR-referenced) may be used in the UAE only if (a) the issuer is registered with CBUAE and (b) the distribution is via a licensed VASP/PSP. This creates a regulator-overlap that needs careful navigation: a stablecoin custody activity may simultaneously trigger VARA custody licensing AND CBUAE registration. We map the overlap matrix at the structuring stage.

VARA, ADGM & CBUAE — virtual-asset counsel for the UAE's regulated markets.

What we do for virtual-asset firms.

Licensing & structuring

Compliance build-out

Enforcement & defence

Transactional

Frequently asked questions

Building or scaling a UAE virtual-asset business?