Which activities VARA licenses, what sits outside the rule, how the two-stage path works, what it costs in capital and fees, and what VARA and federal law impose on unlicensed operators.
No one may carry on any of the eight VA Activities by way of business in Dubai, outside the DIFC, without a VARA licence for it. Licensing runs in two stages and requires a Dubai entity, capital for each activity and key officers resident in the UAE or holding its passport. Unlicensed activity exposes a business to VARA's enforcement powers, federal fines and, on the face of the 2025 Capital Market Law, criminal penalties.
The rule: eight activities, each licensed before it starts
Law No. 4 of 2022 makes VARA the regulator of virtual-asset services across Dubai, including its free zones but not the DIFC (Articles 3 and 6), and requires a VARA permit for any regulated activity there (Article 15(a)). Under VARA's Regulations of 2023, only an Entity licensed by VARA for the activity, an employee acting for such an Entity, or an Exempt Entity may carry out a VA Activity by way of business, or purport to, in the Emirate (Regulation III.A.1), and each activity must be licensed before it starts (Regulation IV.A.1).
Schedule 1 lists eight activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, and VA Transfer and Settlement Services, and Category 1 VA Issuance. The definitions are wide: broker-dealing includes dealing for the firm's own account and placing tokens for issuers, and VA management includes taking responsibility for staking.
Category 1 VA Issuance covers fiat- and asset-referenced tokens and anything else VARA assigns to it; Category 2 issuers need no licence but must place and distribute only through a VASP licensed for Broker-Dealer Services (Virtual Asset Issuance Rulebook Rules I.C.1, I.D.1 and I.E.1).
Federally, Cabinet Resolution No. 111 of 2022 likewise bars VA activities in the UAE, including non-financial free zones, without a federal or local licence (Articles 3 and 4) and lets the federal authority, now the Capital Market Authority (CMA), supervise locally licensed VASPs (Article 9(2)). Resolution No. 112 of 2022 delegates that authority's licensing, supervision and penalty powers to VARA within Dubai and its free zones, and calls for a unified supervision mechanism (Articles 2 to 4). Both remain in force where they do not conflict with the 2025 federal laws (Articles 2(3) and 27(3) of Federal Decree-Law No. 32 of 2025).
What the version in force since 19 June 2025 changed
The current Regulations apply from 19 June 2025; VARA's rulebook page lists four earlier versions, the last dated 1 October 2024. Against that version, the general prohibition no longer mentions entities that 'promote, offer' a VA Activity, promotion falling under the Marketing Regulations (Regulation VII.A.1), and VARA may place providers of services to VASPs under its direct supervision as Critical Service Providers (Regulations IV.A.9 and IV.A.11).
What sits outside the licence requirement
VARA decides whether an activity is carried out 'by way of business' by looking at whether the entity holds itself out as doing so, the activity's regularity, scale and continuity, and any commercial element such as fees (Regulation III.A.2).
Registered lawyers, accountants and other professionally licensed business consultants need no licence for VA Activity wholly incidental to their practice, if they remain professionally authorised in Dubai and carry professional indemnity insurance (Regulation IV.A.5). Exempt Entities (federal and Dubai government entities and their public and non-profit bodies) must still notify VARA and obtain a no-objection confirmation (Regulation IV.A.6; Schedule 4).
Own-portfolio investing is not a listed activity, but an entity in Dubai actively investing its own portfolio at or above USD 250 million in Virtual Assets within any rolling 30 days must register with VARA within three Working Days at the latest; registration is not a licence (Regulation IV.A.7). Beyond the Regulation III.A.2 factors, the texts do not separate this from own-account dealing, which Schedule 1 treats as broker-dealing.
VA Activities relating to UAE central bank digital currencies stay with the Central Bank, and VASPs must also comply with its applicable regulations and guidance, including on payment token services (Regulation III.A.4).
Serving Dubai from abroad
The Regulations speak of activity 'in the Emirate', VARA's licensing page of activity 'in or from Dubai'; neither says when a firm abroad serving Dubai residents online acts there, and the texts offer no cross-border licence: the licensed business must be set up in Dubai (Article 15(b) of the Law; Company Rulebook Rule I.A.2). Two texts reach further: app stores must ensure that apps downloadable in Dubai that facilitate a VA Activity are owned or controlled by a VARA licensee or approved by VARA (Marketing Regulation I.E.3), and the 2025 Capital Market Law, Federal Decree-Law No. 33 of 2025, applies to anyone targeting clients in the State from abroad (Article 2(1)(d)).
On marketing, only a VASP licensed by VARA for the activity, or someone acting for it with its approval, may market a VA Activity in or targeting the UAE (Marketing Regulation I.B.3), apart from limited marketing by unlicensed firms at physical events in Dubai, without onboarding UAE residents (I.F.1). A foreign entity is clearly outside the Marketing Regulations when it is not located in Dubai, carries on no VA Activity there and does no marketing in or targeting the UAE (I.B.5).
The path to a licence and what it costs
VARA's approval comes before commercial licensing (Article 15(c) of the Law; Article 4(3) of Resolution No. 111). On VARA's licensing page, an Initial Disclosure Questionnaire filed through the Department of Economy and Tourism or a Dubai free zone, and initial fees of typically half the application fee, lead to an Approval to Incorporate: the company may be formed but may not yet carry on Virtual Asset activities. After review and payment of the balance and the first year's supervision fees, VARA issues the licence, which may carry conditions (Regulation IV.B.1).
Under Schedule 2, the application fee is AED 40,000 for Advisory Services and VA Transfer and Settlement Services and AED 100,000 for each other activity, and the annual supervision fee, paid before the activity starts, AED 80,000 or AED 200,000 respectively. Each additional activity adds a Licence Extension Fee of 50% of the lower application fee. Application fees are not refundable (Regulation IV.B.4).
Cabinet Resolution No. 83 of 2025 adds a federal fee for the CMA's registration of a locally licensed VASP: AED 3,000, then AED 1,500 a year on renewal and AED 1,000 on cancellation (Article 1(1)); the texts we hold do not set the procedure.
Capital, people and ownership
Paid-up capital is set, and added up, per activity (Company Rulebook Rules VI.B.1 and VI.B.2), from AED 100,000 for Advisory Services to the higher of AED 1.5 million or 25% of fixed annual overheads for an exchange without a VARA-licensed custodian or approved alternative. A Category 1 issuer's capital is set in the VA Issuance Rulebook: AED 1.5 million plus 2% of the value of a fiat-referenced token's available supply, or at least the higher of AED 1.5 million and 2% of the average value of an asset-referenced token's reserve assets (Annex 1 Rule III.F.1; Annex 2 Rule III.G.1). Capital sits in a UAE bank trust account or open-ended surety bond naming VARA as beneficiary, or as VARA specifies (Rule VI.B.3); net liquid assets, insurance and reserve assets matching client liabilities come on top (Rules VI.C.1, VI.D.1 and VI.E.1).
VARA must approve board members as fit and proper (Rule I.B.1). Two Responsible Individuals must be full-time employees, fit and proper, and UAE residents or UAE passport holders (Rules I.C.1 and I.C.2). The Compliance Officer needs five years' compliance experience, UAE residence or a UAE passport and full-time employment; the MLRO needs two years' AML experience (Compliance and Risk Management Rulebook Rules I.C.1 and III.A.1). A separate Chief Information Security Officer and an independent company secretary, who may be external, complete the list (Technology and Information Rulebook Rule I.I.1; Company Rulebook Rules I.E.1 and I.E.3).
Ownership must be traceable to every controlling entity and beneficial owner, with trusts, nominee arrangements and DAO structures explained (Rules I.A.3 and I.A.4). Material structural changes and any change of control, presumed at 25% of voting shares, need VARA's prior written approval (Rules I.A.5 and VIII.C.1; Schedule 1).
Operating without a licence
VARA may act against any Entity in breach, licensed or not, with fines and, new in the current version, cease-and-desist notices, suspension of a commercial licence in coordination with the licensing authority, compelled public statements and periodic penalties (Regulations IX.C.1, IX.C.2 and IX.C.5).
Item 4 of Schedule 3 covers unlicensed VA Activity, unlawful issuance, failure to register, misrepresenting a relationship with VARA and UBO disclosure breaches. In the current table, items 2 to 4 share one indicative amount: up to the higher of AED 20 million or 200% of the profit gained or loss avoided for an individual, and of AED 50 million, 15% of annual revenue or 300% of that profit or loss for a company.
Under Cabinet Resolution No. 99 of 2024, practising a VA activity without a licence costs AED 500,000 the first time, then AED 1 million, AED 2 million and AED 4 million, each with closure of the headquarters and suspension or prevention of the platform; dealing with an unlicensed provider costs AED 100,000 rising to AED 800,000. The federal or local licensing authority (in Dubai, VARA) imposes these, may refer crimes to the Public Prosecution and keeps its own penalties (Articles 3 and 6(5); table, items 1 and 4). Schedule 3 ties VARA's fines to local and federal law, including this Resolution, but keeps them apart from other authorities' penalties; neither text says which scale VARA applies, or whether both, to unlicensed activity.
The Capital Market Law adds criminal exposure: carrying on a financial activity without a CMA licence, approval, registration or accreditation is punishable by imprisonment of at least one year and/or a fine of AED 50,000 to AED 250 million (Article 71(1)), and CMA Decision No. 4/Chairman of 2026 deems the virtual-asset services it lists financial activities (General Framework Module, Article 12). On the face of the texts, an operator with neither a VARA nor a CMA licence is caught; how this applies to a VARA licensee is unsettled.
The open federal question, and what a business checks
The Capital Market Law, listed by the CMA as in force from 1 January 2026, bars trading any Virtual Asset in the State that is not on a CMA-licensed platform's official list and registered with the CMA, and puts virtual-asset activity in the State and its non-financial free zones under CMA oversight (Article 39(2) and (3)). The CMA Decision, effective 28 February 2026, prohibits VA activities from or inside the State without a CMA licence (General Framework Module, Article 4). Neither text, as we hold it, mentions VARA, locally licensed venues or the Resolution No. 112 delegation, while Resolutions No. 111 and No. 83 still assume local licensing; the texts do not reconcile these.
Before launch, the businesses we work with map each product against Schedule 1 and record why anything sits outside it; plan the entity around the Approval to Incorporate; budget capital per activity and arrange the trust account or bond; assemble fit-and-proper files for the key officers; and trace ownership to individuals. Businesses that use virtual-asset providers check their licences (Article 4(4) of Resolution No. 111).
