The wrong way round
Almost every business we see has already answered a different question before it reaches us. It has chosen a free zone, often on price, sometimes on a conference conversation, and now wants to know how to get licensed there.
That is the sequence reversed. The free zone incorporates a company. It does not decide whether the activity needs a licence, or which authority grants it. Those are prior questions, and answering them second means the answer to the first is already constrained by a decision made for unrelated reasons.
What actually decides it
Two things, in this order.
What the business does with client assets and client orders. Not what the product is called, not what the whitepaper says, not what the pitch deck promises. The mechanics. Does it hold client assets? Does it execute or arrange client transactions? Does it hold client money? Does it issue something that functions as a payment instrument?
Where the clients are. A client in Dubai, a client in Riyadh and a client in Frankfurt attract three different bodies of law, and no UAE licence reaches the second or the third.
Everything else — cost, speed, prestige, what a competitor did — is a tiebreak between routes that are already open. It is not how the set of open routes is determined.
The five answers
VARA holds the virtual-asset perimeter for the Emirate of Dubai, including its commercial free zones, with the DIFC carved out by Dubai Law No. 4 of 2022. If the activity is carried on in or from Dubai and it is a virtual-asset activity, this is the default answer.
The FSRA regulates in ADGM, a financial free zone in Abu Dhabi with its own English common-law system and its own courts. It has run a dedicated virtual-asset framework since 2018, which makes it the longest-standing in the country.
The DFSA regulates in the DIFC, which sits inside Dubai geographically and outside VARA's perimeter legally. Its centre of gravity is tokenised securities, funds and wealth management, and DIFC legislation recognising digital assets as property makes it the natural home for custody structures that need that question answered by statute rather than by analogy.
The SCA is the federal regulator, and it holds the perimeter everywhere VARA, the FSRA and the DFSA do not. It is the layer most often missed, because a business picks an emirate and a zone and never asks whether what it is selling is a security under federal law.
The CBUAE regulates payment tokens, payment services and stored value. It is not an alternative to the others: a business can sit inside the Central Bank perimeter and VARA's at the same time, and frequently does.
The dual-licence point
This is the single most expensive misunderstanding in the market, so it is worth stating plainly.
A free-zone licence and a virtual-asset licence are two separate permissions from two separate authorities. DMCC, IFZA, DAFZA, DWTC and RAKEZ incorporate companies and issue activity licences. They do not authorise regulated virtual-asset activity. In Dubai, a company in any of them still needs VARA.
A business that treats the zone licence as permission to operate has bought a company, an office and a visa quota, and no permission at all. It usually discovers this after the lease is signed.
| الهيكل | داخل الدولة | منطقة حرة | منطقة حرة مالية | شركة خارجية |
|---|---|---|---|---|
| التملّك الأجنبي | كامل | كامل | كامل | كامل |
| مزاولة النشاط داخل الإمارات | نعم | عبر موزّع | عبر موزّع | لا |
| تأشيرات الإقامة | نعم | نعم | نعم | لا |
| المحاكم والقانون | محاكم الدولة | محاكم الدولة | القانون العام | بحسب العقد |
| مسار ترخيص الأصول الرقمية | دائرة الاقتصاد وفارا | المنطقة وفارا | سلطة أبوظبي أو دبي المالية | غير متاح |
| الوضع الضريبي | النسبة الأساسية | إعفاء مشروط ممكن | إعفاء مشروط ممكن | يخضع لاختبار الحضور الفعلي |
| قابلية فتح الحسابات | متوسطة | انتقائية | الأقوى | صعبة |
Where the answer is "none of them"
Some businesses sit outside the licensing perimeter entirely. A team writing protocol software that never touches client assets or client orders. A non-custodial interface. Certain mining operations.
That is a real and useful answer, and RAK Digital Assets Oasis exists largely for it. But it is a conclusion to be reasoned and documented, not assumed — and the failure mode is drift: a business incorporates outside the perimeter, then adds a feature that puts it inside, and nobody notices because the incorporation never changed.
How to do it in the right order
- Describe the mechanics of what the business does with client assets, client orders and client money. In writing, in detail, before choosing anything.
- Establish which perimeters that puts it inside. There may be more than one.
- Establish where the clients are, and what that adds.
- Then, and only then, choose between the routes that are open — on cost, substance, counterparty expectations and time.
- Incorporate.
Steps one to four cost a fraction of step five. Doing them afterwards costs considerably more than either.
الجهات التنظيمية
أسئلة متكررة
Can we pick the regulator we prefer?
Only within limits. The activity and the clients decide which perimeters you are inside; the choice is between the routes that are actually open, not between all five.
What happens if we pick wrong?
Usually money and time rather than enforcement — an incorporation that has to be unwound, an office lease that does not meet a substance requirement, an application that stalls. The expensive version is discovering the error after taking client money.
المصادر
- Dubai Law No. 4 of 2022 on the Regulation of Virtual Assets — Establishes the Dubai perimeter and the DIFC carve-out
- ADGM and DIFC founding legislation establishing their own legal systems
- Federal securities legislation and SCA decisions on virtual assets