VARA
Virtual-asset activities across the Emirate of Dubai, with the DIFC carved out.
Dubai, excluding DIFCServices
Counsel on virtual-asset licensing, regulatory compliance and company formation across every UAE regulator — federal, emirate, financial free zone, commercial free zone and offshore — and in the jurisdictions your structure reaches.
Virtual-asset activities across the Emirate of Dubai, with the DIFC carved out.
Dubai, excluding DIFCPayment tokens, payment services, stored value and AML supervision of licensed financial institutions.
FederalSecurities, capital markets and virtual assets outside the VARA, ADGM and DIFC perimeters. Renamed from the SCA on 1 January 2026.
FederalThe AML/CFT reporting portal every VASP and DNFBP must register with.
FederalExchanges, custody, funds and DLT foundations under an English common-law system.
Abu Dhabi Global MarketCrypto tokens, investment tokens and funds inside the DIFC.
Dubai International Financial CentreFree-zone authorities, offshore registrars, the mainland trade-licence authority and the property register. Each grants something real — a company, a licence, an entry on a register — and none of it is permission to carry on a virtual-asset activity, however the activity reads on the licence.
No GCC regulator recognises another's licence, and none recognises the UAE's. Serving a client abroad is a question of that country's law, not of the licence on your wall.
A licensed crypto business answers to more than one regulator at the same time. Not in sequence, and not by choice — the perimeters overlap. Pick what you do and see which ones close around you.
Exchange or trading platform: inside 3 perimeters — VARA, FSRA, DFSA, CBUAE, FIU · goAML.
Virtual assets
The licence for the activity itself
Payments and stored value
Engaged by fiat, whatever else you do
AML and reporting
Follows the licence, every time
Outside the perimeter
A company, but not a permission
This activity cannot be carried on through an unlicensed vehicle. A free-zone company that permits the activity in its objects is not a permission to perform it.
Derived from the same rulebook as the jurisdiction engine. It shows which perimeters are engaged, not which regulator you would apply to — that depends on where you sit and on questions this diagram does not ask.
Work we take on directly. Each one begins with the same question: which regulator, and on what basis.
Choosing the regulator, scoping the activities, and holding the file from first approval to licence.
Mainland, free zone, financial free zone or offshore — chosen on the business, not the brochure.
Futures, options, perpetuals and CFDs on virtual assets are a separate permission from spot, with their own eligibility and leverage conditions.
Where the Central Bank perimeter begins, and what it takes to sit inside it.
Where the licence sits is one question. What the group pays, and under which regime, is a different one with a different answer.
Registration, the programme behind it, and an MLRO who can actually do the job.
A fund that holds virtual assets is two permissions, not one — the vehicle and the manager — and the investors decide which jurisdiction can carry them.
A reasoned opinion that survives a regulator, a bank and an acquirer reading it.
Structuring across the property regime and the token regime, because an offering has to work under both.
The document chain that holds up every incorporation, run properly the first time.
The step most businesses underestimate, prepared as the credit committee will read it.
Residence for founders and key staff, on the route that actually fits the facts.
What happens after the licence — reporting, audits, filings and the MLRO function.
Exchange freezes, closed accounts and law-enforcement holds, handled through the right forum.
Bring what you are building, not a structure you have already been sold. The first conversation is about which perimeter you fall inside — everything else follows from that answer, and nothing sensible can be decided before it.
What it actually is
What the business actually does, in the regulator’s language rather than the pitch deck’s.
What that requires
Which permissions that requires, and which you would hold at the same time.
What is not settled
What is genuinely unsettled, said plainly, so you are not planning around a guess.