VARA

Overview

VARA is the Emirate of Dubai's virtual-asset regulator. It was established by Dubai Law No. 4 of 2022 and supervises virtual-asset activity across the whole Emirate, including the commercial free zones, with one exception: the Dubai International Financial Centre, which sits under the DFSA.

That carve-out is the single most useful fact about VARA, because it determines whether a Dubai address puts you in front of VARA or the DFSA, and the two regimes are not interchangeable.

What it regulates

VARA regulates the activity, not the company. A business is inside the perimeter because of what it does with virtual assets, irrespective of the zone it incorporated in.

The rulebooks divide into those that apply to every licensee and those that attach to a particular activity:

• Company Rulebook — corporate form, governance, senior management.
• Compliance and Risk Management Rulebook — AML/CFT, the compliance function, the MLRO, risk appetite and controls.
• Technology and Information Rulebook — systems, custody technology, cyber-security, resilience, audit.
• Market Conduct Rulebook — client treatment, disclosure, marketing, market abuse.
• Activity-specific rulebooks, plus the Virtual Asset Issuance Rulebook for token issuers.

Who needs a licence

Anyone carrying on a regulated virtual-asset activity in or from Dubai outside the DIFC. In practice that captures:

• exchanges and trading platforms serving UAE clients;
• custodians holding client virtual assets;
• brokers and dealers arranging or executing transactions;
• managers running virtual-asset portfolios or funds;
• lending and borrowing platforms;
• transfer and settlement providers;
• advisers, where the advice is on virtual assets specifically;
• issuers of tokens, under the issuance rulebook.

Being incorporated offshore does not remove you from the perimeter if the activity is carried on in or from Dubai. Conversely, a pure software vendor that never touches client assets or client orders may sit outside it — but that is a conclusion to be reasoned and documented, not assumed.

Licence categories

The VASP categories are, broadly: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, and Transfer and Settlement. Token issuance is handled under its own rulebook.

Categories combine. Most real businesses need more than one, and each one carries its own capital, application fee and annual supervision fee. Mapping the intended business model onto the smallest set of categories that lawfully covers it is the first substantive piece of work on any engagement — and usually the one that saves the most money.

Four structures, compared

Structure	Mainland	Free zone	Financial free zone	Offshore
Foreign ownership	Full	Full	Full	Full
Can trade in the UAE	Yes	Via distributor	Via distributor	No
Residence visas	Yes	Yes	Yes	No
Courts and law	UAE courts	UAE courts	Common law	By contract
Crypto licence path	DET and VARA	Zone and VARA	FSRA or DFSA	None available
Tax position	Standard rate	QFZP possible	QFZP possible	Substance tested
Banking appetite	Moderate	Selective	Strongest	Difficult

Requirements

Substance. A physical office in Dubai. Senior management resident in the UAE. A flexi-desk does not satisfy this for most activities.

Appointed functions. A Compliance Officer and a Money Laundering Reporting Officer, both fit and proper, both with genuine authority and reporting lines that do not run through the people they are meant to challenge.

Capital. Paid-up capital set by activity, with Exchange and Custody at the top of the scale. Capital is held, not spent — it is not a fee, and it is shown separately in the estimator for that reason.

Insurance. Professional indemnity cover proportionate to the activity.

Technology. Documented architecture, a custody and key-management model, wallet policy, penetration testing, business continuity and incident response. The Technology and Information Rulebook is not a formality; it is where applications stall.

Marketing. Virtual-asset marketing rules apply before a licence is granted. Promotion during the application window is a live regulatory question, not a marketing one.

How we help

We map the business model to the narrowest set of activities that lawfully covers it, and say plainly where a category can be dropped. We choose between mainland and free-zone incorporation on the merits rather than on cost alone. We draft the rulebook-mapped policy set, appoint and prepare the MLRO, run the goAML registration, and hold the file through Initial Approval to licence.

Where the answer is that the activity should be licensed somewhere other than Dubai, we say so before the incorporation invoice is raised.