VARA

Overview

VARA is the Emirate of Dubai's virtual-asset regulator. It was established by Dubai Law No. 4 of 2022 and supervises virtual-asset activity across the whole Emirate, including the commercial free zones, with one exception: the Dubai International Financial Centre, which sits under the DFSA.

That carve-out is the single most useful fact about VARA, because it determines whether a Dubai address puts you in front of VARA or the DFSA, and the two regimes are not interchangeable.

What it regulates

VARA regulates the activity, not the company. A business is inside the perimeter because of what it does with virtual assets, irrespective of the zone it incorporated in.

The rulebooks divide into those that apply to every licensee and those that attach to a particular activity:

• Company Rulebook — corporate form, governance, senior management.
• Compliance and Risk Management Rulebook — AML/CFT, the compliance function, the MLRO, risk appetite and controls.
• Technology and Information Rulebook — systems, custody technology, cyber-security, resilience, audit.
• Market Conduct Rulebook — client treatment, disclosure, marketing, market abuse.
• Activity-specific rulebooks, plus the Virtual Asset Issuance Rulebook for token issuers.

Who needs a licence

Anyone carrying on a regulated virtual-asset activity in or from Dubai outside the DIFC. In practice that captures:

• exchanges and trading platforms serving UAE clients;
• custodians holding client virtual assets;
• brokers and dealers arranging or executing transactions;
• managers running virtual-asset portfolios or funds;
• lending and borrowing platforms;
• transfer and settlement providers;
• advisers, where the advice is on virtual assets specifically;
• issuers of tokens, under the issuance rulebook.

Being incorporated offshore does not remove you from the perimeter if the activity is carried on in or from Dubai. Conversely, a pure software vendor that never touches client assets or client orders may sit outside it — but that is a conclusion to be reasoned and documented, not assumed.

Licence categories

The VASP categories are, broadly: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, and Transfer and Settlement. Token issuance is handled under its own rulebook.

Categories combine. Most real businesses need more than one, and each one carries its own capital, application fee and annual supervision fee. Mapping the intended business model onto the smallest set of categories that lawfully covers it is the first substantive piece of work on any engagement — and usually the one that saves the most money.

Cuatro estructuras, comparadas

Estructura	Territorio continental	Zona franca	Zona franca financiera	Extraterritorial
Propiedad extranjera	Total	Total	Total	Total
Puede operar en los EAU	Sí	A través de distribuidor	A través de distribuidor	No
Visados de residencia	Sí	Sí	Sí	No
Tribunales y derecho	Tribunales de los EAU	Tribunales de los EAU	Common law	Según contrato
Vía hacia la licencia cripto	DET y VARA	Zona y VARA	FSRA o DFSA	No disponible
Situación fiscal	Tipo general	QFZP posible	QFZP posible	Sujeto a prueba de sustancia
Apetito bancario	Moderado	Selectivo	El más favorable	Difícil

Requirements

Substance. A physical office in Dubai. Senior management resident in the UAE. A flexi-desk does not satisfy this for most activities.

Appointed functions. A Compliance Officer and a Money Laundering Reporting Officer, both fit and proper, both with genuine authority and reporting lines that do not run through the people they are meant to challenge.

Capital. Paid-up capital set by activity, with Exchange and Custody at the top of the scale. Capital is held, not spent — it is not a fee, and it is shown separately in the estimator for that reason.

Insurance. Professional indemnity cover proportionate to the activity.

Technology. Documented architecture, a custody and key-management model, wallet policy, penetration testing, business continuity and incident response. The Technology and Information Rulebook is not a formality; it is where applications stall.

Marketing. Virtual-asset marketing rules apply before a licence is granted. Promotion during the application window is a live regulatory question, not a marketing one.

How we help

We map the business model to the narrowest set of activities that lawfully covers it, and say plainly where a category can be dropped. We choose between mainland and free-zone incorporation on the merits rather than on cost alone. We draft the rulebook-mapped policy set, appoint and prepare the MLRO, run the goAML registration, and hold the file through Initial Approval to licence.

Where the answer is that the activity should be licensed somewhere other than Dubai, we say so before the incorporation invoice is raised.