VARA

Overview

VARA is the Emirate of Dubai's virtual-asset regulator. It was established by Dubai Law No. 4 of 2022 and supervises virtual-asset activity across the whole Emirate, including the commercial free zones, with one exception: the Dubai International Financial Centre, which sits under the DFSA.

That carve-out is the single most useful fact about VARA, because it determines whether a Dubai address puts you in front of VARA or the DFSA, and the two regimes are not interchangeable.

What it regulates

VARA regulates the activity, not the company. A business is inside the perimeter because of what it does with virtual assets, irrespective of the zone it incorporated in.

The rulebooks divide into those that apply to every licensee and those that attach to a particular activity:

• Company Rulebook — corporate form, governance, senior management.
• Compliance and Risk Management Rulebook — AML/CFT, the compliance function, the MLRO, risk appetite and controls.
• Technology and Information Rulebook — systems, custody technology, cyber-security, resilience, audit.
• Market Conduct Rulebook — client treatment, disclosure, marketing, market abuse.
• Activity-specific rulebooks, plus the Virtual Asset Issuance Rulebook for token issuers.

Who needs a licence

Anyone carrying on a regulated virtual-asset activity in or from Dubai outside the DIFC. In practice that captures:

• exchanges and trading platforms serving UAE clients;
• custodians holding client virtual assets;
• brokers and dealers arranging or executing transactions;
• managers running virtual-asset portfolios or funds;
• lending and borrowing platforms;
• transfer and settlement providers;
• advisers, where the advice is on virtual assets specifically;
• issuers of tokens, under the issuance rulebook.

Being incorporated offshore does not remove you from the perimeter if the activity is carried on in or from Dubai. Conversely, a pure software vendor that never touches client assets or client orders may sit outside it — but that is a conclusion to be reasoned and documented, not assumed.

Licence categories

The VASP categories are, broadly: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, and Transfer and Settlement. Token issuance is handled under its own rulebook.

Categories combine. Most real businesses need more than one, and each one carries its own capital, application fee and annual supervision fee. Mapping the intended business model onto the smallest set of categories that lawfully covers it is the first substantive piece of work on any engagement — and usually the one that saves the most money.

四种架构对比

架构	本土	自由区	金融自由区	离岸
外资持股	可全资	可全资	可全资	可全资
可在阿联酋境内经营	可以	须经分销商	须经分销商	不可以
居留签证	可以	可以	可以	不可以
法院与法律	阿联酋法院	阿联酋法院	普通法	依合同约定
加密牌照路径	DET 与 VARA	自由区与 VARA	FSRA 或 DFSA	无可申请牌照
税务地位	标准税率	可能适用 QFZP	可能适用 QFZP	须通过实质性测试
银行接受度	中等	有选择性	最佳	困难

Requirements

Substance. A physical office in Dubai. Senior management resident in the UAE. A flexi-desk does not satisfy this for most activities.

Appointed functions. A Compliance Officer and a Money Laundering Reporting Officer, both fit and proper, both with genuine authority and reporting lines that do not run through the people they are meant to challenge.

Capital. Paid-up capital set by activity, with Exchange and Custody at the top of the scale. Capital is held, not spent — it is not a fee, and it is shown separately in the estimator for that reason.

Insurance. Professional indemnity cover proportionate to the activity.

Technology. Documented architecture, a custody and key-management model, wallet policy, penetration testing, business continuity and incident response. The Technology and Information Rulebook is not a formality; it is where applications stall.

Marketing. Virtual-asset marketing rules apply before a licence is granted. Promotion during the application window is a live regulatory question, not a marketing one.

How we help

We map the business model to the narrowest set of activities that lawfully covers it, and say plainly where a category can be dropped. We choose between mainland and free-zone incorporation on the merits rather than on cost alone. We draft the rulebook-mapped policy set, appoint and prepare the MLRO, run the goAML registration, and hold the file through Initial Approval to licence.

Where the answer is that the activity should be licensed somewhere other than Dubai, we say so before the incorporation invoice is raised.