Crypto licence in Dubai and the UAE: VARA, DMCC and IFZA
A crypto licence in Dubai is a VARA licence. VARA, the Dubai Virtual Assets Regulatory Authority, licenses seven VA Activities, and you apply in two stages through Dubai Economy and Tourism or a Dubai free zone other than the DIFC. The first stage gives an Approval to Incorporate; the second gives the VASP Licence. A DMCC or IFZA licence is not a crypto licence. It is a commercial licence for non-regulated work such as software development. DMCC’s own pages say regulated virtual asset activity needs a separate VARA licence, and Dubai Law No. 4 of 2022 puts VARA’s approval before the commercial licensing step. Beyond VARA’s territory, the DIFC answers to the DFSA and ADGM in Abu Dhabi to the FSRA. The rest of the UAE answers to the federal Capital Market Authority, or to a local licensing authority where one exists (Cabinet Resolution 111, Article 4(1)). The current count of licensed VASPs and the breakdown by activity are in the VARA register explained.
Service Need this handled rather than explained? See VARA licensing, or book a 30-minute call with the author.
Two things people call a crypto licence in the UAE
The phrase covers two documents. The first is a regulatory licence, which in Dubai outside the DIFC comes from VARA, a public corporation created by Article 4 of Law No. 4 of 2022 and affiliated to the Dubai World Trade Centre Authority. Article 15(a) says no person may conduct a virtual asset Activity in the emirate without a Permit from VARA, and Regulation III.A.1 of VARA’s Regulations 2023 bars any Entity from carrying out, or purporting to carry out, a VA Activity by way of business.
The second is a commercial licence from a free zone or Dubai Economy and Tourism (DET). It registers a company and names its commercial activities; DMCC sells one labelled crypto, agents sell IFZA packages under the same word, and neither permits a virtual asset activity. Article 15(c) of the Law requires VARA’s approvals before the commercial licensing procedures start, and Article 4(3) of Cabinet Resolution No. 111 of 2022 says the same nationally. The confusion predates VARA: the Dubai Media Office’s 24 May 2021 announcement of the DMCC Crypto Centre said crypto exchange in the zone would be regulated by the federal SCA.
Who regulates which territory
Law No. 4 of 2022, issued on 28 February 2022, covers every Dubai zone except the DIFC (Article 3). VARA calls itself the sole authority there; the fuller Dubai answer is under who regulates crypto in Dubai. Everywhere else, Cabinet Resolution No. 111 of 2022, effective 14 January 2023, bars virtual asset activity without approval and a licence from the SCA or the local licensing authority (Articles 1 and 4(1)). It excludes the financial free zones, digital securities and payment virtual assets (Article 3). Since 1 January 2026 the federal regulator is the Capital Market Authority, the SCA’s successor under Federal Decree-Law No. 32 of 2025. Its Virtual Assets Framework of 13 April 2026 is described as five core modules and eight regulated activities. Its text was not retrievable from the CMA site on 26 October 2026, so verify the modules with the CMA.
| Territory | Regulator | What the permission is called | Does the commercial licence alone permit VA activity? |
|---|---|---|---|
| Dubai mainland | VARA, under Law No. 4 of 2022 | VASP Licence, one per VA Activity (Regulation IV.A.1) | No. The DET trade licence follows VARA’s approvals (Article 15(c)) |
| DMCC | VARA | VASP Licence, applied for through DMCC | No. DMCC’s crypto licence covers non-regulated activities only (dmcc.ae, 26 October 2026) |
| IFZA (Dubai Silicon Oasis), the other DIEZ zones and every other Dubai free zone | VARA | VASP Licence, filed through the zone | No. IFZA’s pages carry no crypto or VARA statement (26 October 2026); the Law covers every Dubai free zone except the DIFC |
| DIFC | DFSA | DFSA Licence covering Crypto Tokens (regime amended 12 January 2026) | Not applicable. Outside Law No. 4 of 2022 and Cabinet Resolution 111 |
| ADGM (Abu Dhabi) | FSRA | Financial Services Permission for a VA Regulated Activity (guidance of 10 June 2025) | Not applicable. A financial free zone outside Cabinet Resolution 111 |
| Abu Dhabi outside ADGM and the other five emirates | Capital Market Authority (federal), or a local licensing authority under Cabinet Resolution 111, Article 4(1) | Approval and licence under Cabinet Resolution 111, Article 4(1); framework of 13 April 2026 | No. Article 4(3) puts the regulator’s approvals first |
Sources: Dubai Law No. 4 of 2022; VARA Regulations 2023 (version shown as 19 September 2023; rulebook landing page states effective from 19 June 2025); DMCC, IFZA and DIEZ sites (26 October 2026); Cabinet Resolution No. 111 of 2022; Federal Decree-Law No. 32 of 2025; CMA news, 13 April 2026; FSRA Guidance, 10 June 2025; DFSA Crypto Token page. Which regulator fits your business: VARA vs ADGM vs DIFC. An FSRA or DFSA application: ADGM and DIFC crypto licensing.
The seven VARA activities, and what sits outside them
Schedule 1 of the VARA Regulations 2023 lists seven VA Activities: Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, VA Management and Investment Services, and VA Transfer and Settlement Services. The Law’s own list in Article 16(a) is also seven items, in different words; the Regulations are the operative list for licensing. Regulation IV.A.1 requires authorisation before any is conducted and a separate Licence for each. VARA’s register filter, read 26 October 2026, lists Category 1 VA Issuance alongside those seven, and DMCC’s note of 18 September 2026 counts it as an eighth activity needing VARA authorisation. The same activities across four regimes are in crypto licence requirements by country.
The exemptions are narrow. An Exempt Entity under Schedule 4 is a UAE federal or Dubai government body or its non-profit arm; a DFSA, FSRA or Central Bank licence is not on the list, and the DIFC is outside VARA by territory, not exemption. Professional advisers are exempt only where virtual asset work is wholly incidental to their practice (Regulation IV.A.5). Investing your own portfolio needs no licence, but Regulation IV.A.7 requires registration at or above USD 250,000,000 equivalent in any rolling 30-day period and VARA’s FAQ requires a No Objection Certificate for proprietary trading below that; neither is a licence, and no VA activity is exempt from supervision (VARA FAQ).
The VARA licence path, in order
VARA’s licence applications page, read 26 October 2026, says any firm seeking to carry on virtual asset activities in or from Dubai, excluding the DIFC, must be licensed by VARA before commencing operations. The route runs through the commercial licensor in two stages: an Approval to Incorporate (ATI), which the public register shows as an In-Principle Approval (IPA), then the VASP Licence. Fees, paid-up capital and the absence of a published clock are on VARA licence cost, capital and timeline; the documents for each stage are in the UAE VASP licensing checklist; the application is run through the VARA licensing service.
| Stage | What VARA and the register call it | What the firm may do | What it may not do |
|---|---|---|---|
| Before filing | Not on the register | Choose activities and licensor: DET or a Dubai free zone other than the DIFC | Carry on, or purport to carry on, any VA Activity (Regulation III.A.1); market in Dubai without a marketing permit (VARA FAQ) |
| Approval to Incorporate | Approval to Incorporate (ATI) on the applications page, reached through an Initial Disclosure Questionnaire filed with DET or the free zone; In-Principle Approval (IPA) on the register | Incorporate, rent the office, hire; file the stage two documentation, sit VARA’s interviews, pay the remaining fees | Carry on any virtual asset activity or service a client until the full licence issues (register note on IPAs). VARA may refuse an ATI where the activity sits outside its perimeter |
| Licence granted | VASP Licence, status Active, with a VL-series number and a CMA registration number | The activities named on the licence, within any operational conditions | An activity not on the licence; each needs its own Licence (Regulation IV.A.1) |
| Not a licence | Registration (Regulations IV.A.7 and IV.A.8); proprietary trading NOC (VARA FAQ); the Legacy Operating Permit for firms operating before 7 February 2023 | Invest its own portfolio; provide DLT services that are not a VA Activity; continue a legacy business pending licensing | Accept or trade another Entity’s assets (Regulation IV.A.7(c)); describe itself as licensed |
Sources: VARA licence applications page, register and FAQ, read 26 October 2026; VARA Regulations 2023. The filing steps, fees, capital and durations are absent on purpose: the cost page owns them.
What DMCC and IFZA actually offer
DMCC runs the DMCC Crypto Centre in Uptown Tower. Its crypto page, read 26 October 2026, says a standard DMCC crypto licence covers non-regulated activities (software development, consultancy, trading) and that regulated virtual asset activity requires an additional VARA licence through DMCC. Its note of 18 September 2026 says a DMCC licence is commercial authorisation for the registered activities, a VARA licence is the regulatory authorisation for regulated virtual asset activity, and the first does not replace the second; a firm trading only its own funds, or a blockchain company with no regulated activity, needs a VARA NOC instead.
IFZA is different in kind. Its site, read 26 October 2026, describes a business setup provider headquartered in Dubai Silicon Oasis that sells a Commercial Licence and a Professional Licence through partners, and says nothing about crypto, virtual assets or VARA. Dubai Silicon Oasis is one of the free zones within the Integrated Economic Zones (Resolution No. 1 of 2022, Article 2). Article 23(a) of Dubai Law No. 16 of 2021, issued 14 September 2021, says no person or entity may conduct any activity in that free zone unless licensed by the Dubai Integrated Economic Zones Authority (DIEZ), and Article 6(7) gives DIEZ the function of registering and licensing companies there. So the authority behind a licence sold through IFZA is DIEZ, and the zone sits inside Law No. 4 of 2022 (Article 3). The IFZA crypto licence agents advertise is third-party packaging of a commercial licence. Which seat suits an Indian founder on tax, registrar and the RBI leg is in DMCC vs ADGM vs IFZA vs mainland.
| Question | Free-zone commercial licence (DMCC, IFZA via DIEZ, others) | VARA licence |
|---|---|---|
| Who issues it | DMCC; the Dubai Integrated Economic Zones Authority for Dubai Silicon Oasis, where IFZA sells the package (Law No. 16 of 2021, Articles 6(7) and 23(a)); DET on the mainland | VARA, a public corporation under Article 4 of Law No. 4 of 2022 |
| What it covers | The company’s existence and registered commercial activities; for crypto, DMCC names software development, consultancy and trading | One or more named VA Activities, for other people (Schedule 4) |
| Confusing them: enforcement | A VA Activity on a commercial licence alone breaches Regulation III.A.1. VARA’s unlicensed VASPs page names firms with DMCC and FZCO in their names, and VARA has fined unlicensed firms in dated rounds. The list and the fine rounds are on the VARA register explained; what operating without a licence means for an operator is on the VARA licensing service page | Article 20 lets VARA suspend a Permit for up to six months or revoke it, and on revocation coordinate with the commercial licensing authority to cancel the commercial licence |
| Confusing them: banking | What a trading or consulting company shows a bank; it says nothing about the accounts a VASP must hold | Capital and client accounts are tested against VARA’s rulebooks; what a licence does and does not do for banking is on the VARA licensing service page |
Sources: DMCC crypto page and note of 18 September 2026; IFZA and DIEZ sites (26 October 2026); Dubai Law No. 4 of 2022; Dubai Law No. 16 of 2021 and Resolution No. 1 of 2022; VARA Regulations 2023; VARA FAQ and unlicensed VASPs page (26 October 2026). The Law leaves fine amounts to a Board resolution (Article 20); the dated fine rounds are on the register page.
Where to go next
The pages above own the decisions that follow: regulator choice, cost, the register, the checklist and the free-zone seat. To apply, VARA licensing is the service page for a Dubai application and ADGM and DIFC crypto licensing for an FSRA or DFSA one. Infinilex is a legal, compliance and structuring consultancy. The application is made in your own entity’s name; Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign.
Frequently asked questions
Is a DMCC crypto licence a crypto licence?
No. DMCC's crypto page, read 26 October 2026, says its standard crypto licence covers only non-regulated activities and that regulated virtual asset activity needs an additional VARA licence through DMCC. Its note of 18 September 2026 says the DMCC licence does not replace the VARA licence, and Article 15 of Dubai Law No. 4 of 2022 puts VARA's approvals first.
Is there an IFZA crypto licence?
Not on any official IFZA page. IFZA's site, read 26 October 2026, describes a business setup provider in Dubai Silicon Oasis selling Commercial and Professional licences, and says nothing about crypto or VARA. Dubai Silicon Oasis is a free zone licensed by the Dubai Integrated Economic Zones Authority under Dubai Law No. 16 of 2021 and covered by Dubai Law No. 4 of 2022, so a crypto business set up through IFZA still needs a VARA licence.
How do I get a crypto exchange licence in Dubai?
Apply to VARA for an Exchange Services licence through Dubai Economy and Tourism or a Dubai free zone other than the DIFC. VARA's licence applications page, read 26 October 2026, sets two stages: an Initial Disclosure Questionnaire leading to an Approval to Incorporate, under which you may set up but not operate; then the full documentation, interviews, remaining fees and the VASP Licence.
Is a VARA licence a UAE crypto licence, or only a Dubai one?
Dubai outside the DIFC only. Dubai Law No. 4 of 2022 covers every Dubai zone except the DIFC, where the DFSA regulates Crypto Token activity. ADGM is in Abu Dhabi, under the FSRA. Elsewhere, Cabinet Resolution No. 111 of 2022 requires approval and a licence from the federal regulator, the Capital Market Authority since 1 January 2026, or the local licensing authority.
Do I need a VARA licence to trade my own crypto from Dubai?
No licence, but an NOC. VARA's FAQ, read 26 October 2026, says a proprietary trader using only its own funds needs no licence at this time but does need a VARA No Objection Certificate through its commercial licensor. Regulation IV.A.7 requires registration once own-portfolio investment reaches USD 250,000,000 in any rolling 30-day period; the FAQ also quotes AED 1 billion, so verify with VARA.
What is a Web3 licence in Dubai?
There is no Web3 category at VARA; free zones and agents use the term for commercial licences covering blockchain software and consultancy. DMCC's note of 18 September 2026 says a Web3 company with no regulated virtual asset activity needs a one-time VARA NOC, not a VASP licence. VARA's FAQ says no VA activity is exempt from supervision and an NFT marketplace needs a VA Exchange or Broker-Dealer licence.
Not sure which licence your product needs?
Tell us what the product does, who your users are and which licensor you have in mind. We will tell you whether it is a VARA activity, an FSRA or DFSA one, or a commercial licence with an NOC.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Further reading
VARA licensing · VARA vs ADGM vs DIFC · VARA licence cost, capital and timeline
General information, not legal advice on your product or structure. Law and regulator pages as read on 26 October 2026. Have the position reviewed before you rely on it.