MiCA vs VARA: where should your crypto business get licensed, the EU or Dubai?
MiCA is for businesses that want the EU: one CASP authorisation from one national regulator passports across 30 EEA countries, and since the transitional period closed on 1 July 2026 it is the only lawful way to serve EU clients. VARA is for businesses whose market is Dubai: a dedicated virtual-asset regulator with retail reach, licensing by activity, and no passport beyond the emirate. Where your users sit decides the licence, and plenty of serious businesses end up needing both.
What changed on 1 July 2026
MiCA's transitional period, the grandfathering window that let firms keep operating under old national regimes, closed on 1 July 2026. There was no extension, because the regulation contained no mechanism to grant one. From 2 July 2026, any firm providing crypto-asset services to EU clients without CASP authorisation is in breach of EU law. That applies business-to-business as well as retail, and it applies whether or not the firm's member state finished its national implementing law.
The regulators did not leave this ambiguous. ESMA's public statement of 23 June 2026 called on unauthorised providers to wind down in an orderly way: stop onboarding EU clients, stop marketing, and either transition to compliance or exit EU markets. The EU crypto market is now authorised-only.
The authorised population is smaller than most founders expect. About 290 CASPs held authorisation across the EU and EEA as of mid-July 2026, and four member states, Poland, Hungary, Greece and Romania, had none at all. Poland had no implementing law and no designated regulator, so firms there had no domestic route to file. Which member state you file in has become a real decision, not a formality.
MiCA vs VARA, side by side
| Dimension | MiCA (EU) | VARA (Dubai) |
|---|---|---|
| Regulator and instrument | Regulation (EU) 2023/1114, applied by the national regulator of the member state you file in | The Virtual Assets Regulatory Authority, Dubai's dedicated virtual-asset regulator |
| Reach and passporting | One authorisation passports across the 27 EU member states plus Iceland, Liechtenstein and Norway, 30 EEA countries in all | The Emirate of Dubai excluding the DIFC. No passport to the EU, and no automatic reach into ADGM or DIFC |
| What gets authorised | CASP classes. Class 1 covers orders, execution, placing, transfer services, advice and portfolio management; Class 2 adds custody and exchange; Class 3 adds operating a trading platform | Seven activity licences: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement. Most can be aggregated under one VASP licence |
| Initial capital | EUR 50,000 (Class 1), EUR 125,000 (Class 2) or EUR 150,000 (Class 3), or one quarter of the prior year's fixed overheads if higher. Own funds, an insurance policy or comparable guarantee, or a combination can satisfy it under Art. 67(4) | Activity-based and set in AED. Confirm the current figure for your activity against the current VARA rulebooks |
| Assessment clock | A completeness stage of up to 25 working days, then 40 working days of substantive assessment from a complete file under Art. 63(9), with one information request that can pause the clock | A staged process, from initial approval through provisional approval to the full VASP licence, rather than a single statutory clock |
| Substance | Registered office in a member state where part of the services are carried out, effective management in the EU, at least one EU-resident director (Art. 59(2)), as a continuing condition | Physical office, qualified staff and genuine management presence in Dubai. Banking is often the slowest step |
| Who it fits | Businesses whose users are in the EU or EEA, or whose counterparties demand an EU-regulated entity | Businesses serving the Dubai market, including retail, or anchoring a Gulf presence |
Register counts, timelines and capital treatments change; figures here are stated as of mid-July 2026. The table is a planning aid, not a current-rate citation. Confirm every point against Regulation (EU) 2023/1114 and the current VARA rulebooks for your activity.
When MiCA fits
MiCA fits when your users, or the institutions you serve, are in the EU or EEA. The passport is the whole argument: one regulator, one file, and once you notify your passporting plan the home regulator has 10 working days to pass it to the host states under Art. 65. Nothing on the VARA side, or anywhere in the Gulf, buys that reach with one authorisation. The price is substance. Art. 59(2) requires a registered office in a member state where at least part of the services are carried out, effective management in the Union and at least one EU-resident director, and supervisors treat that as a continuing condition, not a filing-day formality.
One thing to hold lightly: on 4 December 2025 the Commission proposed moving CASP supervision from national regulators to ESMA. As of mid-July 2026 the negotiations were targeted to conclude by the end of the year, existing authorisations stay valid, and nothing about filing today changes. But the choice of home regulator is a decision with a horizon, and worth making deliberately.
When VARA fits
VARA fits when your market is Dubai and you need retail reach. It licenses by activity rather than by class: seven licensable activities, each with its own rulebook, and most of them can be aggregated under a single VASP licence. The process is staged, from initial approval through provisional approval to the full licence, and it expects real substance: a physical office, qualified staff and genuine management presence in Dubai, with application and annual supervision fees taken from VARA's current fee schedule. As with the EU, the licence is the visible part; banking is often the slowest step. If you are weighing Dubai against the UAE's other two regimes, we compare all three in VARA vs ADGM vs DIFC.
When you need both
There is no bridge between the two regimes. A VARA licence does not passport into the EU, and a CASP authorisation says nothing about Dubai. A business that wants EU market access and a Gulf base therefore needs both licences, which means two substance builds, two capital requirements and one group structure that can carry them without the entities fighting each other. Which entity holds which licence, where the token issuer sits, and which licence you file for first are structuring questions before they are licensing questions, and they are much cheaper to answer before the first application than after it.
The stablecoin angle: EMT is the live track
MiCA splits stablecoins into e-money tokens and asset-referenced tokens, and the register tells you which track is real. As of mid-July 2026, zero ART issuers had been authorised anywhere in the EU, while 21 EMT issuers had notified 41 EMT white papers across 12 member states. An EMT issuer must additionally be a credit institution or an authorised e-money institution, so the issuer bar is high.
The trap for product teams is the interest ban. Art. 40 prohibits ART issuers from granting interest, Art. 50 does the same for EMTs, and both articles extend the ban to crypto-asset service providers offering services related to those tokens, defining interest widely enough to catch net compensation or discounts with equivalent effect. A product paying yield on a stablecoin to EU users has a structural problem, not a marketing one. The Commission's targeted review consultation, open until 30 September 2026, covers stablecoins among other things, but that is a review, not relief. We compare how five markets treat this in Stablecoin yield across jurisdictions.
How this connects to the rest of your structure
A licence never stands alone. If Dubai is on the table, the UAE itself offers three regimes, not one, compared in VARA vs ADGM vs DIFC. Where the holding company sits is its own decision, covered in Delaware vs UAE vs India. And the licence-holding entity has to fit the operating stack most of our clients already run across India, the UAE and the US, which is the corridor our Web3 practice works every day. On the EU side, Infinilex works as the cross-border quarterback: we own discovery, jurisdiction choice, group structuring and project management, and EU-qualified local counsel, engaged and managed by us, handles the regulator-facing filing.
What we check before a founder chooses
- Users and markets: where your clients actually are, the EU, Dubai or both, and what each perimeter means for the way you sell.
- Activity mapping: which CASP class your services fall into, and which of VARA's seven activities you genuinely need licensed.
- Capital planning: whether own funds, an insurance policy or a mix is the right way to meet the CASP prudential requirement under Art. 67(4), a route many founders never hear about.
- Substance: whether the EU entity can carry real management under Art. 59(2), and whether the Dubai office and hiring plan holds up.
- The token: if there is one, whether it is an EMT or an ART under MiCA, and what the interest ban does to the product.
- Sequence and structure: which licence comes first, which group entity holds it, and how both fit the India, UAE and US structure you already have.
Frequently asked questions
What is the difference between MiCA and VARA?
MiCA is the EU's single rulebook for crypto-asset services: one CASP authorisation from one national regulator passports across 30 EEA countries. VARA is Dubai's dedicated virtual-asset regulator: one licence covering the Emirate of Dubai excluding the DIFC, with no passport beyond it. MiCA authorises by service class, VARA licenses by activity across seven licensable activities. Where your users sit, and how far you need to reach, decides between them.
Do I need MiCA authorisation to serve EU customers in 2026?
Yes. The transitional period closed on 1 July 2026, and from 2 July any firm providing crypto-asset services to EU clients without CASP authorisation is in breach of EU law. That applies business-to-business as well as retail, and it applies even where a member state has not finished its national implementing law. If EU clients matter to your business, the route is an authorisation filed through a national regulator, not a workaround.
Can a Dubai VARA licence passport into the EU?
No. A VARA licence has single-emirate reach: it covers Dubai outside the DIFC and does not passport anywhere, not into the EU or EEA, and not even automatically into ADGM or DIFC, which are separate regulators. MiCA's one-licence, 30-country passport has no VARA equivalent. A business that wants both the EU and Dubai needs both licences, held in a group structure that can carry the substance each regime expects.
How long does CASP authorisation take?
The statutory clock is short: the regulator acknowledges receipt within 5 working days, has 25 working days to assess completeness, then 40 working days from a complete file to grant or refuse, with one information request allowed that can pause the clock for up to 20 working days. In practice, as of mid-2026, authorisations were taking 4 to 12 months from filing, and 9 to 15 months end to end including entity setup. The gap is file completeness, not regulator slowness.
What happened to firms that missed the 1 July 2026 deadline?
ESMA's public statement of 23 June 2026 told unauthorised providers to wind down in an orderly way: stop onboarding EU clients, stop marketing, and either transition to compliance or exit EU markets. From 2 July 2026, serving EU clients without authorisation is a breach of EU law. The realistic options now are to file for CASP authorisation properly, or to restructure around markets the business can serve lawfully, which for many firms is where Dubai enters the conversation.
Choosing between the EU and Dubai, or planning both?
Tell us where your users are and what you actually do with crypto-assets, and we will map the right regime, the class or activities you need, and how the licence-holding entity fits the rest of your structure.
This article is general information for founders, not legal or regulatory advice for your specific project. The MiCA and VARA frameworks, register counts and timelines change, and figures here are stated as of mid-July 2026; confirm every point against Regulation (EU) 2023/1114, ESMA's registers and the current VARA rulebooks before relying on it. The right regime depends on your users, your activity and the wider structure you are building across India, the UAE and the US. Have your structure reviewed before you file.