MiCA vs VARA: where should your crypto business get licensed, the EU or Dubai?
MiCA is for businesses that want the EU: one CASP authorisation from one national regulator passports across 30 EEA countries, and since the transitional period closed on 1 July 2026 it is the only lawful way to serve EU clients. VARA is for businesses whose market is Dubai: a dedicated virtual-asset regulator with retail reach, licensing by activity, and no passport beyond the emirate. Where your users sit decides the licence, and plenty of serious businesses end up needing both.
The two regimes also use two names for the same kind of firm. The EU calls it a crypto-asset service provider, a CASP. Dubai, following the FATF standard, calls it a virtual asset service provider, a VASP. Same job, two rulebooks, and the definitions are not interchangeable; they are set out in the next section.
Service Need this handled rather than explained? See the Web3 practice, or book a 30-minute call with the author.
CASP vs VASP: what the two labels mean
VASP is the older and wider term, and it comes from anti-money-laundering law rather than licensing law. The FATF glossary (Recommendations, version updated October 2025) defines a virtual asset service provider as any natural or legal person not covered elsewhere under the Recommendations who, as a business, conducts one or more of five activities for or on behalf of another person: exchange between virtual assets and fiat currencies; exchange between one or more forms of virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or of instruments enabling control over them; and participation in and provision of financial services related to an issuer's offer or sale of a virtual asset. The label tells you who must identify customers, keep records and apply the travel rule. Most regulators outside the EU built their licensing vocabulary on it. Dubai is one. India's FIU-IND uses the variant "VDA service provider" under the PMLA, covered in FIU-IND registration.
Dubai turns the label into a status. Dubai Law No. 4 of 2022, Article 2, defines a Virtual Asset Service Provider as "a Person authorised by VARA to conduct the Activity", and Article 15(a) says that no Person may conduct the Activity in the Emirate without a Permit from VARA. VARA's Virtual Assets and Related Activities Regulations 2023 (consolidated version effective 19 June 2025) carry that through: a VASP "means an Entity Licensed by VARA to carry out VA Activity(ies) in the Emirate", and Part IV requires a Licence for each VA Activity before it is conducted. Schedule 1 lists the VA Activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, VA Management and Investment, and VA Transfer and Settlement Services, with Category 1 VA Issuance added as a licensable entry and defined in the VA Issuance Rulebook. So in Dubai a VASP is not a description of what you do but what you become once licensed. A firm doing those things without a licence is not an unlicensed VASP; it is in breach of Article 15.
CASP is MiCA's term, and it is defined by service. Article 3(1)(15) of Regulation (EU) 2023/1114 defines a crypto-asset service provider as "a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59". Article 3(1)(16) lists ten crypto-asset services: custody and administration; operating a trading platform; exchange of crypto-assets for funds; exchange for other crypto-assets; execution of orders; placing; reception and transmission of orders; advice; portfolio management; and transfer services. Article 59(1) closes the perimeter: nobody may provide those services in the Union unless authorised as a CASP under Article 63, or permitted under Article 60 as a credit institution, investment firm, e-money institution or one of the other listed institutions. The one carve-out is Article 61, where an EU client approaches a third-country firm at its own exclusive initiative; what that does and does not cover is on MiCA reverse solicitation for non-EU exchanges.
Three differences matter in practice. First, the activity lists do not line up: FATF names five activities, VARA licenses seven plus Category 1 issuance, and MiCA lists ten, with advice, portfolio management, and reception and transmission of orders having no FATF counterpart. The three lists overlap heavily but do not match, so a business has to be mapped against each one separately. Second, legal form: FATF's VASP can be a natural person; a MiCA CASP must be a legal person or other undertaking; a Dubai VASP must set up in the Emirate in a legal form approved by the commercial licensing authority under Article 15(b). Third, reach: the CASP label travels across 30 EEA states on one authorisation, while the Dubai VASP label is confined to the Emirate excluding the DIFC under Article 3 of the Law, and Regulation IV.A.4 adds that a VASP carrying out a licensed activity outside the Emirate must meet the higher of the two regulatory standards.
| Point | CASP (MiCA, EU) | VASP (FATF standard; Dubai Law No. 4 of 2022) |
|---|---|---|
| Defined in | Regulation (EU) 2023/1114, Art. 3(1)(15) and (16) | FATF Recommendations glossary; Dubai Law No. 4 of 2022, Art. 2; VARA Regulations 2023, Schedule 4 |
| Test | Provides one or more of ten listed crypto-asset services to clients on a professional basis and is allowed to do so under Art. 59 | FATF: conducts one or more of five listed activities as a business for another person. Dubai: a Person authorised by VARA to conduct the Activity |
| Activities counted | Ten: custody, trading platform, two exchange services, execution, placing, reception and transmission, advice, portfolio management, transfer | FATF: five. VARA Schedule 1: seven VA Activities plus Category 1 VA Issuance |
| Legal form | Legal person or other undertaking, with a registered office in a member state (Art. 59(2)) | FATF: natural or legal person. Dubai: must set up in the Emirate in an approved legal form (Art. 15(b)) |
| Where the label is valid | All 30 EEA states on one authorisation (Art. 65 passport) | Dubai, the Emirate excluding the DIFC (Art. 3 of the Law); no passport |
| Carve-outs | Art. 61 reverse solicitation, at the client's exclusive initiative, read narrowly | Regulation IV.A.5 professional exemption for practising lawyers, accountants and licensed consultants acting wholly incidentally to their practice |
What changed on 1 July 2026
MiCA's transitional period, the grandfathering window that let firms keep operating under old national regimes, closed on 1 July 2026. There was no extension, because the regulation contained no mechanism to grant one. From 2 July 2026, any firm providing crypto-asset services to EU clients without CASP authorisation is in breach of EU law. That applies business-to-business as well as retail, and it applies whether or not the firm's member state finished its national implementing law.
The regulators did not leave this ambiguous. ESMA's public statement of 23 June 2026 called on unauthorised providers to wind down in an orderly way: stop onboarding EU clients, stop marketing, and either transition to compliance or exit EU markets. The EU crypto market is now authorised-only.
The authorised population is smaller than most founders expect, though it is growing fast. ESMA's register recorded 323 CASP authorisations at its 31 July 2026 update, 30 of them granted in July alone, and the spread by home state is very uneven: Germany led with 68, then France with 35 and the Netherlands with 29, while four member states, Poland, Hungary, Greece and Romania, still had none at all. Poland had no implementing law and no designated regulator, so firms there had no domestic route to file. Which member state you file in has become a real decision, not a formality. The register is also where institutional entry shows up: Standard Chartered's Luxembourg entity took a CASP authorisation for crypto custody in June 2026, the kind of counterparty pressure that pushes serious businesses toward the authorised column.
What changed after the 30 September 2026 consultation close
Three things moved between August and early October 2026, and none of them loosens the perimeter.
The review is now in the Commission's hands. The Commission's targeted consultation on the review of MiCA ran from 20 May to 30 September 2026 and is closed. It was run under Articles 140 and 142, and the Commission's consultation page says the resulting report may, if warranted, be accompanied by a legislative proposal. Article 140(1) sets the date: a report to Parliament and Council on the application of the Regulation by 30 June 2027. Infinilex filed its own response on 2 September 2026; the five positions are on Our response to the EU's MiCA review consultation.
ESMA set out its asks on the closing day. ESMA's response to the consultation (ESMA75-113276571-1721, 30 September 2026) proposes a new regulated service for CASPs acting as gateways to DeFi, with risk disclosure, conflicts and protocol due-diligence duties attached; binding opinions on token classification, including hybrid tokens; streamlined white-paper notification and simplified authorisation requirements for transfer services; targeted conduct, disclosure and safeguarding requirements for staking, lending and borrowing; marketing restrictions, with obligations for influencers and third parties who promote crypto-assets; an explicit rule that a CASP "cannot provide any licensable service under MiCA in relation to ARTs or EMTs that are not compliant"; and specific powers over third-country firms that solicit EU investors, with the Article 61 reverse-solicitation exemption to be read "in as narrow a way as possible". One silence matters for product teams: the paper does not mention the Article 40 and Article 50 prohibition on interest. The ban stands.
The register kept growing, unevenly. ESMA's interim register, last updated 30 September 2026, lists 364 CASP records, up from 323 entries at the 31 July update; the count by member state and status is in the MiCA CASP register by member state. Poland, Hungary and Romania still have none. On the stablecoin side, 25 EMT issuers had notified 50 white papers across 14 member states, and the ART file was still empty.
Two further markers. On 23 September 2026 ESMA announced a new Union strategic supervisory priority on digital innovation from 2027, with an initial focus on how supervised entities use artificial intelligence and tokenisation; it does not name crypto-assets, but a pathway to tokenised capital markets is the closing section of ESMA's MiCA response. And the ECON committee's vote on the proposal to move CASP supervision to ESMA is still scheduled for 1 December 2026, as set out below.
Dubai did not move. As at 6 October 2026, VARA's news page shows nothing newer than its AML/CFT Business Risk Assessment Guidance of 12 June 2026, and the consolidated Regulations 2023 effective 19 June 2025 remain the operative set. The fee, capital and timeline figures a founder actually needs are on VARA licence cost, capital and timeline, and how to read VARA's public register is on Dubai's virtual asset register explained.
MiCA vs VARA, side by side
| Dimension | MiCA (EU) | VARA (Dubai) |
|---|---|---|
| Name for the licensed firm | Crypto-asset service provider (CASP): a legal person or other undertaking providing one or more of ten listed crypto-asset services on a professional basis, Art. 3(1)(15) and (16) | Virtual asset service provider (VASP): a Person authorised by VARA to conduct the Activity (Dubai Law No. 4 of 2022, Art. 2); an Entity Licensed by VARA for one or more VA Activities (Regulations 2023, Schedule 4) |
| Regulator and instrument | Regulation (EU) 2023/1114, applied by the national regulator of the member state you file in | The Virtual Assets Regulatory Authority, Dubai's dedicated virtual-asset regulator |
| Reach and passporting | One authorisation passports across the 27 EU member states plus Iceland, Liechtenstein and Norway, 30 EEA countries in all | The Emirate of Dubai excluding the DIFC. No passport to the EU, and no automatic reach into ADGM or DIFC |
| What gets authorised | CASP classes. Class 1 covers orders, execution, placing, transfer services, advice and portfolio management; Class 2 adds custody and exchange; Class 3 adds operating a trading platform | Seven activity licences: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement. Most can be aggregated under one VASP licence |
| Initial capital | EUR 50,000 (Class 1), EUR 125,000 (Class 2) or EUR 150,000 (Class 3), or one quarter of the prior year's fixed overheads if higher. Own funds, an insurance policy or comparable guarantee, or a combination can satisfy it under Art. 67(4) | Activity-based and set in AED. Confirm the current figure for your activity against the current VARA rulebooks |
| Assessment clock | A completeness stage of up to 25 working days, then 40 working days of substantive assessment from a complete file under Art. 63(9), with one information request that can pause the clock | A staged process, from initial approval through provisional approval to the full VASP licence, rather than a single statutory clock |
| Substance | Registered office in a member state where part of the services are carried out, effective management in the EU, at least one EU-resident director (Art. 59(2)), as a continuing condition | Physical office, qualified staff and genuine management presence in Dubai. Banking is often the slowest step |
| Who it fits | Businesses whose users are in the EU or EEA, or whose counterparties demand an EU-regulated entity | Businesses serving the Dubai market, including retail, or anchoring a Gulf presence |
Register counts, timelines and capital treatments change; figures here are stated as of 6 October 2026. The table is a planning aid, not a current-rate citation. Confirm every point against Regulation (EU) 2023/1114 and the current VARA rulebooks for your activity.
When MiCA fits
MiCA fits when your users, or the institutions you serve, are in the EU or EEA. The passport is the whole argument: one regulator, one file, and once you notify your passporting plan the home regulator has 10 working days to pass it to the host states under Art. 65. Nothing on the VARA side, or anywhere in the Gulf, buys that reach with one authorisation. The price is substance. Art. 59(2) requires a registered office in a member state where at least part of the services are carried out, effective management in the Union and at least one EU-resident director, and supervisors treat that as a continuing condition, not a filing-day formality. The people standard now has numbers attached: ESMA's knowledge-and-competence guidelines have applied since 28 July 2026, setting minimum qualification and annual training hours for staff who give information or advice on crypto-assets. And authorisation is where supervision starts, not ends: on 8 July 2026 ESMA opened a common supervisory action on the digital operational resilience of CASPs' custody services, running into 2027.
One thing to hold lightly: on 4 December 2025 the Commission proposed moving CASP supervision from national regulators to ESMA. That timeline has stretched. The European Parliament's ECON committee published its draft reports on 12 June 2026, with the rapporteur proposing that only significant CASPs move to direct ESMA supervision while smaller firms stay with their national regulator, and the committee is not scheduled to vote its negotiating position until 1 December 2026. Existing authorisations stay valid, and nothing about filing today changes. But the choice of home regulator is a decision with a horizon, and worth making deliberately.
When VARA fits
VARA fits when your market is Dubai and you need retail reach. It licenses by activity rather than by class: seven licensable activities, each with its own rulebook, and most of them can be aggregated under a single VASP licence. The process is staged, from initial approval through provisional approval to the full licence, and it expects real substance: a physical office, qualified staff and genuine management presence in Dubai, with application and annual supervision fees taken from VARA's current fee schedule. As with the EU, the licence is the visible part; banking is often the slowest step. If you are weighing Dubai against the UAE's other two regimes, we compare all three in VARA vs ADGM vs DIFC.
When you need both
There is no bridge between the two regimes. A VARA licence does not passport into the EU, and a CASP authorisation says nothing about Dubai. A business that wants EU market access and a Gulf base therefore needs both licences, which means two substance builds, two capital requirements and one group structure that can carry them without the entities fighting each other. Which entity holds which licence, where the token issuer sits, and which licence you file for first are structuring questions before they are licensing questions, and they are much cheaper to answer before the first application than after it.
The stablecoin angle: EMT is the live track
MiCA splits stablecoins into e-money tokens and asset-referenced tokens, and the register tells you which track is real. ESMA's register update of 30 September 2026 lists 25 EMT issuers on 50 register lines across 13 member states and Iceland, and the ART column is still empty; where each one sits is compared on where to issue a stablecoin. An EMT issuer must additionally be a credit institution or an authorised e-money institution, so the issuer bar is high.
The trap for product teams is the interest ban. Art. 40 prohibits ART issuers from granting interest, Art. 50 does the same for EMTs, and both articles extend the ban to crypto-asset service providers offering services related to those tokens, defining interest widely enough to catch net compensation or discounts with equivalent effect. A product paying yield on a stablecoin to EU users has a structural problem, not a marketing one. The ban is, for the first time, formally in play: the Commission's targeted consultation on the MiCA review, which ran from 20 May to 30 September 2026, expressly asks whether the interest prohibition should be modified. That is a review, not relief: the consultation has closed, ESMA's response of the same day does not take the interest question up, and the ban stands until the law changes, with the Commission's report under Article 140(1), due by 30 June 2027, as the earliest formal signal. We compare how five markets treat this in Stablecoin yield across jurisdictions.
How this connects to the rest of your structure
A licence never stands alone. If Dubai is on the table, the UAE itself offers three regimes, not one, compared in VARA vs ADGM vs DIFC. Where the holding company sits is its own decision, covered in Delaware vs UAE vs India. And the licence-holding entity has to fit the operating stack most of our clients already run across India, the UAE and the US, which is the corridor our Web3 practice works every day. On the EU side, Infinilex works as the cross-border quarterback: we own discovery, jurisdiction choice, group structuring and project management, and EU-qualified local counsel, engaged and managed by us, handles the regulator-facing filing.
What we check before a founder chooses
- Users and markets: where your clients actually are, the EU, Dubai or both, and what each perimeter means for the way you sell.
- Activity mapping: which CASP class your services fall into, and which of VARA's seven activities you genuinely need licensed.
- Capital planning: whether own funds, an insurance policy or a mix is the right way to meet the CASP prudential requirement under Art. 67(4), a route many founders never hear about.
- Substance: whether the EU entity can carry real management under Art. 59(2), and whether the Dubai office and hiring plan holds up.
- The token: if there is one, whether it is an EMT or an ART under MiCA, and what the interest ban does to the product.
- Sequence and structure: which licence comes first, which group entity holds it, and how both fit the India, UAE and US structure you already have.
Frequently asked questions
What is the difference between MiCA and VARA?
MiCA is the EU's single rulebook for crypto-asset services: one CASP authorisation from one national regulator passports across 30 EEA countries. VARA is Dubai's dedicated virtual-asset regulator: one licence covering the Emirate of Dubai excluding the DIFC, with no passport beyond it. MiCA authorises by service class, VARA licenses by activity across seven licensable activities. Where your users sit, and how far you need to reach, decides between them.
Do I need MiCA authorisation to serve EU customers in 2026?
Yes. The transitional period closed on 1 July 2026, and from 2 July any firm providing crypto-asset services to EU clients without CASP authorisation is in breach of EU law. That applies business-to-business as well as retail, and it applies even where a member state has not finished its national implementing law. If EU clients matter to your business, the route is an authorisation filed through a national regulator, not a workaround.
Can a Dubai VARA licence passport into the EU?
No. A VARA licence has single-emirate reach: it covers Dubai outside the DIFC and does not passport anywhere, not into the EU or EEA, and not even automatically into ADGM or DIFC, which are separate regulators. MiCA's one-licence, 30-country passport has no VARA equivalent. A business that wants both the EU and Dubai needs both licences, held in a group structure that can carry the substance each regime expects.
How long does CASP authorisation take?
The statutory clock is short: the regulator acknowledges receipt within 5 working days, has 25 working days to assess completeness, then 40 working days from a complete file to grant or refuse, with one information request allowed that can pause the clock for up to 20 working days. In practice, as of mid-2026, authorisations were taking 4 to 12 months from filing, and 9 to 15 months end to end including entity setup. The gap is file completeness, not regulator slowness.
What happened to firms that missed the 1 July 2026 deadline?
ESMA's public statement of 23 June 2026 told unauthorised providers to wind down in an orderly way: stop onboarding EU clients, stop marketing, and either transition to compliance or exit EU markets. From 2 July 2026, serving EU clients without authorisation is a breach of EU law. The realistic options now are to file for CASP authorisation properly, or to restructure around markets the business can serve lawfully, which for many firms is where Dubai enters the conversation.
What is the difference between a VASP and a CASP?
A VASP, virtual asset service provider, is the FATF anti-money-laundering term: any natural or legal person who, as a business, conducts one or more of five activities for another person, namely exchange between virtual assets and fiat currencies, exchange between virtual assets, transfer, safekeeping or administration, and participation in an issuer's offer or sale. Dubai Law No. 4 of 2022 adopts the label but defines a VASP as a Person authorised by VARA to conduct the Activity, so in Dubai it is a licensed status, not a description. A CASP, crypto-asset service provider, is MiCA's term: a legal person or other undertaking that provides one or more of ten listed crypto-asset services to clients on a professional basis and is allowed to do so under Article 59. The lists overlap but do not match, a CASP must be a legal person where a FATF VASP need not be, and only the CASP label passports, across 30 EEA states.
EU CASP licence or Dubai VASP licence in 2026: which should I apply for?
Apply where your users are. If you serve EU or EEA clients, only a CASP authorisation is lawful since the transitional period closed on 1 July 2026, and one authorisation passports across 30 states. If your market is Dubai or the Gulf, including retail, a VARA licence fits and a CASP authorisation would give you nothing there. If you need both markets, you need both licences in a group structure that can carry two substance builds. Nothing in the MiCA review consultation that closed on 30 September 2026 changes that choice: ESMA's response asks for a wider EU perimeter, not a narrower one, and VARA's news page shows no rulebook change since June 2026.
What changed in MiCA after the 30 September 2026 consultation close?
The Commission's targeted consultation on the MiCA review closed on 30 September 2026. The Commission now has to report to Parliament and Council under Article 140(1) by 30 June 2027, with a legislative proposal if warranted. On the closing day ESMA published its own response, proposing a new regulated service for CASPs that act as gateways to DeFi, binding opinions on token classification, targeted rules for staking, lending and borrowing, obligations for influencers, an explicit ban on CASP services for non-compliant stablecoins, and a narrower reading of reverse solicitation. ESMA's paper does not mention the interest ban, so it stands. ESMA's interim register, last updated 30 September 2026, showed 359 currently authorised CASPs; Poland, Hungary and Romania still had none.
Can Infinilex run a CASP authorisation or a VARA licence application?
Yes, in the role of cross-border quarterback. Infinilex is a legal, compliance and structuring consultancy. For MiCA, Infinilex quarterbacks and EU local counsel files: we run discovery, class mapping, jurisdiction choice, group structuring and project management, and the EU-qualified counsel we scope and coordinate signs and files with the national regulator. For VARA, ADGM or DIFC we run the same process against the Dubai or Abu Dhabi rulebooks, with in-house chartered accountant and company secretary capacity for the entity, capital and reporting work. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. Email is answered within one working day.
What a non-EU exchange may still do for an EU client who came to it unsolicited, and the evidence file ESMA expects, is on MiCA reverse solicitation for non-EU exchanges after 1 July 2026.
Choosing between the EU and Dubai, or planning both?
Tell us where your users are and what you actually do with crypto-assets, and we will map the right regime, the class or activities you need, and how the licence-holding entity fits the rest of your structure.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Sources: Regulation (EU) 2023/1114 (OJ L 150, 9 June 2023), Arts. 3(1)(15) and (16), 59, 61, 140, 142 and 143(3); ESMA response to the EC consultation on the review of MiCA, ESMA75-113276571-1721, 30 September 2026; ESMA interim MiCA register, last update 30 September 2026 (the counts above are our tally of the CASP, EMT and ART files); European Commission, targeted consultation on the review of MiCA, 20 May to 30 September 2026; Dubai Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai, Arts. 2, 3, 15 and 16; VARA Virtual Assets and Related Activities Regulations 2023, Part IV and Schedules 1 and 4, consolidated version effective 19 June 2025; FATF Recommendations, glossary, version updated October 2025; VARA news, checked 6 October 2026.
This article is general information for founders, not legal or regulatory advice for your specific project. The MiCA and VARA frameworks, register counts and timelines change, and figures here are stated as of 6 October 2026; confirm every point against Regulation (EU) 2023/1114, ESMA's registers and the current VARA rulebooks before relying on it. The right regime depends on your users, your activity and the wider structure you are building across India, the UAE and the US. Have your structure reviewed before you file.