The UAE VASP licensing-readiness checklist
A UAE virtual-asset licence is won or lost before you file, in the choice of regime, the substance, and the compliance function. This is the readiness list we run with founders choosing between VARA, ADGM and DIFC. Read the comparison first: VARA vs ADGM vs DIFC.
Work through it in order. The regime decides the rulebook; the activities decide the scope; substance, capital, compliance and banking decide whether the application survives review.
Choose the regime before anything else
VARA, ADGM or DIFC decides the rulebook, the regulator and the reach.
- Are you serving the Dubai market and need retail reach (VARA), issuing tokens or running a foundation or DAO (ADGM), or building institutional and investment-token activity (DIFC)?
- Have you read the trade-offs before you file? See VARA vs ADGM vs DIFC.
- Does the chosen regime fit the wider India and US structure you are building, not just the UAE leg?
Map your licensable activities
Each regime licenses activities, not companies. List what you actually do.
- Which of VARA's activities do you perform: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, or transfer and settlement?
- Are you applying for exactly the activities you run, and no more? Over-scoping raises capital and compliance cost.
- For ADGM or DIFC, have you mapped the equivalent FSRA or DFSA regulated activities?
Entity and substance
Every UAE regime now expects real presence, not a mailbox.
- A physical office in the right zone, with genuine local management and staff?
- Directors and key function holders who meet the fit-and-proper expectations?
- A structure a regulator can follow: who owns the entity, and where value moves.
Capital and fees
Budget the capital requirement and the fees for your activity category.
- Do you meet the minimum capital for the activities you are applying for?
- Have you budgeted application and annual supervision fees (indicative, confirm current)?
- Is there runway for the licensing period itself, which takes months, before revenue?
The compliance function
The programme a regulator, an auditor and a bank will all ask to see.
- A named Compliance Officer and MLRO, in the UAE, not a title borrowed from a group entity?
- A written AML and CFT programme, KYC, sanctions screening and suspicious-transaction reporting that actually runs?
- Readiness for the FATF Travel Rule on transfers between service providers?
Banking and fiat
Usually the slowest step, and the one that fails structures.
- A banking or payments partner lined up, and a clean, documented source of funds?
- Does the structure read coherently, so it is not declined as opaque?
- If you take fiat, is the flow run through a regulated partner rather than your own entity where required?
The dossier and what comes after
The filing is a beginning, not the finish line.
- A business plan, financial model, and the full policy set the regulator expects?
- A pre-application gap analysis, so you file clean rather than round-tripping corrections?
- A plan for ongoing reporting, audits and renewals once the licence is granted?
Pick the regime for what you actually do, then build the substance and the compliance function to match, before you file. A UAE licence is not a registration you buy; it is a supervised relationship you enter. The structure, the people and the banking have to be real on the day you apply, because the regulator, the auditor and the bank are all checking the same thing: whether this is a genuine, governed business.
Choosing between VARA, ADGM and DIFC?
Send us what you do with tokens and who your users are, and we will map the regime, the activities and the substance, in one call.
Want this as a PDF in your inbox?
Email us and we will send the current version, and the updated one each time the law moves. Or print the page: it is built for paper.
This checklist is general information for founders, not legal or regulatory advice for your specific project. The VARA, ADGM and DIFC frameworks and their fees change; confirm every point against current rules before relying on it. The right regime depends on your activity, your users and your wider structure. Have your setup reviewed before you apply.
Prepared by Infinilex Consultancy · infinilex.io · Verified as of 3 July 2026. Printed copies date; check infinilex.io/resources/ for the current version.