The UAE VASP licensing-readiness checklist
A VARA application is filed in two stages, an Initial Disclosure Questionnaire through DET or a Dubai free zone and then the full VASP licence dossier: business plan and projections, UBO list, Fit and Proper confirmations, source of funds, the policy set for the four compulsory rulebooks, proof of paid-up capital, insurance certificates, a reserve account report, a succession plan and a wind-down plan. You need a physical presence in Dubai, a private office for six of the seven licensed activities (all but Advisory) and for Issuance Category 1, and two full-time Responsible Individuals and a Compliance Officer who are UAE residents or passport holders; the shareholders can be foreign and face no nationality restriction, so relocation is a question for the people who run the business, not the people who own it.
A UAE virtual-asset licence is won or lost before you file, in the choice of regime, the substance, and the compliance function. This is the readiness list we run with founders choosing between VARA, ADGM and DIFC. Read the comparison first: VARA vs ADGM vs DIFC.
Work through it in order. The regime decides the rulebook; the activities decide the scope; substance, capital, compliance and banking decide whether the application survives review.
Choose the regime before anything else
VARA, ADGM or DIFC decides the rulebook, the regulator and the reach.
- Are you serving the Dubai market and need retail reach (VARA), issuing tokens or running a foundation or DAO (ADGM), or building institutional and investment-token activity (DIFC)?
- Have you read the trade-offs before you file? See VARA vs ADGM vs DIFC.
- Does the chosen regime fit the wider India and US structure you are building, not just the UAE leg?
Map your licensable activities
Each regime licenses activities, not companies. List what you actually do.
- Which of VARA's activities do you perform: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, or transfer and settlement?
- Are you applying for exactly the activities you run, and no more? Over-scoping raises capital and compliance cost.
- For ADGM or DIFC, have you mapped the equivalent FSRA or DFSA regulated activities?
Entity and substance
Every UAE regime now expects real presence, not a mailbox.
- A physical office in the right zone, with genuine local management and staff?
- Directors and key function holders who meet the fit-and-proper expectations?
- A structure a regulator can follow: who owns the entity, and where value moves.
- For VARA: an LLC or free zone company established with DET or a Dubai free zone other than the DIFC. VARA says it will not accept applications from sole proprietorships.
- For VARA: two Responsible Individuals of sufficient seniority, each a full-time employee, Fit and Proper, resident in the UAE or a UAE passport holder, and approved by VARA during licensing (Company Rulebook Part I Rules C.1 and C.2, VER20250519).
- For VARA: a private office in Dubai for six of the seven licensed activities (all but Advisory) and for Issuance Category 1, with no minimum size set by VARA. The office and relocation questions are answered below.
Capital and fees
Budget the capital requirement and the fees for your activity category.
- Do you meet the minimum capital for the activities you are applying for?
- Have you budgeted application and annual supervision fees (indicative, confirm current)?
- Is there runway for the licensing period itself, which takes months, before revenue?
- VARA's per-activity fees and capital rules are tabulated, dated, on VARA licence cost, capital and timeline.
The compliance function
The programme a regulator, an auditor and a bank will all ask to see.
- A named Compliance Officer and MLRO, in the UAE, not a title borrowed from a group entity?
- A written AML and CFT programme, KYC, sanctions screening and suspicious-transaction reporting that actually runs?
- Readiness for the FATF Travel Rule on transfers between service providers?
- For VARA: a Compliance Officer with at least five years of compliance experience, a full-time employee resident in the UAE or holding a UAE passport, approved by VARA and reporting directly to the Board; an MLRO with at least two years of AML and CFT experience; one person may hold both where the duties do not conflict (Compliance and Risk Management Rulebook Part I Rule C.1 and Part III Rule A). The programme those officers run is designed on the crypto AML programme page.
Banking and fiat
Usually the slowest step, and the one that fails structures.
- A banking or payments partner lined up, and a clean, documented source of funds?
- Does the structure read coherently, so it is not declined as opaque?
- If you take fiat, is the flow run through a regulated partner rather than your own entity where required?
The dossier and what comes after
The filing is a beginning, not the finish line.
- A business plan, financial model, and the full policy set the regulator expects?
- A pre-application gap analysis, so you file clean rather than round-tripping corrections?
- A plan for ongoing reporting, audits and renewals once the licence is granted?
- For VARA: the evidence list the regulator publishes, from certificate of incorporation and UBO list to proof of paid-up capital, insurance certificates, succession plan and wind-down plan. It is set out in the dossier, stage by stage.
Pick the regime for what you actually do, then build the substance and the compliance function to match, before you file. A UAE licence is not a registration you buy; it is a supervised relationship you enter. The structure, the people and the banking have to be real on the day you apply, because the regulator, the auditor and the bank are all checking the same thing: whether this is a genuine, governed business.
The VARA dossier, stage by stage
VARA’s licence applications page describes licensing for a new firm in two stages. Neither stage carries a published duration.
| Stage | What you file | What you receive |
|---|---|---|
| Stage 1 · Approval to Incorporate | The Initial Disclosure Questionnaire, filed with Dubai Economy and Tourism (mainland) or a Dubai free zone other than the DIFC, which screens it and passes it to VARA; the business plan; beneficial owner and senior management details; the initial fee. | The Approval to Incorporate (ATI). You can incorporate the entity and set up operations. You cannot carry on any virtual asset activity yet. |
| Stage 2 · VASP licence | The documentation VARA’s guidance asks for: certificate of incorporation, UBO list, Fit and Proper confirmations, source of funds, organisational structure and governance framework, website, key personnel job descriptions, CVs and passports, business plan and financial projections, group and entity financial statements, proof of paid-up capital, available capital evidence, reserve account report, insurance certificates, succession plan, wind-down plan, close links analysis. Then VARA’s feedback, which may include meetings and interviews, further documents, the remaining application fee and the first year’s supervision fee. | The VASP licence, which may carry operational conditions. Supervision, reporting and renewal begin. |
Every applicant must comply with the four compulsory rulebooks, Company, Compliance and Risk Management, Technology and Information, and Market Conduct, plus the rulebook for each activity applied for. The policy set in the dossier is written against them. The entity itself is an LLC or a free zone company; VARA’s FAQ says sole proprietorships are not accepted.
Frequently asked questions
What documents does a UAE VASP licence application need?
For VARA, the regulator's own non-exhaustive evidence list, read on 6 October 2026, runs: certificate of incorporation, UBO list, Fit and Proper confirmations for the people, evidence of source of funds, the organisational structure and governance framework, the website, job descriptions, CVs and passports for key personnel, a business plan with financial projections, group and entity financial statements, proof of paid-up capital, evidence of available capital and a reserve account report, insurance certificates, a succession plan, a wind-down plan and an analysis of close links and associated entities. The policy set has to show compliance with the four compulsory rulebooks (Company; Compliance and Risk Management; Technology and Information; Market Conduct) plus the rulebook for each activity you apply for. ADGM (FSRA) and DIFC (DFSA) use their own forms and evidence lists; map them from the regulator's current guidance before you file.
What is VARA's Initial Disclosure Questionnaire, and what should I prepare for it?
The Initial Disclosure Questionnaire (IDQ) opens Stage 1 of VARA's two-stage process. It is filed with the commercial licensor, Dubai Economy and Tourism (DET) for the mainland or a Dubai free zone other than the DIFC, which screens it and passes it to VARA for assessment. Prepare the business plan, the beneficial owner and senior management details and the ownership structure before you start, and pay the initial fee when asked. What you receive is the Approval to Incorporate: it lets you incorporate and set up, and it does not permit any virtual asset activity until the Stage 2 VASP licence is granted.
Do I need a physical office in Dubai for a VARA licence?
Yes. VARA's FAQ states that a VASP must have a physical presence in Dubai to conduct virtual asset activities from Dubai, and that a private office is required for Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement and Issuance Category 1. Advisory is the only one of VARA's seven licensed activities not on that list, so confirm with VARA what presence it expects from an advisory-only applicant. VARA sets no minimum size for the office. VARA's FAQ does not say whether a flexi desk or a shared office counts as a private office, and it leaves space requirements to the commercial licensor; confirm with VARA and with DET or your free zone before you sign a lease. The office has to be in Dubai, where VARA's jurisdiction runs, and outside the DIFC, which the DFSA regulates.
What are VARA's substance requirements for staff, and who has to live in the UAE?
Two Responsible Individuals and the Compliance Officer must be resident in the UAE or hold a UAE passport. Under Company Rulebook Part I Rules C.1 and C.2 (VER20250519), a VASP appoints two Responsible Individuals of sufficient seniority, each a full-time employee, Fit and Proper, and notified to and approved by VARA during licensing; they are re-validated every year and changes need VARA's prior approval. Under Compliance and Risk Management Rulebook Part I Rule C.1, the Compliance Officer is a full-time employee with at least five years of compliance experience, resident in the UAE or a UAE passport holder, approved by VARA as Fit and Proper, and reporting directly to the Board. The MLRO needs at least two years of AML and CFT experience and Fit and Proper standing (Part III Rule A), and one person may hold both the Compliance Officer and MLRO roles where the duties do not conflict. Senior management as a whole must be suitably qualified. None of these roles can be a title borrowed from a group entity or an adviser.
Do I have to relocate to Dubai to get a VARA licence?
Not as a shareholder; yes for the people who run it. VARA states there are no nationality restrictions on applicants and that the application is made by a legal entity established with DET or a Dubai free zone other than the DIFC. But the two Responsible Individuals and the Compliance Officer have to be full-time employees who are UAE residents or UAE passport holders, and the business needs a physical presence in Dubai. So a founder who stays abroad hires those roles locally and accepts that day-to-day control sits in Dubai; a founder who takes a Responsible Individual role relocates. Where the mind and management of the company sits also decides its tax residence: a Dubai company controlled from India can be treated as resident in India under the place of effective management test, which is worked through on the UAE company run from India page and the founder relocation page linked below.
Can a foreigner own 100 percent of a crypto company in Dubai without relocating?
Own, yes; run from abroad, no. VARA's FAQ says there are no nationality restrictions on persons submitting a licence application, and that the applicant must be a legal entity established with DET or a Dubai free zone other than the DIFC, preferably an LLC or a free zone company; sole proprietorships are not accepted. On the mainland, Federal Decree-Law 26 of 2020, in effect from early 2021 and carried into Federal Decree-Law 32 of 2021 on Commercial Companies, abolished the requirement for a majority Emirati shareholder or local partner, so a foreign investor can hold 100 percent of a mainland LLC unless the activity is a strategic impact activity set by the Cabinet or appears on the restricted list on the UAE Government portal, which names banks, exchange, financing and insurance among others (u.ae, Full foreign ownership of commercial companies, updated 6 April 2026, read 6 October 2026). Whether a virtual asset activity falls under any of those headings, and whether your commercial licensor allows full foreign ownership for your specific activity, is confirmed with DET or the free zone before you incorporate, because the licensor's activity list, not VARA, governs that point. Ownership is separate from substance: the Responsible Individuals, the Compliance Officer and the office are in Dubai whoever the shareholders are.
What does Infinilex prepare for a UAE VASP application?
Infinilex maps the regime (VARA, ADGM or DIFC) and the licensable activities to what you actually do, runs the pre-application gap analysis, and assembles the dossier: the regulatory business plan, the ownership and governance papers, the policy set against the compulsory rulebooks, and the capital, insurance and wind-down evidence. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. In-house chartered accountant and company secretary capacity covers the financial statements, capital evidence and corporate filings the regulator asks for. The Responsible Individual, Compliance Officer and MLRO roles stay with your own appointees, as the rulebooks require. Email is answered within one working day.
Who can take on a VARA application end to end, and who signs, is covered on the VARA licensing service page.
Primary texts, each read on 6 October 2026: VARA, Licence applications (two-stage process, evidence list, compulsory rulebooks); VARA, FAQ (legal form, Responsible Individuals, physical presence and private office, nationality); VARA Company Rulebook, Part I.C Responsible Individuals, VER20250519, effective 19 June 2025; VARA Compliance and Risk Management Rulebook, Part I.C Duties of the Compliance Officer and Part III.A Appointment and duties of the MLRO; UAE Government portal, Full foreign ownership of commercial companies, updated 6 April 2026 (Federal Decree-Law 26 of 2020, Federal Decree-Law 32 of 2021, strategic impact activities). Related reading: a UAE company run from India: POEM and QFZP; Indian founder moving to Dubai; the Dubai virtual asset register.
Choosing between VARA, ADGM and DIFC?
Send us what you do with tokens and who your users are, and we will map the regime, the activities and the substance, in one call.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Want this as a PDF in your inbox?
Email us and we will send the current version, and the updated one each time the law moves. Or print the page: it is built for paper.
This checklist is general information for founders, not legal or regulatory advice for your specific project. The VARA, ADGM and DIFC frameworks and their fees change; confirm every point against current rules before relying on it. The right regime depends on your activity, your users and your wider structure. Have your setup reviewed before you apply.
Prepared by Infinilex Consultancy · infinilex.io · Verified as of 6 October 2026. Printed copies date; check infinilex.io/resources/ for the current version.