VARA licensing in Dubai, run end to end.
Dubai's Virtual Assets Regulatory Authority licenses virtual-asset activity by category, through its own rulebooks, with real enforcement behind it. We run the licence from the first structural question to the compliance frameworks the regulator expects to see operating.
Advised on $100M+ of founder fundraising and $200M+ in deal value, with 10+ IPO and pre-IPO mandates. Figures are internal, as of 2026.
Infinilex, a legal, compliance and structuring consultancy, runs VARA licence applications in Dubai end to end: the licence category analysis, the gap assessment, the application and the compliance frameworks that operate after it. The application is made in the name of your own Dubai entity and its Responsible Individuals answer to VARA for it; Infinilex prepares and manages the file, Infinilex counsel qualified in India, the UAE and the US sign the opinions for those jurisdictions, and for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign.
A VARA licence is an activity licence: advisory, broker-dealer, custody, exchange, lending, management and investment, or transfer and settlement, each under its own rulebook, held by a Dubai legal entity. Getting one is a structuring exercise first and an application second. That is the work of a VARA licensing consultant, and it is what Infinilex runs end to end: the category analysis, the gap assessment, the application, and the compliance frameworks after it.
If you searched for a crypto licence in Dubai, this is it: VARA is the regulator that licenses crypto exchanges, brokers and custodians operating in Dubai outside the DIFC. ADGM and the DIFC run their own regimes, and anything dirham-referenced belongs to the Central Bank.
What our VARA licensing service covers
- Licence category analysis. What you actually operate, mapped to VARA's activity categories, and whether VARA is even your regulator: Dubai outside the DIFC is VARA's territory, ADGM and the DIFC run their own regimes, and anything dirham-referenced belongs to the Central Bank. The comparison is on the site: VARA vs ADGM vs DIFC.
- Entity and corridor structuring. The Dubai entity VARA will licence, placed correctly against the rest of your group. For India-linked founders that means FEMA and ODI handled on the India side, which most Dubai-only advisers do not touch.
- The readiness gap assessment. Our pre-application checklist, run against your actual operations: substance, capital, the compliance function, banking, the dossier.
- The application and evidence pack. Prepared, sequenced and managed through VARA's stages, with responses to regulator queries handled as they come.
- Compliance frameworks that run. AML, governance and reporting built to operate from day one, because VARA supervises what you do after the licence, not just what you filed to get it.
How to get a crypto licence in Dubai: the process and the rulebooks
A crypto licence in Dubai, outside the DIFC, is a VARA licence, and the route is published. VARA’s licence applications page, read 6 October 2026, sets out two stages. First, an Initial Disclosure Questionnaire goes to Dubai Economy and Tourism for a mainland firm, or to the Dubai free zone you are incorporating in, with the business plan, the beneficial owners and the senior management, and an initial payment VARA describes as typically 50% of the licence application fee. That produces an Approval to Incorporate, which lets you finish incorporation and, in VARA’s words, does not permit the firm to carry on virtual-asset activities. Second, the full documentation goes to VARA, followed by meetings and interviews, the balance of the application fee and the first year’s supervision fee, and a licence that may carry operational conditions.
The same page states the rule plainly: a firm has a legal obligation to be licensed by VARA before commencing operations. The public register lists both licensed VASPs and holders of an In-Principle Approval, who are strictly prohibited from operating or servicing clients until the full licence issues. How to check a licence on it, and who holds which licence by activity, is in the VARA register explained. A DMCC, IFZA or mainland trade licence is not a crypto licence; why is on the comparison page.
What you are tested against is the rulebook set, and it reads as a stack. Four compulsory rulebooks apply to every VASP whatever the activity. The Company Rulebook covers the ownership structure, the board, the two Responsible Individuals (full-time employees, fit and proper, UAE residents or passport holders, approved by VARA during licensing, Rule I.C), senior management and the company secretary, and in Part VI the paid-up capital, net liquid assets of at least 1.2 times monthly operating expenses, and insurance. The Compliance and Risk Management Rulebook carries the AML, CFT and sanctions programme, the client money rules in Part IV and the client virtual-asset rules in Part V. The Technology and Information Rulebook sets the systems, security and data requirements. The Market Conduct Rulebook governs how you deal with clients and the market.
On top of those sits one activity rulebook for each activity you apply for: Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, VA Management and Investment Services and VA Transfer and Settlement Services, with the Virtual Asset Issuance Rulebook for tokens. Custody is the one activity that must sit in a distinct legal entity with a standalone licence.
On the versions: VARA’s rulebook pages show the Regulations and the Company Rulebook effective from 19 June 2025, the current compulsory and activity rulebooks carry 19 May 2025 on their face, and the Exchange Services Rulebook was reissued with effect from 31 March 2026. The gap assessment we run is exactly this: your operations, read against the four compulsory rulebooks and the activity rulebooks you need, before anything is filed.
Sources, read 6 October 2026: Law No. (4) of 2022, Articles 15, 16 and 20; Virtual Assets and Related Activities Regulations 2023, Regulations III.A, IV.A and IX.C and Schedules 3 and 4 (consolidated text dated 19 May 2025, effective from 19 June 2025); the rulebook index; VARA’s licensed activities, licence applications, public register and enforcement pages.
“With their presence in both the US and India, Infinilex provides Indian founders with US-incorporated entities seamless guidance through the complex maze of compliance requirements.”
What VARA charges, in brief
| VA activity | Application fee | Annual supervision fee | Paid-up capital |
|---|---|---|---|
| Advisory Services | AED 40,000 | AED 80,000 | AED 100,000, flat |
| Broker-Dealer Services | AED 100,000 | AED 200,000 | Higher of AED 400,000 or 15% of fixed annual overheads with a VARA-licensed custodian; otherwise AED 600,000 or 25% |
| Custody Services | AED 100,000 | AED 200,000 | Higher of AED 600,000 or 25% of fixed annual overheads |
| Exchange Services | AED 100,000 | AED 200,000 | Higher of AED 800,000 or 15% with a VARA-licensed custodian; otherwise AED 1,500,000 or 25% |
| VA Transfer and Settlement Services | AED 40,000 | AED 80,000 | Higher of AED 500,000 or 25% of fixed annual overheads |
Fees from Schedule 2 of the VARA Regulations 2023; capital from the Company Rulebook, Part VI.B; each additional activity carries an extension fee of 50% of the lower application fee; VARA’s fees are separate from the commercial licensor’s. All eight activities, the net liquid asset rule, the two-stage timeline and the smaller fees are in VARA licence cost, capital and timeline.
How a VARA licensing engagement runs
Fixed-scope stages, mapped before we start, on a free discovery call. The category analysis and gap assessment come first and stand on their own: you leave knowing exactly what the licence requires of your business before you commit to the application. Ongoing compliance after licensing runs as a monthly retainer if you want it. The scope note, the project or retainer choice and who signs what are on how engagements work.
Who signs what on a VARA licence application
The applicant is your Dubai entity. Article 15 of Law No. (4) of 2022 requires anyone conducting a virtual-asset activity in the Emirate to set up the business in Dubai in a legal form the commercial licensing authority approves, and to obtain VARA’s approvals before the commercial licensing step. The application, its declarations and the filings that follow are made in the entity’s name, and the two Responsible Individuals the Company Rulebook requires (Rule I.C) are responsible for the VASP’s compliance with all legal and regulatory obligations. No consultant can hold that role for you.
Infinilex prepares and runs the file: the category analysis, the gap assessment, the evidence pack, the responses to VARA’s questions and the compliance frameworks. Where an opinion is needed, Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. For an India-linked founder that means the UAE-law perimeter and category opinion and the India-law FEMA and ODI opinion both come from Infinilex counsel, and if the EU is also on the map, Infinilex quarterbacks and EU local counsel files. Infinilex’s in-house chartered accountant and company secretary prepare the paid-up capital and net liquid asset computations under Part VI of the Company Rulebook, the financial information the dossier draws on and the company secretarial filings, and certify where a statute names that professional. Infinilex is a member of the Circle Alliance Program.
Two decisions stay with others. VARA decides the licence, in its own two stages and on its own timetable; it publishes no duration. The bank decides the account. Neither can be signed, promised or accelerated by an adviser, and Schedule 3 of VARA’s Regulations lists misrepresenting a relationship with VARA, or an ability to unduly influence or accelerate the licensing process, as a ground for a fine in its own right (No. 4(d)).
What a crypto licence in Dubai does not do
It does not give you a bank account. The Company Rulebook requires paid-up capital in a trust account with a licensed UAE bank with VARA as beneficiary, or a surety bond (Rule VI.B.3), and the Compliance and Risk Management Rulebook requires client money in a Client Account at a Third-Party Bank outside your group that gives a written acknowledgement (Rules IV.B.2, IV.C.1 and IV.C.3). The bank decides whether to open those accounts, under Central Bank supervision, which is why banking is a gating item in our gap assessment.
It does not cover activities outside the categories on the licence: Regulation IV.A.1.b requires a licence for each VA Activity, and custody needs its own entity. It is not a commercial licence, and a commercial licence is not it: Article 15(c) of Law No. (4) of 2022 puts VARA’s approval first. It is not a passport to the ADGM or the DIFC, which run their own regimes. And an In-Principle Approval is not a licence to operate. For what the perimeter costs when it is ignored, see the enforcement FAQ below.
Frequently asked questions
Which activities need a VARA licence in Dubai?
VARA licenses virtual-asset activity by category, each with its own rulebook, including advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, and transfer and settlement services. Custody is a standalone licence conducted through its own legal entity. If you operate in Dubai outside the DIFC, the activity you actually perform decides the licence you need.
Does a foreign company need a Dubai entity for a VARA licence?
Yes. VARA licenses Dubai legal entities, so the structure comes before the application. For founders running an India, UAE and US corridor, the Dubai entity has to sit correctly against the rest of the group for FEMA, tax and banking, which is exactly the structuring work we do before the licence work starts.
How does the VARA application actually run?
In stages: the licence category analysis, a readiness gap assessment against the rulebooks, then the application with its evidence pack, and the compliance frameworks VARA expects to see operating rather than written. The sequencing matters because remediation after filing is slower and more expensive than preparation before it.
Is VARA enforcement real for unlicensed activity?
Yes. Through 2026 VARA has published enforcement actions and fines against both licensed and unlicensed operators. The perimeter is policed, and the practical consequence is that banks, exchanges and institutional counterparties in Dubai increasingly ask for the licence before they connect you.
Who can help with a VARA licence application in Dubai?
Infinilex, a legal, compliance and structuring consultancy working across Dubai, India and the US, runs the application end to end: the licence category analysis, the gap assessment against the four compulsory rulebooks and your activity rulebooks, the Dubai entity and corridor structuring, the evidence pack, the responses to VARA and the compliance frameworks after licensing. The application is made in the name of your own Dubai entity, as Article 15 of Law No. (4) of 2022 requires, and your two Responsible Individuals carry the regulatory accountability for it. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. An in-house chartered accountant and company secretary prepare the capital computations and the corporate filings. Scope is fixed on a discovery call, and email is answered within one working day.
What are the VARA licence requirements in 2026?
Four things, in order. A Dubai legal entity outside the DIFC, in a form the commercial licensing authority approves, because Article 15 of Law No. (4) of 2022 licenses Dubai businesses and puts VARA's approval before the commercial licence. A clear activity map, since Regulation IV.A.1 of the Virtual Assets and Related Activities Regulations 2023 requires a licence for each VA Activity you conduct, and custody must sit in its own entity with a standalone licence. Compliance with the four compulsory rulebooks (Company, Compliance and Risk Management, Technology and Information, Market Conduct) and the activity rulebook for each activity, including paid-up capital held in a trust account or surety bond with VARA as beneficiary (Company Rulebook Rule VI.B.3), net liquid assets of at least 1.2 times monthly operating expenses (Rule VI.C.1) and two Responsible Individuals who are full-time employees, fit and proper, UAE residents or passport holders and approved by VARA (Rule I.C). And the two-stage process on VARA's licence applications page: an Initial Disclosure Questionnaire and Approval to Incorporate first, then the full application, interviews, the balance of the fees and a licence that may carry operational conditions. The fees and capital figures are in the table above.
What is the maximum fine for operating without a VARA licence in Dubai?
There is no single published number. Schedule 3 of the Virtual Assets and Related Activities Regulations 2023 lists carrying out a VA Activity without being licensed, a breach of Regulation III.A.1, as a ground for a fine at No. 4, with the amount at VARA's discretion and set by reference to local and federal law, including Cabinet Resolution No. (99) of 2024, and the factors in Regulation IX.C. The highest indicative figures in the same schedule, at No. 2 for market offences and for breaches of the Compliance and Risk Management or Market Conduct Rulebooks, run up to the higher of AED 20,000,000 or 200% of profits gained or losses avoided for an individual, and up to the higher of AED 50,000,000, 15% of annual revenue or 300% of profits gained or losses avoided for a corporate entity. Unpaid fines accrue a further 1% per month, compounding. Fines sit alongside the other measures: cease and desist, suspension or revocation of the licence and of the commercial trade licence, a compelled public admission, and fines directly against Responsible Individuals (Regulations IX.C.2 and IX.C.3; Article 20 of Law No. (4) of 2022 adds suspension of the permit for up to six months). VARA's enforcement page, read 6 October 2026, lists cease-and-desist orders and financial penalties against unlicensed operators dated 25 June and 24 July 2026.
Does a VARA licence guarantee a bank account in Dubai?
No. VARA licenses the activity; a bank account is a separate decision by a bank under Central Bank supervision, and the rulebooks assume you will secure one rather than provide it. Rule VI.B.3 of the Company Rulebook requires paid-up capital to be held in a trust account with a licensed UAE bank with VARA named as beneficiary, or in a surety bond. Part IV of the Compliance and Risk Management Rulebook requires client money to sit in a Client Account at a Third-Party Bank that is authorised to take deposits and is not in your group (Rules IV.B.2 and IV.C.1), backed by a written acknowledgement from that bank. If the bank will not give it, you must stop depositing and withdraw the money (Rules IV.C.3 and IV.C.4). That is why banking is a gating item in our gap assessment rather than a step after the licence.
Who is exempt from a VARA licence, and does proprietary trading need one?
The exemptions are narrow. An Exempt Entity, as defined in Schedule 4 of the Regulations, is a UAE federal or Dubai government entity or one of its public, non-profit or charitable bodies, and even those must notify VARA and obtain a no-objection confirmation before any activity (Regulation IV.A.6). Practising lawyers, accountants and professionally licensed consultants whose virtual-asset work is wholly incidental to their practice have a Professional Exemption (Regulation IV.A.5). Trading your own portfolio is not a licensed VA Activity, but VARA's licensed activities page says proprietary trading requires a No Objection Certificate from VARA to confirm it may be undertaken with regulatory oversight without a licence, and Regulation IV.A.7 makes registration mandatory for any entity investing its own portfolio at or above USD 250,000,000 equivalent in any rolling thirty calendar days, within three Working Days. Registration is not a licence, investing your own portfolio never permits accepting or trading anyone else's assets, and failing to register is itself a Schedule 3 ground for a fine. Describing yourself as licensed or exempt when you are neither is prohibited by Regulation III.A.3.
What should I ask any VARA consultant before engaging them?
Six questions sort the field, starting with who signs and in which jurisdiction they are qualified; if they cannot name the counsel who will sign your UAE-law opinion, ask why. Which licence category and which rulebooks have they mapped you to, and will they put that analysis in writing before you commit to the application. Do they promise a timetable or a relationship with VARA; VARA publishes no duration, and Schedule 3 of its Regulations lists misrepresenting a relationship with VARA, or an ability to unduly influence or accelerate the licensing process, as a ground for a fine in its own right. Who handles the home-country side, since for an India-linked founder the FEMA and ODI filings decide whether the Dubai entity is lawful at all. How will banking be approached, given the trust account and Client Account rules, and does any client they name appear on VARA's public register. Nobody is the best VARA consultant in the abstract: the right one has signed opinions in the jurisdictions your group actually touches, and says so in writing.
Tell us what you are building in Dubai.
Send the one-paragraph version of the product and where your users sit. We will tell you which regulator governs it, which licence category fits, and what the realistic path looks like, before you spend anything.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Further reading
VARA vs ADGM vs DIFC: where should your Web3 company get licensed in the UAE? · The UAE VASP licensing-readiness checklist · MiCA vs VARA, if the EU is also on the map · VARA licence cost, capital and timeline in Dubai, 2026 · Who regulates crypto in Dubai · The VARA register explained: who holds which licence
Related services: MiCA authorisation, if the EU is the market · FIU-IND registration, if you serve Indian users
This page is general information about the service, not legal advice for your specific business. Licence categories, rulebook requirements and timelines depend on your activities and structure, and VARA's framework evolves. Law, regulation and rulebook references on this page are as read on 6 October 2026. Scope is confirmed on the discovery call.