Dubai Crypto Exchange Licence (VARA) — 2026 Guide

If you want to run a crypto exchange out of Dubai, the licence you need is specific: VARA’s Exchange Services activity, granted through a two-stage process that ends in a full VASP licence. “Dubai crypto exchange license” is one search, but the Virtual Assets Regulatory Authority does not issue a single generic crypto permit — it licenses eight distinct virtual-asset activities separately, and an exchange has to identify exactly which ones its business touches before it files anything.

VARA’s 2023 Regulations list eight licensable activities in Schedule 1, and an exchange almost always needs more than one of them. Below is the exact activity an exchange needs, why you almost always need the custody activity alongside it, how the Initial Approval and full-licence stages actually run, and the capital, substance and rulebook obligations that come with operating a trading venue from Dubai.

The activity you need: VARA Exchange Services

VARA is a regulator built solely for virtual assets, and it structures everything around a licence-per-activity model. There are eight licensable activities (advisory, broker-dealer, custody, exchange, lending and borrowing, VA management and investment, transfer and settlement, and Category 1 VA issuance), and you hold a licence for each activity you actually perform rather than one blanket authorisation.

For an exchange, the core activity is Exchange Services. It authorises operating a virtual-asset exchange or trading platform: the venue where clients buy, sell and swap virtual assets, whether that is a straightforward convert desk, an order book that matches third-party buy and sell orders, or both running side by side. This is the licence that lets you be the trading venue rather than merely advise on or route orders elsewhere. If you only received and transmitted orders to another platform, that would be the broker-dealer activity; running the venue itself is what Exchange Services covers.

Because VARA prices and assesses each activity on its own, your scope decides your cost and your workload. It also means you license only what you run today and add activities as the business grows. The full activity map is worth reading in detail in our guide to VARA’s licence activities before you fix your scope.

Why you almost always need custody too

Here is the point most exchange applicants miss. The moment your platform holds client virtual assets (and virtually every exchange does, because users keep balances on the venue to trade), you are performing the Custody Services activity as well, and that is a separate licence under VARA’s model. You cannot fold “we hold client crypto” into the Exchange Services licence; safeguarding client assets is its own regulated activity.

That means a typical Dubai exchange files for two activities together: Exchange Services plus Custody Services. The first activity pays the application fee, the second pays a licence extension fee, and each carries its own annual supervision fee and its own slice of the assessment. Custody brings hard obligations — client virtual assets segregated from the firm’s own assets, secure key management and wallet architecture, robust recovery procedures, and clear liability for loss attributable to an incident within your control. If instead you run a strictly non-custodial venue where clients always retain control of their own keys, you may avoid the custody activity, but that is a deliberate architectural choice, and the burden is on you to prove it to VARA.

The two-stage process: Initial Approval to full VASP

Every VARA licence is granted in two stages, and an exchange is no exception.

Stage one — Initial Approval. You submit an Initial Disclosure Questionnaire (IDQ) and a detailed Regulatory Business Plan describing your activities, ownership, governance, financial model and how you intend to meet VARA’s requirements. Fit-and-proper checks run on shareholders, UBOs and senior management. Initial Approval is VARA’s signal that your proposition is viable and that you may proceed to build the real operation. This stage typically runs six to twelve weeks.

Stage two — the full VASP licence. With Initial Approval in hand you stand up the substance: the Dubai company in a VARA-covered zone, the physical office, resident senior staff, the funded capital, and the complete compliance and technology frameworks. VARA then assesses the whole file (governance, AML/CFT, market conduct, custody controls and technology) before granting the full VASP licence that authorises you to go live. Across both stages, a realistic timeline is four to seven months, with multi-activity scopes at the heavier end. The full cost path across both stages is broken down in the Dubai crypto licence cost guide, and the wider process sits inside our Dubai crypto licence flagship.

Capital, substance and the VARA rulebook

Three requirements decide whether an exchange application is credible, and none of them is optional.

Capital. VARA sets a capital requirement at the higher of the activity-specific minimum or approximately 1.2× your monthly operating expenses, held in liquid form. This is working capital of the licensed business, not a fee that disappears — but it does have to be genuinely available, and because it tracks your running costs, a larger exchange carries a larger floor. Where you hold two activities, the requirement reflects the combined operation.

Substance. A VARA exchange is not a brass-plate. You need a UAE company in a VARA-covered zone with a physical Dubai office, resident senior management, and a resident compliance officer / MLRO. VARA expects real people running a real operation on the ground in Dubai — this is the substance that makes the licence bankable, and it is materially easier to open crypto-friendly banking with a licensed Dubai entity than with an offshore VA registration. The upside of that substance is a 0% personal income tax base and genuine access to capital across MENA and Asia.

The rulebooks. A licensed exchange operates under VARA’s activity rulebook plus the cross-cutting compliance, market-conduct and technology rulebooks. In practice that means fair and orderly market rules, transparent operating criteria for the assets you admit to trading, disclosure and client-asset protections, AML/CFT and Travel Rule controls under your resident MLRO, technology and cybersecurity standards documented to VARA’s technology rulebook, and ongoing reporting with prompt notification of any material change. The market-conduct rulebook is the one that separates an exchange from a simpler VA business: because you set the rules of a market that multiple users interact inside, VARA expects you to monitor for and act on market abuse, keep records, and run systems that stay orderly under stress. Running an exchange means running market infrastructure, and VARA supervises it as such — this is what the Exchange Services activity actually commits you to.

No EU passport — plan your market reach

One hard limit shapes every Dubai exchange strategy: a VARA licence does not passport into the EU. It authorises virtual-asset activity in and from Dubai and supports global business, but it gives you no automatic right to serve customers in the 27 EU member states. To reach EU users you need a separate EU CASP authorisation under MiCA — a genuinely different regime with its own capital classes and local substance. This is exactly the trade-off explained in what a crypto exchange licence actually is: VARA gives you a dedicated, credible regulator for the Gulf and Asia but no access to Europe.

For most operators the answer is not either-or. A Dubai VARA exchange is the right base for MENA and Asian reach, strong banking and a tax-efficient hub, and a group that also wants the single market runs an EU CASP alongside it. What you must not do is assume the Dubai licence covers Europe — you would be operating outside your authorisation the moment an EU user trades.

If you are scoping a Dubai exchange and need to fix the right VARA activities, capital and substance before you spend, book a free consultation and we will map the Exchange Services and custody scope, the two-stage timeline and the Dubai setup to your model.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.