VARA Licence Activities: The 7 Explained (2026)

If you are scoping a Dubai crypto licence, the first question is not “how much” — it is “which activities”. Dubai’s Virtual Assets Regulatory Authority does not issue one generic crypto permit. It licenses seven distinct virtual-asset activities, one by one, and everything downstream — your capital, your substance, your fees, your timeline — is decided by which of the seven you actually run.

In our practice, the operators who budget well are the ones who map their real business to VARA’s activity list before they cost anything. The ones who get surprised are the ones who assume “a crypto exchange licence” is a single thing. It rarely is. This guide sets out all seven VARA licence activities — what each authorises, who needs it, and how they combine — so you can scope the licence around what your business genuinely does.

Why VARA licenses per activity, not per company

Most regulators authorise a firm and then tell it which services it may offer. Dubai inverted that. When it built VARA — the only authority on earth created solely to regulate virtual assets — it defined the market as a set of discrete activities and made each one separately licensable. You do not get “a VARA licence” in the abstract. You get a VARA VASP licence that carries the specific activities you applied for and were approved to conduct.

The logic is that a custodian holding billions in client assets and an advisory firm publishing research carry completely different risks, so they should carry completely different obligations. Under the licence-per-activity model, VARA can apply the right capital, the right conduct rules and the right technology standards to each activity rather than forcing one blunt rulebook onto everyone. For you, the practical effect is control: you authorise only what you do today, keep your cost base proportionate, and add activities as you grow. Our Dubai crypto licence guide covers the wider regime, and the VARA licence overview sets the model in context.

The 7 VARA licence activities at a glance

Here are all seven activities, what each one authorises, and the kind of business that needs it. Read the “who needs it” column against your actual operating model — most real businesses will recognise themselves in two or three rows, not one.

The distinctions matter because VARA reads them literally. If your platform lets users buy and sell, that is Exchange. If it holds their coins between trades, that is Custody — a separate authorisation, not an incidental feature of the exchange. If you execute a client’s order into the market rather than matching it on your own venue, that is Broker-Dealer. Getting the boundaries right at scoping is what keeps your later application clean.

How the activities combine — the part most operators miss

Almost no real virtual-asset business fits inside one activity. The clearest example is the one people underestimate most: a retail crypto exchange.

A functioning exchange usually needs Exchange to run the venue, Custody because it holds client virtual assets and fiat between trades, and often Broker-Dealer if it executes client orders or acts as counterparty. That is three activities on one licence, each with its own requirements — which is why “how much is a Dubai exchange licence” never has a single-line answer. Our Dubai crypto exchange licence guide walks that specific stack through in detail.

The same layering shows up elsewhere. A broker that safeguards client funds pairs Broker-Dealer with Custody. A lending platform that also holds collateral pairs Lending and Borrowing with Custody. An asset manager that self-custodies adds Custody to VA Management and Investment. Custody is the activity that attaches to the most other activities, precisely because holding someone else’s assets is the highest-trust function in the market — and VARA treats it that way.

Capital and substance scale with each activity

Because activities are licensed separately, the cost of the licence is not a fixed sticker — it is a function of your scope. Two levers move with every activity you add.

Capital. Each activity carries its own minimum, and VARA applies the higher of that activity floor or roughly 1.2× your monthly operating expenses, held in liquid form. So capital rises on two fronts as you add activities: the fixed floors stack up, and a larger multi-activity operation has higher running costs, which pushes the opex-linked figure up too. A single Advisory licence ties up far less than an Exchange-plus-Custody build with a full compliance and technology team behind it.

Substance. VARA requires genuine presence for any activity — a UAE company established in a VARA-covered zone, a physical Dubai office, resident senior management and a resident compliance officer and MLRO. That baseline does not disappear at one activity, and higher-risk activities such as Custody and Exchange bring heavier expectations on governance, technology, key management and client-asset segregation. This is the trade-off for the credential: a VARA licence carries real weight with banks and institutional counterparties precisely because the substance behind it is real, not a nameplate.

On fees, VARA charges an application fee that can reach AED 100,000 per activity, with annual supervision fees running at roughly double the application fee. Multiply that across a multi-activity scope and the licence-per-activity logic becomes concrete: every activity you add is another application fee, another supervision line, and another slice of capital and substance. That is the case for licensing only what you actually run.

The two-stage process across your activities

VARA does not grant a licence in one motion. It runs a two-stage process, and your chosen activities travel through both stages together.

Stage one — Initial Approval. You submit an Initial Disclosure Questionnaire (IDQ) and a detailed Regulatory Business Plan setting out the activities you intend to conduct, your ownership, governance and financials. VARA assesses the plan and, on approval, gives you the green light to build. This stage typically runs six to twelve weeks depending on the complexity of your activity scope.

Stage two — full VASP licence. In parallel and after Initial Approval, you establish the Dubai office, hire resident staff, fund the capital, and complete the AML/CFT, governance, technology and — where Custody applies — client-asset segregation frameworks. VARA then assesses the full build against the rulebook for each activity on your licence before granting the full VASP authorisation. Realistically the whole journey runs four to seven months, and a multi-activity scope sits at the longer end because each activity is reviewed against its own standard.

The activity map you drew at scoping is what makes this efficient. A clean, honest mapping of your product to the seven activities means VARA is reviewing the right rulebooks from day one, rather than sending the file back to reconcile what you said you do with what your systems actually do.

Choosing your activities — and where VARA fits

The discipline the licence-per-activity model rewards is honesty about scope. Under-scope — leaving out Custody because you think of it as plumbing — and your application stalls when VARA sees client assets on your balance sheet. Over-scope — licensing Exchange and Lending “to be safe” when you only broker — and you pay application fees, supervision fees and capital for activities you never run. The right answer is the tight one: the exact set of activities your business performs today, with a plan to add categories as you grow.

It is also worth being clear on the limit of the credential. A VARA licence authorises virtual-asset activity in and from Dubai and supports global business, but it does not passport into the EU. To serve EU users you need an EU CASP licence under MiCA — many groups run both, a VARA licence for the Gulf and Asia base and a separate CASP for Europe. And you still geo-block the United States, sanctioned and FATF-listed territories and any market that requires its own local authorisation.

If you are trying to work out which of the seven activities your business actually needs, how they combine, and what that means for your capital and timeline, that is exactly the scoping we do before anyone commits a dirham. We will map your product to VARA’s activity list, price the real number against your scope, and run the two-stage process end to end. Book a free consultation and we will scope your VARA activity map with you.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.