VARA Licence Requirements in 2026 (Dubai Crypto)

A VARA licence requires a UAE company in a VARA-covered zone with a genuine physical Dubai office (a mailbox or flexi-desk address does not qualify) and resident senior management. Dubai’s VARA is the only regulator on earth built solely for virtual assets, and the requirements file behind a VARA licence reflects that seriousness. This is not an offshore permit you hold from anywhere. It is a full authorisation that asks for a Dubai company with real substance, funded capital, vetted people and operable AML and technology programmes, granted in two stages.

The checklist below is the one we use in-house. It covers exactly what the 2026 VARA regime demands, so you can price the licence on what it actually takes: a UAE company in a covered zone with a physical Dubai office, the right activity licence, capital tied to your activity and running costs, fit-and-proper senior managers, a resident compliance officer and MLRO, and a detailed document pack. We scope it as the institutional-grade credential it is.

The company, the zone and physical substance

Everything starts with a Dubai company. VARA licenses a UAE legal entity established in a VARA-covered zone, with a genuine physical office in the Emirate of Dubai behind it. There is no remote-only route and no offshore shell: the applicant is incorporated locally, holds a real office rather than a flexi-desk or a mailbox address, and runs a genuine operating presence with resident senior management on the ground.

Substance is assessed in the round. VARA wants to see that the business is directed and administered from Dubai, with the people performing the core functions actually present in the Emirate. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test — this is the requirement operators most often underestimate when they compare Dubai to a lighter offshore registration. For the full picture of what a VARA authorisation buys and how the Dubai regime is structured, our flagship Dubai crypto licence overview maps it end to end.

Licence per activity and capital

VARA does not issue one blanket crypto licence. It authorises eight distinct virtual-asset activities (advisory, broker-dealer, custody, exchange, lending and borrowing, VA management and investment, transfer and settlement, and Category 1 VA issuance) on a licence-per-activity basis, so your scope, obligations and cost scale with exactly what you do. You license only the activities you run, and add categories as you grow.

Capital follows the same logic. Rather than a single flat floor, VARA ties your requirement to the activity you run and your cost base: broadly, the higher of the activity-specific minimum or around 1.2× your monthly operating expenses, held in liquid form. The capital stays in the business as working capital, and it must be genuinely liquid and available.

Because the model is per activity, a single-activity advisory scope and a multi-activity exchange-plus-custody scope are very different files with very different capital and cost profiles. Costs sit outside scope here; for the full year-one build (application fees, annual supervision and running costs), see the Dubai crypto licence cost guide, and for how each of the eight categories maps to obligations our VARA licence activities breakdown covers them one by one.

People, governance and fit-and-proper vetting in VARA

Under the VARA rulebook, the people behind the company are assessed as rigorously as the business itself. This is not a formality — an unresolved file on any one person holds the whole application.

Fit-and-proper senior managers. The people running the licensed entity are assessed for competence, integrity and relevant experience, and VARA expects a leadership team with genuine financial-services or virtual-asset backgrounds and a regulated-industry track record. A defined governance framework, with clear responsibilities and board-level oversight, sits alongside them.

A resident compliance officer and MLRO. A compliance officer and a money-laundering reporting officer, both resident in the UAE, are conditions of the licence. The MLRO is accountable for the AML/CFT programme, transaction monitoring and reporting — and must be a real, appointable person based in the Emirate. This is one of the requirements light-touch applicants consistently get wrong.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. VARA traces the origin of the money behind the business and the wealth history of each beneficial owner, much as a private bank would at onboarding. Files often stall on wealth that cannot be evidenced.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme VARA asks for

Alongside people and capital, VARA reviews a defined set of documents and policies at both stages. Filing with any of these missing, or written for a different business model, is what turns a four-month approval into a seven-month one. The core pack is:

Three elements deserve emphasis. The AML/CFT programme must be an operable set of policies aligned to UAE requirements and FATF standards, including the Travel Rule obligation to attach originator and beneficiary data to virtual-asset transfers, because the resident MLRO is expected to actually run it. The technology and security documentation must meet VARA’s technology rulebook, covering systems resilience, key management, cybersecurity and independent testing. And where you touch custody or safeguarding, strict client-asset segregation procedures are required on top of the activity authorisation. Financial projections and a clear revenue model round out the pack and must be consistent with the capital you hold and the activities you license.

The two-stage process and market reach

Two structural points frame the requirements. First, the two-stage process. VARA does not grant a licence in one step. Stage one is Initial Approval, given on your IDQ and Regulatory Business Plan; this lets you incorporate the Dubai company, secure the office, fund capital and build out compliance and technology. Stage two is the full VASP licence, granted only once governance, compliance, capital and technology all stand up to VARA’s assessment. You cannot operate until the full licence is issued, so incorporation, the office fit-out and the compliance build all happen inside the review window, which is what keeps the total to four to seven months.

Second, market reach. A VARA licence authorises virtual-asset activity in and from Dubai and supports global business, but it does not passport into the EU. To serve EU users you need a separate EU CASP authorisation under MiCA — many groups run both, VARA for the Gulf and Asia base and a CASP for Europe. You also geo-block the United States, sanctioned and FATF-listed territories, and any market that requires its own local licence. For how the two regimes compare on cost, reach and substance, our VARA licence overview and the Dubai crypto exchange licence guide set out where a Dubai base fits and where it does not.

Assembling the VARA file in the right order

Doing the work in the right order spares you rework. Fix your VARA activity scope and the matching capital position first, then prepare the IDQ and Regulatory Business Plan for Initial Approval. On stage-one approval, incorporate the UAE company in the covered zone, secure the physical Dubai office, fund the capital in liquid form and appoint resident senior management, the compliance officer and the MLRO. Assemble every UBO and management fit-and-proper file (source of funds, suitability, experience evidence) in parallel, because they take the longest. Draft the AML/CFT, risk, governance and technology documentation from scratch against your actual operating model. Only then does the full VASP application complete.

VARA is not a light offshore registration. The regime asks for a Dubai company with real substance, funded capital, vetted people and operable AML and technology programmes, and in exchange gives you a licence from a dedicated virtual-asset regulator, in a 0%-personal-tax hub with genuine banking access across MENA and Asia. Get the file complete and internally consistent the first time and the four-to-seven-month window is achievable; file with gaps and it drifts.

Ready to assemble your VARA requirements pack, or want a second opinion on a file you have already started? Our team handles the full Dubai substance, fit-and-proper, AML and technology build across both stages and will review any application against VARA’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.