VARA Licence Requirements in 2026 (Dubai Crypto)

A VARA licence requires a UAE company in a VARA-covered zone with a genuine physical Dubai office and resident senior management — not a mailbox or a flexi-desk address. Dubai’s VARA is the only regulator on earth built solely for virtual assets — and the requirements file behind a VARA licence reflects that seriousness. This is not an offshore permit you hold from anywhere. It is a full authorisation that asks for a Dubai company with real substance, funded capital, vetted people and operable AML and technology programmes, granted in two stages.

This guide is the requirements checklist we work from on our own desk. It covers exactly what the 2026 VARA regime demands — a UAE company in a covered zone with a physical Dubai office, the right activity licence, capital tied to your activity and running costs, fit-and-proper senior managers, a resident compliance officer and MLRO, and a detailed document pack — so you can price the licence on what it actually takes. We scope it as the institutional-grade credential it is.

The company, the zone and physical substance

Everything starts with a Dubai company. VARA licenses a UAE legal entity established in a VARA-covered zone, with a genuine physical office in the Emirate of Dubai behind it. There is no remote-only route and no offshore shell: the applicant is incorporated locally, holds a real office — not a flexi-desk or a mailbox address — and runs a genuine operating presence with resident senior management on the ground.

Substance is assessed in the round. VARA wants to see that the business is directed and administered from Dubai, with the people performing the core functions actually present in the Emirate. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test — this is the requirement operators most often underestimate when they compare Dubai to a lighter offshore registration. For the full picture of what a VARA authorisation buys and how the Dubai regime is structured, our flagship Dubai crypto licence overview maps it end to end.

Licence per activity and capital

VARA does not issue one blanket crypto licence. It authorises seven distinct virtual-asset activities — advisory, broker-dealer, custody, exchange, lending and borrowing, VA management and investment, and transfer and settlement — on a licence-per-activity basis, so your scope, obligations and cost scale with exactly what you do. You license only the activities you run, and add categories as you grow.

Capital follows the same logic. Rather than a single flat floor, VARA ties your requirement to the activity you run and your cost base: broadly, the higher of the activity-specific minimum or around 1.2× your monthly operating expenses, held in liquid form. This is working capital of the business, not a fee you write off, and it must be genuinely liquid and available.

Because the model is per activity, a single-activity advisory scope and a multi-activity exchange-plus-custody scope are very different files with very different capital and cost profiles. Costs sit outside scope here; for the full year-one build — application fees, annual supervision and running costs — see the Dubai crypto licence cost guide, and for how each of the seven categories maps to obligations our VARA licence activities breakdown covers them one by one.

People, governance and fit-and-proper vetting

Under the VARA rulebook, the people behind the company are assessed as rigorously as the business itself. This is not a formality — an unresolved file on any one person holds the whole application.

Fit-and-proper senior managers. The people running the licensed entity are assessed for competence, integrity and relevant experience, and VARA expects a leadership team with genuine financial-services or virtual-asset backgrounds — not a founder team with no regulated-industry track record. A defined governance framework, with clear responsibilities and board-level oversight, sits alongside them.

A resident compliance officer and MLRO. A compliance officer and a money-laundering reporting officer, both resident in the UAE, are conditions of the licence. The MLRO is accountable for the AML/CFT programme, transaction monitoring and reporting — and must be a real, appointable person based in the Emirate, not a name supplied from abroad. This is one of the requirements light-touch applicants consistently get wrong.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. You must show not only that the business is funded, but where the money comes from and how the beneficial owners built their wealth. Vague or undocumented wealth is one of the most common reasons a file stalls — the same standard a tier-1 bank applies.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme

Alongside people and capital, VARA reviews a defined set of documents and policies at both stages. Filing with any of these missing, or written for a different business model, is what turns a four-month approval into a seven-month one. The core pack is:

Three elements deserve emphasis. The AML/CFT programme must be an operable set of policies aligned to UAE requirements and FATF standards — including the Travel Rule obligation to attach originator and beneficiary data to virtual-asset transfers — because the resident MLRO is expected to actually run it. The technology and security documentation must meet VARA’s technology rulebook, covering systems resilience, key management, cybersecurity and independent testing. And where you touch custody or safeguarding, strict client-asset segregation procedures are required on top of the activity authorisation. Financial projections and a clear revenue model round out the pack and must be consistent with the capital you hold and the activities you license.

The two-stage process and market reach

Two structural points frame the requirements. First, the two-stage process. VARA does not grant a licence in one step. Stage one is Initial Approval, given on your IDQ and Regulatory Business Plan — this lets you incorporate the Dubai company, secure the office, fund capital and build out compliance and technology. Stage two is the full VASP licence, granted only once governance, compliance, capital and technology all stand up to VARA’s assessment. You cannot operate until the full licence is issued, so the build happens in parallel with the regulator’s review rather than after it.

Second, market reach. A VARA licence authorises virtual-asset activity in and from Dubai and supports global business, but it does not passport into the EU. To serve EU users you need a separate EU CASP authorisation under MiCA — many groups run both, VARA for the Gulf and Asia base and a CASP for Europe. You also geo-block the United States, sanctioned and FATF-listed territories, and any market that requires its own local licence. For how the two regimes compare on cost, reach and substance, our VARA licence overview and the Dubai crypto exchange licence guide set out where a Dubai base fits and where it does not.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: fix your VARA activity scope and the matching capital position first, then prepare the IDQ and Regulatory Business Plan for Initial Approval. On stage-one approval, incorporate the UAE company in the covered zone, secure the physical Dubai office, fund the capital in liquid form and appoint resident senior management, the compliance officer and the MLRO. Assemble every UBO and management fit-and-proper file — source of funds, suitability, experience evidence — in parallel, because they take the longest. Draft the AML/CFT, risk, governance and technology documentation against your actual operating model, not off a template. Only then does the full VASP application complete.

None of this is a light offshore registration — and that is the point. The VARA regime asks for a real Dubai company, real substance, funded capital, vetted people and operable AML and technology programmes, and in exchange gives you a licence from the world’s only dedicated virtual-asset regulator, in a 0%-personal-tax hub with genuine banking access across MENA and Asia. Get the file complete and internally consistent the first time and the four-to-seven-month window is achievable; file with gaps and it drifts.

Ready to assemble your VARA requirements pack, or want a second opinion on a file you have already started? Our team handles the full Dubai substance, fit-and-proper, AML and technology build across both stages and will review any application against VARA’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.