Broker-Dealer Crypto Licensing in the UAE: VARA, DFSA and SCA

A crypto broker-dealer in the UAE needs authorisation from the regulator that covers the place and the activity. In Dubai, outside the DIFC, that regulator is VARA, and the activity is Broker-Dealer Services. Inside the DIFC it is the DFSA. Federal-level securities-related activity sits with the SCA. Each regime has its own capital rules, governance expectations and supervisory style, so the first decision is where the firm will be licensed. It is also the one that is hardest to reverse.

This guide is for founders, compliance officers, general counsel and boards. It follows the order in which a regulator reads an application: mandate, licensable activities, capital, governance, AML/CFT, technology and custody, enforcement exposure, and structuring.

Cryptoverselawyers

Choose the Right UAE Licensing Route

CRYPTOVERSE advises on UAE crypto regulation, including VARA, DFSA and SCA, to help broker-dealers navigate licensing requirements.

Explore our legal services

Regulatory mandate

The UAE has no single crypto regulator. Which one applies depends on where the business is established and what it does.

Regulator	Territory	Relevance to a broker-dealer
VARA	Emirate of Dubai, excluding the DIFC	Broker-Dealer Services is a defined VA activity with its own rulebook
DFSA	DIFC	Crypto Tokens regime under the DFSA Rulebook modules
FSRA	ADGM	Virtual Asset Framework
SCA	Federal, onshore	Financial activities and securities-related products
CBUAE	Federal	Payment tokens and licensed financial institutions

In Dubai, VARA was established under Law No. 4 of 2022 Regulating Virtual Assets, and its Virtual Assets and Related Activities Regulations 2023 set the general framework. Activity-specific obligations sit in rulebooks, including the Broker-Dealer Services Rulebook, whose current version is effective from 19 June 2025. Market-wide rulebooks (Company, Compliance and Risk Management, Technology and Information, Market Conduct) apply alongside it.

The SCA's Financial Activities Rulebook, issued by Chairman's Decision No. (13/Chairman) of 2021, sets the federal perimeter for regulated financial activity. Where a token behaves like a security, or a product is offered across emirates, the SCA position has to be checked against the VARA or free-zone analysis. For payment tokens, CBUAE instruments, including Circular 2/2024 and Circular 15/2021, should be reviewed before any stablecoin or payment-token flow is built into the brokerage model.

For a licence-route comparison across all regulators, see our guide to the UAE VASP licence: regulators, requirements and process.

Licensable activities

A broker-dealer in the VARA sense arranges or executes transactions in virtual assets for clients, or deals as principal, and does not operate a trading venue. The boundaries matter because adjacent activities carry separate licence categories:

Broker-Dealer Services: executing client orders, dealing as principal or agent, and offering clients access to liquidity.
Exchange Services: operating a venue that matches orders. A firm that internalises and matches client orders at scale can drift into this category.
Custody Services: safekeeping client virtual assets. A broker-dealer can use a licensed custodian or seek its own authorisation.
Advisory Services: recommendations on virtual assets, which become regulated at a defined point. See our note on when crypto advice becomes regulated.
Management and Investment Services, Lending and Borrowing, and VA Issuance each have their own rulebooks.

In the DIFC, the analogous perimeter is built from DFSA financial services such as dealing, arranging and custody, applied to Crypto Tokens. The DFSA also changed how tokens are assessed. As of 12 January 2026, the DFSA no longer uses a prescribed list of Recognised Crypto Tokens. Firms must carry out a documented, firm-led suitability assessment for each token, covering factors such as governance, global market liquidity and technology security, and produce it on request. The DFSA's announcement of the updated framework is dated the same day.

A brokerage that lists many tokens therefore carries a standing documentation burden in the DIFC. That should be reflected in the compliance headcount in the business plan.

Capital and prudential standards

Capital is where the VARA and DFSA models differ most.

VARA paid-up capital

Under the VARA Paid-Up Capital rule, a broker-dealer must hold minimum paid-up capital of AED 400,000 if it uses a VARA-licensed custodian, or AED 600,000 if it does not. The rule also refers to a percentage of fixed annual overheads, and the higher figure applies. The same source lists an application fee of AED 100,000 for the activity, and an additional AED 200,000 extension fee when several VA activities are applied for concurrently.

VARA broker-dealer capital and application fees

The fixed minimum is a floor. The overhead-based test is the one that grows with the business. Our analysis of VARA's share capital requirements for broker-dealer VASPs and the wider UAE crypto firm capital requirements walk through the calculation.

DIFC expenditure-based capital

DIFC capital is not a fixed number. It follows the firm's Regulatory Business Plan. The Expenditure-Based Capital Minimum is often the binding constraint for early-stage crypto firms, because it requires capital proportional to planned operating expenses, including marketing, staffing and technology, as explained in this overview of a DIFC licence category. Founders tend to underestimate how a generous initial spend plan raises the liquid capital they must hold.

Prudential modelling

A supervisor expects a model, not a number. It should include:

A 12 to 24 month cost forecast under base and stressed revenue assumptions.
The capital requirement derived from that forecast under the applicable test, and the headroom above it.
A liquidity view that separates firm capital from client assets.
Triggers and a board-approved action plan for when headroom narrows.

The capital held should be able to be shown at any time to be unencumbered and not funded by client money.

Governance and control requirements

Both VARA and the DFSA treat governance as a licensing condition, not a post-licence tidy-up. Expect to evidence the following before approval:

Board composition and accountability. Directors with relevant financial services or technology experience, with documented responsibility for risk appetite, conflicts and outsourcing.
Senior management roles. A named compliance officer and a money laundering reporting officer with real authority and access to the board. Combining roles at an early stage must be justified in writing.
Conflicts of interest. A broker-dealer often earns from spreads, fees and sometimes principal positions. The conflicts register and the disclosure to clients must describe each of these.
Best execution and order handling. Written policies on how prices are sourced, how liquidity providers are chosen and how orders are prioritised, with evidence that they operate in practice.
Records. Transaction and client records retained for the period the rulebook specifies. Check the current rulebook text for the exact period rather than relying on summaries.
Outsourcing. Where custody, KYC or trading technology is outsourced, accountability stays with the licensed entity and the contract must give the regulator access.

Supervision readiness means the board minutes, policies and monitoring outputs already exist when the regulator asks. A policy that was written for the application and has never been used is visible to an examiner very quickly.

AML/CFT and Travel Rule implications

The federal AML framework starts with Federal Decree-Law No. 20 of 2018 and its subsequent amendments. The 2025 amendments matter for brokers: commentary on the new UAE AML Law describes VASPs as subject to the full range of preventive obligations under Article 19, including customer due diligence, beneficial ownership identification, record-keeping and ongoing transaction monitoring. In practice a VASP is supervised like a traditional financial institution.

The same commentary identifies a recurring failure among new entrants: assuming that an AML/CFT manual accepted in the EU or Singapore will satisfy UAE regulators. VARA and the DFSA expect a framework specific to the entity, addressing UAE Travel Rule and sanctions screening obligations. We see the same pattern in applications. A transplanted manual often references the wrong regulator, reporting channel and escalation path.

A workable programme for a broker-dealer includes:

Enterprise-wide risk assessment covering client types, products, geographies and delivery channels.
CDD and EDD standards, including source of funds and source of wealth for higher-risk clients, and beneficial ownership for corporate clients.
Sanctions screening at onboarding and on an ongoing basis, including wallet-level screening where relevant.
Transaction monitoring with calibrated scenarios and documented alert handling.
Suspicious transaction reporting procedures with a clear internal escalation chain.
Travel Rule operations. The UAE Virtual Assets Travel Rule requirements cover the collection, verification, secure transmission, monitoring and retention of originator and beneficiary information for qualifying transfers. The firm needs a tool, a counterparty due diligence process and a procedure for transfers to unhosted wallets.

Detailed guidance is in our UAE federal AML law compliance guide for crypto firms and our note on VARA AML requirements before licensing.

Technology and custody controls

A brokerage lives or dies on its order, wallet and data systems, and regulators test them. Applicants should be ready to show:

Segregation of client assets. Client virtual assets and client money are held separately from firm assets, with records that reconcile at least daily and a clear position on what happens in insolvency. The choice between a licensed third-party custodian and in-house custody also feeds directly into the VARA capital figure above.
Key management. Documented key generation, storage, signing authority, backup and recovery, with no single person able to move client assets alone.
Access control and change management. Role-based access, logging, and tested release procedures for the trading and wallet stack.
Resilience. Business continuity and disaster recovery plans that have been tested, with defined recovery targets.
Cyber security. Independent penetration testing and a documented incident response plan including regulator notification.
Data location and hosting. Where compliance data and client records are held in the cloud, access, retention and jurisdiction should be mapped. General material on cloud compliance regulations helps technical teams frame their own hosting controls before they tie them to UAE rulebook duties.

If the model uses a third-party custodian, the custody agreement, the due diligence on the custodian and the monitoring of its performance are part of the broker's governance file. See our overview of virtual asset custodian services.

Enforcement exposure and penalty framework

The regulators have powers well beyond refusing a licence. Unlicensed activity in Dubai, breaches of rulebook conditions and AML failures can each lead to supervisory action. Exposure typically arises in four ways:

Carrying on a regulated activity without authorisation. This includes marketing to UAE residents from outside the country when the activity is in scope.
Operating outside licence conditions, for example adding a token category, a product or a custody model that was not approved.
AML/CFT deficiencies, which attract both regulatory and federal consequences, since the federal AML law applies to VASPs on the same footing as other financial institutions.
Failures of record-keeping or disclosure, often found in routine supervision rather than after a client complaint.

The specific sanctions, fine ranges and publication practices vary by regulator and change with each rulebook update. Before relying on any penalty figure, confirm it against the current text of the regulation and the regulator's enforcement notices. We do not quote a figure here because a number copied from a summary is likely to be out of date.

Practical structuring considerations

Several decisions should be made early, because they are costly to reverse.

Choose the jurisdiction by client base and banking, not headline cost. A firm serving retail-adjacent clients in Dubai will face different expectations from one serving institutions in the DIFC. Banking access should be tested at the same time as the licence plan.
Decide the custody model before fixing capital. The AED 400,000 and AED 600,000 VARA figures depend on it.
Plan the licence scope once. Seeking several VA activities at the same time attracts the extension fee described above, so list intended activities, such as broker-dealer plus custody, before filing.
Use a separate entity per jurisdiction where the group will operate under more than one regulator, and map intra-group services in writing.
Build UAE-specific AML documents from scratch, not from a foreign licence file.
Document each token decision. In the DIFC this is mandatory. In Dubai it is the practical basis for explaining your listing policy.
Hire for the controls early. The compliance officer and MLRO should be in place and involved in the application, not recruited after approval.

The application path itself is covered in our guide to the VARA VASP licence process and our complete legal guide to the VARA broker-dealer licence.

Our view: licence the controls, not just the entity

Our view: licence the controls, not just the entity — overview diagram

We advise on all five UAE crypto regulators: VARA, SCA, DFSA, FSRA and CBUAE. Across broker-dealer mandates, the applications that move fastest are those where the business plan, capital model, AML framework and custody design describe the same firm. Where they disagree, for example a plan promising many tokens with a compliance team sized for few, the regulator's questions follow that gap.

Our recommendation is to treat the licence file as a set of operating controls that must work on day one. Start with the activity perimeter, settle the custody model, build the capital model on realistic spend, and write the AML framework for the UAE entity. Choosing the regulator comes after those four, not before. Our partners and associates are crypto-native lawyers, which matters in this work because the legal characterisation of an order flow, a wallet structure or a token depends on understanding how it technically operates.

— CRYPTOVERSE

How we support broker-dealer applicants

Our VASP licensing service for the UAE and other jurisdictions covers pre-application scoping, regulator engagement, governance documents and the application itself. We pair it with AML/CTF and risk management work so the framework is written for the licensed entity. To discuss a broker-dealer mandate, contact us through cryptoverselawyers.io.

FAQ

Does a crypto broker-dealer in Dubai need a VARA licence?

If the firm carries on Broker-Dealer Services from the Emirate of Dubai outside the DIFC, it needs VARA authorisation for that activity. Firms inside the DIFC are regulated by the DFSA instead. Which applies depends on the entity's location and the activity performed, so confirm the perimeter before marketing to clients.

What is the minimum capital for a VARA broker-dealer?

VARA's paid-up capital rule sets AED 400,000 where a VARA-licensed custodian is used and AED 600,000 where one is not. A percentage of fixed annual overheads also applies, and the higher amount governs. The application fee for the activity is AED 100,000.

Can a firm licensed in the EU or Singapore reuse its AML manual in the UAE?

Not as it stands. Regulators expect entity-specific frameworks that address UAE Travel Rule and sanctions screening requirements. An existing manual can be a starting point, but it needs to be localised and approved by the UAE entity's board.

Has the DFSA changed how tokens are approved?

Yes. From 12 January 2026 the DFSA replaced its list of Recognised Crypto Tokens with firm-led, documented suitability assessments. Firms must be able to provide those assessments to the DFSA on request.