UAE VASP Licence: Regulators, Requirements and Process

There is no single UAE VASP licence. The authority that licenses a virtual asset service provider depends on where the business operates, what it does, who its clients are and whether a token functions as a means of payment. VARA licenses activity in Dubai outside the DIFC, the DFSA authorises crypto token activity inside the DIFC, the FSRA covers ADGM, the SCA has federal powers, and the CBUAE licenses payment token services. This guide sets out the regulatory mandate of each, the licensable activities, capital, governance, AML/CFT, custody, enforcement exposure and the structuring decisions founders and boards should settle before filing. It is written for US-based and other foreign teams planning a UAE entry.

Cryptoverselawyers

Clarify Your UAE Licensing Path

CRYPTOVERSE advises on VASP licensing across the UAE’s five crypto regulators, helping businesses assess the regulatory framework for their activities.

Explore UAE licensing guidance

Regulatory mandate: five regulators, one perimeter question

The UAE framework is intentionally multi-regulator. The federal foundation is Cabinet Resolution No. 111 of 2022, and the official UAE government portal explains that VARA regulates Dubai's mainland and free zones other than the DIFC. The same page identifies Cabinet Resolution No. 99 of 2024 as the instrument establishing administrative violations and penalties for breaches of the virtual asset framework. Federal AML/CFT obligations, technical standards and regulator coordination continue to matter even where a local regulator issues the operating licence.

Incorporation alone does not decide the perimeter. Location, the financial-service character of the activity, payment functionality, token classification and client type can each change the competent authority. A Delaware parent with a Dubai subsidiary, for example, cannot assume that a US registration or a mainland trade licence answers the question.

Regulator	Territorial or functional remit	Typical applicants
VARA	Dubai, including free zones but excluding the DIFC	Exchanges, broker-dealers, custodians, lenders, managers, transfer and settlement providers
DFSA	DIFC	Firms providing financial services involving Crypto Tokens
FSRA	ADGM, under its Virtual Asset Framework	Regulated venues, custodians and intermediaries in Abu Dhabi
SCA	Federal powers to supervise and license VASPs	Businesses operating onshore across the UAE, and securities-like tokens
CBUAE	Payment token services in or directed to the UAE	Stablecoin issuers, converters and payment token custodians or transferors

For a comparison of the three most common venues, see our guide to DIFC, VARA and ADGM crypto licences.

Which regulator applies to your business

The correct first question is not whether the company is broadly a crypto business. It is which services it performs, for which client segments and in which geographies. A legal assessment of the applicable regulator should be documented before any application is drafted, because a filing made to the wrong authority costs months. The same exercise has a financial side: capital held in dirhams against revenue in other currencies creates exposure that finance teams should model early, and accounting and currency-risk tooling for licensed entities is one input to that work.

A practical decision sequence:

Map each service. List every function: order matching, brokerage, custody, lending, portfolio management, transfers, advisory, token issuance.
Map each client segment. Retail, qualified or institutional clients, and whether any are in the UAE.
Map the location of activity. Dubai mainland or free zone, DIFC, ADGM, or another emirate.
Test for payment functionality. Any payment token service triggers CBUAE analysis regardless of other licences.
Classify the tokens. A token that is a security or fund interest changes the regime.

Licensable activities

VARA

For activities conducted in or from Dubai outside the DIFC, VARA licensing is mandatory before operations begin. VARA identifies eight regulated activity categories and an applicant may generally combine several under one licence. VARA also states that no virtual asset activity is automatically exempt, so technology and DLT providers must test whether their service falls within a regulated activity.

Custody is the material structural exception. A virtual asset custodian must be a distinct legal entity with a standalone licence and segregated or independent governance. A group that plans to run an exchange and hold client assets therefore needs two entities, or must rely on a separately licensed custodian. Proprietary trading may require a no-objection certificate or registration, depending on the activity and volumes.

Separate exchange and custodian entity structures

DFSA

Firms new to the DIFC that wish to carry out financial services involving Crypto Tokens must be authorised by the DFSA. The updated framework took effect on 12 January 2026 and covers trading, custody, fund and asset management, advisory and related services. Our note on when a crypto business needs DFSA authorisation covers the boundary cases.

CBUAE

The Payment Token Services Regulation, effective 31 August 2024, regulates three categories: issuance, conversion, and custody or transfer of payment tokens. Under Article 2, no person may provide a payment token service in or directed to the UAE without a licence or registration from the Central Bank. The prohibition applies even to persons licensed for virtual asset activities by another authority, so a VARA, SCA, ADGM or DIFC authorisation does not substitute for CBUAE approval. The CBUAE framework also prohibits algorithmic stablecoins and privacy tokens. Founders should read our CBUAE payment token licence guide before designing a stablecoin.

CBUAE payment token services and approval boundary

Capital and prudential standards

Capital adequacy is assessed per regulator and, under VARA, per licensed activity. Under the VARA Company Rulebook, the minimum paid-up capital is set by activity and, for most activities, is the higher of a fixed dirham floor or a percentage of fixed annual overheads, with a separate net liquid asset expectation. Because the overheads limb scales with the cost base, the real requirement for a well-staffed firm is often above the headline floor. The current figures should be taken from the Rulebook text at the time of filing, since VARA revises its rulebooks.

What a board should prepare:

A prudential model. Twelve to twenty-four months of projected overheads, stress scenarios, and the point at which capital or liquid assets fall below the requirement.
Capital that is demonstrably available. Source-of-funds documentation for shareholders contributing capital.
Multi-activity planning. Where several activities are combined, confirm whether capital requirements are cumulative rather than shared.
A wind-down plan. Regulators expect an orderly exit path that protects clients.

Fee obligations are separate. The licence application stage involves payment of the remaining application fee and the first-year supervision fee, as VARA's application guidance describes. For the cost drivers behind total budgets, including professional fees, premises and staffing, see our VASP licence cost breakdown.

Governance and control requirements

Supervisors treat the board as the accountable body. In practice, an application is judged on whether named individuals can be shown to control the firm.

Board composition. Directors with demonstrable financial services and technology experience, and a majority or independent element where the rulebook expects it.
Senior management. Compliance officer, money laundering reporting officer, risk officer and a technology lead with defined responsibilities and reporting lines.
Fit and proper assessment. Disclosure of backgrounds, prior regulatory history and beneficial ownership through the full group chain.
Policies approved at board level. Conflicts of interest, outsourcing, business continuity, complaints, market abuse and token listing.
Local substance. A real office, resident decision-makers and records available to the regulator.

The DFSA's 2026 change makes this concrete. From 12 January 2026, firms rather than the DFSA must make a reasoned and documented determination that each Crypto Token is suitable under GEN Rule 3A.2.1, with ongoing monitoring. Token listing is therefore no longer a one-time product decision. It needs documented criteria, approval records and board and control function oversight. The DFSA also published Crypto Token FAQs to support implementation.

AML/CFT and Travel Rule implications

AML/CFT is assessed in every UAE regime. The federal base is Federal Decree-Law No. 20 of 2018 on anti-money laundering and countering the financing of terrorism and its amendments, supplemented by regulator rules: the VARA Compliance and Risk Management Rulebook, the DFSA AML module, the FSRA's AML rules and, for payment tokens, CBUAE requirements. All of them draw on FATF standards, including the Travel Rule, which requires originator and beneficiary information to accompany virtual asset transfers.

Supervision-ready programmes generally contain:

An enterprise-wide risk assessment covering customers, products, delivery channels and geographies.
KYC and enhanced due diligence procedures, including for politically exposed persons and high-risk jurisdictions.
Transaction monitoring calibrated to on-chain and off-chain behaviour, with documented alert handling.
Suspicious transaction reporting through the appropriate channel, with tipping-off controls.
Travel Rule tooling that can identify counterparty VASPs, transmit data and handle transfers to unhosted wallets.
Sanctions screening across customers and wallet addresses.
Independent testing and training with records.

Policies written for another jurisdiction rarely pass without adaptation. Our AML/CTF and risk management service drafts programmes aligned with FATF standards and UAE federal law.

Technology and custody controls

Regulators expect technology to be governed like any other material risk. Examples of what an application should evidence:

Segregation of client assets from proprietary assets at ledger and wallet level, with monthly reconciliation.
A defined custody model: hot and cold wallet allocation, multi-signature or MPC key management, signing authorities, and recovery procedures.
Access control and change management for production systems and smart contracts.
Independent security testing and audit of in-scope systems and contracts.
Incident response and disclosure procedures, including regulator notification.
Outsourcing oversight where a third party provides custody, matching or analytics.

Because custody must sit in a separately licensed VARA entity, the intercompany agreement between operating company and custodian is itself a supervisory document. Our page on virtual asset custodian services addresses the structure.

Enforcement exposure and penalty framework

Operating without a required licence is the most serious exposure. Cabinet Resolution No. 99 of 2024 establishes administrative violations and penalties for breaches of the virtual asset framework, and each regulator has its own enforcement powers over licensed firms, from directions and conditions to fines and licence action. For SCA matters, see our summary of SCA administrative penalties.

Two frequent triggers deserve emphasis:

Treating in-principle status as authorisation. A VARA in-principle approval is not permission to launch. Applicants must not conduct virtual asset activities or serve clients until the full licence is issued, and VARA's public register distinguishes fully licensed firms from those holding in-principle approval. Marketing to UAE clients at that stage is a risk in itself.
Assuming one licence covers everything. A VARA licence does not cover payment tokens, and a mainland licence does not cover DIFC activity.

If an exchange or bank freezes your accounts, a separate dispute process applies. See our page on crypto account freezes and exchange dispute resolution.

The VARA application: stages and what to expect

VARA's process has two stages: Approval to Incorporate (ATI), followed by the full VASP licence application and supervisory review. The review may involve meetings, interviews, further documents, payment of fees and operational conditions on the licence.

Perimeter analysis and structuring (activities, entities, custody).
Initial submission and ATI, including business plan and ownership.
Incorporation and build-out: premises, staff, systems and policies.
Full licence submission, with the complete rulebook-aligned policy set.
Supervisory review, interviews and conditions.
Licence issuance, after which activity may begin.

The detail of each step is in our VARA licence process guide and the IDQ, ATI and licensing walkthrough.

Practical structuring considerations

Choose the venue by client base. DIFC and ADGM suit institutional and financial-services models; VARA suits crypto-native retail and exchange models. Our VARA regulator profile and the comparison above help here.
Separate custody early. Retrofitting a custodian entity after an exchange is built is costly.
Keep payment tokens ring-fenced. Where a stablecoin is in scope, isolate it in an entity that can hold a CBUAE licence.
Design the group around the licence. Holding company, operating company, custodian and treasury entities should each have a clear regulatory purpose. Our corporate structuring for VASPs work covers multi-entity groups.
Plan banking in parallel. Account opening for VASPs is slow and should start before the licence is issued.
Prepare for supervision, not only approval. Build reporting, audit trails and board minutes from day one.
Check adjacent regimes. Portfolio managers should read SCA compliance for virtual asset portfolios, and tokenisation projects the RWA tokenisation guide.

Our perspective

Most failed or delayed applications we see trace back to the first month, not the last. Founders choose a venue by reputation or speed, then discover that the activity, the custody model or a stablecoin feature belongs to a different regulator. We advise starting with a written perimeter memo covering every service, client segment and token, and having the board approve it before any regulator is approached.

The second pattern is policy sets that were written for another market. A supervisor in Dubai reads for whether your people understand the controls, not whether a document exists. We prepare boards for interviews as carefully as we prepare filings, because every partner and associate at our firm is a crypto-native lawyer who works across all five UAE regulators, and the questions regulators ask are technical as well as legal.

— CRYPTOVERSE

Working with CRYPTOVERSE Legal

Our VASP licensing practice supports clients from pre-application analysis through full approval, with offices in Dubai and Fujairah as well as the USA and Nigeria. If you are still deciding what your service falls under, begin with our regulatory and compliance advisory team.

FAQ

Is there one UAE licence for all crypto businesses?

No. The licence depends on location and activity: VARA for Dubai outside the DIFC, the DFSA for the DIFC, the FSRA for ADGM, the SCA at federal level, and the CBUAE for payment tokens. Some businesses need more than one.

Can I start trading once VARA grants in-principle approval?

No. In-principle approval is not a licence. You must not carry out virtual asset activities or serve clients until the full licence is issued.

How much does a UAE VASP licence cost?

The total depends on the regulator, the number of activities, capital, supervision fees, staffing and professional costs. We do not publish a fixed price, and the cost breakdown explains what drives the figure.

Does a VARA or ADGM licence allow me to issue a stablecoin?

No. The CBUAE applies its payment token prohibition even to persons licensed for virtual asset activities by another authority. Algorithmic stablecoins are prohibited outright.