UAE VASP License: Complete Guide to Virtual Asset Service Provider Setup in 2026

If you want to run a crypto business in Dubai legally in 2026, you need a Virtual Asset Service Provider (VASP) license. There is no grey zone left. As of February 2026, the Virtual Assets Regulatory Authority (VARA) supervises 507+ licensed operators managing more than $25 billion in client assets [1], and unlicensed activity now carries fines up to AED 600,000 plus criminal referral [2].

The problem most founders run into is not whether to get licensed. It is the gap between what marketing pages promise (a four-month process and a fifty-thousand-dirham budget) and what actually happens (a six-to-twelve-month process with a first-year spend that often crosses AED 1.5 million before a single trade settles).

This guide walks you through every license category, the real cost stack, the four-stage application process, and the 2026 rule changes (Travel Rule, derivatives framework, token issuance categories) that determine whether your business model is even allowed. Since 2013, our team at BusinessDubai.ae has helped founders set up companies in every Dubai free zone and the mainland, and we coordinate the corporate side of VASP applications with crypto-specialist legal counsel. Here is what you actually need to know.

What Is a UAE VASP License and Who Needs One?

A UAE VASP license is a regulatory authorisation that allows a company to provide virtual asset services (advisory, broking, custody, exchange, lending, management, transfer, or token issuance) inside the UAE. In Dubai, the license is issued by VARA. In Abu Dhabi Global Market, it is issued by the Financial Services Regulatory Authority (FSRA). Inside the Dubai International Financial Centre, it falls under the Dubai Financial Services Authority (DFSA) Crypto Token Regime [3].

You need one if your business does any of the following from or in the UAE:

• Operates a crypto exchange (centralised or decentralised matching)
• Provides custody of client crypto assets
• Brokers crypto orders or makes markets
• Lends crypto, accepts crypto collateral, or runs a yield product
• Manages a crypto fund or runs discretionary portfolios
• Issues tokens (stablecoins, security tokens, utility tokens)
• Advises clients on virtual asset purchases, sales, or structures
• Provides transfer or settlement infrastructure for VAs

Which UAE Regulators Issue Virtual Asset Licenses?

Three regulators cover the UAE, and each has a different scope. VARA is the Dubai-specific authority and applies across the Dubai mainland and most free zones except DIFC. ADGM FSRA is the Abu Dhabi free-zone regulator and runs an institutional, notification-led framework. DFSA covers DIFC only and operates a narrow Crypto Token Regime focused on a small list of recognised tokens [4].

For most retail-facing or regional businesses, VARA is the right starting point. Institutional funds and global players tend toward ADGM. DIFC-based wealth managers running crypto desks for accredited clients use DFSA.

What Are the 8 VARA License Categories?

VARA uses an activity-based licensing model, which means you apply for the specific service you provide rather than a generic crypto license. There are eight discrete categories [5], and you can hold more than one under a single license (each additional activity attracts an extension fee equal to half of the relevant application fee).

Real Talk: Custody cannot be combined with anything else under one license. If you want to operate an exchange and custody client funds in-house, that is two separate companies, two licenses, two compliance teams, and two audits. Most founders we have seen partner with an existing licensed custodian rather than build the second entity from scratch.

How Much Does a UAE VASP License Cost in 2026?

A realistic first-year budget for a UAE VASP license sits between AED 1.2 million and AED 3.5 million, excluding paid-up capital, with the spread driven by license category and team size. The total is built from four cost stacks: application fees, annual supervision fees, paid-up capital, and pre-operating plus operating costs.

VARA Application and Supervision Fees (2026 Schedule)

You pay 50% of the application fee with the Initial Disclosure Questionnaire and the remaining 50% before final license issuance. Both tranches are non-refundable [6]. VARA can also impose variable supervision fees up to two or three times the baseline if your operation is high-volume or high-risk.

VARA Paid-Up Capital Requirements

Capital must be held in AED in a UAE bank account, with auditor confirmation submitted to VARA before the license is issued. You also have to maintain at least 1.2 times your monthly operating expenses as a working buffer, so a team burning AED 500,000 per month must hold AED 600,000 of liquid runway on top of base capital.

Total First-Year Investment by Scenario

Common Mistake: Founders who budget against marketing claims of "AED 50,000 for a crypto license" run out of cash during the pre-operating phase. The license fee is a small piece. The expensive parts are full-time Responsible Individuals, the dedicated Dubai office, the cybersecurity audit, and the AML stack. Plan as if your first revenue is fifteen months out and you will not be wrong.

If you are weighing the VASP path against simpler activities, our breakdown of Dubai business setup costs across mainstream license types gives a useful baseline before you commit.

How Long Does the VARA License Application Take?

The realistic VARA timeline is six to twelve months from Initial Disclosure Questionnaire (IDQ) to operational license, broken across four stages. Marketing pages quoting four-month timelines describe the lower bound under perfect preparation, which is rare in our experience.

The Four Stages of VARA Licensing

Stage 1: Approval to Incorporate (ATI)

You submit the IDQ through Dubai Economy and Tourism or your free zone authority along with 50% of the application fee. The IDQ covers your proposed activities, business model, ownership and ultimate beneficial ownership, senior management profiles, the regulatory business plan, and your indicative office location. VARA reviews this for one to two months and issues an Approval to Incorporate that lets you set up the entity and start preparatory work. Roughly 11% of IDQ applicants ultimately reach a full license, so the bar is high [7].

Stage 2: Pre-Operating Phase

This is where most of the time and money goes. You incorporate the company, sign a Dubai office lease, hire two full-time Responsible Individuals, appoint a Chief Compliance Officer, Chief Risk Officer and Chief Information Security Officer, build the technology stack, run a third-party cybersecurity audit, draft the full policy suite, and prepare the AML and Travel Rule systems. Two to six months is typical.

Stage 3: Full License Application and Assessment

You submit the complete application package, pay the second half of the fee, and VARA conducts a pre-operating assessment that includes a field visit, systems testing, and a stress test of your compliance framework. Expect two to four months of back-and-forth with one to three rounds of queries.

Stage 4: Operating License Issuance

If VARA is satisfied, the license is issued (often with conditions such as enhanced monitoring or initial capital top-up) and your firm is added to the VARA Public Register with a license number such as VL/24/04/001.

Pro Tip: Begin recruiting Responsible Individuals four to six months before you submit the IDQ. About two thirds of applicants we see hit walls finding a CCO with both AML experience and a clean regulatory record, and notice periods of two to three months are standard.

What Documents Do You Need for a VASP License?

VARA expects a complete policy suite, organisational readiness, physical office proof, technology infrastructure, and financial readiness all at once. Skimping on any of these is the most common reason for delay.

Your full submission must include risk management, AML and CFT, cybersecurity, business continuity, IT security, complaints handling, and accounting policies. You need board minutes approving each policy and appointment, fit and proper declarations for senior officers, a signed Dubai office lease, an independent cybersecurity audit report, a Travel Rule implementation plan, three-year financial projections, and bank confirmation of paid-up capital.

Generic template policies fail. We have seen applications stall for three months because policy documents were copy-pasted from another jurisdiction. Custom-drafted documents that match your actual operations are the only ones that get through first-round review.

Should You Choose VARA, ADGM, or DIFC?

Most founders we work with land on VARA because the activity-based model gives clear answers and the licensee community is large enough that vendors, lawyers, and auditors are plentiful. ADGM works well for a fund manager who needs a globally recognised regulator and is happy with a notification model. DIFC suits a private bank crypto desk and almost no one else.

What Changed in UAE Virtual Asset Regulation in 2026?

Three regulatory shifts reshaped the UAE virtual asset market in early 2026, and any application filed today must address all three from day one.

Travel Rule Live (February 2026)

Since February 2026, every VASP must collect, verify, hold, and share originator and beneficiary information for any virtual asset transfer of AED 3,500 or more, in line with FATF Recommendation 16 [8]. You need a counterparty due diligence framework, sanctions screening on both sides of the transaction, and unhosted wallet controls. The Travel Rule policy is now part of every full application.

Exchange-Traded Derivatives Framework (March 2026)

VARA published Part V of the Exchange Services Rulebook on 31 March 2026, covering crypto futures, perpetuals, options, and CFDs. Margin trading now requires explicit pre-approval from VARA, and the regulator has the power to adjust margin thresholds in real time. If your business model includes margin or derivatives trading, expect two to four extra weeks in the licensing process.

Token Issuance Categories

VARA now distinguishes Category 1 issuance (stablecoins, security tokens, substantive utility tokens) which requires prior VARA approval, from Category 2 issuance which uses a notification model with distribution through a licensed Broker-Dealer. There is no unregulated ICO route in Dubai. Token founders need to choose a path before they raise.

For founders who plan to also operate beyond crypto, our guides on free zone company setup and mainland company setup cover the corporate base layer that sits underneath your VARA application.

What Are the Mandatory Staffing Requirements for a VASP?

A VARA-licensed VASP needs at least two Responsible Individuals (RIs) plus a senior compliance, risk, and security team, and every key role must be full-time and locally based. There is no "flying CCO" model permitted.

The two RIs must be UAE residents or UAE passport holders, employed full-time, with two or more years of relevant experience and a clean regulatory record. Typically RI #1 is the CEO or Managing Director and RI #2 is the Chief Compliance Officer or MLRO. Beyond the RIs, an exchange or lender also needs a Chief Risk Officer and a Chief Information Security Officer, both full-time and based in Dubai.

Salary expectations in the 2026 Dubai market are roughly from AED 25,000 per month for an RI-level CEO, from AED 18,000 for a CCO or MLRO, and from AED 8,000 for AML analysts. A minimum-viable VASP team of two RIs plus four to six staff costs from AED 950,000 million per year before benefits.

Real Client Stories

These are real examples from businesses we have helped set up. Names have been changed for privacy.

Karim's OTC Brokerage (DMCC + VARA Broker-Dealer)

Karim, a Lebanese-Canadian trader with eight years on a Toronto trading desk, wanted to set up an OTC crypto brokerage for high-net-worth Gulf clients. We registered a DMCC FZ-LLC for him in three weeks (AED 28,500 in setup) and helped him secure a small office in the DMCC Crypto Centre. He partnered with an existing VARA-licensed custodian, which dropped his capital requirement from AED 600,000 From IDQ to operational license took nine months. First-year all-in cost landed at AED 2.1 million. "The custody partnership saved me the equivalent of one full hire," Karim said. "I would have wasted six months trying to build it in-house."

Aisha's Crypto Advisory Practice (Mainland + VARA Advisory)

Aisha runs a boutique advisory practice for family offices looking at digital asset exposure. We set her up as a Dubai mainland LLC under DET (AED 12,000 in setup costs), and she went for the VA Advisory license, the cheapest VARA path. Her IDQ was approved in seven weeks and the full license came through in five months total. Year-one all-in cost was AED 1.34 million including AED 100,000 paid-up capital. "I spent two months scoping the AML software stack before realising I could outsource transaction monitoring and just keep the CCO role in-house," she said. "Founders should outsource everything they can and protect the headcount budget for the people VARA actually mandates."

The Token Project That Restructured (IFZA + Category 1 Issuance)

A four-founder team building a UAE-focused stablecoin originally planned an unregulated launch from offshore. After a single legal review, they realised VARA's 2026 issuance rules made that path a one-way ticket to enforcement. We restructured them into an IFZA FZ-LLC (AED 22,000) and connected them to specialist counsel for Category 1 issuance pre-approval. They are still in the pre-operating phase eight months in, with paid-up capital of AED 1.5 million parked. "If we had launched first and applied later, we would have been a case study for the wrong reasons," the founder told us. "Doing the regulatory work upfront cost more but kept the project alive."

How BusinessDubai.ae Helps with VASP Setup

The corporate side of a VASP application (entity formation, office lease, bank account, immigration, PRO services) is what we have been doing since 2013, with 900+ company registrations completed across DMCC, IFZA, DWTC, DET, ADGM, and other UAE jurisdictions. We coordinate the regulatory submission with crypto-specialist legal counsel so that the legal entity and the VARA application stay aligned.

Our typical scope includes free-zone or mainland company setup, office identification and lease support, bank account opening (which is harder for crypto businesses than most founders expect), Responsible Individual visa processing, and ongoing PRO and accounting services once you are licensed. Whether your first stop is a free zone licensing path or a mainland LLC under DET, we can map the full setup before you commit a fee.

Frequently Asked Questions

Is a UAE VASP license expensive?

A first-year all-in budget of AED 1.2 million to AED 3.5 million is realistic, depending on the license category and team size, and that excludes paid-up capital. VA Advisory is the cheapest path at roughly AED 1.3 million all-in, while a crypto exchange typically lands between AED 3.3 million and AED 4.2 million. Plan for a fifteen-month runway before first revenue.

How long does a VARA license actually take?

Six to twelve months is the realistic range from IDQ submission to operational license, broken down as two to three months for the Approval to Incorporate stage and four to six months for the pre-operating phase. Marketing claims of four months reflect a best-case scenario that is rare in practice.

Can I get a VASP license remotely from abroad?

No. VARA mandates a physical office in Dubai and two full-time Responsible Individuals who are UAE residents or UAE passport holders. Remote support roles are fine, but the senior leadership and compliance team must be locally based.

What is the difference between a VARA license and a crypto license?

A VARA license is the formal Virtual Asset Service Provider authorisation issued by Dubai's Virtual Assets Regulatory Authority. "Crypto license" is informal shorthand that can also refer to ADGM FSRA, DIFC DFSA, or federal SCA licenses depending on jurisdiction. In Dubai outside DIFC, VARA is the only relevant regulator.

Can I run a crypto business in Dubai without a VARA license?

No, if any part of the activity touches Dubai. Operating without a license now triggers fines from AED 50,000 potential bans from reapplying, and possible criminal referral. Even crypto marketing in Dubai requires VARA authorisation under the Marketing Rulebook.

What is the minimum capital needed for a VARA license?

Capital depends on the license type. VA Advisory needs AED 100,000, Broker-Dealer needs from AED 400,000 depending on whether you use a licensed custodian, and an Exchange needs from AED 800,000 million. The capital must be held in AED in a UAE bank account before VARA issues the operating license.

Do supervision fees stay the same every year?

The baseline annual supervision fee (from AED 80,000 depending on category) is fixed, but VARA can impose variable fees of two to three times the baseline for high-risk or high-volume operators. The variable assessment happens during annual renewal.

Can a foreign individual own a VARA-licensed VASP?

Yes. The ultimate beneficial owner can be a foreign national, but full UBO disclosure is mandatory and nominee arrangements are not permitted. The Responsible Individuals and senior compliance team must be UAE-based regardless of who owns the company.

Is a physical office in Dubai really mandatory?

Yes. VARA requires a signed lease and proof of occupancy before the pre-operating assessment. Home offices and virtual office arrangements are not accepted. A mid-sized VASP typically needs around 200 square metres for staff and secure operations areas.

What is the VARA Travel Rule and AED 3,500 threshold?

For any virtual asset transfer of AED 3,500 or more, VASPs must collect, verify, hold, and share originator and beneficiary information with the counterparty VASP. Below the threshold, basic KYC applies. The Travel Rule has been live since February 2026 and a written compliance plan is required in every new application.

Can I apply for multiple VARA license categories at the same time?

Yes. The IDQ allows you to list every activity you plan to operate, and you pay application fees for each upfront. Each additional non-custody activity attracts an extension fee equal to 50% of its standalone application fee. Custody must always be a separate entity.

What happens if VARA rejects my application?

VARA provides written reasons for rejection and you can reapply once you have addressed the deficiencies, typically after three to six months. There is no formal time limit, but rapid resubmission without remediation is usually rejected again. The application fee is non-refundable.

Can my Responsible Individuals work part-time or hold other jobs?

No. VARA explicitly requires both RIs to be full-time employees of the licensed entity. External advisory or fractional arrangements are not permitted, and any attempt to structure RIs as consultants will lead to rejection at the fit and proper assessment.

Do my Responsible Individuals need to be UAE citizens?

No. UAE residency on a valid visa is sufficient, or a UAE passport. Expat professionals are commonly approved provided they meet the experience and fit and proper criteria.

What experience does my CCO or MLRO need?

At minimum, two years of hands-on AML and CFT experience. VARA strongly prefers candidates with prior virtual asset or crypto background and recognised certifications such as ACAMS, plus demonstrable knowledge of FATF Travel Rule implementation and blockchain transaction monitoring.

How long does Responsible Individual vetting take?

Four to eight weeks typically. VARA conducts background checks and a fit and proper assessment that examines regulatory history, qualifications, and competency. Complex employment histories or prior compliance issues extend the review.

Can I outsource AML and compliance to a third party?

You can outsource the software stack (transaction monitoring, sanctions screening) and use compliance consultants for advisory work, but the CCO or MLRO role itself cannot be outsourced. VARA requires a full-time in-house compliance officer.

What is the difference between Approval to Incorporate (ATI) and the full license?

The ATI is the green light to incorporate the legal entity and undertake preparatory activities such as hiring, office setup, and technology build. It does not authorise virtual asset business. The full license, issued at the end of Stage 3, allows you to commence operations and accept clients.

Can I operate while my VARA application is pending?

Not as a VASP. After the ATI you can incorporate, hire, and prepare infrastructure, but virtual asset business activities are only permitted once the operating license is issued. Marketing or accepting clients before that triggers enforcement.

Should I choose mainland or free zone for my VASP entity?

Most founders choose either a mainland Dubai LLC under DET (faster setup, broader market access) or a DMCC free zone LLC (strong crypto cluster, brand recognition, VAT efficiency). IFZA is the cheapest free zone path. The choice does not affect VARA approval but does affect setup costs, office options, and tax exposure.

Can I structure my VASP as a sole proprietorship or partnership?

No. VARA only accepts mainland LLCs, free zone LLCs, or free zone branches. Sole proprietorships, civil partnerships, and pure offshore holding companies are not eligible structures.

What if my business model changes during the licensing process?

Notify VARA immediately. A material shift (for example from advisory to exchange) typically requires a new application. Smaller modifications such as adding one extra activity to a pending application are handled through an amendment review and an extension fee.

Is there a faster path through ADGM instead of VARA?

ADGM FSRA uses a notification-based model and approvals can complete in two to four months. The trade-off is a narrower scope (privacy tokens and algorithmic stablecoins are banned, the asset universe is smaller) and a more institutional tilt. Retail crypto exchanges still mostly choose VARA.

Are NFTs covered under the VARA license?

NFTs fall inside VARA's scope when they are structured as virtual assets used for trading or investment. Pure collectible NFTs without financial features are usually outside scope. The classification depends on the specific token characteristics and how it is marketed.

Does VARA allow crypto staking and yield products?

Yes, under the Lending and Borrowing license. Yield products require a documented risk framework, clear client disclosures, and capital adequacy under the lending capital matrix. VARA expects detailed scenario analysis on stress losses.

What are the bank account options for a VARA-licensed company?

Crypto-friendly banking is the single hardest part of the setup in our experience. A handful of UAE banks accept VASP corporate accounts (typically after the operating license is issued, not before), and most founders also rely on regional crypto-friendly correspondent banks for fiat on-ramps. Expect a six to twelve week onboarding process.

Can I migrate an existing offshore crypto company into VARA?

Not directly. The Dubai entity has to be incorporated as a new UAE structure (mainland or free zone) and apply through the standard four-stage VARA process. The offshore entity can continue to exist as a holding parent if disclosed transparently in the UBO documentation.

What is the VARA Public Register?

The VARA Public Register is the official online list of every licensed VASP, including each entity's license number, permitted activities, and any conditions imposed at issuance. Counterparties and clients can verify your status before transacting, which makes the register the practical proof of authorisation.

What kind of fines does VARA issue for non-compliance?

Statutory fines run from AED 50,000 for typical breaches and up to AED 10 million in extreme cases. Recent 2025-2026 enforcement has included Skilled Person monitoring orders, conditional license restrictions, and public censure. Marketing rule breaches alone have produced multiple fines in 2026.

How does the Dubai corporate tax regime apply to a VASP?

UAE Corporate Tax of 9% applies to taxable income above AED 375,000, including for VASPs. Free zone entities can qualify for the 0% Qualifying Free Zone Person rate on qualifying income, but most VASP activities are not on the qualifying activities list. A specific tax review is essential before structuring.

Can I get help from BusinessDubai.ae with the VARA application?

We handle the corporate setup work that sits underneath the regulatory submission: company formation, office lease, bank account introductions, RI visa processing, and ongoing PRO and accounting support. We coordinate with crypto-specialist legal counsel for the regulatory drafting itself so that the entity and the VARA application stay aligned.

References

[1] Virtual Assets Regulatory Authority (VARA), Dubai: Public Register and licensee statistics (2026). vara.ae

[2] VARA: Enforcement actions and statutory fine framework. vara.ae/en/regulatory-action

[3] Dubai Financial Services Authority (DFSA): Updated Crypto Token Regime, January 2026. dfsa.ae

[4] ADGM Financial Services Regulatory Authority: Digital Assets Framework. adgm.com/setting-up/digital-assets

[5] VARA Rulebooks: License categories and activity definitions (Version 2.1, 2026). rulebooks.vara.ae

[6] VARA: Schedule 2: Supervision and Authorisation Fees. rulebooks.vara.ae/rulebook/schedule-2-supervision-and-authorisation-fees

[7] VARA: License application data and approval rates (2025-2026 disclosures). vara.ae

[8] VARA: FATF Travel Rule implementation, effective February 2026. rulebooks.vara.ae/rulebook/g-fatf-travel-rule

[9] BusinessDubai.ae: Internal data from UAE company registrations since 2013, including DMCC, IFZA, DWTC, and DET setups for virtual asset and fintech firms. businessdubai.ae