Dubai Virtual Asset Regulation Law: Key Rules for Crypto Businesses

Dubai has built one of the region’s most detailed virtual asset regulatory systems. If you plan to run an exchange, broker crypto, hold customer assets, manage virtual asset portfolios or issue certain tokens, a standard Dubai trade licence is not enough.

The starting point is Law No. 4 of 2022 Regulating Virtual Assets in the Emirate of Dubai. It created the Virtual Assets Regulatory Authority, or VARA. The detailed operating requirements now sit in the Virtual Assets and Related Activities Regulations 2023, compulsory rulebooks, activity-specific rulebooks and later updates.

For a crypto founder, the practical question is simple: what activity are you carrying out, which regulator covers it and what approvals must be in place before you serve customers?

What Is the Dubai Virtual Asset Regulation Law?

Dubai Law No. 4 of 2022 is the legal foundation for virtual asset regulation in the emirate. It applies across Dubai, including commercial free zones and special development zones, but excludes DIFC.

VARA then issued the Virtual Assets and Related Activities Regulations 2023. The current version became effective on 19 June 2025. It covers licensing, virtual asset issuance, AML/CFT, marketing, market offences, supervision and enforcement.

So, when people refer to the “Dubai Virtual Asset Regulation Law”, they usually mean a wider regulatory package rather than a single document.

Which Crypto Activities Need a VARA Licence?

VARA currently lists eight regulated activities through its official licensed activities framework.

A business can apply for more than one activity under an overarching licence, subject to VARA’s rules. Proprietary trading follows a different route and may require a VARA No Objection Certificate.

Do not rely on labels such as “software”, “Web3 infrastructure” or “blockchain technology”. If the real service falls inside a regulated activity, VARA may still treat it as regulated.

Where Does VARA Have Jurisdiction?

VARA covers virtual asset services carried out in or from Dubai mainland and Dubai free zones, excluding DIFC. A company registered in DMCC, DWTC Free Zone or another Dubai free zone may still need VARA approval. The commercial licence and regulatory licence serve different purposes. If your business is based in DIFC, the DFSA framework applies instead.

How Does the VARA Licensing Process Work?

For new firms, VARA currently uses two stages through its VASP licence application process.

1. Approval to Incorporate

You apply through the Dubai Department of Economy and Tourism or your selected Dubai free-zone authority. VARA reviews the proposed activity, ownership, business plan, governance and financial resources.

Approval to Incorporate lets you establish the entity and build the operational setup. It does not allow you to start serving virtual asset customers.

2. Full VASP Licence

VARA then checks whether the business is ready to operate. Depending on the activity, this can cover compliance policies, cybersecurity, custody arrangements, financial resources, contracts, client disclosures and testing.

Only after the required licence is issued can the firm conduct the approved regulated activities. VARA’s public register also makes clear that conditional approval does not itself authorise a firm to start VA operations.

VARA Application Fees and Capital Requirements

VARA fees vary by activity under its current supervision and authorisation fee schedule.

For Advisory Services and Transfer and Settlement Services, the licence application fee is AED 40,000 and the annual supervision fee is AED 80,000 per regulated activity.

For Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment and Category 1 VA Issuance, the application fee is generally AED 100,000 and the annual supervision fee is AED 200,000 per regulated activity.

These are VARA fees only. Commercial licensing, office space, staff, visas, audit, compliance, insurance and technology are separate costs. Nexture’s Dubai business setup cost guide can help you budget for the wider company expenses.

Capital also depends on the activity. Advisory Services requires AED 100,000 paid-up capital. For Exchange Services without an approved external custody structure, the requirement can be the higher of AED 1.5 million or 25% of fixed annual overheads.

Four Compulsory VARA Rulebooks Apply to Every VASP

Every licensed VASP must comply with:

1. Company Rulebook

2. Compliance and Risk Management Rulebook

3. Technology and Information Rulebook

4. Market Conduct Rulebook

You must also follow every activity-specific rulebook linked to your licence.

The Company Rulebook covers ownership, governance, fit-and-proper standards, outsourcing, capital, insurance and wind-down planning. The compliance rulebook covers AML/CFT, client money, client virtual assets, regulatory reporting and related controls.

AML, KYC and the Travel Rule

Crypto businesses in Dubai should treat AML as a daily operating requirement.

The UAE introduced Federal Decree-Law No. 10 of 2025 on AML, terrorist financing and proliferation financing, supported by Cabinet Resolution No. 134 of 2025. VARA’s current framework incorporates these federal obligations.

A licensed VASP needs customer due diligence, sanctions screening, transaction monitoring, suspicious transaction controls and an appropriate MLRO structure.

VARA’s FATF Travel Rule requirements require VASPs to obtain and hold specified originator and beneficiary information for virtual asset transfers above AED 3,500. VASPs must also conduct risk-based due diligence on counterparty providers and manage risks involving unhosted wallets.

Client Money and Virtual Assets Must Be Protected

A VASP cannot treat customer assets as its own balance-sheet assets. VARA requires client money and client virtual assets to be identified, protected and segregated. Client virtual assets do not form part of the VASP’s estate if the VASP becomes insolvent.

If your business touches client funds or private keys, build segregation, reconciliation and custody controls into the operating model before the final licensing stage.

Marketing Crypto in Dubai Is Regulated

VARA’s Regulations on the Marketing of Virtual Assets and Related Activities 2024 took effect on 1 October 2024. Its scope covers licensed and unlicensed entities marketing virtual assets or related services in the UAE.

Marketing must reflect the firm’s real regulatory status. Do not present initial approval as a full licence. Influencer campaigns, referral promotions, paid ads, social media content and event promotions can all fall within the rules.

VARA has used enforcement powers against firms serving or promoting to Dubai customers without approval. In 2026, it issued cease-and-desist actions and financial penalties involving unlicensed platforms, including KuCoin and MEXC.

Cybersecurity Is a Regulatory Requirement

Licensed VASPs need a technology governance framework, cybersecurity policy and controls for wallets, keys, access, business continuity and incident response.

The Technology and Information Rulebook requires a Chief Information Security Officer. The CISO must be a separate individual from the Compliance Officer.

A material cybersecurity event, or a business-continuity event that materially affects operations, must be reported to VARA as soon as reasonably practicable and no later than 72 hours after detection.

Token Issuance and Stablecoins Need Extra Checks

VARA’s Virtual Asset Issuance Rulebook covers approval, whitepapers, disclosures and risk statements for different issuance categories. It also contains specific rules for fiat-referenced and asset-referenced virtual assets.

Payment tokens can add another regulatory layer. The Central Bank of the UAE has an in-force Payment Token Services Regulation covering payment-token issuance, conversion, custody and transfer. A VARA-licensed business may therefore need Central Bank licensing or registration as well.

If you are building a stablecoin, crypto payment product or tokenised asset, define the regulatory perimeter before choosing the licence.

Market Conduct and Enforcement

VARA prohibits conduct such as insider dealing and market manipulation. Licensed firms also face rules on client agreements, complaints, risk disclosures and public information.

VARA can investigate, impose financial penalties, add supervision requirements, suspend permissions or take action against responsible individuals.

Its public VASP register shows licensed providers and firms with conditional approval. Check it before signing a custody, liquidity, settlement or exchange agreement.

Practical Checklist Before You Launch

Before committing to a Dubai crypto setup, confirm:

• your exact regulated activity

• the correct regulator and commercial jurisdiction

• paid-up capital and financial-resource requirements

• physical office and key staffing requirements

• AML, sanctions and Travel Rule controls

• custody and client-asset segregation

• cybersecurity and incident-response systems

• marketing and token-issuance rules

Most costly setup mistakes start with a wrong activity map. Get that right before building the company structure and compliance package.

Conclusion

Dubai gives crypto businesses a defined route to operate, but the standard is much higher than obtaining a trade licence. The framework combines Law No. 4 of 2022, VARA regulations, compulsory rulebooks, activity-specific rules, federal AML requirements and, for some payment-token models, Central Bank regulation.

Start with the activity and regulatory perimeter. Once those are clear, company formation, staffing, capital planning and documentation become easier to organise.

Frequently Asked Questions