VARA Custody License Dubai: Requirements, Capital and Application Process

Holding cryptocurrency for customers carries a different level of responsibility from running a software platform or giving blockchain advice. Once your company controls clients' private keys or safeguards virtual assets on their behalf, Dubai's custody rules come into play.

A VARA custody license Dubai applicant faces some of the strictest requirements in the emirate's virtual asset framework. You need a separate legal entity, dedicated governance, individual client wallets, strong key-management controls and enough regulatory capital to support the operation.

You cannot start serving clients after forming the company or receiving preliminary approval. Full Virtual Asset Service Provider approval from Dubai's Virtual Assets Regulatory Authority, or VARA, is required before regulated custody operations begin.

What Is a VARA Custody License?

VARA defines Custody Services as safekeeping virtual assets for or on behalf of another entity and acting only on verified instructions from that entity. A firm qualifies for the custody category only where individual clients' assets are segregated into separate virtual asset wallets.

This could cover a business that controls private keys for institutional investors, funds, family offices, exchanges or other customers.

VARA regulates these activities across mainland Dubai and Dubai free zones, except the Dubai International Financial Centre. DIFC has its own financial services regulatory framework.

You can review VARA's current categories through the official licensed activities page. 

VARA Custody License Requirements at a Glance

The current VARA Custody Services Rulebook has been effective since 19 June 2025.

How Much Capital Does a VARA Custodian Need?

The headline amount is AED 600,000, but treating that as a fixed capital requirement can leave you underfunded.

VARA requires a custody provider to maintain paid-up capital equal to the higher of AED 600,000 or 25% of fixed annual overheads.

For example, suppose your fixed annual overheads are AED 4 million:

25% × AED 4,000,000 = AED 1,000,000

Your required paid-up capital would therefore be AED 1 million rather than AED 600,000.

If fixed annual overheads are AED 2 million, 25% equals AED 500,000, so the AED 600,000 floor applies.

VARA also requires capital to be reconciled monthly. The rules permit it to be maintained through a UAE bank trust account with VARA stated as beneficiary, an eligible surety bond or another arrangement specified by VARA.

There is a separate liquidity requirement too. A VASP must maintain net liquid assets of at least 1.2 times its monthly operating expenses.

VARA Custody License Cost

According to VARA's official supervision and authorisation fee schedule, for Custody Services, VARA currently charges an AED 100,000 licence application fee and an AED 200,000 annual supervision fee. That puts the stated first-year regulatory charges at AED 300,000 before commercial licensing and operating expenses.

During Stage 1, a new applicant typically pays 50% of the application fee to start the review. The balance and first annual supervision fee are paid later in the licensing process.

Your actual budget should also cover incorporation, physical premises, staff, compliance personnel, cybersecurity systems, wallet infrastructure, audits, legal work and insurance.

The regulatory fee is therefore only one part of the project.

A Custody Business Must Be Legally Separate

This is one of the biggest differences between custody and other VARA activities.

VARA states that a VASP providing Custody Services must be a separate legal entity from any member of its group providing other regulated virtual asset activities. A dedicated custody team must also be operationally separated from other group operations.

There is a limited route for a custody provider to seek Transfer and Settlement Services authorisation, subject to VARA's approval and adequate segregation controls.

Your choice between mainland incorporation and an eligible Dubai free zone should therefore be made around the regulatory structure rather than the cheapest licence package. Nexture's Dubai mainland vs free zone comparison can help you understand the wider commercial differences.

Governance and Staffing Requirements

A custodian needs more than named directors on incorporation documents.

The board must contain executive and non-executive directors and include at least one independent director. It must meet at least quarterly. Custody firms must also establish remuneration, nomination and audit committees.

All VASPs must appoint two Responsible Individuals. Each must be a full-time employee, meet fit-and-proper standards and either live in the UAE or hold a UAE passport. VARA approves them during licensing.

The Compliance Officer must generally have at least five years of relevant compliance experience, work full-time for the VASP and report directly to the board. The MLRO must have at least two years of AML/CFT experience.

Plan these appointments early. A strong policy file will not compensate for key personnel who cannot explain the business model during a regulatory interview.

Client Asset and Wallet Controls

VARA applies strict custody-specific controls.

Client virtual assets are not assets or deposit liabilities of the custodian. The custodian cannot rehypothecate them. Each client must have separate VA wallets and the provider must maintain control of assets while supplying the custody service.

Wallet architecture also receives close attention. VARA expects a risk-based decision on hot, warm and cold storage, documented transfer procedures, secure seed and private-key creation and appropriate industry certifications. Controls around transfers between wallet types should be independently audited.

The company must be able to process withdrawals even during extreme volatility or market uncertainty. Custody policies must be reviewed at least annually.

VARA also requires daily reconciliation of client virtual asset records under its wider Client VA rules. Custody providers must supply account statements at least monthly and keep transaction audit trails for at least eight years.

Cybersecurity, AML and Insurance

A crypto custodian is exposed to private-key compromise, unauthorised withdrawals, cyberattacks, sanctions risk and operational failures. Your licensing file needs controls that address those risks directly.

VARA's Technology and Information Rulebook covers cryptographic key management, cybersecurity, vulnerability testing, independent audits, transaction monitoring and business continuity. VASPs must use distributed-ledger tracing tools to screen incoming and outgoing transactions and wallet addresses.

Insurance requirements include professional indemnity, directors' and officers' cover and commercial crime insurance or similar cover for virtual assets stored in hot wallets. VARA can impose additional insurance conditions based on the business.

Documents Required for a VARA Custody License

VARA's application documentation is explicitly non-exhaustive, so additional evidence can be requested.

Expect to prepare your incorporation documents, UBO information, source-of-funds evidence, organisational structure, governance framework, key-person CVs, regulatory business plan, financial projections, financial statements, capital evidence, reserve information, insurance certificates, succession planning and wind-down arrangements.

The regulatory file should also explain AML controls, sanctions screening, wallet architecture, cybersecurity, outsourcing, key management, incident response, client agreements and business continuity.

VARA lists these requirements on its VASP licence application page.

VARA Custody License Application Process

1. Map the Custody Model

   Document which assets you will support, who your clients are, who controls private keys, where infrastructure is hosted, how withdrawals work and whether any functions are outsourced.

2. Choose the Commercial Jurisdiction

   Apply through Dubai Economy and Tourism for a mainland entity or an eligible Dubai free zone. Nexture's Dubai business setup guide explains the general incorporation process.

3. Submit the Initial Disclosure Questionnaire

   The IDQ goes through DET or the chosen free zone. VARA will review the ownership, senior management and proposed business model.

4. Obtain Approval to Incorporate

   Successful Stage 1 applicants receive Approval to Incorporate, or ATI. This lets you complete company formation, premises, recruitment and operational setup.

   ATI does not allow you to provide Custody Services.

5. Complete the Full Regulatory Submission

   Submit the detailed governance, compliance, financial and technology documentation requested by VARA. Expect follow-up questions, meetings and possible interviews with key personnel.

6. Complete Capital and Operational Readiness

   Put the required capital arrangements, insurance, staffing, wallet controls, cybersecurity, audits and operating procedures in place.

7. Pay Final Fees and Receive the Licence

   The remaining application fee and first annual supervision fee are paid before final licensing. VARA may issue the licence with specific operating conditions.

   You can confirm approved firms on VARA's public VASP register before dealing with another regulated provider.

What About Custodial Staking?

A standard custody licence does not automatically give you unrestricted permission to provide staking.

A custodian may provide Staking from Custody Services only where VARA gives explicit authorisation and records it on the licence. Additional licensing or supervision fees may apply. Client assets remain subject to strict segregation requirements.

Collateral Wallet Services also require express VARA approval and may carry extra regulatory fees.

Define these products before applying rather than trying to add them after the custody architecture has already been built.

Conclusion

Getting a VARA custody license Dubai businesses can operate under requires serious preparation. The AED 600,000 capital floor is only the starting point. Your overheads may push the required capital higher and you still need liquidity, insurance, qualified staff, independent governance and secure wallet infrastructure.

The best approach is to design the regulatory structure before incorporating. Confirm the custody activity, build the separate legal entity, calculate capital from realistic operating costs and make sure the technology and compliance documents describe the system you will actually use.

Frequently Asked Questions