UAE VARA Licence Guide: Application, Capital, Timeline (2026)

Dubai's Virtual Asset Regulatory Authority is the fastest serious crypto regulator in the world. From application to operational permit, VARA can grant a fully-scoped VASP licence in 3–9 months — materially faster than any EEA NCA, the UK FCA, or Singapore MAS. The trade-off is a more demanding application file at the front end and substance expectations that have hardened since 2024.

VARA was established under Dubai Law No. 4 of 2022 and operationalised through the VARA Virtual Assets and Related Activities Regulations 2023. The regime authorises seven VA activity classes (Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, VA Issuance) on a class-by-class basis. The Abu Dhabi Global Market FSRA operates a parallel regime in the ADGM free zone for institutional firms; the two are independent rather than competing.¹^[1]²^[2]³^[3]

This guide covers the practical mechanics: the seven VA classes, the capital floors and timeline by class, the in-principle approval process, the operational-permit milestone, the substance expectations VARA tests at inspection, the costs of a full programme, the UAE corporate tax position (0% in qualifying free zones, 9% mainland above AED 375,000), and how VARA compares to MiCA CASP authorisation for firms choosing between a UAE base and an EEA base. The headline: VARA is fast and credible, but not light-touch.

The VARA Virtual Assets and Related Activities Regulations 2023 split crypto activities into seven classes. A VARA licence is granted on a per-class basis; firms operating across multiple classes hold multi-class authorisations rather than a single global VASP licence. This contrasts with the MiCA CASP model where authorisation covers all eight services in a tiered class structure.

Capital floors are set per class and per risk profile. VARA tests the higher of the class minimum and a risk-weighted variable that considers customer base, asset under custody, and transaction volume — analogous to the MiCA fixed overhead requirement but explicitly volume-driven. Indicative figures below.

VARA authorisation runs in two phases: in-principle approval (IPA) and operational permit. The IPA confirms VARA is willing to license the entity subject to outstanding conditions (capital deposited, premises secured, MLRO appointed, technology audited). The operational permit is the live licence enabling actual provision of services to clients.

• Phase 1 — Pre-application (4–8 weeks). Entity incorporation in Dubai mainland or qualifying free zone (DMCC, DWTC). Initial scoping with VARA's licensing team. Programme of Operations drafting. Initial fee deposits.

• Phase 2 — IPA submission (file lodged). Complete authorisation file: governance, capital, AML/CTF programme, ICT controls, business plan, fit-and-proper for all key function holders.

• Phase 3 — Substantive review (3–6 months). VARA's licensing committee reviews and iterates with the applicant. Typically 2–4 rounds of written questions; deeper engagement than EEA NCAs.

• Phase 4 — IPA grant (1–2 weeks). VARA issues the in-principle approval listing remaining conditions for the operational permit.

• Phase 5 — Conditions discharge (1–4 months). Capital deposited and segregated; MLRO and Compliance Officer appointed and pre-approved; office secured and staffed; ICT environment audited; AML systems live with named vendors (Travel Rule provider, blockchain analytics).

• Phase 6 — Operational permit. VARA issues the live VA licence; the firm may begin providing services to clients.

VARA's reputation for speed should not be confused with light-touch substance. The Authority has tightened substance requirements progressively since the first cohort of licences in 2023 and now expects:

• Local executive presence. CEO and at least one executive director ordinarily resident in Dubai with documented physical presence. Flying-in executives do not satisfy the test.

• Local MLRO and Compliance Officer. Both pre-approved by VARA, both ordinarily resident, both with crypto-specific experience.

• Real office premises. Not a virtual office or PO box. VARA inspectors visit during the IPA review and post-licence.

• Material local employment. Generally interpreted as 5+ FTEs based in Dubai for a serious operational firm; smaller for advisory-only Class 1.

• Local technology operations. Servers either in UAE or with documented data-residency carve-outs; ICT third-party register populated.

Total programme cost from decision to first year operational typically falls between US$700,000 and US$2.5 million depending on class, with the breakdown below for a mid-sized Custody + Exchange (multi-class) applicant.

VARA covers all of Dubai except the DIFC financial free zone. The Abu Dhabi Global Market FSRA covers the ADGM free zone only. The two regimes are independent; a firm authorised by VARA cannot operate from ADGM without a separate FSRA permission, and vice versa. The choice depends on customer base, sponsor preferences, and target counterparties.

Founders choosing between a UAE base and an EEA base often frame the decision on cost and tax. The right framing is on customer geography, banking access, and access to institutional counterparties.

• Choose VARA if your customer base is MENA, GCC, South Asia (India, Pakistan), or Africa; if speed to authorisation matters; if 0% free zone tax materially affects unit economics; or if your founders prefer to live in Dubai.

• Choose MiCA CASP if your customer base is EEA-resident; if EEA passporting matters commercially; if institutional counterparty diligence will happen via a European correspondent bank; or if eventual EEA bank-grade credibility matters more than tax efficiency.

• Run both if you have material customer demand in both regions. Many large CASPs hold a VARA licence (UAE entity) and a MiCA CASP authorisation (typically Lithuania, Cyprus, or Malta) in parallel.

• Treating VARA as a fast-track CASP. The capital, governance, AML, and ICT bar is at full EEA-equivalent depth. Speed comes from process, not from substance.

• Generic Programme of Operations. Lifted templates are flagged on first review and downgrade the file to high-scrutiny.

• Underestimating substance. Pre-2024 nominal-substance grants are now under remediation review; new applicants should plan from day one for 5+ FTEs based in Dubai.

• Confusing free zone with mainland tax. Only qualifying free zone income is 0%-taxed; mainland operations or non-qualifying free zone income is subject to 9% federal CIT above AED 375,000.

• Assuming VARA authorisation enables MENA passporting. It does not. Saudi Arabia, Bahrain, Kuwait operate independent crypto regimes. Bilateral MoUs exist but no formal passport.

From decision to operational permit: 3–6 months for Class 1 Advisory; 4–7 months for Class 2 Broker-Dealer; 6–9 months for Class 3 Custody and Exchange; 9–12 months for VA Issuance. Multi-class applications add 1–2 months. The clock is dominated by VARA review iterations and conditions discharge — not by drafting speed.

No. A VARA licence authorises VA activities from a Dubai-domiciled entity to MENA, GCC, and other non-EEA customers. Serving EEA-resident customers from a VARA-licensed entity requires either MiCA reverse solicitation (narrowly available) or a parallel MiCA CASP authorisation in an EEA member state. Many large operators hold both licences.

0% on qualifying free zone income; 9% federal corporate tax on mainland income or non-qualifying free zone income above AED 375,000 (~US$100,000) per UAE Federal Decree-Law No. 47 of 2022. Most VARA-licensed firms structure operations to maximise qualifying free zone income — typically by basing the VARA-licensed entity in DMCC or DWTC. Detailed structuring requires UAE tax counsel.⁵^[4]

Strictly, yes. VARA's writ runs to Dubai; ADGM FSRA's runs to the ADGM free zone. In practice, VARA-licensed firms typically serve UAE-wide customers through cross-Emirate marketing protocols, while ADGM FSRA firms typically serve institutional clients globally. Dual authorisation is unusual but exists for very large multi-product groups.

Substantively similar. VARA applies UAE Federal Decree-Law No. 20 of 2018 on AML/CTF plus the FATF Updated Guidance baseline. Expected programme components (risk assessment, CDD/EDD, sanctions screening, Travel Rule, transaction monitoring, MLRO, training, audit) are equivalent to EBA Guidelines expectations. Vendors deployed are largely the same — Notabene, Sumsub, Chainalysis, Elliptic, TRM Labs.⁴^[5]⁶^[6]

Wio Bank, Emirates NBD, First Abu Dhabi Bank, and Mashreq Bank actively onboard VARA-licensed firms with documented AML programmes. Banking timelines are 3–9 months end-to-end. International correspondent USD access typically routes through BCB Group's UAE-side relationships or directly via Mashreq's USD correspondents. The banking landscape is materially friendlier than most EEA jurisdictions.

• EEA vs UK vs Offshore: Where to Incorporate Your Crypto Business: Which jurisdiction maximises regulatory access and tax efficiency

• MiCA Compliance Guide for CASPs: Authorisation walkthrough — capital, governance, supplier stack

• How to Get a Bank Account for a VASP or CASP: The 2026 banking playbook for regulated crypto firms

• AML Compliance for Crypto Firms: What the 6AMLD requires from CASPs and VASPs

VARA is the rare regulator that combines speed, credibility, and a tax structure that materially improves crypto-business unit economics. The bar is real — substance expectations, capital, governance, AML, ICT — and the bar has tightened. But the firms that work with VARA's process get to a fully operational permit in 3–9 months, with 0% tax on qualifying free zone income and one of the friendliest banking landscapes in regulated crypto. For any operator with a meaningful MENA, GCC, South Asia, or Africa customer base — or simply a preference for Dubai over Vilnius — VARA is the right answer.