Virtual Asset Service Provider (VASP)

Definition

A Virtual Asset Service Provider (VASP) is any entity that conducts one or more virtual asset activities as defined by the Virtual Assets and Related Activities Regulations 2023. Under VARA’s framework, VASPs are the primary regulated entities — the businesses that must obtain licences, implement compliance programmes, and submit to ongoing regulatory supervision.

The VASP classification is central to VARA’s regulatory architecture. Any entity meeting this definition must obtain a VARA licence before conducting virtual asset activities in or from the Emirate of Dubai (excluding the DIFC). Failure to do so constitutes unlicensed operation, subject to enforcement action including cease-and-desist orders and financial penalties.

Regulated Activity Categories

VARA defines seven categories of virtual asset activities that bring an entity within the VASP definition. An entity conducting any of these activities requires a VARA licence:

1. Advisory Services: Providing advice on virtual asset investments, portfolio management, or regulatory compliance
2. Broker-Dealer Operations: Acting as an intermediary in buying, selling, or exchanging virtual assets on behalf of clients — the category under which BitOasis became the first entity to obtain an MVP Operational Licence
3. Custody Services: Holding, storing, and safeguarding virtual assets on behalf of clients, subject to VARA’s custody and staking rules
4. Exchange Operations: Operating platforms that match buyers and sellers of virtual assets — the core activity of licensed entities like Binance Dubai, OKX Middle East, Bybit Dubai, and Crypto.com Dubai
5. Lending and Borrowing: Facilitating virtual asset lending and borrowing services
6. Payment and Remittance Services: Using virtual assets for payment processing or cross-border remittances, subject to coordination with CBUAE payment token service requirements
7. VA Management and Investment Services: Managing virtual asset portfolios or investment products

These categories are analysed in detail in our licensed activities guide.

Licensed VASPs in Dubai

As of 2026, VARA has licensed approximately 21 VASPs. The licensed ecosystem includes:

• International Exchanges: Binance Dubai (MVP licence, September 2022), OKX Middle East (MVP Preparatory, June 2023), Crypto.com Dubai (MVP Preparatory, March 2023), Bybit Dubai
• Regional Platforms: BitOasis (first MVP Operational Licence, May 2023), Rain Financial
• Specialised Service Providers: Custody providers, advisory firms, and other entities licensed under specific activity categories

The full list of licensed VASPs is maintained on the licensed VASPs dashboard and VARA’s public register.

Compliance Obligations for VASPs

Licensed VASPs must implement comprehensive compliance programmes covering:

• AML/CFT/CPF requirements aligned with VARA rulebooks, the UAE Federal AML Decree-Law, and FATF standards
• Virtual Assets Travel Rule implementation per the February 2026 circular
• Marketing regulations compliance
• Consumer protection including asset segregation and disclosure
• FATF high-risk jurisdiction screening
• EOCN sanctions screening
• Qualified investor classification per the January 2026 circular
• Risk assessment and management per the May 2025 rulebook v2.0 requirements

Enforcement Against Unlicensed VASPs

VARA has taken action against more than 36 entities operating as unlicensed VASPs. The enforcement actions dashboard tracks all published actions. Entities penalised include those registered in various Dubai free zones — DMCC, DAFZA, IFZA, and others — that conducted virtual asset activities without VARA authorisation. Cases like Vesta Prime Portal and UAEC Digital Fintech demonstrate that free zone registration does not substitute for VARA licensing.

International Definition

The VASP definition aligns with FATF’s definition, which covers entities that conduct exchange, transfer, safekeeping, or administration of virtual assets, or provide financial services related to virtual assets. For comparison across jurisdictions, see our analyses of VARA vs ADGM FSRA, VARA vs EU MiCA, and VARA vs international frameworks.

For the licensing process and fee structure applicable to VASPs, see our licensing section. For related terms, browse our glossary.

Legacy Operator Transition

The March 2023 circular on Application Acknowledgment Notices and the transition of legacy firms (deadline March 31, 2023) created a formal pathway for entities that had been operating in Dubai’s virtual asset market before the 2023 regulations. The April 2023 coordination between DET and the Free Zone Council activated VARA licensing applications for legacy operators, requiring all existing market participants to engage with the regulatory process or cease operations.

This transition period was significant because it acknowledged that an ecosystem of virtual asset businesses existed in Dubai before formal regulation. The November 2023 market notice warning that “market-wide enforcements pick-up pace as final VARA deadline for Virtual Asset Service Provider licensing engagement lapses” signalled the end of the transition period and the beginning of systematic enforcement against entities that failed to engage. The subsequent enforcement actions against 36+ entities confirmed that VARA was willing to pursue unlicensed operators aggressively.

The VASP definition’s practical application to the DWTCA free zone ecosystem, DMCC-registered entities, and operators across other Dubai free zones demonstrates that VARA’s jurisdiction is geographically comprehensive within the Emirate, regardless of an entity’s free zone registration. Entities registered in DMCC (such as Shenzhou Crypto DMCC, A to Z Globe DMCC, and Mastercoin DMCC), DAFZA, IFZA, and other free zones have all been subject to enforcement for conducting VASP activities without VARA authorisation — confirming that free zone business registration is separate from and does not substitute for VARA’s virtual asset licensing requirement.