How to Apply for a VARA Licence — Step-by-Step Guide

Before You Begin

This guide walks you through the practical steps of applying for a VARA licence to operate as a Virtual Asset Service Provider in the Emirate of Dubai. VARA administers a two-step licensing process — MVP Preparatory Licence followed by MVP Operational Licence. The process is substantive and requires significant preparation.

Prerequisites:

• Determine which regulated activity categories your entity will conduct
• Engage qualified legal counsel experienced with VARA licensing
• Secure sufficient financial resources for licensing fees and operational setup
• Identify key personnel including compliance officer and senior management

Step 1: Pre-Application Engagement

Contact VARA through official channels at vara.ae to initiate the pre-application process. This initial engagement allows VARA to understand your proposed activities and provides you with specific guidance on the application requirements applicable to your business model.

Select your establishment location. Most VASPs establish in the DWTCA free zone, but any Dubai free zone (except DIFC) or mainland Dubai is within VARA’s jurisdiction. Consider proximity to VARA, cost structure, and operational requirements.

Step 2: Corporate Establishment

Register your corporate entity in the chosen free zone or mainland Dubai. This provides the legal entity through which you will apply for and hold your VARA licence.

Secure office space meeting VARA’s physical presence requirements. VARA requires a genuine Dubai presence, not merely a registered address.

Obtain employment visas for key personnel who will be based in Dubai.

Step 3: Prepare Application Documentation

Compile comprehensive documentation covering:

• Corporate structure — ownership charts, beneficial ownership disclosures, group relationships
• Business plan — proposed activities, target market, revenue model, risk profile
• Governance framework — board composition, committees, reporting lines
• Compliance programme — AML/CFT programme, marketing compliance, consumer protection procedures
• Technology infrastructure — security architecture, key management (for custody), platform design (for exchanges)
• Financial resources — capital adequacy, liquidity management, insurance
• Key personnel profiles — CVs, fitness and propriety documentation for all senior management

Step 4: Submit MVP Preparatory Licence Application

Submit the formal application to VARA with all required documentation and applicable fees. The assessment process involves:

• Detailed document review by VARA
• Possible requests for additional information
• Senior management interviews
• Compliance framework assessment
• Technology review

Timeline: Assessment periods vary based on application complexity and applicant responsiveness. There is no published fixed timeline.

Step 5: Preparatory Phase Operations

Upon receiving the MVP Preparatory Licence, establish your operational infrastructure:

• Deploy and test technology systems
• Activate AML/CFT monitoring and screening systems
• Register on the EOCN system for sanctions alerts
• Register on the UAEFIU IEMS for suspicious transaction reporting
• Implement Travel Rule capabilities
• Complete staff recruitment and training
• Conduct security audits and penetration testing

Important: During this phase, you may not serve customers or conduct public-facing virtual asset activities.

Step 6: Apply for MVP Operational Licence

Once preparatory requirements are met, submit the operational licence application demonstrating:

• Full operational readiness
• Activated compliance systems
• Completed security assessments
• Staff training completion
• Customer protection mechanisms in place

Step 7: Commence Operations

Upon receiving the MVP Operational Licence, you may begin serving customers. BitOasis was the first entity to complete this full journey for broker-dealer services (May 2023).

Post-Licensing Obligations: Maintain ongoing compliance with all VARA requirements, monitor regulatory circulars for updates, and prepare for supervisory assessments.

Common Pitfalls

• Underestimating compliance requirements — VARA’s standards are institutional-grade; see the compliance requirements map
• Insufficient financial resources — Budget for the complete cost of licensing, not just VARA fees
• Weak governance structures — VARA expects board-level oversight; see the MORPHEUS/FUZE case for consequences of governance failures
• Ignoring marketing rules — Marketing regulations apply even during the application process

For comparison with licensing processes in ADGM and DFSA, see our comparisons section.

For broader UAE licensing context, visit UAE Tokenization Regulations.

Step 3: Prepare Your AML/CFT Programme

Before submitting your application, develop a comprehensive AML/CFT programme that meets VARA’s standards. This programme is a critical component of the licensing assessment and must demonstrate genuine compliance capability, not merely documented policies.

Your AML/CFT programme should address:

Customer Due Diligence (CDD): Procedures for identifying and verifying customer identity, understanding the purpose of the business relationship, and conducting ongoing monitoring. Include provisions for enhanced due diligence for higher-risk categories including politically exposed persons and customers from FATF high-risk jurisdictions.

Transaction Monitoring: Describe the systems and processes you will use to monitor transactions for suspicious activity. VARA expects automated monitoring capabilities appropriate to your transaction volumes and risk profile.

Sanctions Screening: Detail your approach to screening customers and transactions against EOCN sanctions lists, including registration on the EOCN digital platform for real-time alerts.

Suspicious Activity Reporting: Procedures for escalating, investigating, and reporting suspicious activity to the UAE Financial Intelligence Unit via the Integrated Enquiry Management System (IEMS).

Record-Keeping: Systems for maintaining customer identification, transaction records, and compliance documentation for prescribed retention periods.

Step 4: Technology Infrastructure Documentation

VARA assesses the technology infrastructure supporting your virtual asset operations. Prepare documentation covering:

• Trading platform architecture and security measures
• Wallet management and private key custody arrangements
• Cybersecurity framework including penetration testing and vulnerability management
• Business continuity and disaster recovery plans
• Data protection and privacy compliance
• Systems for Virtual Assets Travel Rule implementation

Step 5: Submit MVP Preparatory Licence Application

With your documentation prepared, submit the formal application through VARA’s channels. The application package typically includes:

• Corporate structure and beneficial ownership documentation
• Business plan including projected activity volumes and revenue model
• AML/CFT programme documentation
• Technology infrastructure specifications
• Risk management framework
• Financial resource statements demonstrating adequacy for proposed activities
• Fitness-and-propriety declarations for all key personnel
• Compliance staffing plan

Step 6: VARA Assessment Process

VARA reviews applications through a structured assessment process:

Documentary Review: VARA examines all submitted documentation for completeness, accuracy, and compliance with regulatory standards.

Clarification Requests: Expect VARA to request additional information, clarifications, or modifications to your application. Response times affect overall processing duration.

Personnel Assessment: Fitness-and-propriety assessments for senior management, compliance officers, and other key personnel. This may include background checks, interviews, and verification of qualifications and experience.

On-Site Assessment: VARA may conduct on-site inspections to verify that your operational setup, technology infrastructure, and staffing match the representations in your application.

Step 7: MVP Preparatory Licence — Conditions and Establishment

If VARA grants the MVP Preparatory Licence, you may establish operations in Dubai but cannot yet serve customers. During this preparatory phase:

• Set up office infrastructure in your chosen free zone or mainland location
• Hire and train compliance, technology, and operational staff
• Implement and test technology systems
• Conduct dry runs of compliance processes (transaction monitoring, KYC procedures, reporting)
• Prepare for VARA’s operational readiness assessment

Step 8: Progress to MVP Operational Licence

To advance from preparatory to operational status, demonstrate to VARA that you have:

• Implemented all compliance systems and processes described in your application
• Hired and trained all required personnel
• Tested technology infrastructure under realistic conditions
• Established banking relationships for fiat currency operations
• Completed any conditions attached to the preparatory licence

Step 9: Ongoing Compliance After Licensing

Licensing is the beginning of regulatory engagement, not the end. Licensed VASPs must maintain ongoing compliance with VARA’s evolving framework, including:

• Responding to new circulars (41 issued through early 2026, with increasing frequency)
• Implementing rulebook v2.0 requirements
• Conducting FATF high-risk jurisdiction screening updates
• Implementing qualified investor classification procedures
• Maintaining marketing regulation compliance
• Filing periodic regulatory reports

Common Pitfalls

Based on VARA’s enforcement record and publicly available information:

• Insufficient AML programme design: The FUZE case demonstrates VARA’s focus on AML programme substance
• Inadequate staffing: VARA expects genuine operational presence, not minimal registrations
• Incomplete documentation: Missing or vague application materials cause delays
• Failure to engage early: The March 2023 deadline for legacy operators demonstrated the importance of timely regulatory engagement

Estimated Timeline and Costs

While VARA does not publish standard processing times, the licensing process from initial engagement to operational licence typically spans several months. Licensing fees cover application processing, but the total cost includes legal fees, compliance infrastructure, technology setup, office establishment, and staffing.

For the fee structure, see our dedicated guide. For licensed activity categories, see our licensing section. For the DWTCA free zone as a location option, see our ecosystem section.

Choosing Between Free Zones for Your VASP

The choice of corporate domicile affects your licensing experience and ongoing operations:

DWTCA Free Zone: The institutional home of VARA. Establishing in the DWTCA provides proximity to the regulator, access to the DWTC complex’s office infrastructure, and streamlined coordination with VARA’s administrative systems. Major licensed entities including Binance Dubai and OKX Middle East have chosen DWTCA-based registration.

Other Dubai Free Zones: Entities may register in DMCC, DAFZA, IFZA, or other free zones while still obtaining VARA licensing. However, free zone registration alone does not authorise virtual asset activities — VARA licensing is required regardless of free zone. VARA’s enforcement record includes actions against entities registered in various free zones (such as DMCC-registered Shenzhou Crypto and A to Z Globe) that operated without VARA authorisation.

Mainland Dubai: Entities may also establish mainland Dubai companies for virtual asset activities. The same VARA licensing requirements apply.

Understanding Licensed Activity Categories

Before applying, determine precisely which regulated activity categories your entity will conduct:

• Advisory Services: Providing advice on virtual asset investments or compliance
• Broker-Dealer Operations: BitOasis was the first broker-dealer to receive an MVP Operational Licence
• Custody Services: Holding customer virtual assets, subject to custody and staking rules
• Exchange Operations: Operating order book platforms matching buyers and sellers
• Lending and Borrowing: Facilitating virtual asset lending
• Payment and Remittance: Using virtual assets for payment processing
• VA Management and Investment: Managing virtual asset portfolios
• Proprietary Trading: Trading on the entity’s own account (licence code created May 2023)
• VA Issuance: Token issuance activities (Category 1 licence code created November 2023)

Each activity category triggers specific rulebook requirements under the v2.0 rulebooks published May 2025.

Financial Resource Planning

Budget for the full cost of VARA licensing and first-year operations:

• Application Fees: Covered in the fee structure guide
• Legal and Advisory Fees: Specialist VARA licensing counsel
• Compliance Infrastructure: AML software, blockchain analytics, sanctions screening, Travel Rule messaging systems
• Staffing: Compliance officers, MLRO, technology staff, management — OKX Middle East committed to 30 staff upon licensing
• Office Space: Free zone or mainland rental costs
• Technology: Trading platform, security infrastructure, monitoring systems
• Ongoing Regulatory Costs: Regulatory reporting, audit, and compliance maintenance

The SCA-VARA Unified Register

Once licensed, your entity will appear on the SCA-VARA unified VA sector register, providing federal-level recognition of your VARA licensing. This register is important for banking relationships, counterparty due diligence, and demonstrating regulatory status to partners and customers.