The Seven Pillars of VARA Regulation
The Virtual Assets and Related Activities Regulations 2023 define seven categories of regulated virtual asset activities, each requiring specific licensing from VARA. These categories form the structural foundation of Dubai’s virtual asset regulatory architecture — every entity seeking to operate in the sector must identify which categories apply to its business model and obtain the corresponding VARA licence.
Understanding these categories is the first step in any VARA licensing journey. Each category has a dedicated rulebook (updated to Version 2.0 in May 2025) that establishes specific operational, compliance, and governance requirements. Entities may apply for licensing in one or multiple categories, depending on the scope of their proposed activities.
Category 1: Advisory Services
Definition and Scope
Advisory services encompass the provision of advice to clients on virtual asset transactions, portfolio management, investment strategies, and related matters. This category captures both traditional financial advisory services adapted for virtual assets and crypto-native advisory models.
Key Requirements
- Advisors must hold relevant qualifications and demonstrate competence in virtual asset markets
- Suitability assessments must be conducted before providing personalized advice
- Conflicts of interest must be identified, managed, and disclosed
- Advice must be based on reasonable analysis and must not be misleading
Compliance Considerations
Advisory service providers must maintain AML/CFT programmes appropriate to their client base and service model. While advisory services may involve less direct asset handling than exchange or custody services, the client relationship creates obligations around suitability, disclosure, and consumer protection.
Category 2: Broker-Dealer Services
Definition and Scope
Broker-dealer services involve acting as an intermediary in buying, selling, or exchanging virtual assets on behalf of clients. Unlike exchange services (which operate a trading platform), broker-dealer services involve the entity acting as a counterparty or agent in individual transactions.
Notable Licensed Entity
BitOasis — described as “MENA’s leading regional cryptocurrency trading platform” — became the first broker-dealer to secure an MVP Operational Licence from VARA in May 2023, establishing the precedent for this activity category.
Key Requirements
- Best execution obligations when executing client orders
- Order handling procedures ensuring fair and timely execution
- Transparent fee disclosure
- Client money and asset segregation
- Adequate technology infrastructure for reliable trade execution
Category 3: Custody Services
Definition and Scope
Custody services involve the safekeeping and administration of virtual assets on behalf of clients. This is one of the most technically demanding activity categories, requiring sophisticated key management infrastructure, asset segregation systems, and operational security measures.
Notable Licensed Entities
Hex Trust and Komainu — both institutional-grade custody providers — received MVP licences from VARA in November 2022, establishing early regulatory precedent for custody operations in Dubai.
Key Requirements
- Mandatory asset segregation between client and proprietary assets
- Secure key generation, storage, and management procedures
- Access controls including multi-signature requirements
- Key recovery procedures
- Business continuity and disaster recovery plans
- Insurance arrangements for client asset protection
Staking from Custody
The August 2023 amendment to the Custody Services Rulebook explicitly permitted staking from custody services, allowing custody providers to stake client virtual assets while maintaining regulatory compliance. This amendment requires specific client consent, risk disclosure, and reward distribution procedures.
Category 4: Exchange Services
Definition and Scope
Exchange services involve operating a platform for the exchange of virtual assets, including both fiat-to-crypto and crypto-to-crypto trading. This is the activity category most commonly associated with major cryptocurrency platforms.
Notable Licensed Entities
- Binance Dubai — received MVP licence September 2022
- OKX Middle East — received MVP Preparatory Licence June 2023
- Crypto.com Dubai — received MVP Preparatory License March 2023
Key Requirements
- Market surveillance and monitoring systems
- Trade matching and execution infrastructure
- Pre- and post-trade transparency measures
- Market integrity controls including market abuse prevention
- System resilience and capacity management
- Fair access and non-discrimination in platform access
Category 5: Lending and Borrowing Services
Definition and Scope
Lending and borrowing services involve providing lending or borrowing services involving virtual assets. This category covers both centralized lending platforms and regulated lending activities that may have DeFi-adjacent characteristics.
Key Requirements
- Credit risk assessment procedures
- Collateral management frameworks
- Interest rate disclosure and fair lending practices
- Default management procedures
- Consumer protection measures including clear terms and risk disclosure
Regulatory Sensitivity
Lending and borrowing services have been subject to significant regulatory scrutiny globally following several high-profile platform failures. VARA’s regulated approach to this activity category — requiring licensing, compliance infrastructure, and ongoing supervision — provides a framework for responsible lending operations.
Category 6: Payment and Remittance Services
Definition and Scope
Payment and remittance services involve using virtual assets for payment processing or cross-border remittance services. This category intersects with Central Bank of the UAE (CBUAE) payment regulations.
Key Requirements
- Compliance with both VARA and CBUAE payment regulations
- The July 2025 circular on CBUAE PTSR Non-Objection Registration established specific registration requirements for VASPs providing payment services
- Transaction processing security and reliability
- Payment finality and settlement procedures
- Cross-border compliance including Travel Rule implementation
CBUAE Coordination
This category requires careful coordination between VARA’s licensing requirements and CBUAE payment regulations. The CBUAE PTSR NoC requirement ensures that VASPs providing payment services have obtained necessary central bank clearances alongside their VARA licences.
Category 7: VA Management and Investment Services
Definition and Scope
VA management and investment services encompass managing virtual asset portfolios or investment vehicles on behalf of clients, including fund management, discretionary portfolio management, and collective investment schemes involving virtual assets.
Key Requirements
- Portfolio management and investment decision-making frameworks
- Client mandate documentation and investment policy statements
- Performance reporting and fee transparency
- Qualified investor classification compliance (per January 2026 circular)
- Risk management for managed portfolios
- Valuation methodologies for virtual asset portfolios
Additional Licence Codes
Beyond the seven core activity categories, VARA has created additional licence codes for specific activities:
VA Issuance (Category 1)
Created in November 2023, this licence code covers the issuance of virtual assets. VARA’s October 2023 announcement on “Asset Reference Token Issuance Rules” positioned these rules as “the Global Standard on Asset Reference Tokens,” covering virtual assets backed by real-world assets.
VA Proprietary Trading
A dedicated licence code for proprietary trading was created in May 2023. The July 2025 reminder circular emphasized the requirement for entities to use the correct licence code for proprietary trading activities.
Choosing the Right Activity Categories
Prospective VARA applicants should carefully evaluate which activity categories apply to their business model. Key considerations:
- Scope accuracy: Apply for categories that genuinely describe your intended activities — over-application creates unnecessary compliance burden; under-application creates regulatory risk
- Cost implications: Each additional category adds to licensing costs and compliance programme requirements
- Phased approach: Consider starting with core categories and adding additional categories through licence amendments as your business evolves
- Combined operations: Many entities operate across multiple categories — Binance Dubai combines exchange and custody functions, for example
For guidance on the licensing process, see our two-step licensing guide. For fee information, see our costs analysis. For practical application guidance, see our how-to guide.
For comparison with activity categories in ADGM and DFSA, see our comparisons section. For federal regulatory context, visit UAE Tokenization Regulations.
Detailed Activity Category Analysis
Advisory Services
Licensed advisory service providers offer professional guidance on virtual asset investments, portfolio construction, regulatory compliance, and market analysis. This category encompasses both investment advisory and regulatory advisory functions.
Key requirements for advisory licensees include:
- Fitness-and-propriety standards for advisory personnel
- Conflict of interest management (particularly if the advisory firm also holds other VARA licences)
- Client agreement requirements specifying the scope and limitations of advice
- Record-keeping of advisory recommendations and client outcomes
Broker-Dealer Operations
BitOasis became the first entity to receive an MVP Operational Licence for broker-dealer services in May 2023. Broker-dealer operations involve acting as intermediary in virtual asset transactions on behalf of clients — buying and selling virtual assets at client request and potentially maintaining an inventory of virtual assets.
Broker-dealer requirements include:
- Best execution obligations when executing client orders
- Segregation of client assets from the firm’s own assets
- Transparent fee disclosure including commissions and spreads
- Qualified investor classification procedures
- Transaction reporting to VARA
Custody Services
Custody providers hold, store, and safeguard virtual assets on behalf of clients. This activity category was enhanced by the August 2023 amended custody services rulebook, which introduced staking from custody as a permitted activity.
Custody requirements include:
- Secure private key management with appropriate controls (multi-signature, hardware security modules)
- Segregation of client assets from the custodian’s own assets
- Insurance or equivalent financial protection arrangements
- Business continuity and disaster recovery specific to cryptographic key management
- Regular reporting to clients and VARA on asset holdings
Exchange Operations
The core activity for entities like Binance Dubai, OKX Middle East, Bybit Dubai, and Crypto.com Dubai. Exchange operations involve operating platforms that match buyers and sellers of virtual assets through order books.
Exchange-specific requirements include:
- Market integrity controls (surveillance for manipulation, insider trading, front-running)
- Order management and execution systems meeting VARA’s technical standards
- Fair and orderly market obligations
- Marketing regulations compliance for platform promotion
- The v2.0 rulebooks strengthened market integrity requirements for exchanges
Additional Licence Codes
Beyond the seven base categories, VARA has created specific licence codes:
- VA Proprietary Trading (May 2023): Trading on the entity’s own account
- VA Issuance Category 1 (November 2023): Token issuance activities, including asset reference tokens
These additional codes reflect VARA’s responsive approach to market development, creating regulatory infrastructure for specific activities as demand and market development warrant.
Lending and Borrowing
Virtual asset lending and borrowing services facilitate loans denominated in or collateralised by virtual assets. This activity category covers:
- Lending Platforms: Entities that enable users to lend virtual assets to borrowers, earning interest
- Borrowing Services: Entities that enable users to borrow virtual assets or fiat against virtual asset collateral
- Margin Lending: Providing virtual assets on margin for leveraged trading
Regulatory requirements for lending activities include collateralisation standards, disclosure of lending terms and risks, and risk management frameworks addressing credit risk, liquidation procedures, and collateral management.
Payment and Remittance Services
Using virtual assets for payment processing or cross-border remittances falls within this activity category. Requirements include:
- Coordination with CBUAE for payment token services (per the July 2025 circular on CBUAE PTSR Non-Objection Registration)
- Consumer protection for payment users
- Settlement finality and error resolution procedures
- AML/CFT requirements specific to payment flows
VA Management and Investment Services
Managing virtual asset portfolios or investment products on behalf of clients. This category encompasses:
- Discretionary portfolio management (making investment decisions on behalf of clients)
- Advisory services combined with execution (managing and implementing investment strategies)
- Fund-like structures investing in virtual assets
Requirements include suitability assessments, performance reporting, fee disclosure, and governance frameworks for investment decision-making.
Interaction Between Activity Categories
Many licensed entities conduct multiple regulated activities simultaneously. Binance Dubai may hold authorisations for exchange, custody, and potentially proprietary trading. The interaction between activity categories creates compliance considerations:
- Conflict of Interest Management: Operating an exchange while also conducting proprietary trading requires controls to prevent conflicts
- Consolidated Risk Management: Entities with multiple activity authorisations must assess risk on a consolidated basis
- Activity-Specific Compliance: Each activity category has specific rulebook requirements under the v2.0 framework