Crypto Custody License in Dubai: Regulatory Requirements for Digital Asset Custodians

To obtain a crypto custody license in Dubai, firms must first receive approval from the Virtual Assets Regulatory Authority (VARA), create necessary structures for the protection of client assets, and set up strict governance, cybersecurity and compliance systems. Companies dealing with the custodianship of virtual assets on behalf of their clients must follow the Custody Services Rulebook issued by the VARA as well as any other relevant regulations.

While in Dubai the custody service is separated from other virtual assets business activities, such as brokerage, and exchange services. It is essential for those who provide businesses with the storage of digital assets.

This guide is going to explain what are the specific requirements for obtaining a digital asset custody license in the United Arab Emirates, which steps to take in order to get the license, what is the allowed dollar amount that the applicant needs to have, and what are the requirements for ongoing compliance in regard to custodians working in Dubai.

Read More: MiCA License in Europe: Requirements for UAE Crypto Companies Expanding Into the EU

Meaning of Crypto Custody Services

The crypto custody means providing services for experts regarding the storage and management of electronic assets.

To protect customer assets, custodians can apply various technologies such as cold and hot wallets, multi-signature setups, or multi-party computation (MPC) tools. Nevertheless, the chosen type of wallet does not solely determine if an entity provides regulated custody services. The legal interpretation of the situation will depend on how much control a service provider has over virtual assets, keys, and transactions.

To illustrate the point, a corporation that has access to private keys for clients’ assets may be recognized as a custody services provider in accordance with the law.

Read More: VARA vs. ADGM FSRA vs. DFSA: Which UAE Crypto Regulator Is Right for Your Business?

Overview of Virtual Asset Custody in the UAE

Different regulations are in place in the UAE with regard to the virtual asset custody depending on authorities.

VARA: Dubai Mainland and Free Zones

In Dubai, VARA oversees the provision of custody services with its Custody Services Rulebook providing the details on asset segregation, wallet arrangements, cybersecurity strategies, governance, and protection of clients.

A company that delivers custody services and operates from Dubai needs to obtain a VARA authorization.

ADGM: Financial Services Regulatory Authority

Within Abu Dhabi Global Market (ADGM), the Financial Services Regulatory Authority (FSRA) regulates relevant virtual asset activities under its financial services framework.

Custodians must comply with applicable requirements concerning safeguarding, technology risk, governance, and operational controls.

DIFC: Dubai Financial Services Authority

Within DIFC, the Dubai Financial Services Authority (DFSA) regulates relevant crypto-token and investment-token activities.

Businesses providing custody services involving regulated tokens must assess whether their activities constitute Providing Custody or another regulated financial service.

Consequently, a digital asset custody license in the UAE is not a single nationwide authorisation.

Businesses must select the appropriate jurisdiction and identify the specific permissions required for their operating model.

Read More: What Does a Cryptocurrency Attorney in Dubai Do? A Complete Guide

Who Needs a Crypto Custody License in Dubai?

Businesses that safeguard virtual assets for customers and act on verified instructions concerning those assets may fall within VARA's Custody Services category.

Potential applicants include institutional crypto custodians, digital asset safekeeping providers, and businesses managing custodial wallet infrastructure.

However, not every technology provider requires a custody licence.

A software company supplying non-custodial wallet technology, without controlling or safeguarding customer assets, may fall outside the definition of Custody Services. Its actual activities must still be assessed against the wider VARA regulatory framework.

Importantly, VARA requires licensed custodians to maintain client-specific wallet segregation. A custody provider cannot assume that an omnibus wallet structure will satisfy the standalone Custody Services licensing requirements.

Read More: Choosing the Right Cryptocurrency Attorney in Dubai: Key Factors to Consider

Independent Legal Entity Requirement for Custodians

One of the most important crypto custodian regulatory requirements in Dubai is operational and legal independence.

VARA requires a custody provider to operate through a distinct legal entity, separate from group companies conducting other virtual asset activities or linked services.

An exception applies to permitted Transfer and Settlement Services, subject to the relevant regulatory requirements.

For example, a corporate group intending to operate both a crypto exchange and a custody business would generally need a separately licensed custody entity.

This separation is designed to reduce conflicts of interest and protect customer assets from risks associated with other business activities.

The requirement is expressly addressed in VARA's Custody Services Rulebook.

Read More: How to Buy and Sell Cryptocurrency in UAE

Capital Requirements for a Crypto Custody License

VARA's Company Rulebook establishes a minimum paid-up capital requirement for Custody Services.

Minimum paid-up capital for Custody Services

Higher of AED 600,000 or 25% of fixed annual overheads

VARA Company Rulebook, Part VI. The requirement must be maintained on an ongoing basis.

For example, if a custodian has fixed annual overheads of AED 4 million, 25% would amount to AED 1 million. In that case, the applicable capital requirement would be AED 1 million rather than AED 600,000.

Regulatory capital is separate from customer assets held in custody and from licensing fees or other operational expenditure.

Read More: How to Use Cryptocurrency (Legally and Safely) to Buy a Home in Dubai — 2025 Compliance Guide

Client Asset Segregation and Safekeeping Requirements

Client asset protection is central to VARA's custody framework.

Segregated Client Wallets

Custodians must maintain appropriate segregation of client virtual assets.

VARA's Custody Services definition specifically requires each client's assets to be held in separate virtual asset wallets to qualify for a Custody Services licence.

Custodians must also distinguish customer assets from their own corporate assets.

This helps prevent the commingling of assets and supports clearer ownership records.

Verified Client Instructions

Custodians must act only on verified instructions from the client or a properly authorised representative.

Internal procedures should address instruction authentication, approval hierarchies, withdrawal controls, and the handling of unauthorised transaction attempts.

A custodian should not independently deploy client assets for proprietary trading or other purposes without the necessary legal and regulatory basis.

Reconciliation and Recordkeeping

Custodians must establish reliable records of client entitlements, wallet balances, and asset movements.

Reconciliation procedures should identify discrepancies between internal ledgers and blockchain balances.

Businesses should also maintain procedures for investigating and resolving reconciliation exceptions.

Read More: Charting the Course for a Cryptocurrency License – Global Trends and Legal Fundamentals

Key Management and Cybersecurity Requirements

A secure custody model must address the entire lifecycle of cryptographic keys, from generation and storage to recovery and destruction.

Private Key and Wallet Management

VARA's Technology and Information Rulebook requires appropriate controls over cryptographic keys, wallet creation, transaction signing, and access permissions.

Custodians must avoid single points of failure and implement safeguards against unauthorised access.

Depending on the custody architecture, businesses may use MPC technology, multisignature wallets, hardware security modules, and geographically separated backups.

However, adopting MPC or cold storage alone does not establish regulatory compliance. The custodian must demonstrate that its controls are effective and appropriate for its business model.

Security Testing and Business Continuity

Custodians must maintain cybersecurity policies, incident response procedures, and business continuity arrangements.

VARA also requires independent vulnerability assessments and penetration testing at least annually and before introducing relevant new systems, applications, or products.

These measures are particularly important for institutional custodians managing substantial customer holdings.

Read More: The Importance of Cryptocurrency Licenses in Enhancing Industry Legitimacy

How to Obtain a Crypto Custody License in Dubai

The crypto custody license Dubai application process generally involves the following stages.

Step 1: Define the Custody Model

Identify the assets to be safeguarded, customer categories, wallet architecture, and arrangements for transaction authorisation.

Determine whether the business will provide custody alone or additional services requiring separate permissions.

Step 2: Establish an Appropriate Legal Structure

Select a Dubai mainland or eligible free zone structure and account for VARA's independent legal entity requirement.

The company must establish a physical presence in Dubai, including an appropriate private office.

Step 3: Apply for Approval to Incorporate

New applicants generally initiate the licensing process through the Dubai Department of Economy and Tourism or the relevant free zone authority.

VARA's initial assessment may lead to an Approval to Incorporate, allowing the applicant to establish the company and develop its operational arrangements.

Step 4: Prepare Regulatory Documentation

Applicants should prepare comprehensive documentation covering governance, financial resources, AML/CFT, wallet management, cybersecurity, outsourcing, and client asset safeguarding.

A custody applicant should also document key ceremonies, withdrawal controls, reconciliation procedures, disaster recovery, and custody agreements.

Step 5: Complete VARA's Regulatory Assessment

VARA reviews the applicant's business model, management suitability, operational readiness, and compliance framework.

The authority may request additional information, interviews, independent assurance, or changes to proposed arrangements.

Step 6: Obtain the VASP Licence

Following successful assessment, VARA may grant the Custody Services licence, subject to applicable conditions.

An Approval to Incorporate does not permit the company to begin regulated custody operations.

Read More: How to Obtain a VARA License in Dubai: The Definitive Resource for Crypto Companies

Crypto Custody Licensing Costs in Dubai

VARA's published fee schedule specifies the following charges for Custody Services.

Application fee

AED 100,000

Custody Services licence application

Annual supervision fee

AED 200,000

Ongoing regulatory supervision

These fees are separate from minimum paid-up capital and operational expenditure.

Additional costs may include incorporation, personnel, cybersecurity assessments, custody technology, insurance, audits, and professional advisory services.

AML/CFT Compliance for Digital Asset Custodians

Licensed custodians must implement appropriate anti-money laundering, counter-terrorist financing, and sanctions compliance arrangements.

These include customer due diligence, beneficial ownership verification, transaction monitoring, and suspicious transaction reporting.

Custodians should assess the financial crime risks associated with wallet addresses, blockchain transactions, customer profiles, and geographical exposure.

Where applicable, Travel Rule obligations must also be addressed.

Outsourcing blockchain analytics or customer verification does not remove the custodian's responsibility for maintaining an effective compliance programme.

Institutional Crypto Custody UAE: Additional Considerations

Institutional clients often require sophisticated custody arrangements that accommodate governance, transaction approval, reporting, and risk management.

For example, an institutional investor may require multiple authorised signatories before virtual assets can be transferred.

Custody agreements should clearly establish ownership, withdrawal rights, fees, liability allocation, and procedures for handling operational disruptions.

Staking and Collateral Wallet Services

Custodians proposing to offer staking or collateral wallet services must assess additional VARA requirements.

These services are not automatically permitted under every Custody Services licence.

VARA requires explicit authorisation for Staking from Custody Services and Collateral Wallet Services, together with compliance with the applicable supplementary rules.

Frequently Asked Questions

1. Who regulates crypto custody in Dubai?

VARA regulates virtual asset Custody Services in Dubai, excluding DIFC. Custody activities in DIFC are subject to the DFSA's applicable regulatory framework.

2. What is the minimum capital for a crypto custody license?

VARA requires the higher of AED 600,000 or 25% of fixed annual overheads as paid-up capital for Custody Services.

3. Can a crypto exchange provide custody under the same company?

VARA generally requires a custody provider to operate as a separate legal entity from group businesses providing other virtual asset activities. Limited exceptions apply to permitted Transfer and Settlement Services.

4. Are omnibus wallets permitted for VARA-licensed custodians?

VARA's standalone Custody Services framework requires separate wallets for each client's virtual assets. A proposed omnibus custody model must therefore be assessed carefully and should not be assumed to satisfy the licensing requirements.

5. Can a licensed custodian offer staking services?

Yes, but only where VARA has explicitly authorised Staking from Custody Services and included the permission in the custodian's licence.