VARA License for Management & Investment Services: Everything You Need to Know

VARA License for Management & Investment Services in Dubai explained — scope, rules, eligibility & step-by-step process for 2025.

Finjuris

Sep 4, 2025 - 17:32

0 5

Over the last few years, Dubai has moved decisively to become one of the world’s most sophisticated jurisdictions for regulated digital-asset activity. Rather than letting crypto markets operate in a legal grey zone, the Emirate created a dedicated regulator—the Virtual Assets Regulatory Authority (VARA)—with a single mandate: build a clear, activity-based framework that protects investors and promotes responsible innovation across the virtual-asset lifecycle. VARA oversees virtual-asset service providers (VASPs) across Dubai’s mainland and free zones, with the single carve-out of the DIFC (which is regulated by the DFSA).

Crucially, VARA’s rulebooks are not static. The regulator issued its core Virtual Assets and Related Activities Regulations 2023 and has continued to refine and tighten standards, with updated rulebooks that took effect on June 19, 2025—a sign that this regime is alive to market risks and international standards.

If your business model involves managing client crypto portfolios, running pooled strategies, offering staking on behalf of clients, or giving personalized investment recommendations, your pathway to operate legally “in or from Dubai” is the VARA License for Management & Investment Services—often accompanied by other activity licenses (for example, Advisory Services) depending on what you do. This guide explains what that license covers, who needs it, why it matters in 2025, and how to obtain it—step by step.

What is the VARA License for Management & Investment Services?

Definition and scope

Under VARA’s Regulations, “VA Management and Investment Services” means acting on behalf of a client as agent, fiduciary, or otherwise taking responsibility for the management, administration, or disposition of that client’s virtual assets. The rule explicitly cites examples that include investment management (i.e., portfolio or fund management) and taking responsibility for staking virtual assets in proof-of-stake networks on a client’s behalf.

The dedicated VA Management & Investment Services Rulebook sits on top of the general VARA framework and sets granular requirements for client suitability, staff competency, impermissible activities (e.g., rehypothecation without explicit consent), client reporting and valuation, fees and charges, marketing, management practices, order handling, risk management, and client agreements.

Types of activities covered

Portfolio/fund management of clients’ virtual assets (discretionary or according to an agreed strategy).
Staking on behalf of clients, where you take responsibility for locking, delegating, or otherwise using client tokens to participate in a network’s consensus and generate protocol rewards.
Administration/disposition of client virtual assets in line with client instructions and documented mandates (with clear limits around use, segregation, and reporting).

What about “investment advice”?

Personalized investment recommendations are recognized separately as “Advisory Services” under VARA’s Schedule 1 and have their own rulebook. Many managers apply for both “Management & Investment Services” and “Advisory Services,” because running money often goes hand-in-hand with tailored recommendations and research. If you’ll give personal recommendations, plan to include Advisory Services in your application.

Who needs this license

Any entity in or from Dubai (outside DIFC) that manages client virtual assets, administers pooled investment structures holding virtual assets, or takes responsibility for client staking will require the VARA license for Management & Investment Services—and, where relevant, additional activity authorizations such as Advisory Services or Custody Services (for example, if you stake “from custody”).

Why the VARA License is Essential in 2025

a) Legal compliance and market access

VARA has been clear since the 2023 Regulations: carrying on VA activities “in or from Dubai” requires a VARA license (excluding DIFC, which is separately regulated). Operating without the proper authorization risks enforcement and shuts you out of partnerships with reputable counterparties. The licensing architecture is activity-based, so you apply for exactly the activities you’ll perform.

b) Enhancing investor trust and transparency

The updated rulebooks effective June 19, 2025 raise the bar on client reporting, independent valuation, conflicts management, and public disclosures—all central to how a professional manager earns trust. VARA’s Management & Investment Services Rulebook, for example, requires monthly statements to clients and ongoing independent valuation of assets under management.

At the framework level, the Compliance & Risk Management Rulebook embeds modern AML/CFT controls, including client due diligence, suspicious-transaction monitoring, sanctions compliance, and the FATF Travel Rule, reinforcing transparency end-to-end.

c) Supporting Dubai’s virtual-asset ecosystem

Dubai’s Marketing Regulations (2024) apply to any marketing “in or targeting the UAE,” ensuring fairness and accountability for promotions, influencers, and events—another pillar of market credibility as managers attract capital. VARA explicitly links this regime to its mandate to promote Dubai as a regional and international hub for virtual assets.

Finally, VARA cooperates with the UAE’s federal Securities and Commodities Authority (SCA) to align oversight and licensing processes for virtual-asset activities—coordination that strengthens the overall ecosystem.

Activities Covered Under This License

Below are the core activities that fall under VA Management & Investment Services, and how VARA expects them to be run:

a) Managing client virtual-asset portfolios

Discretionary or mandate-based management: You act with authority to manage, allocate, and rebalance client VAs, but only within the scope of valid client authorization and documented agreements. Rehypothecation is prohibited unless you have explicit client consent.
Client reporting & valuation: Managers must provide at least monthly statements showing holdings, transactions, and valuation changes—and implement independent, well-documented valuation policies.
Best-interest duty and order handling: You must act in clients’ best interests, disclose any routing benefits, and avoid misuse of client information.

b) Administering pooled investment funds

If you operate pooled structures (for example, a token strategy fund or a special-purpose vehicle pooling client VAs), your activity is captured by “managing virtual assets” on behalf of clients. You must evidence policies, risk controls, valuation, fee transparency, client agreements, and disclosures aligned with VARA’s rulebooks. (If you also custody client VAs for the pool, you will need the Custody activity approval and to comply with its rulebook.)

c) Providing staking services on behalf of clients

Staking is explicitly called out in the definition of VA Management & Investment Services (“taking responsibility for staking”). If staking occurs from custody, additional Custody Rulebook requirements apply (e.g., “Staking from Custody Services” controls). In all cases, client consent, risk disclosures, and clear revenue-share mechanics must be embedded in client agreements and marketing must not over-promise rewards.

d) Offering investment advice in virtual assets

When you make personalized recommendations (on request or on your initiative), that activity is “Advisory Services” under VARA’s framework and requires its own authorization. Managers commonly apply for both licenses (Management & Investment + Advisory) so they can lawfully combine discretionary management with tailored recommendations and research.

Eligibility Criteria

A strong VARA license application for management & investment services demonstrates that you’re fit and proper, technically competent, financially sound, and operationally ready to protect clients’ assets. Expect VARA to examine the following themes across the relevant rulebooks.

a) Business registration requirements

Incorporation in Dubai (mainland via the Department of Economy & Tourism, or a Dubai free zone—excluding DIFC) is part of the two-stage process. You’ll first obtain Approval to Incorporate (ATI) based on an Initial Disclosure Questionnaire (IDQ) and initial documentation. Only after ATI do you submit your full VASP license application.
Applications are activity-based—you must select the set of VARA activities you intend to perform (e.g., VA Management & Investment Services, and Advisory Services if applicable).

b) Management and staff qualifications (“fit and proper” + competency)

Fit & Proper: VARA assesses the firm’s controllers and key individuals against qualifications, industry and management experience, solvency, integrity and reputation, and ongoing obligations.
Staff competency (activity-specific): For Management & Investment Services, the rulebook requires that staff understand the VARA framework and have relevant professional/industry experience and training suitable for their roles.

c) Minimum compliance standards (AML/KYC and client safeguarding)

AML/CFT: The Compliance & Risk Management Rulebook requires policies & procedures, MLRO appointment, risk assessments, client due diligence, ongoing monitoring, suspicious activity reporting, sanctions screening, and compliance with the FATF Travel Rule.
Client money & client VAs: VARA prescribes rules for treatment of client money, treatment of client virtual assets, proof of reserves, and reconciliation obligations.
Market conduct & investor classification: You must classify investors appropriately, have robust client agreements, keep complaints-handling in order, and disclose risks and your license status publicly.

d) Operational readiness and risk frameworks

Technology & security: VARA’s Technology & Information Rulebook requires a technology governance and risk assessment framework, cybersecurity policies, wallet/keys management, business continuity, and incident reporting protocols; it also touches data-protection and confidentiality obligations.
Capital & prudential resources: The Company Rulebook sets Paid-Up Capital, net liquid assets, insurance, and (where applicable) reserve-asset requirements, plus wind-down planning. (Capital levels vary by activity and business model; VARA points applicants to Part VI – Capital and Prudential Requirements.)
Policies, disclosures & management practices (activity-specific): For managers, the rulebook mandates written policies on client access to assets (including during market stress), suitability, conflicts and disclosures, fees, valuation, and order transmission, and requires best-interest management practices.

Step-by-Step Process to Obtain the License

VARA runs a two-stage process for new firms seeking a VASP License. Here’s how it maps out specifically for a VARA license for management services/investment services (and any complementary activities you need, such as Advisory Services):

Step 1 — Company incorporation in Dubai (mainland or free zone)

Choose your commercial licensor:

Mainland: Apply via the Dubai Department of Economy & Tourism (DET).
Free zone: Apply via your chosen Dubai free zone (e.g., DMCC, DSO, etc.).
(DIFC is outside VARA’s remit.)

Submit the Initial Disclosure Questionnaire (IDQ) to DET or the relevant free zone. Be prepared to describe your business, beneficial owners, and senior management, and to pay initial fees (typically 50% of license fee).
Approval to Incorporate (ATI): Upon a positive first-stage review, VARA issues ATI, permitting you to set up the legal entity (rent office, onboard staff, implement systems). You still cannot carry on VA activities at this point.

Step 2 — Prepare and submit the full VASP application

Compile your full application package in line with VARA’s guidance following ATI. Expect to include (non-exhaustive):

Corporate structure & governance (incorporation certificate, UBOs, org chart, Board/SM roles, governance frameworks).
Fit & Proper confirmations, source of funds evidence.
Regulatory business plan, financial projections, financial statements.
Proof of paid-up capital and other prudential items (e.g., insurance, reserve asset approach where applicable).
Key personnel details (CVs, passports, job descriptions).
Risk & compliance frameworks (AML/CFT program, MLRO appointment; client money / client VA controls; proof-of-reserves approach; reconciliation).
Technology & security documentation (governance, cybersecurity, keys/wallets management, BCP/incident response).
Client-facing documents (client agreements, investor classification, risk disclosures, complaint handling), and marketing governance (to comply with the 2024 Marketing Regulations).

Engage with VARA during review—expect feedback, meetings, interviews, and requests for further documentation.
Pay remaining license application fees and first-year supervision fees, then receive the VASP License (sometimes with operational conditions you must satisfy before go-live). Fee schedules and supervision fees are set out in the Regulations’ annexes.

Practical Compliance Notes for Managers (What VARA Will Look For)

Clear scope mapping: Your submission should map each planned activity (e.g., VA Management & Investment Services, Advisory Services, Custody if relevant) to the rulebooks you’ll comply with—Company, Compliance & Risk Management, Technology & Information, Market Conduct, plus activity-specific rulebooks.
Suitability & investor classification: Show how you’ll assess knowledge/experience, objectives, risk tolerance, and financial circumstances; and how you’ll classify investors and tailor protections accordingly.
Client asset protection: Evidence segregation, no rehypothecation without explicit consent, reconciliation, proof of reserves, and independent valuation.
Staking governance: If you stake on clients’ behalf, your client agreements must capture consent, rewards mechanics, risks, withdrawal rights, termination, and treatment under stress. Marketing must be fair, clear, not misleading, and must not suggest rewards you can’t directly attribute to protocol staking.
Technology & cybersecurity: Demonstrate a risk-based wallet/keys program, change management, monitoring, penetration testing/audit, incident response, and CISO accountability aligned to the Technology & Information Rulebook.
Public disclosures: Post prominent disclosures around conflicts, client access to assets (including during volatility), custody arrangements, and counterparty risk—as required in the Management & Investment Services Rulebook and Market Conduct Rulebook.

FAQs

Do I need Advisory Services if I only execute a mandate?
If your service includes personal recommendations, yes—add Advisory Services. Purely discretionary mandate execution without personal recommendations may remain within Management & Investment Services, but many managers still apply for both to avoid scope creep.

Can I market my strategies to prospects in Dubai while I’m applying?
Marketing of VA activities in or targeting the UAE must comply with Marketing Regulations 2024. In general, marketing may only be carried out by (or on behalf of) a licensed VASP for the relevant activity. Plan your marketing calendar accordingly.

What if I’m based outside Dubai but want UAE clients?
If you market into the UAE or carry on VA activities in or from Dubai, VARA’s regime will likely apply. You may also face federal SCA touchpoints depending on your structure. Coordinate early on cross-border questions.

We operate inside DIFC—does VARA apply?
No. DIFC is a separate jurisdiction regulated by the DFSA. VARA covers all of Dubai outside DIFC.

Where can I see the latest rule changes?
VARA’s online rulebooks display effective versions (the latest major update took effect June 19, 2025). Always cite the current version for your policies and procedures.

Executive Checklist

Scope your activities precisely (Management & Investment Services, plus Advisory, Custody, etc.). Map each to the right rulebooks.
Choose your licensor (DET mainland vs free zone) and submit the IDQ to kick off Stage 1.
Build the entity post-ATI: office, hiring, governance, policies, tech stack, and controls—you still can’t operate yet.
Prepare the full application: governance/UBO/fit-and-proper, AML/CFT, client asset & valuation controls, tech/cyber, client docs, and marketing compliance; ensure capital and insurance meet Part VI standards.
Engage with VARA during review; address feedback and conditions; pay fees; receive your VASP License with the authorized activities listed.

Final Thoughts

For firms eyeing the Middle East, a VARA license for management & investment services offers a clear, internationally recognizable path to run regulated crypto-asset strategies from Dubai. The bar is high-monthly client reporting, independent valuations, proof-of-reserves discipline, investor classification, AML/CFT rigor, and robust tech & wallet controls. but that’s precisely the point. The 2025 rulebook updates sharpen expectations and, in doing so, increase institutional comfort with Dubai-based managers. If you’re serious about building a durable business in digital assets, structuring your operating model to the VARA rulebooks is how you earn and keep access to this market.