VASP License in UAE & Dubai — Done Right

A Virtual Asset Service Provider (VASP) License in the UAE is a mandatory regulatory permit that authorizes companies to legally provide virtual asset services — including cryptocurrency exchange operations, custody, brokerage, lending, advisory, and token issuance. Under UAE law (Cabinet Resolution No. 111 of 2022 and emirate-level laws), any entity offering, facilitating, or enabling virtual asset services within or from the UAE must be licensed by the appropriate authority before commencing operations. This applies equally to UAE-based businesses and foreign firms marketing or delivering services to UAE customers. Operating without a valid VASP license is a serious regulatory offense carrying fines of up to AED 10 million and criminal prosecution.

In Dubai, the Virtual Assets Regulatory Authority (VARA) issues the VASP License for all virtual asset activities within the Emirate of Dubai (excluding the DIFC). VARA was established under Dubai Law No. 4 of 2022 and is the world's first independent regulatory authority dedicated exclusively to virtual assets. What makes VARA exceptional is its comprehensive, bespoke regulatory framework — covering 8 distinct virtual asset activity categories with dedicated rulebooks for each — combined with a practical, business-friendly approach that has attracted global leaders including Binance, OKX, Bybit, and Crypto.com. VARA's licensing is increasingly recognized globally as a gold standard for crypto regulation, giving VARA-licensed VASPs significant market credibility.

The VARA VASP licensing process has two formal stages. Stage 1 (Approval to Incorporate): Submit an Initial Disclosure Questionnaire (IDQ) to Dubai Economy & Tourism (DET) or your preferred Dubai free zone authority, providing a business plan and beneficial owner/management details. Pay approximately 50% of the license application fee to commence VARA's review. Upon approval, receive an Approval to Incorporate (ATI) — this allows you to finalize your company's legal incorporation, set up an office, and onboard key personnel. Note: at this stage, you are not yet permitted to carry out virtual asset activities. Stage 2 (Full VASP License): Prepare and submit comprehensive documentation covering all applicable VARA rulebooks — Company, Compliance & Risk Management, Technology & Information, Market Conduct, and relevant activity-specific rulebooks. VARA reviews, may issue information requests, and upon final approval issues the full VASP License, authorizing you to begin operations. Total timeline: typically 6–12 months for well-prepared applications.

Timeline varies significantly by regulator and application quality. For a VARA VASP License in Dubai, well-prepared applications with complete documentation typically take 6 to 12 months from initial IDQ submission to license issuance. Incomplete or complex applications can extend this timeline. For ADGM FSRA licensing in Abu Dhabi, the timeline is 12 to 24 months due to the more intensive engagement process. For CMA (federal UAE) licensing, timelines vary based on the activity category under the 2026 regulatory framework. The single biggest factor affecting timeline is documentation quality — applications with comprehensive, regulator-ready documents from day one move significantly faster. Finjuris's preparation methodology is specifically designed to minimize regulatory queries and compress timelines.

Under VARA's framework, the minimum paid-up capital starts at AED 100,000 (approximately USD 27,000) at the ATI/incorporation stage. Once the full VASP License application is made, capital requirements rise to a minimum of AED 500,000 (approximately USD 135,000), increasing further depending on the virtual asset activities being licensed. Exchange, custody, and lending operations carry significantly higher thresholds. VASPs licensed for multiple activities must maintain the designated paid-up capital for each authorized activity simultaneously. Annual supervision fees are also payable to maintain the license. ADGM FSRA and DIFC DFSA carry their own capital requirements, generally higher for institutional-grade services. Finjuris provides a precise capital planning analysis before application to prevent costly surprises.

Yes — there are no nationality restrictions for VASP license applicants in the UAE. Foreign founders, shareholders, and companies are welcome to apply under all UAE licensing regimes. However, strict local substance requirements apply regardless of the applicant's origin. Specifically, you must establish a UAE legal entity (VARA applications can be through a Dubai free zone or mainland company), maintain a genuine physical office in Dubai, appoint a minimum of two UAE-resident or UAE-citizen Responsible Individuals (RIs) who are approved by the relevant regulator, and appoint a UAE-based Compliance Officer and MLRO. Regulators verify that the business is genuinely managed and operated from the UAE — not remotely managed from another country. Finjuris specializes in guiding international founders through this substance establishment process efficiently.

Each UAE VASP regulator covers a distinct geographical and legal scope. VARA licenses VASPs in the Emirate of Dubai (excluding DIFC), covering mainland Dubai and all non-DIFC Dubai free zones (DWTC, DMCC, etc.) — ideal for most crypto exchanges, brokers, custodians, and lenders. The Capital Markets Authority (CMA, formerly SCA) regulates VASPs at the federal level for mainland UAE operations outside of financial free zones. Its 2026 framework introduces eight modular licensed activities with heightened governance requirements. ADGM's FSRA (Abu Dhabi Global Market) regulates VASPs within the ADGM free zone under an English common law framework — best for institutional firms, large exchanges, and international players seeking a globally recognized regulatory environment. DFSA (DIFC, Dubai) regulates VASPs within the Dubai International Financial Centre under its own independent framework, favored by global financial institutions with established DIFC presence. Choosing incorrectly wastes significant time and money — Finjuris performs a detailed jurisdiction mapping before any application begins.

All UAE-licensed VASPs must comply with a comprehensive anti-money laundering and counter-terrorist financing framework. This includes: compliance with Federal Decree-Law No. 10 of 2025 and its executive regulations; adherence to FATF recommendations for virtual asset activities; a formal AML/CFT Policy Manual covering Know Your Customer (KYC), Customer Due Diligence (CDD), and Enhanced Due Diligence (EDD) procedures; real-time transaction monitoring systems capable of generating Suspicious Activity Reports (SARs); registration on the UAE's goAML portal; appointment of a qualified and UAE-approved MLRO (Money Laundering Reporting Officer); periodic independent AML audits; and Politically Exposed Person (PEP) screening. VARA, CMA, ADGM, and DFSA each impose additional, jurisdiction-specific compliance obligations layered on top of federal AML requirements. Finjuris builds and implements complete AML/CFT frameworks that satisfy all applicable regulator standards.

Dubai offers a highly advantageous tax environment for licensed VASPs. Companies incorporated in Dubai free zones (where VARA licenses can be held) benefit from 0% corporate income tax — compared to the 9% rate applicable on the mainland. There is no personal income tax in the UAE, no tax on dividends, and no capital gains tax. The UAE has an extensive network of Double Tax Agreements (DTAs) with over 100 countries, reducing withholding taxes on cross-border transactions and simplifying international operations. Dubai also permits full repatriation of profits and capital without restrictions — a critical advantage for international crypto businesses. It is important to note that even free zone companies must maintain tax compliance obligations under applicable international standards, including FATCA and CRS reporting.

Operating as a VASP in the UAE or Dubai without the required license is a serious regulatory violation with severe consequences. Under VARA's enforcement framework, penalties include fines of up to AED 10 million, criminal prosecution of directors and key personnel, mandatory cessation of business operations, and permanent prohibition from obtaining a future VASP license in Dubai. Unauthorized marketing of virtual asset services in the UAE — including digital marketing targeting UAE residents — is also expressly prohibited and subject to enforcement action regardless of whether the operator is based in the UAE or overseas. VARA, CMA, and other regulators actively monitor and enforce against unlicensed operations. Finjuris strongly recommends that any business with UAE virtual asset exposure obtain a proper VASP license before commencing operations or marketing activities.