Where you operate decides it. Dubai's Virtual Assets Regulatory Authority (VARA) licenses firms in the mainland and free zones, except the DIFC, where the DFSA regulates. In Abu Dhabi Global Market you need a Financial Services Permission from the FSRA. From another emirate, outside ADGM, you need an SCA licence. A VARA licensee can be registered by default with the SCA to serve the wider UAE.
What a regulator is paid before launch: one VARA case, one ADGM case
Choosing between VARA and ADGM means choosing a regulator, and three more authorities sit in the picture. New to the question? Start with licence selection, or compare regions on jurisdictions.
Key takeaways
- VARA requires two full-time Responsible Individuals who are UAE residents or passport holders, and custody must sit in a separate legal entity.
- VARA charges per activity: an exchange pays AED 100,000 to apply and AED 200,000 a year in supervision.
- The Central Bank law's one-year reconciliation period runs to 16 September 2026, unless the Central Bank's Board extends it.
Who issues a crypto licence in the UAE?
No single UAE authority issues crypto licences. The regulator follows where you operate:
Who issues a UAE crypto licence, by where you operate
| Where you operate | Regulator | What you apply for |
|---|---|---|
| Dubai mainland and free zones, excluding DIFC | VARA (Dubai Law No. 4 of 2022) | VASP licence, activity by activity |
| Dubai International Financial Centre | DFSA | Authorisation for crypto-token financial services |
| Abu Dhabi Global Market | FSRA | Financial Services Permission (FSP) |
| Any other emirate, outside ADGM | SCA | SCA licence |
| Payment services using virtual assets, outside the financial free zones | Central Bank of the UAE | Central Bank licence |
The DIFC is a purpose-built financial free zone (DFSA) and ADGM was established by federal decree as one (ADGM), so "a Dubai licence" can mean VARA's or the DFSA's.
Does a VARA licence passport across the UAE, or the Gulf?
A VARA licence reaches the rest of the UAE through registration, not on its own. Under the agreement the SCA and VARA announced on 5 September 2024, firms operating in or from Dubai need a VARA licence and can be registered by default with the SCA to serve the wider UAE. Helal Saeed Al Marri, Chairman of VARA's Executive Board, put it this way (SCA release):
The strength of our collaboration with federal partners like SCA, allows for seamless and efficient passportability of regulated services, while assuring uncompromised market risk assurance across the UAE.
Nothing in the SCA's announcement extends that passport to another Gulf state. And VARA licenses by where you operate: serving only global customers from Dubai still needs a licence.
What does VARA license, and what must sit in a separate company?
VARA licenses eight activities: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and Category 1 VA issuance. Two arrangements cannot live inside the licensed company: a custodian must be a distinct legal entity with a standalone licence, and proprietary trading needs a separate company. How the same model maps elsewhere: which licence a crypto exchange needs.
How does a VARA application run?
A new firm goes through two stages: an Approval to Incorporate (ATI) to set up the entity and operations, then the VASP licence application. Filing goes through Dubai Economy and Tourism for mainland firms, or a Dubai free zone other than the DIFC.
File and pay the first instalment
Typically 50% of the licence application fee (VARA).
Set up under the ATI
Incorporate and build the operation; no activity yet.
Apply for the licence
Meet the four compulsory rulebooks (Company; Compliance and Risk Management; Technology and Information; Market Conduct) plus each activity's rulebook, then pay the balance and the first year's supervision fees.
Hold and renew
The licence is annual; each renewal runs 12 months. VARA may refuse a firm that falls outside its perimeter or below its standards.
VARA's FAQ requires two Responsible Individuals, each full-time, fit and proper, and a UAE resident or UAE passport holder. Any nationality may apply; sole proprietorships are refused. Every activity except advisory needs a private office in Dubai. Compare substance rules in local substance requirements.
What do VARA and ADGM charge, and how much capital?
Both charge by activity, and the FSRA adds a single virtual asset "add on" fee on top of all the activity fees. VARA's capital rules sit in its Company Rulebook; its fees come from Schedule 2 of its regulations:
VARA fees, charged per activity
| VARA activity | Application fee | Annual supervision fee |
|---|---|---|
| Exchange, broker-dealer or custody (each) | AED 100,000 | AED 200,000 |
| Advisory, or transfer and settlement (each) | AED 40,000 | AED 80,000 |
| Each additional activity | Extension fee: 50% of the lower application fee | Charged per activity |
So an exchange-only applicant pays VARA AED 300,000 before it can start: AED 100,000 to apply plus the first year's AED 200,000 supervision. Adding broker-dealer costs an AED 50,000 extension fee and AED 200,000 more a year. Under Schedule 2 these are separate from other authorities' fees, and VARA may adjust them by risk profile.
In the FSRA's guidance, a firm dealing as unmatched principal and arranging deals pays USD 40k + USD 10k + a USD 20k add-on, totalling USD 70k, to apply, then USD 75k a year. Custody capital is the higher of $250,000 or six months of audited expenditure; a multilateral trading facility holds six months of operating expenses plus, unless the FSRA directs otherwise, a buffer of up to six more, all in fiat. Terms: glossary.
When is ADGM the better fit?
ADGM suits firms that want an institutional-grade permission and can put real people in Abu Dhabi. The FSRA expects a firm's mind and management to sit within ADGM, with substantive resources there.
- Accepted assets only. Each virtual asset is assessed by the firm and notified to the FSRA at least five business days before use; privacy tokens and algorithmic stablecoins are prohibited (ADGM).
- Five stages. Discussions, formal application, in-principle approval (IPA), final approval, then operational launch testing, with technology demonstrations before filing, generally in person.
- Banks. The FSRA intends banks open to virtual asset firms to take comfort from its oversight and an IPA. See banking for licensed crypto businesses.
Do stablecoin payment services need a Central Bank licence?
Outside the financial free zones, they do. Federal Decree-Law No. 6 of 2025, in force since 16 September 2025, makes "providing payment services using Virtual Assets" a licensed activity; Article 184 gives everyone subject to it one year to comply, extendable by the Central Bank's Board.
- Reach. Article 62 of the decree-law reaches anyone facilitating a licensed financial activity, whatever the technology, including platforms, dApps and protocols.
- Limits. Article 2 excludes the financial free zones and the institutions their authorities regulate. Ashurst reads it as leaving out virtual assets held for investment, exchanged for another virtual asset or swapped for trading.
- Stablecoins. Under the Payment Token Services Regulation, in force since 31 August 2024, UAE merchants may accept a licensed dirham payment token, or a registered foreign-currency token only as payment for a virtual asset or derivative. Algorithmic stablecoins and privacy tokens are banned for everyone, SCA- and VARA-licensed firms included.
If your model collects payments, converts stablecoins or runs payment rails, check it against the Central Bank's perimeter by 16 September 2026; see licences for stablecoin payments.
How should you choose?
- Exchange, broker or custodian run from Dubai: VARA, then default SCA registration for the wider UAE.
- Institutional business with its decision-makers in Abu Dhabi: ADGM.
- Company in another emirate, outside ADGM: the SCA.
- Stablecoin payments: the Central Bank rules first.
Abu Dhabi, through ADGM, is on CryptoLicense's coverage list; Dubai and VARA are not, and if your model belongs in Dubai we will say so. No approval can be guaranteed; see what happens after a rejection.
Frequently asked questions
Who issues the VARA crypto licence?
Dubai's Virtual Assets Regulatory Authority (VARA) issues it. Established in March 2022 under Dubai Law No. 4 of 2022, it regulates virtual assets across Dubai and its free zones, except the DIFC. Applications go through DET or a Dubai free zone: first an Approval to Incorporate, then the annual VASP licence.
How can I check whether a firm holds a VARA licence?
Search the register of licensed firms that VARA publishes on its website; VARA's own FAQ points there. A firm holding only an Approval to Incorporate may not yet operate, and firms in the DIFC or ADGM answer to the DFSA or the FSRA instead.
Can I start operating once I have an ATI?
No. VARA states that at the Approval to Incorporate stage a firm is not permitted to carry on virtual asset activities. Activity waits for the full VASP licence.
A final word
Based on documents published by VARA, the SCA, the FSRA, the DFSA and the Central Bank of the UAE as of 11 September 2026; not legal advice. CryptoLicense is the trading name of CL GLOBAL SDN BHD (1421939-T), in business since 2020, with 100+ companies served across 10+ jurisdictions; see entity proof. Every regulator keeps its own discretion.
Part of a series: the full guide is at licence selection.