Since 2010, the Global Law Experts annual awards have been celebrating excellence, innovation and performance across the legal communities from around the world.
posted 4 hours ago
If you are a founder, compliance officer or in-house counsel preparing to obtain a VARA licence Dubai or you already hold an Approval to Incorporate (ATI) and need to convert it into a full VASP licence this page provides the practical, step-by-step guidance you need. It covers every stage of the licensing journey: from the Initial Disclosure Questionnaire (IDQ) through to post-licence compliance obligations, with indicative costs, timelines and a downloadable application checklist mapped to each phase.
Whether you are launching an exchange, a custody platform, a broker-dealer or a lending protocol, the information below draws directly from VARA’s published rulebooks and official guidance to give you a realistic, commercially grounded roadmap. Download the VARA Application Checklist to track your documentation across IDQ, ATI and full submission milestones.
At a glance: indicative capital floors range from AED 200,000 (advisory/issuance) to AED 10,000,000+ (exchange services), and a typical ATI-to-full-licence timeline runs between three and eight months depending on activity type and application quality.
Dubai’s Virtual Assets Regulatory Authority (VARA) is the dedicated regulator established under Law No. (4) of 2022 Regulating Virtual Assets. VARA exercises jurisdiction over all virtual-asset activities conducted in or from the Emirate of Dubai, with the sole exception of the Dubai International Financial Centre (DIFC), which is supervised by its own regulator (DFSA). Any entity that wishes to provide virtual-asset services within this perimeter must first receive VARA’s approval operating without a licence is a regulatory offence.
VARA maintains a modular rulebook framework the Virtual Assets and Related Activities Regulations 2023 supplemented by activity-specific rulebooks for exchanges, custody, lending, issuance and more. Together, these set out the capital, governance, technology and AML requirements that every applicant must satisfy.
The business case for obtaining a VARA licence extends well beyond regulatory compliance. Licensed VASPs gain access to Dubai’s banking infrastructure, can establish formal custody and settlement relationships, and benefit from the supervisory credibility that institutional counterparties and sophisticated retail users now expect. VARA’s Public Register which lists entities with In-Principle Approvals (IPAs) and full VASP licences has become a de facto verification tool for the market.
The licensing pathway is structured in two stages: first, an IDQ submission leading to an In-Principle Approval or Approval to Incorporate (ATI); second, an operational build-out phase culminating in the conversion of that ATI into a full VASP licence. Understanding what each stage requires and how long it realistically takes is essential to planning capital, headcount and launch timelines.
VARA’s regulatory framework covers a defined set of Virtual Asset Activities set out in Schedule 1 of the VA Regulations, each governed by its own activity-specific rulebook. Applicants may apply for one or more activity permissions, all held under a single VASP licence. The principal categories are:
Importantly, a single VASP may hold permissions across multiple activity categories for example, an exchange that also offers custody and staking provided it meets the requirements for each activity independently.
The VARA licence application follows a clearly staged pathway. VARA’s official licensing page describes a structured sequence: pre-assessment, IDQ submission, In-Principle Approval (IPA) or Approval to Incorporate (ATI), operational build-out, and final conversion to a full VASP licence. Each stage has distinct deliverables and evidence requirements.
Before engaging with VARA, applicants should determine their preferred entity type (Dubai mainland LLC or qualifying free-zone company), map their proposed business model to one or more VA activity codes in Schedule 1, and conduct preliminary legal and tax checks including any implications arising from UAE corporate-tax obligations. This preparatory phase typically takes two to four weeks and reduces the risk of structural rework later in the process.
The IDQ is the applicant’s first substantive submission to VARA. It requires detailed, candid disclosures across several domains: corporate structure and ownership, proposed VA activities, technology architecture, AML/KYC controls, governance arrangements (including board composition and an organisational chart), and financial projections. Common pitfalls include vague descriptions of the business model, incomplete beneficial-ownership structures, and generic AML policies that do not reflect the applicant’s specific risk profile. The IDQ should be treated as a regulatory interview in documentary form examiners will follow up on inconsistencies. Preparing supporting evidence (tech-architecture diagrams, draft AML policies, CVs of key personnel) at this stage accelerates the review considerably. For applicants preparing their first IDQ submission, a practical IDQ answers guide can highlight common traps and examiner queries.
If VARA is satisfied with the IDQ and any supplementary information requests, it issues an In-Principle Approval (IPA), also referred to as an Approval to Incorporate (ATI). The ATI is not a licence to operate it is conditional approval that authorises the applicant to incorporate a legal entity in Dubai, open bank accounts, lease office space, and begin hiring. The ATI letter will typically set out specific conditions that must be met before a full licence can be granted: these commonly include depositing the required regulatory capital, appointing a Money Laundering Reporting Officer (MLRO), completing independent technology audits, and finalising custodian or insurance arrangements. Applicants should plan for the ATI decision to take eight to sixteen weeks from IDQ submission, depending on the complexity of the application and the quality of the initial submission.
With ATI in hand, the applicant enters the operational build-out phase. This involves establishing a physical office in Dubai, deploying and testing technology infrastructure, onboarding AML/KYC vendors and transaction-monitoring systems, securing bank custody or settlement accounts, and engaging an independent auditor for the technology and security assessment VARA requires. This phase is often the longest, typically spanning twelve to twenty-eight weeks, with bank onboarding and technology audits being the most common sources of delay.
Once all ATI conditions are satisfied, the applicant prepares a final evidence package for VARA. This includes proof of capital deposit and segregation, completed independent audit reports (technology and, where applicable, financial), executed custody and insurance agreements, and evidence that all governance and compliance functions are operational. VARA reviews the package, may conduct an on-site inspection or request supplementary evidence, and if satisfied issues the full VASP licence. The applicant’s details are then added to the Public Register.
Receiving a full VARA licence is the start of an ongoing supervisory relationship, not the end of the regulatory journey. VASPs must comply with periodic reporting obligations, submit to annual audits, maintain capital adequacy at all times, and promptly notify VARA of any material changes to their business model, governance or technology architecture.
The table below provides indicative ranges for the principal cost and timeline variables across five common activity types. These figures are based on market experience and publicly available VARA fee communications; they should be used as planning estimates, not as definitive regulatory quotations. Actual figures depend on the applicant’s specific business model, activity scope and risk profile.
| Activity | Indicative Capital Floor (AED) | VARA Application Fee (Indicative AED) | Annual Supervision Fee (Indicative AED) | ATI → Full Licence Timeline |
|---|---|---|---|---|
| Exchange Services | 3,000,000 – 10,000,000 | 50,000 – 150,000 | 150,000 – 400,000 | 4–8 months |
| Broker-Dealer Services | 500,000 – 3,000,000 | 40,000 – 100,000 | 80,000 – 200,000 | 3–6 months |
| Custody Services | 1,000,000 – 5,000,000 | 50,000 – 120,000 | 100,000 – 300,000 | 4–7 months |
| Lending & Borrowing | 500,000 – 3,000,000 | 40,000 – 100,000 | 80,000 – 250,000 | 3–6 months |
| VA Issuance / Advisory | 200,000 – 1,000,000 | 25,000 – 75,000 | 40,000 – 120,000 | 2–5 months |
Important: these ranges cover VARA’s direct regulatory fees only. Applicants should budget separately for incorporation and local-licence costs, legal and compliance advisory fees, independent technology and security audits, office establishment, staffing (including the MLRO), custody and insurance arrangements, and travel-rule and KYC-vendor subscriptions. In aggregate, these ancillary costs often equal or exceed the regulatory fee component. Industry observers expect VARA to continue publishing periodic fee clarifications as the licensing regime matures.
Applicants must establish or maintain a legal entity registered in Dubai either a mainland LLC or an entity within a qualifying free zone. The ATI stage of the VARA application specifically authorises the applicant to incorporate, meaning that in many cases the entity is formed after (not before) ATI is granted. Law No. (4) of 2022 makes clear that VARA’s jurisdiction covers all Dubai territories except the DIFC. Free-zone entities applying for a VARA licence should verify that their zone’s regulations permit VA activities and that the entity can satisfy VARA’s substance requirements.
VARA places significant weight on the quality of an applicant’s governance framework. The Company Rulebook requires that directors, senior management and key function holders pass fit-and-proper assessments covering competence, integrity, financial soundness and relevant experience. Boards must include members with demonstrable expertise in virtual assets, financial services or technology, and VARA expects a meaningful local management presence in Dubai not a purely nominal directorship. Governance documentation should include detailed CVs, declarations of interests, criminal-record clearances and a clear organisational chart mapping reporting lines from board level through to operational functions including the MLRO and Chief Technology Officer.
Regulatory capital floors are set by the Company Rulebook and supplemented by activity-specific rulebooks. Capital must typically be deposited with a UAE-licensed bank and evidenced by a bank-confirmation letter. The required amount varies by activity type and risk profile as the comparison table above illustrates, exchange operators face substantially higher capital requirements than advisory or issuance applicants. Applicants should also prepare for ongoing capital-adequacy obligations, including maintaining minimum net-liquid-asset ratios throughout the licence term. Detailed capital-requirements modelling is available in our VARA capital requirements deep-dive.
Technology infrastructure is scrutinised closely, particularly for custody and exchange applicants. The Custody Services Rulebook mandates segregated-wallet architectures, formal key-management procedures, disaster-recovery and business-continuity planning, and independent penetration testing. All applicants must demonstrate travel-rule readiness and may need to engage an accredited third-party auditor to certify their technology stack before a full licence is issued.
Robust AML/KYC controls are non-negotiable. VARA’s Regulations require applicants to implement customer due diligence, enhanced due diligence for high-risk clients, ongoing transaction monitoring, suspicious-activity reporting, and comprehensive record-keeping. The MLRO must be appointed before a full licence can be granted, and AML policies must be tailored to the specific VA activities being performed.
Preparing the right documentation at the right stage is one of the most important determinants of application speed. Below is a grouped checklist indicating which items are typically required at each milestone. Download the VARA Application Checklist for a printable version mapped to IDQ, ATI and full-submission phases.
Getting documents right at the IDQ stage significantly reduces the number of supplementary-information requests from VARA and can shorten the overall timeline by several weeks.
Based on market experience, the most frequent reasons for VARA delaying or refusing an ATI or full licence conversion are:
A standard VARA licence application from initial pre-assessment through to receiving a full VASP licence typically spans six to ten months end to end. The following milestones represent a realistic month-by-month overview:
Factors that accelerate the process include a well-prepared IDQ with complete supporting evidence, prior regulatory engagement with VARA, and early appointment of an MLRO and independent auditor. Conversely, bank-onboarding delays, incomplete technology audits and unclear beneficial-ownership structures are the most common sources of timeline slippage.
Understanding the full cost of obtaining a VARA licence Dubai requires looking beyond VARA’s direct regulatory fees. The principal cost categories are:
Three illustrative first-year budget scenarios based on market experience:
These are indicative estimates based on market experience. All applicants should build a contingency buffer of 15–25 per cent above their base-case budget to accommodate VARA supplementary requests, audit re-work and bank-onboarding delays.
Regional broker-dealer IDQ to full licence in five months: A MENA-headquartered brokerage submitted a well-prepared IDQ with complete governance documentation and a tailored AML framework. ATI was granted within ten weeks. The operational build-out, including bank onboarding and technology audit, took a further twelve weeks. Total advisory cost was approximately AED 350,000, with regulatory capital of AED 1,200,000 deposited during the ATI phase.
Digital-asset custodian technology audit as the critical path: A custody start-up with institutional backing received ATI within fourteen weeks but spent an additional sixteen weeks resolving technology-audit findings related to key-management procedures and disaster-recovery documentation. After engaging a specialist security auditor to remediate the findings, the full VASP licence was issued at week thirty. The experience underscores the value of commissioning the technology audit early in the ATI phase rather than waiting for the final-submission stage.
Multi-activity exchange parallel licensing and cost savings: An exchange applicant seeking permissions across exchange, custody and broker-dealer activities consolidated its applications into a single VASP licence. By preparing unified governance and compliance documentation and conducting a single comprehensive technology audit covering all three activities, the applicant reduced total advisory costs by approximately 20 per cent compared to sequential applications.
Receiving a full VARA licence opens the next chapter: ongoing supervisory compliance. VARA’s activity and other rulebooks impose a series of continuing obligations that licensees must embed into their operations from day one:
A structured VARA compliance playbook covering KYC/AML operations, transaction monitoring and regulatory reporting is essential for managing these obligations efficiently. Industry observers expect VARA’s supervisory approach to intensify as the number of licensed entities grows.
The VARA Application Checklist is a structured, printable document designed to accompany you through every stage of the licensing journey. It maps each required document and evidence item to the specific milestone at which VARA expects to receive it IDQ, ATI or full submission and includes practical notes on formatting, common examiner queries and quality-control checkpoints.
The checklist covers five document groups: corporate formation, governance and fit-and-proper evidence, compliance and AML materials, technology and security documentation, and financial proof. Each item is flagged with a priority level (critical, recommended, supporting) and cross-referenced to the relevant VARA rulebook provision. Download the VARA Application Checklist to begin organising your submission immediately.
Global Law Experts connects businesses pursuing a VARA licence Dubai with specialist regulatory advisers who provide hands-on application support at every stage. Services available through the network include IDQ preparation and coaching, ATI-condition satisfaction planning, document drafting (AML policies, governance frameworks, compliance manuals), technology-audit coordination with accredited providers, capital-structuring advice, and direct regulator-liaison support throughout the VARA review process.
With a global network spanning more than 180 jurisdictions and over seventeen years of experience connecting clients with leading legal professionals, Global Law Experts brings both depth and breadth to the VARA application process. For multi-jurisdictional groups requiring parallel crypto licensing in Abu Dhabi (ADGM/FSRA), Singapore or the EU, the network can coordinate advisory teams across regulators to ensure consistency and efficiency.
Whether you are at the pre-assessment stage, managing an active ATI build-out, or converting an existing IPA into a full VASP licence, the right advisory support can materially reduce timeline risk, avoid common rejection triggers, and ensure your application reaches VARA in the strongest possible form.
Find the right Legal Expert for your business
Sign up for the latest advisor briefings and news within Global Advisory Experts’ community, as well as a whole host of features, editorial and conference updates direct to your email inbox.
Naturally you can unsubscribe at any time.
Global Advisory Experts is dedicated to providing exceptional advisory services to clients around the world. With a vast network of highly skilled and experienced advisors, we are committed to delivering innovative and tailored solutions to meet the diverse needs of our clients in various jurisdictions.
