When Does a Spanish Digital-Asset Business Need a VARA Licence in Dubai?

When does a Spanish digital-asset business require a VARA licence?

A VARA licence is typically required where a business intends to carry on a regulated Virtual Asset activity in or from Dubai within VARA's jurisdiction. VARA states that firms must obtain the appropriate authorisation before starting regulated Virtual Asset activities in Dubai, excluding the Dubai International Financial Centre, or DIFC.

This means the nationality of the parent company is not the main licensing test.

A Spanish company could remain completely outside VARA's licensing perimeter if its regulated operations stay in Spain or elsewhere in the EU and it does not conduct relevant activities in or from Dubai. By contrast, the same group could create a Dubai entity and bring itself within the VARA framework through the services that entity performs.

VARA currently identifies eight regulated activity categories:

• Advisory Services
• Broker-Dealer Services
• Custody Services
• Exchange Services
• Lending and Borrowing Services
• Management and Investment Services
• Transfer and Settlement Services
• Category 1 Virtual Asset Issuance

A business can seek authorisation for multiple activities, although specific requirements can apply to particular services, including custody.

For an international crypto group, the licensing question usually starts with the service being performed, the entity performing it and where that activity takes place—not the nationality written on the parent company's incorporation certificate. — Consulting Journal editorial observation

Why does the phrase "in or from Dubai" matter?

The wording matters because a business does not necessarily have to serve only Dubai customers for VARA licensing to become relevant. A regulated activity carried out from a Dubai operation can require authorisation even where the customer base is international.

Consider a Spanish crypto-asset service provider that establishes a Dubai subsidiary and places its advisory, brokerage or exchange team in the Emirate. The business cannot assume that VARA is irrelevant simply because most customers remain in Spain, France or other markets.

VARA's current licensing guidance states that firms seeking to carry on Virtual Asset activities in or from Dubai, excluding DIFC, have a legal obligation to obtain licensing before commencing those operations.

Example 1: A fictional Spanish exchange, Iberia Digital Markets SL, establishes a Dubai free-zone company outside DIFC to operate an exchange serving clients across several countries. The group would need to assess the Dubai entity's proposed Exchange Services against VARA requirements before launching customer operations.

The practical lesson is to perform regulatory mapping before moving staff, technology functions, customer onboarding or revenue-generating operations into Dubai.

Does a MiCA authorisation in Spain replace a VARA licence?

No. MiCA authorisation and VARA authorisation address different regulatory jurisdictions.

Under Article 59 of MiCA, crypto-asset services within the European Union generally need to be provided by an appropriately authorised crypto-asset service provider or another qualifying regulated financial entity permitted under the Regulation.

Spain's transitional arrangements have also ended. The CNMV confirmed that the Spanish MiCA transitional period ended on 30 June 2026 and that, from 1 July 2026, providers operating in Spain need the required authorisation from the CNMV or another competent EU authority, subject to the applicable MiCA framework.

A Spanish CASP expanding into Dubai should therefore treat the two regimes separately.

The group may need to consider:

• the authorised Spanish or EU entity;
• the proposed Dubai legal entity;
• which services each entity performs;
• customer contracting arrangements;
• employees and management responsible for regulated activities;
• custody or control of customer assets;
• technology and operational functions;
• marketing into the UAE; and
• financial, Accounting and compliance arrangements for each jurisdiction.

Having a strong compliance record in Spain can support organisational readiness, but businesses should not present MiCA authorisation as permission to conduct VARA-regulated activities in Dubai.

What if the Spanish company only serves Dubai customers remotely?

Remote access requires a fact-specific assessment rather than a simple rule based on website availability.

There is a meaningful difference between a Spanish platform that happens to be accessible globally and a business that deliberately enters the UAE market through advertising, Dubai-focused sales activity, local representatives, events, customer solicitation or operational functions.

Businesses should consider:

• whether UAE or Dubai customers are actively targeted;
• whether Dubai-specific advertisements are being used;
• whether sales personnel or representatives are based in Dubai;
• whether contracts are entered into through a Dubai entity;
• whether customer assets are handled in Dubai;
• whether the platform presents itself as serving the UAE market; and
• whether any regulated activity is actually conducted in or from Dubai.

Businesses with material Dubai-facing activity should obtain a specific regulatory-perimeter assessment before assuming that an offshore corporate structure avoids VARA requirements.

Can a foreign crypto business market services in Dubai without considering VARA?

Marketing should be assessed separately from the operating licence.

VARA's Marketing Regulations apply to relevant domestic and foreign entities and cover marketing relating to Virtual Assets and Virtual Asset activities in or targeting the UAE. The regulations also state that marketing of regulated VA Activities must generally be carried out by, or on behalf of and approved by, an appropriately VARA-licensed VASP.

This is particularly relevant to Spanish businesses considering Dubai conferences, paid digital advertising, influencer promotions, sponsorships or UAE-focused lead-generation campaigns.

A common mistake is to view marketing as something that can begin first while licensing is considered later. For regulated digital-asset businesses, marketing strategy and regulatory strategy should be reviewed together before market entry.

What changes if the Spanish business establishes a Dubai subsidiary?

Creating a Dubai company and receiving permission to conduct regulated Virtual Asset activities are separate steps.

VARA currently describes a two-stage process for new VASP applicants. The first stage involves an Approval to Incorporate, allowing the applicant to establish the legal entity and complete operational setup. The second stage is the application for the full VASP licence. VARA expressly states that an applicant is not permitted to carry on Virtual Asset activities merely because the Approval to Incorporate has been obtained.

Applications can require substantial preparation around:

• beneficial ownership and corporate structure;
• senior management and key personnel;
• regulatory business plans;
• financial projections;
• paid-up capital;
• governance arrangements;
• risk and compliance;
• source-of-funds evidence;
• insurance;
• succession and wind-down planning; and
• technology and operational controls.

An In-Principle Approval should also not be treated as a launch licence. VARA's public register states that an applicant holding an IPA cannot begin Virtual Asset activities or service clients until the full VASP licence has been obtained.

Example 2: A fictional Barcelona-based custody technology company establishes a Dubai entity and receives preliminary regulatory progress while building its team and systems. It should not onboard custody clients on the assumption that incorporation or an IPA authorises regulated operations. Customer launch dates need to follow the actual permissions granted.

Does VARA regulate digital-asset businesses in DIFC?

VARA does not regulate Virtual Asset activities within DIFC. A business considering DIFC therefore needs a separate assessment under the DIFC and Dubai Financial Services Authority framework.

The DFSA states that firms seeking to carry out Financial Services involving Crypto Tokens in or from DIFC must consider its Crypto Token framework. Updated DFSA Crypto Token rules took effect on 12 January 2026.

For Spanish groups deciding where to establish their Dubai operation, this distinction should be examined before choosing between mainland Dubai, a VARA-covered free zone and DIFC.

The commercial licence location can affect the regulatory analysis, governance structure and type of professional advice required.

Do proprietary trading and token issuance always require a full VASP licence?

Not necessarily. Certain activities can follow a different regulatory pathway, but businesses should not interpret that as an exemption from regulatory supervision.

Current VARA regulations include registration requirements for entities in the Emirate actively investing their own portfolio in Virtual Assets at or above USD 250 million equivalent during a rolling 30-calendar-day period. VARA guidance also addresses No Objection requirements for proprietary trading.

Token issuance also requires classification. Category 1 VA Issuance appears among VARA's licensed activities, while Category 2 issuance is addressed through a separate approval framework. Businesses must also consider whether related functions—such as custody, arranging transactions, advisory services or exchange services—create additional regulatory obligations.

Classification should come before the licensing conclusion.

What common mistakes do business owners make?

Cross-border expansion can become difficult when corporate formation moves ahead of regulatory planning.

Common mistakes include:

• assuming a Spanish or MiCA authorisation automatically covers Dubai;
• choosing a Dubai entity or free zone before mapping regulated activities;
• treating incorporation as permission to begin crypto operations;
• launching UAE marketing before reviewing VARA marketing requirements;
• focusing only on where customers are located instead of where services are performed;
• using broad descriptions such as "Web3 company" without analysing individual functions;
• assuming proprietary trading or token issuance is outside regulatory oversight;
• starting customer onboarding after an IPA rather than a full operational licence; and
• leaving Financial, Accounting, Tax, banking and governance preparation until late in the licensing process.

What documents and preparation should management organise?

Before approaching a Dubai market entry, management should build a clear internal file covering both the Spanish group and the planned UAE operation.

A practical preparation checklist includes:

• Spanish company incorporation and ownership records;
• details of existing MiCA or other regulatory permissions;
• group and beneficial ownership structure;
• description of every Virtual Asset service offered;
• proposed Dubai legal entity and jurisdiction;
• regulatory business plan;
• customer and target-market description;
• management and key-person CVs;
• source-of-funds documentation;
• historical Financial statements where available;
• financial forecasts and capital planning;
• Accounting policies and recordkeeping processes;
• compliance and risk-management framework;
• technology and cybersecurity documentation;
• custody and asset-control arrangements;
• marketing plan for Dubai and the UAE;
• banking readiness documentation;
• proposed staffing and office arrangements; and
• wind-down and business-continuity planning.

Early preparation can also help management identify whether the proposed Dubai model differs materially from the activities already authorised in Spain.

How can KPM Global Services UAE assist?

KPM Global Services UAE can support Spanish founders, digital-asset groups and international SMEs with the commercial and operational preparation surrounding a Dubai market entry.

Depending on the business model, support can include UAE company-formation coordination, group-structure planning, business plans, Financial projections, Accounting setup, corporate Tax and VAT considerations, banking-readiness documentation, management reporting and preparation of corporate records required during onboarding and compliance processes.

Where activities involve VARA, DFSA or other regulated Financial Services permissions, businesses should also obtain appropriate specialist legal and regulatory advice. Corporate setup, Accounting and commercial preparation should be aligned with the proposed regulatory route rather than completed independently of it.

KPM Global Services UAE does not promise licensing approval or regulatory outcomes. The objective is to help management enter the process with clearer documentation, a workable UAE structure and better financial and operational readiness.

What should a Spanish digital-asset business do before entering Dubai?

Start by mapping the actual activity rather than the company label.

Identify the service, the entity delivering it, where the people and systems performing it will be located, which customers are being targeted and whether the operation will sit in mainland Dubai, a free zone outside DIFC or DIFC.

A Spanish MiCA authorisation can remain important for the European side of the group, but it should not be relied upon as a substitute for Dubai regulatory analysis.

For businesses preparing a UAE expansion, regulatory permissions, company formation, marketing, banking, Accounting, Tax and operational readiness should be planned as connected workstreams. Addressing them in the wrong order can create unnecessary restructuring and launch delays.

This article is for informational purposes and does not constitute legal, tax, accounting, or financial advice.