VARA Licence Categories Explained: Which Dubai Virtual-Asset Activity Fits Your Model?

Services

• Category 1 VA Issuance

These categories are not simply administrative licence names.

Each category represents a different economic function within the virtual-asset ecosystem.

A useful starting point is to ask:

Does the company advise?

Does it arrange transactions?

Does it hold customer assets?

Does it operate a market?

Does it lend or borrow virtual assets?

Does it manage assets?

Does it transfer or settle assets?

Does it issue qualifying virtual assets?

A single business may answer “yes” to more than one of these questions.

That is why VARA classification should be based on functions rather than branding.

VARA Jurisdiction in Dubai

VARA regulates virtual-asset activities across the Emirate of Dubai, including Dubai free zones, except the Dubai International Financial Centre.

This distinction is important because founders cannot assume that all Dubai jurisdictions fall under the same regulatory perimeter.

A company established on the Dubai mainland or inside a Dubai free zone may still require VARA authorisation if its activities fall within VARA’s regulated virtual-asset framework.

A commercial licence by itself does not necessarily provide permission to conduct regulated virtual-asset activities.

Corporate licensing and regulatory authorisation are separate matters.

A company may therefore be properly incorporated while still being unable to legally offer a regulated virtual-asset service until the relevant VARA approval has been obtained.

Advisory Services

Advisory Services are relevant where a business provides personal recommendations to clients concerning virtual assets or transactions involving them.

The important word is personal.

There is a material difference between publishing general educational content about blockchain or digital assets and recommending a particular transaction or investment strategy to a specific client.

VARA’s definition considers client-specific factors such as:

• knowledge and experience;

• investment objectives;

• risk tolerance; and

• financial circumstances.

A consultancy that reviews a client’s situation and recommends a specific virtual-asset strategy may therefore fall within this category.

By comparison, a media business publishing general crypto-market information may not automatically fall within the same regulatory definition.

The closer the service moves towards personalised recommendations, the more relevant Advisory Services become.

Under the current framework referenced in the source material, Advisory Services require paid-up capital of AED 100,000.

The current application and supervision fees should always be confirmed directly with VARA before filing because regulatory fees may change.

Consultant observation:

Founders often focus on whether they execute transactions. However, personalised recommendations alone can create a separate licensing question, even where the company does not operate an exchange or custody platform.

Broker-Dealer Services

Broker-Dealer Services can cover a wide range of transaction-related activities.

This category can become relevant where a company arranges, facilitates, deals in, or otherwise participates in virtual-asset transactions between parties.

A business does not necessarily need to operate its own exchange before Broker-Dealer Services become relevant.

For example, a platform may receive instructions from customers and arrange execution through another venue.

In that case, the platform may be functioning as an intermediary even though it does not maintain its own order book.

The regulatory analysis therefore needs to examine what role the business plays between the customer and the execution venue.

Broker Versus Exchange

The distinction between a broker and an exchange is particularly important.

Consider two fictional platforms.

Platform A accepts customer instructions and sends them to an external trading venue for execution.

Platform B maintains its own order book and matches buyers and sellers directly.

Both may appear to customers as trading applications.

However, their underlying functions are different.

Platform A may raise Broker-Dealer Services considerations.

Platform B may fall more directly within Exchange Services.

Some companies may perform both functions and therefore require more than one regulated activity permission.

VARA’s current capital requirements also distinguish between certain Broker-Dealer models depending on whether approved custody arrangements are used.

This means the custody architecture of the business can affect not only operations but also regulatory capital.

Custody Services

Custody is one of the clearest examples of why technical architecture matters in virtual-asset regulation.

VARA defines Custody Services around safeguarding virtual assets for another entity and acting on verified instructions.

The underlying question is therefore not simply whether a company provides a wallet.

The more important questions are:

Who controls the private keys?

Who can authorise transactions?

Who can move the assets?

Are customer assets segregated?

Can the company move client assets independently?

Is a third-party custodian involved?

These questions can materially affect regulatory classification.

Imagine two wallet providers.

The first controls the private keys associated with customer assets.

The second provides software through which users retain exclusive control over their own keys.

Although both businesses may market themselves as wallet providers, their regulatory positions can be very different.

VARA’s current framework also places specific requirements on segregation of client assets within Custody Services.

The source material identifies a current paid-up capital requirement of the higher of AED 600,000 or 25% of fixed annual overheads for Custody Services.

Exchange Services

Exchange Services are highly relevant to centralised virtual-asset trading platforms.

VARA’s definition includes activities involving exchange or conversion between:

• virtual assets and fiat currency;

• one virtual asset and another;

• buyer and seller orders; and

• trading through an order book.

A business may therefore fall within Exchange Services where customers can buy, sell, or exchange supported virtual assets through a platform operated by the company.

Branding does not determine the licence.

Calling a business a:

• digital marketplace;

• swap platform;

• trading application;

• Web3 platform; or

• NFT marketplace

does not change the underlying regulatory analysis.

What matters is what the platform actually does.

VARA’s published guidance also indicates that NFT marketplaces may require Exchange and/or Broker-Dealer permissions depending on their exact activities.

Example:

A fictional digital-asset platform allows customers to deposit fiat currency, convert it into supported virtual assets, trade those assets against each other, and place orders into an internal order book.

The customer may think of this as a single service.

From a regulatory perspective, however, several separate functions may need to be analysed.

Under the current source material, Exchange Services using certain approved custody arrangements may require the higher of AED 800,000 or 15% of fixed annual overheads.

Other structures may face the higher of AED 1.5 million or 25% of fixed annual overheads.

Lending and Borrowing Services

Virtual-asset lending is another distinct VARA activity.

This category applies to arrangements where virtual assets are transferred or lent from one party to another, with the borrower agreeing to return them according to agreed terms.

A centralised crypto-lending platform may therefore need to assess whether Lending and Borrowing Services authorisation applies.

However, businesses should avoid assuming that every product offering “yield” is automatically a lending product.

Yield can potentially be generated through:

• lending;

• staking;

• asset management;

• liquidity arrangements; or

• other structures.

The regulatory analysis therefore depends on how the return is actually generated.

A useful internal question for founders is:

Where do the customer’s assets go, what happens to them, who controls them, and what creates the return?

The answer can help determine whether lending, management, staking, or another regulated function is involved.

The current source material identifies a paid-up capital requirement of the higher of AED 500,000 or 25% of fixed annual overheads for Lending and Borrowing Services.

VA Management and Investment Services

VA Management and Investment Services apply where a firm takes responsibility for managing, administering, or disposing of virtual assets belonging to another entity.

This category can apply to managed investment arrangements and certain forms of staking.

Staking is particularly important because businesses sometimes assume that staking falls outside conventional financial-service regulation.

That assumption may be incorrect.

Where a business takes responsibility for client virtual assets and stakes those assets as part of a managed service, VARA’s Management and Investment Services framework may become relevant.

By comparison, a technology company that merely provides software without assuming responsibility for client assets may require a different regulatory analysis.

The relevant question is therefore not:

“Do we provide staking?”

A better question is:

“What responsibility do we assume for the customer’s assets?”

That distinction can materially affect the licensing requirement.

The source material identifies current paid-up capital requirements of the higher of AED 280,000 or 15% of fixed annual overheads for certain approved custody structures.

Other models may require the higher of AED 500,000 or 25% of fixed annual overheads.

VA Transfer and Settlement Services

VA Transfer and Settlement Services relate to the transmission, transfer, or settlement of virtual assets between entities, wallets, addresses, or other destinations.

This can be relevant to companies providing payment, transfer, or settlement infrastructure involving virtual assets.

However, founders should avoid assuming that every blockchain technology company is automatically carrying out this regulated activity.

A software provider may develop technical infrastructure without directly transmitting virtual assets for customers.

Another business may actively move or settle assets on behalf of users.

Those models can create very different regulatory outcomes.

VARA has specifically highlighted that distributed-ledger technology providers must determine whether the actual services they perform amount to regulated virtual-asset activities.

The commercial label “technology company” does not automatically remove a regulated activity from VARA’s perimeter.

The current source material identifies a paid-up capital requirement of the higher of AED 500,000 or 25% of fixed annual overheads for Transfer and Settlement Services.

Category 1 VA Issuance

Token issuance requires careful analysis because not every token is treated in the same way.

VARA distinguishes between different categories of virtual-asset issuance.

Category 1 includes:

• Fiat-Referenced Virtual Assets;

• Asset-Referenced Virtual Assets; and

• other virtual assets VARA may designate.

Category 1 issuance requires a VARA licence.

This means the common question:

“Do I need a VARA licence to launch a token?”

is too broad.

The correct answer depends on the structure of the token.

Founders should assess:

• what the token represents;

• whether it references another asset;

• whether it is redeemable;

• whether it is transferable;

• how it is distributed;

• what rights token holders receive; and

• whether it falls within another issuance category.

For example, a token designed to maintain value by reference to gold can potentially fall within the Asset-Referenced Virtual Asset framework.

VARA also distinguishes Category 1 from Category 2 and certain exempt issuance arrangements.

The source material explains that Category 2 issuance is treated differently from Category 1, including specific distribution requirements.

This makes pre-launch regulatory analysis especially important for tokenisation projects.

When One Business Model Crosses Several VARA Activities

One of the most important features of VARA’s framework is that regulatory permissions are activity specific.

A sophisticated platform can perform several regulated functions at the same time.

Consider a fictional business that:

• operates an order book;

• executes customer trades;

• holds customer virtual assets;

• allows customers to lend supported assets; and

• provides managed staking.

The company may market itself simply as a crypto exchange.

But from a regulatory perspective, the platform could potentially involve:

• Exchange Services;

• Custody Services;

• Lending and Borrowing Services;

• VA Management and Investment Services; and

• potentially other regulated functions depending on the exact structure.

VARA permits businesses to apply for multiple regulated activities within an overarching licence structure, subject to applicable restrictions.

However, multiple permissions can create additional:

• capital requirements;

• compliance obligations;

• governance requirements;

• technology controls;

• reporting requirements; and

• activity-specific rulebook obligations.

A founder should therefore not stop the regulatory analysis after identifying the first relevant category.

Proprietary Virtual-Asset Trading

A company trading virtual assets exclusively for its own account is different from a company providing services to clients.

VARA currently treats proprietary trading separately from the principal VASP licence categories.

According to the source material, VA proprietary trading requires a No Objection Certificate rather than a full VA Licence in relevant circumstances.

The source also states that proprietary trading exceeding AED 1 billion in monthly rolling trading volume must be registered with VARA.

This distinction may be particularly relevant to:

• family offices;

• treasury companies;

• investment companies;

• proprietary trading firms; and

• corporate investment vehicles.

The position may change if the business later starts offering services to third parties.

How Should Founders Identify the Correct VARA Activity?

A business should begin by mapping every service rather than choosing a licence based on the company’s marketing description.

A practical assessment can follow these steps.

1. Identify Every Service

Document exactly what users can do on the platform.

Avoid vague descriptions such as “digital asset ecosystem.”

2. Map the Transaction Flow

Identify who:

• initiates the transaction;

• routes it;

• approves it;

• executes it; and

• settles it.

3. Map Asset Control

Determine who controls:

• private keys;

• wallets;

• fiat funds;

• virtual assets; and

• transaction permissions.

4. Map Investment Decision-Making

Establish whether clients make their own decisions or whether the business recommends or manages investments.

5. Map Trading Functionality

Determine whether the company:

• arranges trades;

• deals;

• matches orders;

• maintains an order book; or

• routes execution elsewhere.

6. Review Yield Products

Identify whether customer returns arise from:

• lending;

• staking;

• asset management; or

• another structure.

7. Review Token Issuance

If a token is being created, assess its:

• rights;

• underlying reference assets;

• transferability;

• redemption terms; and

• distribution structure.

8. Test Every Function Separately

Do not stop after identifying the first regulated activity.

9. Model the Cumulative Compliance Burden

Several activities may create multiple rulebook, capital, operational, and governance requirements.

10. Confirm the Regulatory Classification Before Launch

The correct time to analyse the model is before customer onboarding and before regulated activities begin.

Licence Fees Are Only One Part of the Cost

Founders often focus on the application fee when estimating the cost of obtaining VARA authorisation.

That can significantly underestimate the total budget.

VARA’s current fee schedule, as reflected in the source material, identifies application fees of AED 40,000 or AED 100,000 depending on the activity.

Annual supervision fees are generally identified as AED 80,000 or AED 200,000, depending on the activity.

Additional regulated activities may create further fees.

However, the real regulatory budget may also need to include:

• paid-up capital;

• compliance personnel;

• AML and CFT systems;

• technology governance;

• cybersecurity;

• legal support;

• audits;

• insurance where applicable;

• office requirements;

• operational controls; and

• continuing regulatory supervision.

The better budgeting question is therefore not simply:

“How much is a VARA licence?”

It is:

“What will it cost to establish and maintain a fully compliant VARA-regulated business model?”

Why a Commercial Licence Is Not the Same as VARA Authorisation

A common mistake is to assume that once the company is incorporated and its commercial licence is issued, the virtual-asset business is ready to operate.

That is not necessarily the case.

A commercial licence establishes the legal company and identifies its permitted commercial activities.

VARA authorisation addresses whether the company can perform regulated virtual-asset activities.

The distinction is important.

A business can therefore have a valid corporate licence while still requiring separate regulatory permission before launching a regulated product.

A more practical planning sequence is:

Business model → regulatory analysis → VARA activity mapping → company structure → application → operational readiness → launch

This approach can reduce the risk of major restructuring later.

Why Technical Architecture Matters to VARA Licensing

Virtual-asset regulation is closely connected with technology design.

A seemingly technical decision can affect regulatory classification.

For example:

Should the company control customer private keys?

Should custody be outsourced to an approved provider?

Should orders be matched internally?

Should trades be routed to another venue?

Should the company manage staking or allow users to interact directly with a protocol?

Should users receive personalised recommendations?

Will customer assets pass through company-controlled wallets?

Each decision can affect the regulatory model.

This is why compliance should not be treated as a final-stage legal exercise.

For a virtual-asset company, product architecture and regulatory architecture should often be planned together.

Example:

A fictional startup begins development as a “non-custodial trading platform.”

During product development, the founders later decide to hold customer keys temporarily and introduce an internal matching engine.

Those two design changes may create regulatory implications that were not part of the original business plan.

Addressing those questions after development is complete can be more expensive than resolving them before the product is built.

VARA’s Framework Continues to Evolve

Virtual-asset regulation should never be treated as static.

The source material notes that VARA issued Version 2.0 of its activity-based rulebooks in May 2025, with the updated rules becoming fully effective on 19 June 2025.

Further revisions were recorded later in 2025.

This means businesses should avoid relying on:

• outdated blog posts;

• old PDFs;

• informal licensing checklists;

• previous fee schedules; or

• earlier versions of activity definitions.

Founders should review the current VARA rulebooks both during licensing and throughout the life of the business.

How Can KPM Global Services UAE Assist?

KPM Global Services UAE can support entrepreneurs, fintech operators, investors, and international businesses with the practical preparation required before establishing a virtual-asset business in Dubai.

The engagement should begin with understanding the operating model rather than immediately selecting a company licence.

Depending on the proposed activity and structure, assistance may include:

• initial business-model assessment;

• identification of relevant commercial activities;

• coordination of company formation planning;

• preliminary mapping of potential VARA-regulated functions;

• document preparation support;

• ownership and UBO documentation;

• accounting and tax planning;

• compliance-readiness coordination;

• banking-readiness documentation;

• operational-cost planning; and

• coordination with appropriately qualified regulatory and legal advisers where formal legal interpretation is required.

The role of a consultant is to help organise the commercial, corporate, accounting, tax, documentation, and operational workstreams so that the business approaches the regulatory process with a clearly defined operating model.

Formal regulatory interpretations and legal opinions should be obtained from suitably qualified legal and regulatory professionals where required.

What Should Founders Decide Before Proceeding?

Founders should first define exactly what the business will do.

They should then identify:

• how customer assets move;

• who controls those assets;

• who executes transactions;

• how revenue and yield are generated; and

• whether the platform makes recommendations or manages investments.

Only after these functions are clearly documented should the company finalise:

• corporate jurisdiction;

• commercial licence;

• custody structure;

• trading architecture;

• token model;

• capital planning;

• compliance systems; and

• regulatory application strategy.

VARA’s framework rewards detailed planning.

It can also expose weaknesses in a business model that has been built around vague assumptions.

A company that begins with a clear regulatory map is better positioned to design its technology, capital structure, operations, governance, and compliance processes correctly from the start.

The central lesson is simple:

The correct VARA licence is determined by the functions performed by the business, not the label used to describe the company.

This article is for informational purposes only and does not constitute legal, regulatory, tax, accounting, investment, or financial advice.