UAE crypto license 2026 — VARA Dubai authorisation
The UAE has no single crypto licence. VARA licenses eight activities in Dubai outside the DIFC; the DFSA covers the DIFC, the FSRA the ADGM free zone and the Capital Market Authority the rest of the mainland. VARA publishes its fees; practitioners put Year 1 at USD 250k–800k.
Last reviewed by the Crypto Law Index editorial desk
What a UAE crypto licence actually is
The UAE does not issue a single crypto licence; the regulator depends on where the business sits. VARA, created under Dubai Law No. 4 of 2022, regulates virtual assets across Dubai's mainland and free zones, except the Dubai International Financial Centre (DIFC). In the DIFC, the Dubai Financial Services Authority (DFSA) authorises financial services involving crypto tokens. In Abu Dhabi, the ADGM Financial Services Regulatory Authority (FSRA) licenses regulated activities using virtual assets within the ADGM free zone, under English common law. Elsewhere on the mainland, the Capital Market Authority (CMA), which replaced the Securities and Commodities Authority on 1 January 2026, applies its Decision No. 4/R.M/2026. The Central Bank of the UAE licenses or registers payment token services. So the first decision is not 'how do I get a UAE crypto licence' but which regulator, and for which activities.
VARA's framework identifies eight virtual asset activities — advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and VA Issuance (Category 1). An operator licenses each activity it plans to run and can aggregate them under one licence, with specific rules where custody is involved. There's no single 'do everything' licence; you build the stack from the activities you actually need, and an exchange that also custodies client assets licenses both.
Capital, fees, and the two-stage timeline
VARA publishes both capital and fees. Paid-up capital is set per activity in Part VI.B of the Company Rulebook: AED 100,000 for Advisory, rising to the higher of AED 1,500,000 or 25% of fixed annual overheads for an Exchange that does not use a VARA-licensed custodian, and it must be held in forms VARA specifies, such as a UAE bank trust account or a surety bond naming VARA as beneficiary. Schedule 2 of the 2023 Regulations sets a licence application fee of AED 40,000 (Advisory; Transfer and Settlement) or AED 100,000 (other activities) and an annual supervision fee of AED 80,000 or AED 200,000 for each licensed activity. Including legal, substance and compliance work, practitioners put Year 1 spending at USD 250,000–800,000 (practitioner estimate).
Licensing runs in two stages. In the first, the firm files an Initial Disclosure Questionnaire through Dubai Economy and Tourism or the relevant free zone, provides a business plan and details of its owners and senior management, and pays part of the application fee; VARA then issues an Approval to Incorporate. The firm can incorporate and set up operations but may not carry on virtual asset activity. In the second stage it applies for the full VASP licence, answers VARA's questions and meetings, pays the remaining fees and the first year's supervision fee, and receives a licence that may carry conditions. Practitioners report six to twelve months end-to-end (practitioner estimate); thin substance or unclear ownership slows the second stage.
VARA, ADGM, and why a UAE licence is not an EU passport
ADGM's FSRA is the main alternative inside Abu Dhabi's financial free zone. It applies English common law, which international institutions often find familiar. VARA covers Dubai outside the DIFC, and firms that want to sit in the DIFC go to the DFSA instead. None of the three is objectively better — the choice turns on where you want presence and which supervisor's style suits your model.
One point matters for anyone reading this index: the UAE is not in the EU or EEA, so a UAE licence grants no MiCA passport. A UAE base can serve the Gulf, Asia and other non-EU customers, but it does nothing for EU market access. Operators selling to EU residents still need a separate CASP authorisation in an EU member state — plan the UAE licence as a regional hub, not a back door into the single market.
A crypto license in the United Arab Emirates is an authorisation from one of several regulators, depending on where the business sits: the Virtual Assets Regulatory Authority (VARA) for Dubai's mainland and free zones outside the DIFC, the Dubai Financial Services Authority in the DIFC, the ADGM Financial Services Regulatory Authority inside the ADGM free zone, and the Capital Market Authority (formerly the SCA) on the rest of the mainland; the Central Bank of the UAE regulates payment tokens.
Fast facts
| Parameter | Value |
|---|---|
| Dubai regulator | VARA, created under Dubai Law No. 4 of 2022; covers Dubai's mainland and free zones, excluding the DIFC |
| DIFC regulator | Dubai Financial Services Authority (DFSA); authorises financial services involving crypto tokens in the DIFC |
| ADGM regulator | ADGM Financial Services Regulatory Authority (FSRA); licenses regulated activities using virtual assets within ADGM |
| Mainland outside Dubai | Capital Market Authority (CMA), successor to the SCA since 1 January 2026; VASP framework in CMA Decision No. 4/R.M/2026 |
| Payment tokens | Central Bank of the UAE (CBUAE) Payment Token Services Regulation (2024) |
| VARA activities | Eight — advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, VA Issuance (Category 1) |
| VARA fees | Application AED 40,000 or AED 100,000 and annual supervision AED 80,000 or AED 200,000 per activity (Schedule 2) |
| Typical Year 1 cost | USD 250,000–800,000 depending on category, substance, and capital (practitioner estimate) |
| Application timeline | Six to twelve months across VARA's two stages (practitioner estimate) |
| EU market access | None — a UAE licence grants no EU MiCA passport; EU customers need a CASP authorisation |
Top counsel for United Arab Emirates CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented United Arab Emirates engagement, regardless of where they are headquartered.
Frequently asked questions about United Arab Emirates CASP authorisation
How much does a crypto license in Dubai cost?
VARA's published fees (Schedule 2 of the 2023 Regulations) are AED 40,000 to apply and AED 80,000 a year in supervision for Advisory or Transfer and Settlement, and AED 100,000 and AED 200,000 for each other activity. Paid-up capital runs from AED 100,000 (Advisory) to the higher of AED 1,500,000 or 25% of fixed annual overheads (Exchange without a VARA-licensed custodian). Including the legal, substance and compliance build, practitioners put Year 1 at USD 250,000–800,000.
Is VARA or ADGM better for a crypto exchange?
It depends on where the exchange is based. VARA licenses Dubai's mainland and free zones outside the DIFC; the FSRA licenses activities within the ADGM free zone in Abu Dhabi, under English common law; the DFSA authorises crypto-token services in the DIFC. Exchanges choose by location, client base and which supervisor fits the model.
Does a Dubai crypto licence give EU market access?
No. The UAE is not in the EU or EEA, so a VARA, DFSA, ADGM or CMA licence grants no MiCA passport. Serving EU clients requires a separate CASP authorisation in an EU member state.
How long does VARA licensing take?
Practitioners report six to twelve months. VARA runs two stages: an Approval to Incorporate, which follows an Initial Disclosure Questionnaire filed through Dubai Economy and Tourism or a free zone, and then the full Virtual Asset Service Provider licence. The firm may not carry on virtual asset activities at the Approval to Incorporate stage.
What activities does VARA regulate?
Eight: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and VA Issuance (Category 1). A VASP can aggregate several activities under one licence, with specific rules where custody is involved.
Which regulator covers the rest of the UAE?
Outside Dubai and the financial free zones, virtual asset service providers fall under the Capital Market Authority, which succeeded the Securities and Commodities Authority on 1 January 2026 under Federal Decree-Law No. 32 of 2025. Its Decision No. 4/R.M/2026 sets the mainland VASP framework and does not apply in the ADGM or the DIFC. Payment token services need a licence or registration from the Central Bank of the UAE.
Pitfalls and nuances in United Arab Emirates
1 Treating Dubai as a light-touch jurisdiction
The 'crypto-friendly Dubai' framing is dated. VARA runs a detailed rulebook system — a Company Rulebook, Compliance and Risk Management, Technology and Information and Market Conduct Rulebooks, plus a rulebook for each licensed activity — with activity-specific capital. A VARA file looks closer to a financial-services application than a sandbox registration. Operators that budget for a quick offshore-style setup underestimate the substance and timeline.
2 Confusing the UAE's regulators
VARA regulates virtual assets in Dubai outside the DIFC; the DFSA regulates crypto-token services in the DIFC; the FSRA regulates them inside the ADGM free zone; the CMA covers the rest of the mainland; and the CBUAE regulates payment tokens. They have different rulebooks, fees and licence structures, and a VARA licence does not cover a business located in the DIFC or ADGM.
3 Assuming a UAE licence solves EU access
A UAE base can serve Middle East, Asian and other non-EU customers. It does nothing for EU market access. Operators selling to EU residents still need a MiCA CASP authorisation, and reverse solicitation is a narrow exception, not a strategy. Plan the UAE licence as a regional hub, not a back door into the single market.
4 Underbudgeting local substance
VARA expects genuine presence — a UAE-incorporated entity, fit-and-proper senior managers, a compliance officer, an MLRO, and paid-up capital held in the form VARA requires. Practitioners report that nominee arrangements and thin local headcount draw supervisory questions. Substance is a recurring cost, not a one-off.
Practitioners in United Arab Emirates
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes United Arab Emirates. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in United Arab Emirates is Virtual Assets Regulatory Authority (VARA) for Dubai outside the DIFC; DFSA in the DIFC; ADGM FSRA in the ADGM free zone; Capital Market Authority (CMA, formerly SCA) on the mainland outside Dubai; CBUAE for payment tokens. The legal basis is Dubai Law No. 4 of 2022 and VARA Virtual Assets and Related Activities Regulations 2023; DFSA Crypto Token regime (DIFC); ADGM FSRA Virtual Asset Framework; CMA Decision No. 4/R.M/2026 (mainland); CBUAE Payment Token Services Regulation (2024). Visit www.vara.ae for the regulator's official guidance, application forms, and supervisory expectations.