Dubai VARA licensing: activities, rulebooks and the UAE's other regulators

VARA licenses eight virtual asset activities in Dubai outside the DIFC. Here is how licensing works and how ADGM, SCA and the central bank fit in.

2026-10-17 · 6 min read

If you trade with, hold assets at or set up an entity in the UAE, the first question is which regulator covers the firm. In Dubai, outside the DIFC financial free zone, that is VARA; elsewhere it may be ADGM's FSRA, the federal securities regulator SCA, or the UAE central bank for payment tokens. Each has its own licence and rules.

Who VARA covers

VARA describes itself as the sole regulator of virtual assets across Dubai's mainland and free zones, except within the Dubai International Financial Centre [1]. Its framework rests on the Virtual Assets and Related Activities Regulations 2023 [1]. Any entity that wants to carry on a virtual asset activity in Dubai must be authorised first and must hold a licence for each activity it conducts [2].

VARA licenses eight activities [2]:

• Advisory services
• Broker-dealer services
• Custody services
• Exchange services
• Lending and borrowing services
• Management and investment services
• Transfer and settlement services
• Virtual asset issuance (Category 1)

Issuance of what VARA calls Category 2 virtual assets needs separate approval [1].

How licensing works

A new firm goes through two stages, and applications run through the commercial licensing body: Dubai Economy and Tourism for mainland firms, or the relevant free zone authority [2].

• Stage one, approval to incorporate: the applicant files an Initial Disclosure Questionnaire with a business plan and details of owners and senior managers, and pays an initial fee, typically half the application fee. The approval lets it incorporate and set up, but it may not yet carry on virtual asset activities [2].
• Stage two, the VASP licence: the firm submits fuller documentation, meets VARA for interviews and follow-up, pays the remaining licence fee and first-year supervision fee, and receives a licence that may carry operational conditions [2].

This matters for due diligence. A counterparty that says it is VARA approved may only hold the first-stage approval, which does not allow it to operate. VARA keeps a public register, so check the exact status yourself.

The rulebooks

VARA's requirements sit in rulebooks: compulsory ones on company matters, compliance and risk management, technology and information, and market conduct, plus activity-specific rulebooks and a virtual asset issuance rulebook [1]. On 19 May 2025 VARA published Version 2.0 of its activity rulebooks, with tighter controls on margin trading and token distribution, clearer definitions for collateral wallet arrangements, and more consistent compliance requirements across activities [3]. Firms had 30 days to comply, until 19 June 2025 [3]. VARA also warns that breaching its marketing rules can lead to material fines and even closure [1].

The rest of the UAE

Securities and Commodities Authority (SCA). SCA regulates virtual asset service providers in the UAE outside Dubai and outside the financial free zones. Dubai firms are licensed by VARA, and VARA informs SCA so there is a single national register [4].

ADGM's FSRA. Abu Dhabi Global Market has its own regime. On 10 June 2025 the FSRA amended it with immediate effect: a revised process for accepting tokens as Accepted Virtual Assets, updated capital requirements and fees, a new product intervention power, and rules confirming that privacy tokens and algorithmic stablecoins are prohibited [5].

Central Bank of the UAE (CBUAE). In June 2024 the central bank issued the Payment Token Services Regulation, covering issuance, conversion, custody and transfer of payment tokens [6]. Dirham payment tokens need a CBUAE-licensed issuer; foreign-currency payment tokens need a registered issuer and can be used only to buy virtual assets or derivatives, not for ordinary goods and services [6]. Issuers may not pay interest, and algorithmic stablecoins and privacy tokens are banned [6].

A wider central bank law followed. Federal Decree-Law No. 6 of 2025 took effect on 16 September 2025 [7]. Article 62 extends the central bank's licensing reach to anyone who engages in, offers, issues or facilitates a licensed financial activity by any means, which commentators read as covering technology providers and DeFi operators [7]. Existing firms had one year, to 16 September 2026, to comply, and the central bank can extend that period [7]. As of October 2026 we have not confirmed whether any extension was granted, so treat the deadline as passed unless you hear otherwise.

What it means for finance teams

Licensing status does not change how a token is measured, but it shapes counterparty risk, custody evidence and what you can disclose about restrictions. If you use a UAE exchange or custodian, its licence and conditions are part of the evidence auditors may ask for. If you pay UAE vendors or staff in stablecoins, note that foreign-currency payment tokens are restricted for paying for goods and services under the central bank rules.

What to do

• Map every UAE counterparty to its regulator (VARA, FSRA, SCA or CBUAE) and record its licence stage and any conditions.
• Do not accept a stage-one approval as a licence to operate; confirm full licence status on the regulator's register.
• Review any stablecoin payments to UAE parties against the payment token rules.
• If a group entity provides or facilitates financial services in the UAE, ask counsel whether the 2025 central bank law applies.
• Treat this as general information, not legal advice.

Sources

1. Frequently Asked Questions (Virtual Assets Regulatory Authority (VARA))
2. Licence Applications (Virtual Assets Regulatory Authority (VARA))
3. VARA Issues Updated Activity Rulebooks to Strengthen Market Integrity and Risk Oversight (Virtual Assets Regulatory Authority (VARA))
4. SCA-VARA to ensure Unified VA Sector Register of Regulated VASPs for the UAE (Virtual Assets Regulatory Authority (VARA))
5. ADGM FSRA implements amendments to its Digital Asset Regulatory Framework (Abu Dhabi Global Market)
6. The new CBUAE Payment Token Services Regulation: 10 things you need to know (CMS)
7. UAE Central Bank Issues New Central Bank Law Consolidating Financial Sector Regulation (Gibson Dunn)

General information for finance teams, current as of publication. Not legal, tax or accounting advice.

All Newsroom explainers