The UAE Crypto
Law Firm for Web3 &
Digital Assets, Since 2016

It depends on where the entity sits and what it does. VARA licenses virtual asset activity in Dubai outside the DIFC. The FSRA and the DFSA license financial services inside ADGM and the DIFC, each under English common law. The CMA covers UAE mainland outside those zones. The CBUAE covers payment tokens and stored value facilities. A free zone trade licence is not one of these.

VASP licence UAE →

There is no personal income tax in the UAE, so an individual’s gains are untaxed. Companies pay 9% corporate tax on taxable profits above the threshold. A free zone entity can access a 0% rate on qualifying income, but only if it meets the qualifying free zone person conditions, including adequate substance. The 0% headline is conditional, not automatic.

Crypto tax UAE →

Timelines vary by regulator and by activity, and most of the time sits between first approval and operational licence. VARA moves through provisional approval, preparatory conditions and operational licence, typically 9 to 15 months for a well-prepared applicant. ADGM and the DIFC run in-principle approval before authorisation, typically 8 to 14 months. The CMA has 45 working days to decide on an in-principle approval. The applicant then has six months to meet all licensing requirements, and a full licence typically follows in 4 to 9 months overall.

VASP licence UAE →

Four separate costs, and most published figures only cover the first. VARA’s own fees are set in Schedule 2 of its Regulations. Advisory and VA Transfer and Settlement pay AED 40,000 on application and AED 80,000 a year in supervision. Exchange, Broker-Dealer, Custody, Lending and Borrowing, and Management and Investment pay AED 100,000 on application and AED 200,000 a year. Each additional activity adds 50% of the lower application fee, and VARA can raise supervision fees for higher-risk firms. Paid-up capital is fixed by activity, from AED 100,000 for Advisory, and stays locked in the company. Free zone or DET establishment costs sit on top, and legal and compliance work completes the budget. NeosLegal quotes that work as a fixed fee, so founders know the number before they commit.

VARA licence Dubai →

The CMA took over from the Securities and Commodities Authority on 1 January 2026, under Federal Decree-Laws Nos 32 and 33 of 2025. It now regulates virtual assets and capital markets on the UAE mainland, outside the DIFC and ADGM. Its framework carries penalties of up to AED 250 million for unauthorised activity and reaches conduct directed at the UAE from outside it.

CMA federal crypto licence →

In practice, yes. Major exchanges require a classification opinion from counsel before listing, covering whether the token is a security in the relevant jurisdictions, how it is distributed, and who controls issuance. The opinion has to survive the exchange’s own legal review, not simply read well. Every opinion NeosLegal has submitted to a Tier-1 exchange has been accepted.

UAE token launch →

No. Company formation and regulated activity authorisation are different things. A DMCC, IFZA, RAKEZ or RAK DAO trade licence lets a company exist. It does not authorise exchange, custody, broker-dealer, lending, management or payment token activity. Those need authorisation from VARA, the FSRA, the DFSA, the CMA or the CBUAE, depending on where the entity sits and what it does.

UAE crypto company setup →

A VARA licence covers virtual asset activity in the Emirate of Dubai, outside the DIFC. Under the cooperation framework between VARA and the federal regulator (signed with the SCA in September 2024, formalised in August 2025 and now carried by the CMA), a VARA-licensed firm is registered with the federal regulator to serve clients on the wider UAE mainland. VARA describes this as licence recognition. It does not reach ADGM or the DIFC, which license under their own regimes, so a firm serving clients there needs a separate authorisation.

VARA licence Dubai →

NeosLegal works to fixed fees with a defined scope, agreed before the work starts. A token classification opinion, a VASP application and a fund formation are scoped differently, and the regulator’s own fees and capital requirements sit on top of legal cost. The strategy call is where scope gets defined and the fee follows it.

Book a strategy call →

Before the token exists and before the entity is incorporated. The expensive problems in this market are structural: a token issued from the wrong entity, an activity started before authorisation, a cap table that blocks a licence application. Those cost multiples to unwind and some cannot be unwound at all. The cheapest engagement is the one that happens at the whiteboard stage.

Book a strategy call →