A business becomes a VASP the moment it conducts regulated virtual asset activities on behalf of others or as part of its commercial operations.

The activities below cover the full spectrum of VASP operations in the UAE in 2026. If your business conducts any one of them without the correct authorization from the relevant UAE regulator, it is operating as an unlicensed VASP.

Exchange Operations
Running any platform or facility that enables buyers and sellers of virtual assets to transact with each other. This covers centralized exchanges, order book platforms, peer-to-peer trading venues, OTC desks that match multiple counterparties, and hybrid exchange models. The defining characteristic is that the platform brings buyers and sellers together to execute transactions. Whether the exchange is centralized or partially decentralized does not change the regulatory analysis.

Brokerage
Executing transactions in virtual assets as principal or agent on behalf of clients. This covers bilateral OTC desks dealing directly with clients, prime brokerage services for institutional crypto traders, market makers quoting prices to clients, and brokers placing client orders on third-party venues. The key distinction from exchange operations is that brokerage involves bilateral dealing with clients rather than operating a venue. Many businesses conduct both exchange and brokerage activities simultaneously and require authorization for each.

Custody
Holding, storing, or safeguarding virtual assets or the private keys to virtual assets on behalf of clients. This covers institutional custodians, wallet providers that hold client private keys, exchanges that hold client assets in pooled or segregated wallets, and multi-signature custody arrangements where the custodian holds one or more keys. Custody is one of the most technically demanding VASP categories because regulators require detailed documentation of key management architecture, segregation of client assets, and technology security standards.

Investment Management
Managing portfolios of virtual assets on a discretionary or non-discretionary basis on behalf of clients. This covers crypto fund managers making investment decisions on client capital, separately managed account providers, robo-advisors and automated portfolio management systems, and staking services where the firm exercises discretion over client assets. The critical boundary: managing client assets is regulated. Advising on what to do with client assets is a separate regulated activity. Both require authorization.

Advisory Services
Providing specific investment advice on virtual assets to identified clients. This covers firms providing specific recommendations on which virtual assets to buy, sell, or hold, investment consultancies advising on digital asset allocation, and token advisory firms providing recommendations on specific token investments. General market commentary, research reports, and educational content published to the public are generally outside scope. The regulatory line is crossed when advice becomes specific to a client and specific to an asset.

Transfer and Settlement
Facilitating the transfer of virtual assets between parties. This covers payment processors using virtual assets for cross-border transfers, virtual asset remittance services, settlement infrastructure providers, and payment solutions built on blockchain networks. Note: transfer and settlement services with a payment component may trigger both VARA and CBUAE obligations simultaneously under Federal Decree-Law No. 6 of 2025.

Lending and Borrowing
Facilitating or providing lending of virtual assets or borrowing against virtual asset collateral. This covers virtual asset lending platforms matching lenders and borrowers, collateralized loan platforms using virtual assets as collateral, yield-generating products where the yield mechanism involves lending client assets to third parties, and margin lending facilities for trading platforms.

Virtual Asset Issuance
Issuing, offering, or selling virtual assets to investors or the public. This covers all token issuance activities regardless of token type: utility tokens, investment tokens, exchange tokens, asset-referenced tokens (ARVA), and fiat-referenced tokens (FRVA). It covers public sales, private placements, and pre-launch fundraising structures. It also covers marketing a forthcoming token sale, which can constitute regulated activity before any token is issued.