VARA License Categories Explained (2026): Complete Guide to Dubai Crypto Licensing

VARA regulates activities rather than labels. How a business chooses to describe itself carries no regulatory weight. What matters is how the activity functions in practice. This distinction is particularly important for Web3 start-ups and investment structures that operate across multiple verticals or combine operational and investment roles.

Exchange Licence

A VARA Exchange Licence is required where a person or platform conducts exchange, trade or conversion between virtual assets and fiat currency, between two or more virtual assets, or matches orders between buyers and sellers for such transactions. The definition also captures the maintenance of an order book in furtherance of any of these activities.

VARA treats exchanges as market infrastructure rather than pure technology products. Licensing therefore focuses heavily on governance, listing and delisting frameworks, conflict management, market integrity controls, and operational resilience. Technical capability alone is insufficient.

The Exchange Services Rulebook Version 2.0 imposes detailed public disclosure requirements on licensed exchanges, including mandatory publication of conflicts of interest, price determination methodology, and key data on each virtual asset offered for trading — obligations that increasingly complement the due diligence expectations of institutional market participants. 

Broker-Dealer Licence

The Broker-Dealer Licence covers a broad range of intermediary and dealing activities in virtual assets, including arranging orders between parties, soliciting or accepting client orders, facilitating transaction matching, entering into transactions as a dealer on the entity’s own account, making a market in virtual assets using client assets, and providing placement, distribution or other issuance-related services.

This model is commonly used by OTC desks, execution platforms, and intermediaries serving family offices, funds, and high-net-worth investors. A recurring misconception is that avoiding custody or relying on third-party trading venues eliminates licensing requirements. VARA’s framework makes clear that the act of intermediation itself is regulated.

From an investment and governance perspective, this has implications for execution quality, fee transparency, conflict management, and disclosure practices. For senior leadership and investment committees, brokerage licensing decisions often shape commercial models and cross-border execution strategy.

Custody Licence

Custody Services are defined as the safekeeping of virtual assets for or on behalf of another entity, where the custodian acts only on verified instructions from or on behalf of that entity. A notable qualifying condition under VARA’s framework is that only entities which segregate each client’s assets in separate virtual asset wallets will be eligible for a Custody Services Licence, subject to any exceptions permitted under the Custody Services Rulebook.

VARA applies an institution-grade approach to custody. Applicants are expected to demonstrate robust key management systems, internal controls, audit mechanisms, and clear legal segregation of client assets. These expectations are particularly relevant for family offices and institutional investors where fiduciary responsibility and capital preservation are central considerations.

In practice, custody exposure is often unintentional. Exchanges, token issuers, and Web3 platforms frequently retain some level of wallet control during onboarding, system migration, or contingency processes. Without careful structuring, this can materially expand regulatory scope and compliance cost.

Advisory Licence

Advisory Services are defined as offering, providing, or agreeing to provide a personal recommendation to a client, whether upon the client’s request or on the entity’s own initiative, in respect of one or more actions or transactions relating to virtual assets. A recommendation is personal where it is made following consideration of the client’s knowledge and experience in investing in virtual assets, their investment objectives including risk tolerance and time horizon, and their financial circumstances including their ability to bear losses.

VARA draws a clear boundary between general information and regulated advice. The distinction turns on personalisation: once a recommendation is tailored to a specific client and their circumstances in the manner described above, licensing is required. This means that activities such as research distribution or strategic consulting will only fall within the definition where they cross into personalised recommendations. The activity type alone is not determinative.

For family offices and institutional investors, this reinforces the importance of ensuring that advisory relationships, content strategies, and commercial incentives remain clearly delineated and defensible from a regulatory perspective.

Lending and Borrowing Licence
Lending and Borrowing Services are defined as carrying out a contract under which a virtual asset is transferred or lent from one or more lenders to one or more borrowers, where the borrower commits to return the same virtual assets to the lender on demand, either at any time during the agreed period or at its end.

VARA treats these activities as higher risk due to leverage and counterparty exposure. The Lending and Borrowing Services Rulebook imposes a detailed framework of operational and disclosure obligations on licensed entities. VASPs must publicly disclose how client virtual assets are used, how counterparty risk is managed, and whether they only enter into over-collateralised loans. A quarterly asset and liability report, covering values of virtual assets held, lent, borrowed, and pledged as collateral, must be published and kept current. Client positions must be subject to independent valuation, and all risk management and due diligence must be regularly audited by an independent third party.

At the operational level, VASPs must maintain sufficient virtual assets to satisfy client obligations at all times and must complete client withdrawal requests within twenty-four hours. Clients are entitled to monthly written statements detailing account value, all transactions executed in the period, interest accrued and paid, and collateral posted.

For investors, this licence is an important indicator of whether lending and borrowing models are operating within a regulated and transparent framework. One that imposes concrete liquidity, disclosure, and reporting obligations rather than leaving these to commercial discretion.

Management and Investment Services Licence
VA Management and Investment Services are defined as acting on behalf of an entity as an agent, fiduciary, or otherwise taking responsibility for the management, administration or disposition of that entity’s virtual assets. The definition expressly includes investment management services and, notably, taking responsibility for the staking of virtual assets to earn fees paid to validators or node operators on proof-of-stake networks. This definition reflects the breadth of activities this licence is intended to capture.

The VA Management and Investment Services Rulebook imposes substantive obligations that go beyond governance and risk management. VASPs may only provide services that are suitable for a given client, assessed by reference to that client’s knowledge and experience, investment objectives, and financial circumstances. They must act in clients’ best interests at all times, taking into account factors including price, costs, speed, likelihood of execution and settlement, and custody conditions. Rehypothecation of client virtual assets is prohibited without explicit prior client consent, a provision of direct relevance to asset protection and fiduciary accountability.

On transparency, VASPs must provide clients with monthly written statements covering account value, all transactions executed in the period, and changes in valuation. All assets under management must be subject to ongoing independent valuation. VASPs cannot receive remuneration for routing client orders to particular platforms unless this is disclosed in the client agreement. Any introduction of new fee categories or increase in existing fees requires at least ninety calendar days’ written notice to clients. Where staking services are provided, VASPs are prohibited from representing that their services involve the distribution of staking rewards unless payments to clients directly originate from those rewards.

For family offices and institutional investors, this licence provides a meaningful framework of accountability. One that addresses investment control, asset protection, conflicts of interest, and fee governance within a single regulated structure.

Transfer and Settlement Services Licence
The Transfer and Settlement Services Licence applies to the transmission, transfer and settlement of virtual assets, including payment-like and remittance services. Notably, VARA does not offer this as a standalone licence. It is only available in combination with Custody Services. In practice, as of the date of publication, no entity appears on VARA’s public register as holding this licence, in part reflecting the jurisdictional overlap with the Central Bank of the UAE, which retains regulatory authority over payment and remittance services and whose requirements VASPs in this space must also satisfy.

Where the licence is relevant, the framework imposes substantive obligations including AML/CFT compliance and adherence to the FATF Travel Rule, cross-border permissibility checks for each transaction, a prohibition on using client virtual assets without explicit consent, and a 24-hour remediation obligation where settlements are unauthorised or defectively executed.

For institutional participants, the more immediate practical significance of this licence category lies in understanding where transfer and settlement functions embedded within custody may engage the regulatory perimeter, a structuring question that warrants attention even where a standalone licence is not being sought.


Virtual Asset Issuance Licence
VARA’s issuance framework applies to all entities in Dubai issuing a virtual asset in the course of a business, and operates across three tiers. Category 1 issuances, which include Fiat-Referenced Virtual Assets, Asset-Referenced Virtual Assets, and other virtual assets as VARA may determine — require a VARA Licence. Category 2 issuances do not require a licence, but all placement and distribution must be carried out through a Licensed Distributor, who assumes responsibility for validating the issuer’s compliance with the framework. Exempt Virtual Assets, including non-transferable and redeemable closed-loop virtual assets, require neither a licence nor prior approval, though issuers remain subject to VARA’s supervision and enforcement. The issuance of Anonymity-Enhanced Cryptocurrencies is prohibited in the Emirate entirely.

All issuers, other than issuers of Exempt VAs, must publish a Whitepaper and a separate Risk Disclosure Statement before the virtual asset is made available to the public. No issuer may exclude or attempt to exclude civil liability in respect of information in a Whitepaper. Both documents must be kept accurate and up-to-date, with all prior versions remaining accessible for at least eight years from the date the virtual asset ceases to circulate. Issuers must also notify holders of any changes to the virtual asset before those changes take effect. Environmental responsibility is an explicit obligation under the framework and issuers must disclose how they identify, assess and manage climate-related risks relevant to the issuance and project lifecycle.

VARA’s licence for Category 1 issuances is not an endorsement of the issuer or the virtual asset and may not be represented as such. For investors, this is an important baseline: licensing confirms regulatory compliance at the point of authorisation, not the quality or suitability of the asset itself. Diligence expectations at the structuring and investment stage remain unchanged, and are if anything reinforced by the disclosure obligations the framework imposes on issuers.