VARA licence for a crypto exchange in Dubai

What Dubai's virtual assets regulator asks of a crypto exchange: the two-stage licence, the rulebooks, capital and fees as VARA publishes them, local staff and the Travel Rule.

· Head of IT
· 7 min read
A gold key beside a violet glass bitcoin coin and trading candles, with shield and custody blocks

Running a crypto exchange in or from Dubai, outside the Dubai International Financial Centre (DIFC), takes a licence from the Virtual Assets Regulatory Authority (VARA), set up under Dubai Law No. (4) of 2022. VARA's licence page says the licence must be in place before you start operating.

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply. UAE rules change often, so each rule below carries the version and date VARA's site shows.

What an exchange is in VARA's law

VARA licenses eight activities, each applied for separately (FAQ). Exchange Services, defined in Schedule 1 of the Virtual Assets and Related Activities Regulations 2023 (version dated 19 May 2025, in force from 19 June 2025), covers exchanging virtual assets for fiat or for other virtual assets, matching buyers' and sellers' orders, and keeping an order book. Every licensee follows rules on storing clients' assets. Custody Services is a separate licence, and the Custody Services Rulebook (version dated 19 May 2025) puts the custodian in its own legal entity, apart from group companies running other virtual asset activities.

Who regulates it, and where

VARA covers the Dubai mainland and its free zones; DIFC has its own regulator, the DFSA. You do not apply to VARA directly: applications go through Dubai Economy and Tourism (DET) for mainland firms, or through a Dubai free zone. Federal rules apply too, including the anti-money laundering law and the Central Bank of the UAE's (CBUAE) payment token rules (Regulation III.A.4).

What the licence asks for

Rulebooks

Every exchange follows four compulsory rulebooks, each in a version dated 19 May 2025 and in force from 19 June 2025: the Company Rulebook, the Compliance and Risk Management Rulebook, the Technology and Information Rulebook and the Market Conduct Rulebook. On top comes the Exchange Services Rulebook, in a version dated and in force from 31 March 2026. It added rules for exchange-traded derivatives, which, like margin trading, need explicit approval in your licence.

Capital

Part VI of the Company Rulebook sets paid-up capital for Exchange Services at the higher of AED 1,500,000 or 25% of fixed annual overheads. If you use a VARA-licensed custodian, or VARA approves your arrangement during licensing, it is the higher of AED 800,000 or 15%. The capital sits in a trust account at a UAE bank with VARA as beneficiary, in a surety bond naming VARA, or as VARA specifies. You also need:

  • net liquid assets of at least 1.2 times monthly operating expenses, reconciled daily and reported monthly;

  • professional indemnity, directors' and officers' insurance, and crime cover for assets in hot wallets;

  • reserve assets equal to 100% of what you owe clients, in the same virtual asset, reconciled daily and audited independently at least every six months. A VARA circular of 6 October 2026 sets the minimum scope of that audit.

Fees

Schedule 2 of the Regulations sets an application fee of AED 100,000 and an annual supervision fee of AED 200,000 for Exchange Services. Each additional activity adds an extension fee of 50% of the lower application fee. VARA may adjust fees to a firm's risk profile, and DET or free zone fees are separate.

People and governance

  • Two Responsible Individuals: full-time employees, fit and proper, UAE residents or UAE passport holders, approved by VARA (Company Rulebook, Rule I.C).

  • A Compliance Officer with five years' compliance experience, resident in the UAE or holding a UAE passport, reporting to the board; an MLRO with two years' AML experience (Compliance and Risk Management Rulebook); and a CISO who is not the Compliance Officer (Technology and Information Rulebook).

  • A board with at least one independent director, meeting at least quarterly, with remuneration, nomination and audit committees (Exchange Services Rulebook, Part I).

Client assets and conduct

Client virtual assets sit in wallets separate from yours, one to one, never rehypothecated without client consent and the right licence, and reconciled daily. Client fiat goes into a client account at a third-party bank within one calendar day, and UAE clients' money stays with UAE banks. Trades settle within 24 hours. The firm may not actively invest its own or its group's portfolio, and it publishes its listing standards and a summary of each token it lists.

Local substance, technology and outsourcing

VARA requires a physical presence in Dubai, and exchange services need a private office (FAQ). Other staff may work outside Dubai if supervision stays effective. An independent third party tests your systems at least once a year and before new systems go live, and key management may have no single point of failure. Material outsourcing is notified to VARA in advance, and VARA may object.

AML and the Travel Rule

The federal AML law is Federal Decree-Law No. (10) of 2025, in force since 14 October 2025 as the CBUAE Rulebook shows, and VARA asked every licensee for a gap assessment against it in a circular of 24 November 2025. The UAE Virtual Assets Travel Rule is issued under its implementing regulation, Cabinet Resolution No. (134) of 2025, in force from 14 December 2025. VARA's circular of 24 February 2026 sets out what it expects:

  • originator and beneficiary details travel with every qualifying transfer, or it is not executed;

  • the counterparty provider is confirmed as regulated before sending;

  • the beneficiary is verified for transfers of AED 3,500 or more a day in aggregate, where not verified before;

  • transfers involving unhosted wallets get enhanced due diligence, including source of funds;

  • no transfers in privacy tokens.

During licensing you show VARA how you comply, including with providers in countries without a Travel Rule (Rule III.G). Suspicious transactions go to the UAE Financial Intelligence Unit through goAML, and VARA requires registration with the Executive Office (EOCN) for sanctions alerts (VARA news).

The steps

  1. Submit an Initial Disclosure Questionnaire to DET or a Dubai free zone, with a business plan and details of owners and senior management, and pay the initial fees, typically 50% of the application fee.

  2. Receive an Approval to Incorporate. You may incorporate, rent an office and hire, but not carry on virtual asset activities.

  3. Submit the full application following VARA's guidance, and expect meetings, interviews and requests for documents.

  4. Pay the rest of the application fee and the first year's supervision fee, and receive the licence, which may carry operational conditions.

The licence is annual, and VARA sends a renewal notice 90 days ahead. Retail clients can be served once licensed, though VARA may limit a licensee to qualified and institutional investors. VARA's pages publish no target processing time.

Before your own licence

There is little room to start early. VARA's Sponsored VASP regime (Compliance and Risk Management Rulebook, Part VII) works only within a group: the sponsor must control the sponsored firm or share its controller. A branded front end on another firm's exchange is no shortcut, because soliciting or accepting orders is itself a licensed Broker-Dealer Service. Unlicensed firms may market in Dubai with a permit, but may not onboard Dubai residents (FAQ). Use the Approval to Incorporate stage to build the entity, the team and the systems.

Common mistakes

  • Budgeting only the paid-up capital. Net liquid assets, insurance and full reserves come on top.

  • Choosing the custodian late. It changes your capital floor, and in-house custody needs a separate licensed company.

  • Key people abroad. Responsible Individuals and the Compliance Officer must be UAE residents or UAE passport holders.

  • Market making from the house account. Actively investing the firm's own portfolio is prohibited.

  • Policies written to the old AML law. Federal Decree-Law No. (20) of 2018 has been replaced.

  • An old rulebook PDF. The Exchange Services Rulebook changed on 31 March 2026.

What this means for your platform

Most of these rules end up in software. Our white-label crypto exchange platform ships with custody wallets in hot, warm and cold tiers, withdrawal approvals and proof of reserves reporting; a ledger that reconciles daily against the chain and the bank; screening of every deposit and withdrawal; Travel Rule messaging through Notabene, Sygna, 21 Analytics or TRP; and a matching engine with a full audit trail and circuit breakers. We configure it to match the licence VARA grants you. For the EU route, see our MiCA checklist; for the budget, what it costs to launch an exchange.

Sources

Checked on 6 October 2026.

Written by

Paynoramic's Head of IT

Head of IT

Head of IT at Paynoramic, responsible for the module library every platform is built from. Has worked on payment, banking and workforce platforms for companies including American Express, Teya and Indeed Flex, and for a global card issuer-processor. Writes about what a fintech or crypto launch needs beyond the software: licensing, certification and the real cost.

Keep reading

All insights

Building something like this?

Tell us the idea and we will show you the platform it maps to.

Start your project