Dubai is becoming a global leader in virtual asset regulation, thanks to the advent of the Virtual Asset Regulatory Authority (VARA) in 2022. With this new model, as more businesses enter the asset space, the need to follow a straight path through regulation has increased. VARA is the organization in charge of framing and enforcing these regulations and issuing licenses.
Applying for a VARA license is a complex process and ensures that only thorough and compliant entities are permitted to act as Virtual Asset Service Providers (VASPs) in Dubai. This article will provide a detailed overview of the multi-stage process of acquiring a VARA license, a review of the requirements, estimated costs, and best practices to help focus on increasing the chances of approval.
The Significance of a VARA License
To strengthen regulation surrounding virtual assets, Dubai implemented the Dubai Virtual Assets Regulation Law, thus establishing VARA. VARA has the authority to regulate and enforce virtual asset services in Dubai (except for the Dubai International Financial Centre which is regulated by the DFSA). VARA already has one of the most progressive regulatory frameworks for virtual assets in the world and is aimed at ensuring safe and sustainable innovation in the blockchain and crypto economy.
For a business that wishes to offer virtual asset services, like trading, brokerage, custody, or advisory services with respect to Virtual Assets in Dubai, obtaining a VARA license is not optional but a mandatory plan of action. Doing so without lawfully obtaining the license can lead to severe penalties, enforcement actions, including criminal penalties, and adverse consequences to the reputation of the business.
Having a VARA license shows that a firm operates under a governance framework that meets some of the highest standards for governance, financial stability, cybersecurity, AML, and consumer protection. It gives assurance to its investors, clients, and other business partners that the firm is serious about complying with regulations and is conducting its business ethically.
ALSO READ: What Is VARA and How Does It Help Make Crypto Safer in Dubai?
Summary of the VARA Licensing Framework
There are two stages to this licensing process:
- Stage 1: Initial Disclosure and Incorporation Approval
- Stage 2: Full-fledged VASP License Application
Within each stage, there are requirements, and correspondence with VARA and other governmental or free zone parties is required.
Stage 1: Initial Application and Incorporation Approval
The first stage begins with an Initial Disclosure Questionnaire (IDQ) submitted to either the Dubai Department of Economy & Tourism (DET) or a relevant Free Zone (FZ) (i.e., Dubai Multi Commodities Centre (DMCC) or Dubai Silicon Oasis). The stages of the process are initiated as follows:
1. IDQ Submission
The IDQ is a formal document that explains the business’ intentions, services offered, and operational model. The IDQ allows VARA to understand the applicant’s objectives and to enable the authority to establish whether the business is within the regulatory perimeter of the authority.
2. Supporting Document Submission
The following supporting documents must also be submitted:
- A full business plan
- Organizational chart and governance structure
- Identify all beneficial owners and senior management
- Communication of the company’s target clients and market entry strategy
- Risk management and cybersecurity frameworks (initial versions)
3. Payment of Initial Application Fees
Firms are usually required to pay 50% of the total license application fees at this stage. The fees are subject to change based on the specific type of license VASP being applied for.
4. Approval to Incorporate (ATI)
After the application is reviewed and accepted, VARA issues an Approval to Incorporate (ATI). This authorizes the applicant to legally incorporate the firm, secure office space, recruitment staff, and set up operational infrastructure.
It is important to note that at this stage, the applicant cannot conduct any virtual asset services. The ATI is merely a conditional approval to proceed with their business set-up, and not to launch any commercial activity.
Conditionality of the ATI
VARA may refuse to issue an ATI if the applicant:
- Is acting outside of virtual assets
- Is incapable of governance or financial stability
- Doesn’t meet the preliminary AML/KYC
Therefore, an ATI is a major milestone, however, it does not guarantee final approval.
Stage 2: Application for VASP License
Once the applicant’s entity has been incorporated, they may proceed to the second stage, application for a VASP license.
1. Final Documents Submission
VARA will provide a tailored checklist regarding the activities proposed by the firm. The applicant is required to submit:
- Final AML/KYC policy documents
- Cybersecurity protocols and technology stack
- Business continuity and disaster recovery plans
- Financial forecast and capital adequacy
- Customer onboarding and complaint procedures
This stage is more intensive as VARA scrutinizes the firm’s capabilities to safeguard client assets, mitigate financial crime risk, and respond to operational risk.
2. VARA Feedback and Engagement
VARA has the discretion to ask for further clarifications, documents, or interview key personnel. Applicants must expect to engage with and be closely scrutinised by the regulator including:
- Management interviews
- Compliance framework assessment
- IT infrastructure walk-through
This allows VARA to determine whether the firm has proper controls, staff and expertise to operate safely in the market for virtual assets.
3. Payment of Remaining Fees
The applicant will need to pay the other 50% of the application fee, in addition to the annual supervision fee for the first year, both of which vary from firm to firm, depending on the business model, activities, exhibits and hazards.
Fee schedules can be found in Schedule 2 of the Virtual Assets and Related Activities Regulations 2023.
4. Issuance of VASP License
If VARA is done reviewing all submissions as part of operational readiness, it will issue the VASP licence. The licence will include operational conditions, for example, reporting obligations, limitations on certain activities, or require audits on a regular basis.
Companies should also note to refer to Part VI of the Company Rulebook for the specific details on capital requirements, which will depend on whether the licence is for brokerage, custody, exchange, advisory or other regulated activity.
Typical Timelines:
The total licensing process can take anywhere from 4 months to 12 months, depending on the complexity of the business model, completeness, and the speed at which authority is provided by the applicant. Below is a rough breakdown:
IDQ submission to ATI: 1 to 3 months
Company setup and incorporation: 1 to 2 months
Full licence application to licence issue: 2 to 6 months
Capital and Compliance Requirements
Each VASP license type has its own capital adequacy requirements and management controls:
- Broker/Dealer: AED 1,000,000 embedded
- Custodian: AED 2,000,000+ minimum
- Exchange/Marketplace: AED 4,000,000 minimum or more, depending on size and scale
Besides capital, firms must also have:
- Transaction monitoring system
- Client due diligence procedures
- Independent compliance officer MLRO
- Regular internal and external audits
Best Practices for an Effective Submission
Involve experts early: Get legal and compliance consulting experts who know the UAE crypto regulations to guide and assist with your document preparation, develop a structural business plan, and determine the best options with interactions with the VARA.
Avoid generic documentation: Don’t use generic templates for compliance and risk or security policies. Develop compliance and security policies to match your operations.
Be transparent: Appropriately engage and careful to be clear, thorough and timely with the regulator. Do not expect vague communications from the regulator but they will follow up personally to your inquiries.
Demonstrate a local presence and commitment: Be committed to the UAE market by hiring local staff, having local offices, and integrating with local banking and legal systems.
Closing Thoughts
A VARA license is more than just one regulatory guideline—it is a strategic enhancement to a company’s credibility, safety in operation, and market access. The licensing process may not be easy, but is intended to build a safe, innovative, global space for a virtual asset ecosystem in Dubai.
The UAE is positioning itself as a global hub for blockchain and crypto and obtaining a VARA license for your firm sets it up for regulated and transparent activity in this high potential market.
If you are a business unfamiliar with the region, or new to compliance processes, a team of trusted advisors can make the application and license process much easier. Legal firms with expertise in crypto licensing, or that can appreciate, and are familiar with the VARA, ADGM, and DIFC frameworks, can support you and your team from pre-application requirements to ongoing compliance requirements after licensing.
By following the steps presented here, and maintaining adherence to best practices, applicants can achieve a successful licensing experience with VARA and realize the corresponding possibilities available in Dubai’s vibrant and rapid digital asset space.
