Crypto Business Licence in the UAE: VARA, DFSA, FSRA or CMA (formerly SCA)

In short: there is no single UAE crypto licence. In Dubai outside DIFC, you need a VARA licence for each virtual asset activity, granted in two stages: an Approval to Incorporate, then the full licence. VARA’s application fee is AED 40,000 or AED 100,000, and its annual supervision fee is AED 80,000 or AED 200,000 per activity, so a single-activity exchange pays VARA AED 300,000 in year one. DIFC firms need the DFSA, ADGM firms the FSRA, and the other emirates the Capital Market Authority (CMA, formerly the SCA). Stablecoin services also need the Central Bank. A trade licence alone never permits regulated crypto activity.

The UAE has no single crypto licence. VARA covers Dubai outside DIFC, the DFSA covers DIFC, the FSRA covers ADGM, and the Capital Market Authority (CMA, formerly the SCA) covers the other emirates. The Central Bank regulates stablecoins. Your location and activity decide which one you need.

This guide is for founders and finance teams who plan to offer crypto or virtual asset services in or from the UAE: exchanges, brokers, custodians, asset managers, lending platforms, token issuers and payment businesses. It also covers the Web3 teams that need to know whether they need a licence at all. It is part of our guide to starting a business in the UAE.

Its main tool is a regulator map, by location and by activity. It quotes only fees and rules published by the regulators themselves, first checked on 3 October 2026 and re-checked on 10 October 2026. This is a regulated financial sector: no regulator guarantees approval, and neither can any setup company.

Which regulator licenses a crypto business in the UAE?

It depends first on where your company is established. The two financial free zones have their own regulators, Dubai has VARA for the rest of the emirate, and a federal authority covers everywhere else.

VARA, created by Dubai Law No. 4 of 2022, describes itself as the sole virtual asset authority across Dubai’s mainland and free zones, except the DIFC.

How VARA and the federal authority divide the work

In April 2023 the SCA said every UAE company providing virtual asset services, except in the financial free zones, must be licensed by it, with Dubai firms applying to VARA. Under a September 2024 cooperation agreement, Dubai firms get a VARA licence and are registered with the SCA (now the CMA) to serve the wider UAE. The CMA’s 2026 framework has since replaced the SCA’s rules, and law firm commentary describes the CMA and VARA regimes as running in parallel. If you will serve clients in several emirates from Dubai, ask VARA in writing how the 2024 arrangement applies now. We found no official statement on this.

Which regulator covers which activity?

Activity is the second filter. One business can need two regulators, such as a Dubai exchange that also issues a dirham stablecoin.

Payment tokens and stablecoins: the Central Bank

The CBUAE’s Payment Token Services Regulation (C 2/2024), in force since 31 August 2024, covers Payment Token Issuance, Conversion, and Custody and Transfer. Article 2 says no one may provide these services in the UAE, or to people in the UAE, without a Central Bank licence or registration. It also bans algorithmic stablecoins and privacy tokens, even for firms licensed by the CMA (formerly the SCA) or VARA. Foreign-currency stablecoins may be transferred only to pay for virtual assets or their derivatives. For this Regulation, a financial free zone company counts as outside the UAE. The Central Bank’s powers now rest on Federal Decree-Law No. 6 of 2025, which replaced the 2018 Central Bank law.

Do crypto-linked payment cards need a licence?

Usually two permissions are involved. Under the Central Bank’s Retail Payment Services and Card Schemes Regulation, a card issuer is a category of payment service provider, so the card itself must be issued under a Central Bank licence, whether yours or a licensed issuer’s. Holding, converting or selling the user’s crypto behind the card is a separate virtual asset activity that needs the regulator for your location, such as VARA in Dubai. The Payment Token Services Regulation matters too: under its Article 2, a UAE merchant may accept a virtual asset itself as payment only if it is a licensed dirham payment token, or a registered foreign payment token used to buy virtual assets.

Where can you set up a crypto company in the UAE?

Inside Dubai, the free zone or mainland choice mainly affects your office, visas and costs, because VARA regulates both.

Innovation City, the former RAK Digital Assets Oasis (RAK DAO), states on its home page that it is a commercial free zone, and that regulated activity cannot start until the CMA licence or approval is issued. A free zone licence that names a blockchain activity is not a financial services licence.

VARA vs DFSA: what is the difference?

Both are Dubai regulators, but they do not overlap. The DFSA covers only the DIFC. VARA covers the rest of Dubai, mainland and free zones. So the choice is really a choice of location: a DMCC or mainland company cannot opt for the DFSA, and a DIFC firm cannot opt for VARA.

Both assess your business model and whether the people running it are fit and proper, and neither guarantees approval. In general terms, the DFSA route fits firms that want to sit in a common-law financial centre alongside other regulated financial services, while the VARA route fits firms that want a mainland or ordinary free zone base with virtual assets as the core business.

How does the VARA route work?

VARA’s process has two stages, and both start with your commercial licensing authority (DET or the free zone), not with VARA directly. This is a summary only: the detailed application file is a specialist compliance project.

Timeline: VARA publishes no target processing time. Expect months rather than weeks, and budget for office and key staff costs between ATI and licence, when you cannot earn virtual asset revenue. The company formation part usually moves faster than the regulatory part.

What does a VARA licence cost?

VARA’s fees are set in Schedule 2 of the Virtual Assets and Related Activities Regulations 2023, re-checked on VARA’s rulebook site on 10 October 2026.

How the fees work, per Schedule 2:

• Each additional activity in the same application carries a Licence Extension Fee of 50% of the lower application fee(s). Application and extension fees are due when you submit, and VARA does not process the application until they are paid.
• The annual supervision fee is payable for each licensed activity before you start operating.
• VARA may charge extra supervision fees based on your risk profile, market share, target market, business complexity or compliance history. It may also charge a fee for issuance approvals and whitepapers.

Worked example from the published figures: a single-activity Advisory Services licence means AED 40,000 in application fees and AED 80,000 in first-year supervision, so AED 120,000 to VARA before you start. A single-activity exchange licence means AED 100,000 plus AED 200,000, so AED 300,000.

Not included above: DET or free zone licence and office costs, visa fees, the capital VARA requires under its Company Rulebook, compliance staff, legal drafting and bank fees. Setup and consultancy fees are commercial charges, not government fees. DFSA, FSRA and CMA fees are set in their own rules and are not covered here.

Do you need a licence if you only build blockchain software or NFTs?

Sometimes not, but “it’s just code” is not a reliable test. What matters is what your product does for users. In short:

• Pure development: VARA’s FAQ says Distributed Ledger Technology (DLT) service providers need a VARA licence only if they carry on one of the eight regulated activities. Those that do not may register with VARA voluntarily. A studio building smart contracts or software for clients is usually a software business. See our software and IT company setup guide.
• Metaverse and games: VARA says metaverse businesses are generally not required to hold a VARA licence “at this time”, unless they carry on regulated virtual asset activities. For games with tokens or in-game economies, see our gaming business setup guide.
• NFTs: minting NFTs or releasing a new token in Dubai is Category 2 issuance, which needs VARA’s prior approval. An NFT marketplace with a free zone commercial licence needs a VARA Exchange and/or Broker-Dealer licence, depending on what it does.
• Proprietary trading: VARA’s FAQ says a company trading only its own funds with no clients does not need a VARA licence at this time. Trading above certain volumes must be registered with VARA, and different FAQ answers give different thresholds, so confirm with VARA directly.
• DeFi: Article 62 of the Central Bank law (Federal Decree-Law No. 6 of 2025, in force since 16 September 2025) brings within Central Bank licensing anyone offering or operating platforms, dApps, protocols or infrastructure that enable payments, credit, deposits, exchange, remittances or investment services, whatever the technology.

Outside Dubai, tech zones such as RAK Innovation City fit Web3 teams whose activity is confirmed to be outside regulated services. Get that confirmation from the zone or the CMA in writing before you sign a package. Our Ras Al Khaimah free zones comparison sets Innovation City’s packages against RAKEZ.

What approvals does a crypto business need in the UAE?

• A written activity analysis: which regulated activities you will carry on, for whom, and from where.
• The regulator for your location (VARA, DFSA, FSRA or CMA), plus the CBUAE if payment tokens are involved.
• For Dubai: an Initial Disclosure Questionnaire through DET or the free zone, then an Approval to Incorporate, then the full VASP licence for each activity.
• A commercial licence from DET or the free zone, with a legal form VARA accepts (LLC or FZ-CO).
• Two Responsible Individuals approved by VARA as fit and proper. Each must be a full-time employee and either a UAE resident or a UAE passport holder.
• A private office in Dubai for every VARA activity except advisory.
• Capital at the level the regulator’s rules require (VARA: Company Rulebook).
• Ultimate beneficial owner records filed with your licensing authority (see our UBO register guide).
• goAML registration with the UAE Financial Intelligence Unit, and a named money laundering reporting officer (MLRO).
• Corporate tax registration and, if your taxable supplies require it, VAT registration.
• Marketing cleared under VARA’s Marketing Regulations (or your regulator’s equivalent) before any promotion.

Can you market crypto services in the UAE before you are licensed?

No. VARA’s Marketing Regulations 2024 apply to every entity, licensed or not, local or foreign, that markets virtual assets or VA activities “in or targeting the UAE”. Under Regulation I.B.3, only a VASP licensed by VARA for that activity, or someone acting with its approval, may market it. Marketing includes social media posts, influencer content, podcasts, events in Dubai, sponsored articles, merchandise and airdrops.

Influencers need their own permission as well. Under the CMA Chairman’s Resolution No. 10/R.M of 2025, people who give recommendations on buying, selling or holding a financial product or virtual asset in the UAE, including on social media, must be registered with the Capital Market Authority (CMA, formerly the SCA) as finfluencers. The CMA publishes a list of authorised finfluencers, so check it before you pay anyone to promote your service.

Why do banking and AML take the longest?

VARA’s Compliance and Risk Management Rulebook requires your MLRO to report suspicious transactions to the UAE Financial Intelligence Unit (FIU) immediately, on the goAML platform or another FIU-approved channel. You need a goAML registration, an MLRO who understands on-chain monitoring, and written policies the regulator reviews before licensing.

Banking is usually the slowest step. A regulator’s licence does not oblige a bank to open an account. Expect questions on founders’ source of wealth, client fiat flows, supported chains and tokens, and monitoring tools. Approach banks early, using the ATI or in-principle approval as evidence of progress. Our corporate bank account guide covers the KYC file and common refusal reasons.

Which staff need UAE residence for a crypto licence?

VARA’s two Responsible Individuals must be full-time employees and UAE residents or passport holders, so at least two people usually need residence through the company early on. Founders’ options are in our guide to investor, partner and manager visas. Visa quota follows your office, and VARA leaves office size to DET or the free zone.

Do crypto businesses pay VAT and corporate tax in the UAE?

VAT: the VAT Executive Regulation (Article 42, as amended by Cabinet Decision No. 100 of 2024) treats the transfer of ownership of virtual assets and the conversion of virtual assets as exempt financial services. The exemption applies to supplies made on or after 1 January 2018. Keeping and managing virtual assets (custody) is listed as a financial service, but it is exempt only when no explicit fee or commission is charged. Fee-based custody, advisory and software services are generally standard-rated. Exempt supplies affect how much input VAT you can recover, so take tax advice on your revenue mix.

Corporate tax: UAE corporate tax is 9% on taxable income above AED 375,000. Free zone status does not mean regulated financial income is taxed at 0%, so check the qualifying-income rules with a tax adviser. Registration steps and deadlines are in our corporate tax registration guide.

What mistakes delay or block a crypto licence?

• Choosing the zone before the regulator. Signing a free zone package and then finding that the activity needs a regulator the zone cannot provide, or a VARA private office that the package does not include.
• Treating the trade licence as the licence. Starting operations after incorporation or the ATI, before the regulator’s licence is issued.
• Combining custody with other activities in one company. VARA requires a separate custody entity.
• Running the group’s treasury trading inside the licensed VASP. VARA prohibits proprietary trading under the regulated licence.
• Marketing too early. Social posts, sponsorships and airdrops aimed at the UAE before licensing.
• Reusing another regulator’s file. The DFSA warns applicants not to reuse documents submitted to other regulators without checking that they are relevant.
• Ignoring the Central Bank. Adding a stablecoin, fiat on-ramp or DeFi lending feature without checking the Payment Token Services Regulation and Article 62.
• Leaving banking to the end. Licensed but unbanked is a common and expensive gap.

For the company formation side of any of these routes, see our business setup service in Dubai.

Questions people ask