Dubai has emerged as one of the more structured regions in the world for operating a virtual asset company, and the leading body in this is the Virtual Assets Regulatory Authority (VARA). VARA license is the key to most crypto businesses looking to do business from Dubai. While this guide is informative in nature and clearly outlines what VARA is, what it regulates, how the licensing process works and what a business can expect, it is important to note that the rules are detailed, and have changed over time, and the current requirements of a company should be confirmed by reference to the published rulebooks for VARA.
What is VARA?
VARA is the regulator of virtual assets in Dubai, which encompasses cryptocurrencies and other digital representations of value that are traded or transferred. It was created to provide virtual asset businesses with a defined licensing process, rather than a grey area to exist. A VARA license is official permission granted by VARA to conduct one or more specific virtual asset activities in The Emirate of Dubai.
There is one boundary which is fundamental and must be understood from the beginning. VARA is responsible for Dubai, including free zones, but with one notable exception, the Dubai International Financial Centre (DIFC). Inside DIFC, the activity of virtual assets is regulated by the Dubai Financial Services Authority, in its own crypto framework, rather than VARA. A crypto company in Dubai will thus need to determine at first if it falls under VARA or the DIFC regime, as the two are completely split.
Which Businesses Need a VARA License?
The scope is wide, but not all companies that come into contact with crypto are obliged to have a VARA license. VARA will, in general, have jurisdiction over a business that performs any of the regulated virtual asset activities from, or within, Dubai, such as operating an exchange, holding customer assets in custody, broking virtual asset trades, or providing management, advisory, lending or transfer services relating to virtual assets. A business may also fall under the radar if it is marketing or otherwise promoting virtual asset services to individuals in Dubai. A company that accepts a virtual asset as a payment for a different business it provided will have a different position to a company that provides virtual asset related business. This is because there are specific boundaries within each particular model which need to be defined and cannot be assumed.
The Regulatory Framework
VARA was set up under the legislation which regulates virtual assets, giving VARA the authority and power to regulate virtual asset activities in Dubai. VARA has since published a set of regulations and rulebooks which must be followed by a licensee. They are general rulebooks, applicable to all of the licensees (usually covering company and governance requirements, compliance and risk management, technology and information security, and market conduct) and activity-specific rulebooks which add rules for each type of activity. VARA is also within the broader framework of the UAE. On the federal level, the Securities and Commodities Authority has a role in regulating virtual assets nationwide, outside the financial free zones and Dubai, and the Federal and Dubai regimes are coordinated. The two financial free zones, DIFC and ADGM, have their own virtual asset regulations implemented by the Dubai Financial Services Authority (DFSA) and the Financial Services Regulatory Authority (FSRA), respectively. In practice, a business will need to determine which regulator it will fall under in the jurisdiction it wishes to register in, and the way the regimes will interact. The issue now is not whether it is possible to get a crypto licence in Dubai, but whose regulator is responsible for the particular location and the activity that is being reviewed, which will then dictate the rulebook, time and costs. If one gets this wrong at the beginning, the they will be training for the wrong regime and will have to start over.
Activities VARA Licenses
VARA licenses specific activities. There are a number of regulated activities that it covers, including the following.
Advisory services relating to virtual assets.
Custody services: Custodial services are a way of storing virtual assets on behalf of other people.
Exchange services: operating a platform to trade virtual assets.
Lending and borrowing services.
Management and investing services for virtual assets.
Transfer and settlement services.
A business needs to determine which of these it will undertake, since the requirements and the rulebook used will vary depending on what activities are required. Some of the activities may be undertaken jointly under one authorisation, while other activities require increased requirements.
It is useful to follow this method. It allows VARA to customize its needs to the specific risk associated with a particular service (custody of client assets, for example, presents a different set of concerns from pure advice), and it suggests that a business thinking about providing multiple services should scope all those services up front. It is also a new regulatory step to add a new regulated activity later, but if planning is done early it will not need to be re-opened. If a new regulated activity is added at a later stage, this is a new regulatory action and not something that can be taken for granted, it is better to plan for this action now than at a later point.
How the Licensing Process Works
The process has been more of a staged process whereby the applicant has progressed from initial approval to a full authorisation to operate. At a high level, the following shape can be expected of a business.
Preparation and pre-application engagement: The applicant implements its activities, corporate structure, and management and usually approaches VARA prior to applying formally.
Application and initial approval: Handing over comprehensive details of the business and its owners and controllers, its governance, its financial resources, its compliance and technology arrangements, and VARA assessing the fitness and propriety of those involved.
Conditions and preparatory phase: The applicant meets a set of conditions (implements the necessary policies, systems, capital, compliance officer, money laundering reporting officer, etc) before operations commence.
Authorisation to operate: VARA will give approval to the licensed activity when conditions are met, with continued oversight.
VARA has had precise nomenclature for the stages of its licence and over time has developed a process. Therefore, the present stages, terminology, costs, and timelines should be verified directly with VARA and not be assumed based on reporting on previous stages. This is where the most changes are likely to have occurred.
What VARA Expects a Licensee to Have
A well-formed Dubai company with fit and proper owners and managers and a physical presence in Dubai. Good governance and senior appointments such as dedicated compliance and anti-money laundering functions.
Financial resources and capital suitable for the activity, this should be taken from the current rule books and not assumed.
Anti-money-laundering and counter-terrorist-financing systems that comply with UAE laws.
Technology, cyber security, and information-security controls.
Market conduct, such as the way a client's assets are protected and the way a customer is treated.
While doing so, the ongoing process has to be updated to VARA.
Key Considerations and Risks
As mentioned above, there are two separate regimes, one of which is VARA and the other is DIFC regulator. Basing a crypto business in Dubai without checking whether VARA or the DIFC regulator applies is a fundamental mistake.
Lowering the level of material and price. The business needs the raw materials, the systems and the capital in Dubai. There are significant compliance, technology and staffing needs.
Marketing before licensing. Marketing as a regulated activity is already the stance of VARA and the promotion or offering of virtual asset services in Dubai without the necessary authorization can lead to a violation of its rules. Any marketing or provision of virtual asset services in Dubai that is not properly authorized by VARA could be a violation of the regulatory framework of VARA. Compliance has been at the heart of its published rules, rulebooks and supervisory communications, and it is important for businesses to put in place all the necessary approvals before they start to engage in regulated activities.
The presumption of activities one over the other. Requirements vary from activity to activity and performing an activity without a licence is a violation.
Using inaccurate data. This is a fast-moving area. The set-up requirements including rulebooks, fees, capital requirements, and phases of the process have altered since the regime was introduced and could change again and so it is important to check the current requirements with a regulatory adviser.
Getting a VARA License Right
The main way for crypto businesses to want to fly outside the DIFC is via a VARA license and the regime is purpose built: specific activities, detailed rulebooks, staged authorisation, ongoing supervision. The strengths of the framework (clarity, legitimacy) are accompanied by real commitments as it relates to governance, capital, compliance, and technology.
The steps would presumably be first, to see if VARA or DIFC regulator applies, second, to see what can be done that is covered by the rulebooks, third, to establish governance, compliance, technology and capital to satisfy the rulebooks, and fourth, to budget for a regulator relationship, which continues after the licence is granted. It is more of a continuous regulatory requirement, rather than an application once. The biggest precaution relates to information. The rules of VARA are quite specific and have been altered over the years, but this paper is not about a set of numbers or steps that could be taken at this moment, but it is about the general form of the regime. When making an application, any business should base itself on the current rulebooks of VARA, and, for something so complex, and with so much at stake for getting it wrong, should take regulatory advice first. It is important to know first which regulator has jurisdiction and what the regulator is currently looking for.
