So you’ve picked your jurisdiction. You know whether you’re going VARA or ADGM. Now comes the part where most founders get stuck: putting together the actual application.
Because regulators don’t just want a business plan and some AML policies. They want evidence. Logs, board minutes, test results, vendor SLAs, training registers, and detailed risk frameworks that prove you can run a regulated business, not just describe one on paper.
And the bar keeps rising. The UAE’s 2025 National Risk Assessment flagged virtual assets as high-risk. FATF and MENAFATF mutual evaluation onsite is scheduled for June 2026. Applications are getting more scrutiny, not less.
If you haven’t chosen your licensing path yet, start with our guide on the five licensing paths for crypto companies in the UAE. This article picks up where that decision ends: what regulators typically ask for across six documentation categories, where applications stall, and how to prepare before you file.
All figures in this article are approximate. Service charges, consultation fees, legal advisory, document preparation, notary, attestation, PRO services, and government processing fees are additional and quoted separately.
1. The Six Documentation Categories Regulators Evaluate
Whether you’re applying to VARA, ADGM, or DIFC, regulators evaluate your application across six broad categories. The specific forms differ, but the underlying questions are the same: Can you actually run this business? Do you have the people, systems, and controls to operate safely? And can you prove it?
Corporate Structure and Ownership
Regulators start here. They want to see who owns the entity, how it fits into any larger group structure, and whether the ownership chain is clean.
What you’ll submit:
Certificate of incorporation, or for VARA applications, your plan for incorporation after receiving Approval to Incorporate. Organizational chart showing reporting lines, subsidiaries, and group structure. Ultimate Beneficial Owner list with ownership percentages down to the required threshold. Close-links analysis covering relationships between UBOs, other regulated entities, and any regulatory connections. Shareholder agreements and articles of association.
Jurisdiction-specific requirements:
VARA requires an LLC or Free Zone Company. Sole proprietorships are rejected. You need a physical office in Dubai, not a flexi-desk arrangement. ADGM requires an ADGM-registered entity under the common law framework. You’ll submit the GIRA form alongside your Virtual Asset Application Form.
What “good” looks like:
Clean ownership chain with no unexplained gaps. UBO declarations that match corporate registry records exactly. Org chart showing the actual operational structure, rather than legal entities on paper. If you have a complex group structure, clear documentation of how the UAE entity relates to parent companies, sister entities, and any regulated affiliates.
What gets flagged:
Nominees hiding real ownership without disclosure. Circular ownership structures that obscure control. UBOs in high-risk jurisdictions without explanation or enhanced due diligence documentation. Mismatches between what’s declared in the application and what’s registered with corporate authorities. Any gaps in the ownership chain that leave regulators guessing.
People and Fit-and-Proper Assessments
Once your corporate structure checks out, regulators turn to the individuals behind the business. This category surprises founders more than any other. Regulators don’t simply check CVs. They evaluate character, competence, and financial soundness for every key individual.
VARA’s Fit and Proper criteria:
Competence means relevant degree or industry qualifications plus hands-on experience in virtual assets or similar regulated industries. The scale of your experience must match the complexity of the business you’re proposing to run.
Integrity involves a criminal background check. Prior convictions don’t automatically disqualify you, but VARA considers severity, relevance, time elapsed, and evidence of rehabilitation. Any adverse findings from other regulators globally must be disclosed.
Financial soundness covers unresolved bankruptcy, insolvency, or debt judgments. VARA checks whether personal financial history suggests risk to client money.
Reputation is evaluated explicitly. Would this individual’s appointment damage market perception of the VASP? VARA makes that judgment call.
Responsible Individuals:
Two are required. Each must be a full-time employee of the VASP, VARA-approved through their own fit-and-proper assessment, and a UAE resident or UAE passport holder. They carry personal accountability for the firm’s regulatory compliance.
Compliance Officer:
Must be full-time, UAE-resident, with minimum five years of relevant experience. VARA approves this appointment.
Money Laundering Reporting Officer:
UAE-resident with real authority, not a title on paper. Responsible for suspicious activity reporting and escalation.
Evidence regulators expect:
Full CVs with complete employment history. Passport copies. Education certificates and professional qualifications. Reference letters from prior employers or professional contacts. Declaration forms covering criminal history, regulatory actions anywhere in the world, bankruptcy or insolvency, directorships held, and any conflicts of interest. For Responsible Individuals, evidence of UAE residency or passport status.
Where this breaks:
Founders who plan to appoint Responsible Individuals “later” or who assume a remote compliance officer counts. VARA wants these roles filled and individuals vetted before granting the full licence. Budget 4-8 weeks for fit-and-proper clearance, sometimes longer.
ADGM operates similarly through its Controlled Functions framework. FSRA approval is required for specific regulated functions, assessed under the Financial Services and Markets Regulations.
Governance and Risk Management
Regulators want to see that your company has the structures to make decisions, manage risk, and handle problems when they arise.
Documentation required:
Board and committee charters showing governance structure. Governance framework document explaining how decisions flow. Compliance manual with real detail, not a template. Risk management framework covering enterprise risk assessment and product-level risk scoring. Outsourcing register listing every third-party service provider, what they do, oversight mechanisms, and SLAs. Conflict of interest policy. Complaints handling procedures. Succession plan for key roles.
Wind-down plan:
Mandatory under Rulebook 2.0 for all VASPs regardless of whether you’re planning to close. Your wind-down plan must show how VARA can intervene and assume control of client money and virtual assets if your VASP fails or breaches regulations. This requirement exists to protect clients, not you.
What passes review:
Board with crypto-competent members, not just legal and finance generalists who’ve never touched a blockchain. Governance procedures that are documented and implemented, with evidence of actual use. Outsourcing register that includes vendor SLAs and records of oversight, beyond a simple list of names.
Common red flags:
Boilerplate policies clearly copied from templates. Governance frameworks that don’t match your actual business structure. Missing succession plans for critical roles. No wind-down plan despite the Rulebook 2.0 requirement.
AML and CFT Framework
If there’s one category where regulators spend the most time, it’s this one. The UAE’s 2025 National Risk Assessment rated virtual assets as high-risk. With the FATF onsite evaluation coming in June 2026, regulators are preparing by tightening application review.
What your AML/CFT policy must cover:
Client risk assessment methodology explaining how you categorize clients as high, medium, or low risk. What factors drive the rating? How often do you reassess? Rulebook 2.0 requires at least quarterly reassessment.
Customer Due Diligence procedures for identity verification, UBO identification for corporate clients, and triggers for enhanced due diligence.
PEP and sanctions screening identifying which databases you use, screening frequency, and escalation procedures when there’s a match.
Transaction monitoring covering on-chain and off-chain analytics, automated alerts, manual review thresholds, and escalation procedures.
Suspicious Activity Reporting including internal escalation process, timeline for filing with the UAE Financial Intelligence Unit, and record-keeping requirements.
Wallet screening and DeFi interaction policies explaining how you handle funds from mixing services, privacy protocols, or unhosted wallets.
Training program with AML/CFT training schedule for all staff and training attendance records.
Evidence regulators expect:
Beyond the policy document, regulators want proof of implementation. Transaction monitoring system vendor contract. Screening tool configuration screenshots. Sample onboarding workflow. Training attendance logs. SAR filing records with client details redacted. Board-level AML reporting samples showing the compliance function actually reports upward.
Where regulators push back:
Generic policies that read like templates. Client risk methodology that lacks specificity for your actual business model. No evidence of implementation beyond the policy document itself. Missing wallet screening procedures in an industry where on-chain risk is fundamental.
ADGM expects full FATF compliance and alignment with UAE federal AML laws, with enhanced requirements for clients with PEP status or connections to sanctioned jurisdictions.
Technology and Information Security
Your AML framework shows regulators you can detect financial crime. Your technology documentation shows them you can prevent it. VARA’s Technology and Information Rulebook, updated in Rulebook 2.0, introduced the Technology Governance and Risk Assessment Framework. For exchanges and custodians, technology requirements are the most demanding in the entire application.
What TGRAF covers:
Cybersecurity governance and organizational accountability. Secure systems development lifecycle. Change management procedures. Incident response plans. Third-party technology risk assessment. Developer environment controls. Logging and audit trails. Data protection aligned with UAE’s Personal Data Protection Law.
Mandatory threat-led penetration testing:
Not just vulnerability scans, but adversarial testing that simulates real attack scenarios. You need this completed and documented before submission.
Additional requirements for certain activities:
Key and custody management documentation if you’re handling client assets. Business continuity and disaster recovery plans. Systems readiness confirmation before go-live.
Evidence expected:
Security policies. Access control documentation. Change management logs. Penetration test reports from a recognized provider. Incident response runbooks. Backup and recovery test results.
For exchanges: market manipulation detection systems documentation, real-time surveillance architecture, hot and cold wallet architecture, key management procedures.
Gaps that delay licensing:
Submitting without penetration test reports. Missing incident response plans. Vague or generic security policies that don’t address the specific risks of virtual asset custody. No evidence of backup and recovery testing.
Financial Projections and Capital Evidence
The final category ties everything together: can you afford to run what you’re proposing? Regulators want to see that your business model works on paper and that you have the capital to back it up.
Documentation required:
Detailed business plan covering revenue model, client acquisition strategy, transaction flow projections, and break-even timeline. Not “we’re a crypto company” but specific operational details.
Financial projections including three-year P&L, cash flow, and balance sheet.
Proof of paid-up capital with bank statements showing the required minimum is deposited in the entity’s account.
Expense-based capital buffer demonstrating 1.2x monthly operating expenses held as liquid assets. Rulebook 2.0 expanded accepted assets to include USD or AED-referenced virtual assets.
Reserve arrangements for token issuers.
Insurance certificates covering professional indemnity, directors and officers liability, and commercial crime including hot wallet coverage where applicable.
Wind-down plan financial projections showing how long the business can sustain operations during orderly wind-down and what that costs.
A strong submission includes:
Realistic financial model that matches the business plan narrative. Capital proof that exceeds minimums with buffer. Insurance coverage that reflects your actual risk profile. Clear wind-down projections.
What gets flagged:
Overly optimistic revenue projections with no supporting basis. Capital sitting in a founder’s personal account rather than the entity’s corporate account. No insurance for client-facing activities. Financial model that ignores compliance costs. For ongoing cost expectations, see our guide on crypto business licence activities, compliance, and banking.
Not sure if your documentation is regulator-ready? We review application packages before submission.
2. Where Applications Actually Stall
Knowing what to prepare is one thing. Knowing where founders actually trip up is another. These are the delays and rejections that add months to timelines and thousands to costs.
People not ready.
Founders who haven’t secured their Responsible Individuals or Compliance Officer before filing. VARA won’t grant a full licence without approved fit-and-proper individuals in place. The 4-8 week clearance timeline runs in parallel with your application, but only if you start it early enough. Wait until VARA asks, and you’ve added months.
Policies without evidence.
“We do X” is not enough. Regulators want logs, records, vendor SLAs, test results, board minutes, and training registers. A policy document is a starting point, not proof of compliance. If your AML policy says you screen all transactions but you can’t show your screening tool configuration and sample alerts, expect questions.
Underestimating AML depth.
The AML/CFT framework is the most scrutinized section. Generic policies or obvious templates get sent back. Regulators look for client-specific risk methodology, wallet screening procedures, and evidence that your compliance function actually operates. Boilerplate doesn’t pass.
Wrong entity structure.
Incorporating before understanding regulatory requirements. Setting up as a sole proprietorship when VARA only accepts LLCs and Free Zone Companies. Incorporating without custody segregation in mind when your business model requires it. Fixing structural mistakes after the fact is expensive.
Incomplete technology documentation.
Submitting without penetration test reports, incident response plans, or systems readiness confirmation. Technology gaps delay licensing by months because you can’t fake this evidence. Either the test happened or it didn’t.
No wind-down plan.
Mandatory under Rulebook 2.0 for all VASPs. Founders forget this requirement or assume it only applies to businesses planning to close. It doesn’t. Every VASP needs one.
Capital in wrong place.
Money sitting in a founder’s personal account instead of the entity’s corporate account. Capital proof that doesn’t match declared share capital. Bank statement dates that don’t align with application timing.
Ignoring regulator queries.
After submission, VARA and ADGM send follow-up questions. Slow or incomplete responses extend timelines by weeks or months. Treat every query as a test of your operational readiness. Fast, evidence-based replies signal competence.
Most delays come from gaps that could have been fixed before filing. We identify those gaps upfront.
3. VARA vs ADGM: How Application Processes Differ
The documentation requirements above apply regardless of which regulator you’re approaching. But the process for submitting that documentation differs between VARA and ADGM in ways that affect your preparation timeline and strategy. This comparison is procedural, not jurisdictional. For jurisdiction selection, see our guide on the five licensing paths for crypto companies in the UAE.
VARA Application Stages:
Submit the Initial Disclosure Questionnaire through Dubai Economy and Tourism or your relevant free zone authority. VARA conducts a preliminary assessment. If approved, you receive Approval to Incorporate and pay 50% of the licence fee. Incorporate your Dubai entity as an LLC or Free Zone Company. Build out your full operational presence: policies, technology, staffing. Submit the complete VASP licence application with documentation across all six categories. VARA reviews with follow-up queries, often multiple rounds. Licence grant with any conditions. Go-live authorized.
Total timeline: 7-12+ months depending on preparedness and activity complexity.
VARA’s style is prescriptive. Detailed rulebooks tell you exactly what to submit. Follow the checklist.
ADGM Application Stages:
Pre-application engagement with FSRA is recommended though not mandatory. Submit the GIRA form and Virtual Asset Application Form. Provide detailed business plan, compliance documentation, and fit-and-proper assessments. FSRA reviews with engagement sessions. Grant of Financial Services Permission. Become an Authorized Person under the Financial Services and Markets Regulations.
Total timeline: 12-24 months for a full licence. 2-3 months via RegLab sandbox with limited scope.
ADGM’s style is principles-based. They expect you to demonstrate understanding of regulatory objectives and design your own compliance framework accordingly. More freedom, more responsibility.
Key procedural difference:
ADGM’s June 2025 amendments shifted Accepted Virtual Asset approvals from regulator-approval to self-assessment notification. You conduct the assessment against FSRA criteria and notify. FSRA can intervene, but the process is faster for established tokens.
Practical implication:
VARA tells you exactly what to submit and in what format. ADGM expects you to prove you understand the principles and can implement them appropriately. Both require evidence of implementation, not just documentation.
4. The New Federal Layer: What Decree-Law No. 6 of 2025 Means
On top of the VARA and ADGM processes above, there’s now a federal regulatory layer that didn’t exist before 2025.
All crypto and blockchain organizations operating in or from the UAE must now be licensed by the Central Bank. Fines for unlicensed operations reach up to AED 1 billion+, approximately USD 272 million+. The law mandates 60-day licensing decisions, a speed benchmark. A one-year grace period until September 2026 gives existing operators time to comply.
New licensable categories include virtual asset payments, open finance, and digital wallets.
For new applicants: you may need to consider CBUAE requirements alongside VARA or ADGM licensing. The regulatory layers are additive, not replacements. The UAE now has federal oversight on top of emirate-level and free zone regulators. Expect more compliance requirements, not fewer.
5. Why 2026 Applications Face More Scrutiny
The new CBUAE law is part of a broader pattern. Several converging factors mean applications filed through 2026 will face tighter review than in previous years.
The UAE National Risk Assessment published in 2025 flagged virtual assets as high-risk. Regulators across the country are responding with enhanced scrutiny.
FATF and MENAFATF mutual evaluation onsite is scheduled for June 2026. The UAE is preparing for this assessment, and that preparation means stricter enforcement and more demanding application review.
Total AML/CFT fines across UAE financial institutions and designated non-financial businesses and professions crossed AED 400 million+ by mid-August 2025.
VARA enforcement has been active: 36 firms penalized between August 2024 and August 2025, with fines ranging from AED 50,000+ to AED 600,000+ per entity. Maximum potential fines reach AED 10 million+ with doubling for repeat offenses.
CARF, the Crypto-Asset Reporting Framework, was signed in September 2025 with first data exchange scheduled for 2028. Preparation starts now for firms that want to avoid scrambling later.
Bottom line: the window for weak applications is closing. Regulators are tightening, not loosening. Prepare properly or face rejection and rework costs.
6. How Consultycs Helps
All of the above comes down to preparation. Here’s what we do to make sure your application is ready before it hits a regulator’s desk.
- Application documentation preparation. We assemble your full submission package across all six documentation categories before you file. Business plan, AML/CFT framework, governance documents, technology policies, financial projections, and fit-and-proper materials, formatted to what regulators expect.
- Fit-and-proper coordination. We advise on Responsible Individual selection, prepare F&P declaration packs, and manage the timeline for VARA or FSRA approval. Getting your people cleared before filing avoids the most common delay.
- Entity structuring aligned to regulatory requirements. We incorporate your entity with the licensing application in mind. Custody segregation, activity mapping, shareholder structure, and governance setup are built to match what VARA or ADGM expects at review stage.
- Regulator dialogue support. After you submit, queries come back. We help prepare evidence-based responses that demonstrate implementation, not just intent. Fast, complete replies shorten the timeline.
- Wind-down planning. Mandatory under Rulebook 2.0. We draft your wind-down plan covering client asset protection, operational continuity, and VARA intervention procedures.
Frequently Asked Questions
What documents does VARA need for a crypto licence application?
VARA evaluates applications across six categories: corporate structure and ownership, people and fit-and-proper assessments, governance and risk management, AML/CFT framework, technology and information security, and financial projections with capital evidence. Each category requires detailed documentation and evidence of implementation, beyond policies alone. Service charges, consultation fees, legal advisory, document preparation, notary, attestation, PRO services, and government processing fees are additional.
What is a fit-and-proper test for a VARA licence?
VARA assesses competence, integrity, financial soundness, and reputation for key individuals. Two Responsible Individuals are required, both must be UAE-resident, full-time employees who are VARA-approved. Your Compliance Officer needs minimum five years of relevant experience. Expect 4-8 weeks for clearance.
Why do crypto licence applications get rejected in the UAE?
Common reasons: incomplete AML framework with no evidence of implementation, people not ready with Responsible Individuals or Compliance Officer not yet approved, policies that lack supporting evidence, wrong entity structure such as sole proprietorship, missing technology documentation like penetration test reports, no wind-down plan despite the Rulebook 2.0 requirement, and capital in the wrong account.
How long does a VARA licence application take?
7-12+ months total. Timeline varies based on documentation completeness, activity complexity, speed of regulator query responses, and fit-and-proper clearance timing. Better prepared applications move faster. Service charges, consultation fees, and government processing fees are additional.
What is a wind-down plan and why do I need one?
Mandatory under Rulebook 2.0 for all VASPs regardless of business stage. Your wind-down plan shows how the business would close in an orderly manner, how VARA can intervene and assume control of client money and virtual assets, and financial projections for the wind-down period. Submitting without one will delay your application.
Next Step
Preparing a blockchain or crypto licence application in the UAE? Book a call with Consultycs. We’ll review your documentation readiness and identify gaps before you file.
