Getting a crypto licence in Dubai is only half the battle. The other half is running the business once you have it: choosing the right activity categories, building a compliance operation that survives VARA’s audits, and opening a bank account without getting rejected three times.
Most guides stop at the licensing decision. They list VARA’s activity categories, mention AML requirements in passing, and move on to the sales pitch. Nobody talks about the operational reality: custody must be a separate legal entity, leverage is banned for retail clients, annual supervision fees for an exchange run AED 300,000+, and banks reject crypto companies routinely.
This article covers what happens after you’ve chosen your licensing path. If you haven’t made that decision yet, start with our guide on the five licensing paths for crypto companies in the UAE. This piece assumes you’re committed to Dubai and need to understand what you’re actually signing up for.
The Eight Regulated Activities Under VARA
VARA regulates eight distinct virtual asset activities. You can combine most of them under a single licence, with one major exception we’ll cover. Each activity carries its own capital requirements, supervision fees, and rulebook obligations.
Here’s what each one actually involves.
A note on costs: The capital requirements, supervision fees, and cost figures mentioned throughout this article are approximate and based on publicly available VARA guidelines at the time of writing. Actual costs vary depending on your specific business model, activity combination, and operational scope. Service charges, consultation fees, legal and compliance advisory, document preparation, notary, attestation, PRO services, and government processing fees are all additional and quoted separately. Treat the figures below as directional, not final. Your actual estimate from Consultycs will reflect your specific setup.
1. Advisory Services
The scope: Providing investment advice, strategy recommendations, or research on virtual assets to clients. Think consulting firms, research houses, and independent advisors.
Capital requirement: AED 100,000
Annual supervision fee: AED 100,000+
This is the lowest barrier to entry among VARA activities. If you’re offering analysis or recommendations without handling client funds, Advisory is your category. The compliance burden is lighter than transaction-focused activities, but you still need full AML/KYC procedures and client suitability assessments.
2. Broker-Dealer Services
In practice: Arranging or executing trades on behalf of clients, order routing to exchanges, and facilitating transactions where the broker acts as intermediary.
Capital requirement: AED 800,000 if you use a VARA-licensed custodian, or AED 1,500,000 if you hold client assets yourself
Annual supervision fee: AED 200,000+
Broker-dealers sit between clients and liquidity. You’re not running an exchange, but you’re facilitating access to one. Rulebook 2.0 introduced formal requirements for margin trading policies. If you offer any form of leverage to clients, your internal controls, disclosure documents, and risk management frameworks need to meet VARA’s new standards.
The capital difference between using an external custodian versus self-custody is substantial. Most broker-dealers opt for the external custodian route to keep capital requirements lower and avoid the operational complexity of managing private keys.
3. Custody Services
What this covers: Safekeeping client virtual assets, managing private keys, operating wallets on behalf of clients, and securing assets against theft or loss.
Capital requirement: AED 800,000 with a VARA custodian arrangement, or AED 1,500,000 for standalone custody
Annual supervision fee: AED 200,000+
The rule that changes everything: Custody must be operated through a separate legal entity. You cannot run custody services under the same company that handles your exchange, broker-dealer, or other activities. VARA requires full legal segregation.
This has direct implications for your corporate structure. If you’re building an exchange that also holds client assets, you need two companies: one for the exchange, one for custody. Each requires its own VARA licence, its own capital, its own governance, and its own compliance infrastructure.
Rulebook 2.0 added proof-of-reserves requirements, full client asset segregation, and enhanced cybersecurity controls for custodians. You’ll need to demonstrate that client assets are never commingled with company funds and that your key management procedures meet institutional standards.
4. Exchange Services
The operation: Matching buyers and sellers, facilitating crypto-to-fiat conversion, crypto-to-crypto trading, OTC desk operations, and any platform where users trade virtual assets with each other or with the exchange.
Capital requirement: AED 5,000,000+
Annual supervision fee: AED 300,000+
This is the highest capital and compliance burden among VARA activities. If you’re running a trading platform, expect the full weight of regulatory scrutiny.
Key restrictions: leverage is banned for retail clients. You must implement market manipulation detection systems. Your technology infrastructure faces the most demanding requirements under VARA’s Technology & Information Rulebook.
Exchange operators also face the custody segregation rule. Your exchange entity cannot hold client assets directly. You either partner with a separate VARA-licensed custodian or set up your own custody entity under a separate licence.
Between capital requirements, supervision fees, compliance staffing, and technology infrastructure, an exchange operation in Dubai requires serious backing. Not a bootstrapped startup play.
5. Lending and Borrowing Services
The business model: Crypto-collateralized loans, margin lending, yield programs, and any arrangement where clients borrow virtual assets or use them as collateral.
Capital requirement: AED 500,000+
Annual supervision fee: AED 200,000+
Rulebook 2.0 transformed this category. VARA now requires credit assessments before extending loans, loan-to-value ratio limits, stress testing of collateral positions, and periodic collateral revaluation. If you’re running a lending protocol or CeFi yield product, your operational procedures need to match these requirements.
The DeFi gray area: if your lending happens entirely on-chain without a centralized entity, VARA’s direct jurisdiction becomes more complex. But if you’re marketing lending services to Dubai residents or operating through a Dubai entity, you’re in scope.
6. Management and Investment Services
What falls here: Discretionary portfolio management, staking on behalf of clients, operating collective investment schemes, and any arrangement where you make investment decisions for client assets.
Capital requirement: AED 280,000 with a VARA custodian, or AED 500,000 without
Annual supervision fee: AED 200,000+
This category covers crypto fund managers, staking-as-a-service providers, and anyone offering managed accounts. Client suitability requirements apply: you need to assess each client’s risk tolerance, investment objectives, and financial situation before taking on their assets.
7. Transfer and Settlement Services
The function: Moving virtual assets between wallets, settling transactions, clearing trades, and the infrastructure layer that makes crypto transactions final.
Capital requirement: Lower threshold among VARA activities
Annual supervision fee: AED 80,000+
Often combined with exchange or broker-dealer activities rather than operated standalone. If your business model focuses purely on payment rails or settlement infrastructure, this is your category.
8. VA Issuance
Two categories exist:
Category 1 covers publicly traded tokens, stablecoins, and utility tokens offered to the general public. This requires VARA pre-approval, a compliant whitepaper, and ongoing disclosure obligations.
Category 2 covers closed-loop tokens, loyalty points, and tokens used within a single ecosystem. Registration is required, but the full licensing process does not apply.
Capital requirement: Varies by token type and distribution method
Annual supervision fee: AED 150,000+
Hard prohibition: Anonymity-enhanced tokens are banned. Privacy coins and any token designed to obscure transaction origins cannot be issued under VARA’s framework.
Structural Points That Matter
Combining activities: You can hold multiple activity authorizations under one VASP licence. An exchange might also hold broker-dealer and management authorizations. But custody always requires a separate entity.
Proprietary trading restriction: Licensed VASPs cannot engage in proprietary trading under their regulated licence. If you want to trade your own capital, that activity needs to sit in a separate, non-VARA-licensed entity.
Sponsored VASPs: Rulebook 2.0 introduced this regime for smaller operators. Instead of meeting full capital requirements, you can operate under the sponsorship of a fully licensed VASP. The sponsor takes on regulatory responsibility, and you operate within their compliance umbrella. This opens a path for startups that can’t meet exchange-level capital requirements.
Expense-based capital buffer: Beyond the minimums listed above, every VASP must hold liquid assets equal to at least 1.2x monthly operating expenses. Your actual capital requirement is the higher of the activity minimum or your expense buffer.
Not sure which activity categories match your business model? We help founders map their operations to the right VARA categories before they apply.
What Compliance Actually Looks Like
This is where most competitor articles go quiet. They mention AML requirements and move on. But compliance for a VARA-licensed entity is not a checkbox exercise. It’s an ongoing operational commitment that costs real money and requires real people.
The Four Mandatory Rulebooks
Every VARA-licensed entity must comply with four core rulebooks, regardless of which activities they’re licensed for:
Company Rulebook: Governance structures, board composition, director qualification requirements, and corporate administration standards. Your board needs crypto-competent members. Your governance procedures need documentation.
Compliance and Risk Management Rulebook: Your AML/CFT framework lives here. You must appoint a Money Laundering Reporting Officer who is UAE-resident. Client risk assessments, transaction monitoring, and suspicious activity reporting procedures all fall under this rulebook.
Technology and Information Rulebook: Cybersecurity requirements, the TGRAF framework for technology governance, mandatory threat-led penetration testing, developer environment controls, and incident response procedures. VARA takes technology risk seriously.
Market Conduct Rulebook: Client agreement standards, marketing restrictions, conflict of interest management, and fair dealing requirements. How you communicate with clients, what you can promise, and how you handle complaints all fall here.
On top of these four, each licensed activity has its own activity-specific rulebook with additional requirements.
Ongoing Compliance Obligations
Once you’re licensed, the work continues:
Quarterly AML/CFT reports submitted through VARA’s portal. Transaction volumes, suspicious activity reports, client onboarding statistics, and risk assessment updates.
Annual external audit covering your technology infrastructure, security controls, and financial statements. This audit must be conducted by a VARA-approved firm.
Annual licence renewal with payment of supervision fees. Renewal is not automatic. VARA reviews your compliance record before approving.
Material event notifications within specified timeframes. Ownership changes above certain thresholds, new product launches, acquisitions, senior management changes, and security incidents all require notification.
Client money segregation monitoring on an ongoing basis. Client assets must remain separate from company funds at all times, with documentation to prove it.
Monthly client reporting added under Rulebook 2.0. Your clients must receive regular statements showing their holdings, transactions, and any fees charged.
Compliance Staffing Reality
Minimum viable team: A Compliance Officer and an MLRO. For smaller VASPs, one person can hold both roles, but they must be UAE-resident and have relevant qualifications and experience.
Mid-size operation: Dedicated compliance team of 2-3 people, plus outsourced audit support. You’ll need someone focused on AML operations, someone on regulatory reporting, and someone managing client documentation.
Exchange or custody operation: Full compliance department. Dedicated cybersecurity team or heavy outsourcing. External penetration testing provider on retainer. Internal audit function. This is enterprise-level compliance infrastructure.
The Marketing Restriction Nobody Mentions
Since October 2024, only VARA-licensed entities may market virtual asset activities in or targeting Dubai. Unauthorized marketing carries fines up to AED 10 million.
This applies even if you’re based outside the UAE. If your marketing reaches Dubai residents and promotes virtual asset services, you’re in scope. VARA’s marketing rulebook, issued jointly with the CMA, covers all market participants in the UAE regardless of their direct licensing status.
For founders: this means you cannot run Dubai-targeted ads, sponsor Dubai events, or engage Dubai-based influencers until you hold your licence or In-Principle Approval.
What Compliance Actually Costs
Annual budget for a mid-size VASP, rough ranges:
| Cost Category | Annual Range |
| Supervision fee | AED 100,000 to AED 300,000+ |
| External audit | AED 50,000 to AED 150,000+ |
| Compliance staff | AED 300,000 to AED 600,000+ |
| Technology and cybersecurity | AED 200,000 to AED 500,000+ |
| Legal advisory | AED 100,000 to AED 200,000+ |
| Transaction monitoring systems | AED 50,000 to AED 150,000+ |
| Total ongoing | AED 800,000 to AED 1,900,000+ |
These figures exclude initial setup costs, office rent, visa fees, and non-compliance operational expenses. An exchange faces the upper end of every range. A small advisory firm sits at the lower end. All figures are approximate. Actual costs depend on your business model, activity mix, and operational complexity. Service charges, consultation, legal advisory, and paperwork costs are additional.
These numbers separate serious founders from tourists. Dubai wants legitimate crypto businesses. The compliance infrastructure filters for committed operators.
Banking Reality for Crypto Companies in Dubai
This is where crypto company setups stall most often. You can have your VARA licence, your compliance team, your technology stack, and your first clients lined up. None of it matters if you cannot open a bank account.
Why This Is Hard
Banks in the UAE answer to the Central Bank, which enforces strict AML/CFT standards. For most banks’ internal compliance teams, crypto remains a “high-risk” classification, sitting alongside online gaming, money services businesses, and certain import/export categories.
Even with a valid VARA licence, your bank account application goes through enhanced due diligence. The bank’s compliance team will scrutinize your business model, your source of funds, your client profile, and your AML procedures. Many applications get rejected.
Common Rejection Reasons
Incomplete AML/KYC documentation: Banks want to see your compliance framework before they onboard you. If your AML policies are thin or your KYC procedures are vague, expect rejection.
Unclear source of funds: Where does your operating capital come from? If the answer involves multiple blockchain transactions, DeFi protocols, or non-regulated exchanges, banks get nervous.
Mixed wallet activities: Funds from multiple blockchains, interactions with DeFi protocols, or wallet addresses connected to mixing services raise flags.
High-risk jurisdiction connections: Founders from sanctioned countries, funds routed through non-regulated exchanges, or clients in high-risk regions trigger additional scrutiny.
No VARA licence or IPA: Banks strongly prefer applicants who already hold their licence or at minimum an In-Principle Approval. Approaching banks before you have regulatory status confirmed reduces your odds.
Weak business plan: “We’re a crypto company” is not enough. Banks want to understand your revenue model, your client acquisition strategy, and your transaction flow projections.
Which Banks Have Crypto Appetite
Bank policies change, and no institution publicly advertises “we love crypto clients.” But some patterns emerge from industry experience:
Certain major UAE banks have built dedicated digital asset teams specifically to onboard VARA-licensed firms. These teams understand the industry and can shepherd applications through internal compliance.
Some smaller banks and digital-first institutions are more open to crypto clients but may impose transaction volume limits or activity restrictions.
DIFC-based banks may be more comfortable with ADGM or DIFC-licensed entities than with mainland or DMCC structures.
Emirates NBD, RAKBANK, and Mashreq have been referenced in industry conversations as relatively receptive, though experiences vary by branch, relationship manager, and specific business model.
How to Increase Your Approval Odds
Get your regulatory status first. Having your VARA licence, or at minimum your In-Principle Approval, before approaching banks materially improves your chances. Banks want to see that VARA has vetted you.
Prepare source-of-funds documentation. Be ready to explain and document every significant deposit into your operating accounts. If your capital came from crypto sales, have the transaction records ready.
Document your AML framework. Banks will ask for your compliance policies. Have your AML/KYC procedures, client onboarding standards, and transaction monitoring approach documented and presentation-ready.
Present a clear business plan. Revenue model, client profile, transaction volume projections, and operational structure. Banks want to understand what you’re building and where the money flows.
Keep personal banking history clean. Directors and shareholders with existing UAE banking relationships and clean credit histories help the application. Red flags on personal accounts can sink a corporate application.
Apply to multiple banks simultaneously. Rather than approaching one bank, waiting for rejection, and starting over, submit to 3-4 banks at once. This shortens your total timeline and gives you options.
Work with someone who has relationships. Bank introductions matter. A formation consultant or corporate services provider with established banking relationships can get your application in front of the right relationship manager rather than the generic intake queue.
Timeline Expectations
Best case: VARA-licensed, clean documentation, warm introduction to the right bank. 2-4 weeks to account opening.
Typical case: Good documentation, no major red flags, applying to multiple banks. 4-8 weeks.
Difficult case: High-risk activity category, complex corporate structure, funds from multiple sources, no existing relationships. 3-6 months, with meaningful rejection risk.
Alternatives While You Wait
If your bank account is delayed but you need to operate:
Payment Service Providers: Licensed PSPs can process certain transaction types while you wait for traditional banking.
EMI accounts: Electronic money institutions and neobanks offer operational accounts that can handle payroll, supplier payments, and some client transactions. These are not full banking replacements but can bridge the gap.
DIFC or ADGM-based providers: Multi-currency accounts through financial free zone institutions may offer faster onboarding for certain use cases.
Dubai is a strong jurisdiction for crypto, but the banking challenge is real. Plan for it, budget time for it, and don’t assume your VARA licence automatically opens bank doors.
Banking is where crypto company setups in Dubai stall most often. Consultycs prepares your documentation and makes introductions to banks with crypto appetite.
How Consultycs Helps
Running a licensed crypto business in Dubai requires getting three things right: your corporate structure, your compliance setup, and your banking relationships. Here’s what we bring to each:
- Corporate structuring with custody segregation built in. When VARA requires custody to sit in a separate legal entity, your corporate formation needs to reflect that from day one. Retrofitting a structure after licensing creates delays and additional costs. We build the right structure before you file.
- Bank documentation and introductions. We prepare source-of-funds declarations, AML policy summaries, and business plans formatted for compliance review before you approach any bank. Then we make introductions to relationship managers who understand digital assets, rather than leaving your application in a generic intake queue.
- Visa processing for compliance staff. VARA requires UAE-resident compliance officers. We coordinate visa processing for your key personnel in parallel with company formation so you don’t hit bottlenecks when VARA asks for proof of local substance.
- VARA application coordination. We work alongside you during the application process, making sure your company structure, governance documents, and compliance framework align with what VARA expects to see. No surprises at the review stage.
- Activity mapping and licensing strategy. Before you commit to specific VARA categories, we map your business model to the right activity mix. Getting this wrong means either paying for categories you don’t need or discovering mid-application that you’re missing one.
Frequently Asked Questions
What are the eight VARA-regulated activities in Dubai?
Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and VA Issuance. Each carries its own capital requirements, supervision fees, and activity-specific rulebook. Custody must be operated through a separate legal entity and cannot be combined with other activities under one licence.
How much does it cost to maintain a VARA licence annually?
Annual supervision fees alone range from AED 80,000+ for Transfer and Settlement to AED 300,000+ for Exchange activities. Add external audit costs at AED 50,000+ to AED 150,000+, compliance staffing, technology infrastructure, and legal advisory. A mid-size VASP should budget AED 800,000+ to AED 1,900,000+ per year for ongoing compliance and operations. All figures are approximate and vary based on your specific business model and activity mix. Service charges, consultation fees, legal advisory, document preparation, notary, attestation, PRO services, and government processing fees are additional and quoted separately.
Can I combine multiple VARA activities under one licence?
Yes, most activities can be aggregated under a single VASP licence. The exception is Custody Services, which must be operated through a separate legal entity with its own standalone licence. Licensed VASPs are also prohibited from proprietary trading under their regulated licence.
Why do banks reject crypto companies in Dubai?
Banks classify crypto as high-risk. Common rejection reasons include incomplete AML/KYC documentation, unclear source of funds, mixed wallet activities, connections to high-risk jurisdictions, and lack of a VARA licence or In-Principle Approval. Having your regulatory status confirmed and your compliance documentation ready before approaching banks increases approval odds.
Do I need a separate company for crypto custody in Dubai?
Yes. VARA requires custody services to be segregated from other virtual asset activities. A VA Custodian must be set up as a distinct legal entity with its own standalone licence, independent governance, and separate capital. This has direct implications for your corporate structure and formation costs.
Next Step
Running a licensed crypto business in Dubai takes more than a licence. It takes the right structure, the right compliance setup, and the right banking relationships. Book a call with Consultycs to plan all three.
