Setting up an advisory firm in Dubai’s crypto space is like opening a consulting practice. Setting up a crypto exchange is like building a bank. Different animal entirely.
Think about what an exchange actually does: it holds client money, matches trades in milliseconds, monitors its own market for manipulation, and answers to a regulator that treats you more like a financial institution than a tech startup. VARA knows this, and the licensing requirements reflect it. AED 5,000,000+ minimum capital for Exchange Services alone. A separate custody company if you’re holding client assets. Market surveillance systems running in real time. Kill switches that can freeze trading across your entire platform. And a technology audit that goes deeper than anything an advisory or broker-dealer applicant will face.
Most online guides treat exchange licensing as one bullet point in a list of eight VARA activities. They’ll mention the capital requirement, maybe flag the custody segregation rule, and move on. That’s not enough for founders who are actually building an exchange. You need to know what technology stack to have ready, whether to build custody in-house or partner with an existing provider, what team VARA expects to see before go-live, and how your corporate structure needs to accommodate multiple entities with separate licences.
That’s what this article covers. If you haven’t chosen your licensing jurisdiction yet, start with our guide on the five licensing paths for crypto companies in the UAE. For the full regulatory documentation checklist that applies to all VARA applicants, see our guide on what regulators typically ask for. This article picks up where those leave off, focused entirely on exchange-specific preparation.
Here’s what we’ll walk through:
- The technology stack your exchange needs before you apply
- The custody decision: build your own or partner
- Client classification and what products you can actually offer
- Exchange-specific team roles beyond standard VARA requirements
- What an exchange setup actually costs
- A pre-application readiness checklist
One more thing worth knowing upfront. Exchange Services carries VARA’s highest capital requirement (AED 5,000,000+), highest annual supervision fee (AED 300,000+), and the only activity category where your trading platform itself gets audited before you can go live. Retail clients can only access spot trading. Derivatives need separate VARA pre-approval and are restricted to Qualified Investors. And you cannot trade your own capital under the same licence. Proprietary trading requires yet another entity. For capital and fee details across all eight VARA activity categories, see our guide on crypto business licence activities, compliance, and banking.
1. The Technology Stack Your Exchange Needs
If you’ve built tech products before, think of the VARA technology audit as a code review combined with a security audit combined with a stress test, all conducted by the regulator before you’re allowed to onboard a single client. Exchanges get more scrutiny here than any other activity category because the technology IS the product. Your matching engine, surveillance systems, wallet architecture, and incident response all face review before go-live authorization.
Matching Engine and Order Book
Your matching engine is the heart of the exchange, and VARA treats it that way. The regulator wants to see that your order book works under pressure, matches trades fairly, and can’t be gamed by insiders.
Throughput and capacity. How many orders per second can your engine process? What happens at peak volume? If you’re licensing a white-label solution, the vendor’s capacity specs become part of your regulatory documentation. If you’re building custom, expect to demonstrate performance under load testing conditions.
Matching fairness. VARA prohibits front-running by the exchange operator. Your documentation must show how matching works, whether that’s FIFO, pro-rata, or another model, and why the logic is fair. Institutional clients and market makers will ask about this too, so the documentation serves double duty.
Order book transparency. Published fee structures and venue rules, clearly available to clients before they trade. No hidden fees, no opaque pricing tiers that only surface after execution.
Systems readiness. Before authorizing go-live, VARA will want evidence that the platform actually works. Expect to demonstrate your matching engine under realistic conditions, not just show architecture diagrams.
Market Surveillance: Your Exchange Polices Itself
Here’s something that surprises founders coming from unregulated environments: under VARA, your exchange is responsible for detecting market manipulation on your own platform. Think of it as being both the marketplace and the market police.
VARA’s 2025 Rulebook made this explicit. Exchanges must combine on-chain transaction monitoring with behavioral analytics and AML typologies to catch manipulation patterns. The specific behaviors your systems must detect include spoofing (placing and cancelling orders to mislead about supply or demand), layering (stacking orders across price levels to fake market depth), wash trading (self-dealing or coordinated trades to inflate volume), and pump-and-dump coordination where unusual price movements align with social media campaigns or coordinated buying.
Several vendors serve this space: Solidus Labs, Eventus, and Nasdaq Surveillance for traditional market abuse detection. Some exchanges build surveillance in-house if they have the engineering depth. Whichever path you take, the system must be operational before go-live, not bolted on after launch.
One detail founders overlook: VARA also requires exchanges to share surveillance data with the regulator to support market oversight. Factor this into your data architecture from day one. Retrofitting data exports after launch creates unnecessary technical debt.
Kill Switches and Circuit Breakers
Every trading venue needs an emergency brake. VARA mandates kill-switch and circuit-breaker controls on exchange platforms, and leaving this out of your documentation is a common reason applications get sent back for rework.
In practice, this means your platform must be able to halt trading in specific pairs when anomalies surface, and across the entire exchange in extreme scenarios. You’ll need documented incident response procedures showing when these controls activate, who has authority to trigger them, and how trading resumes once the issue is resolved. If you’re implementing automatic circuit breakers based on price movement or volume spikes, the trigger thresholds and logic must be documented too.
Wallet Architecture: Hot, Cold, and Everything Between
If your exchange holds client assets under a custodial model, wallet architecture documentation becomes mandatory. Even if you’re partnering with a third-party custodian, the regulator wants to understand how client assets flow through your system and where they’re stored at rest.
The general principle: minimize what’s exposed, maximize what’s secured. Your hot wallet carries just enough for operational withdrawals, protected with multi-signature or MPC controls, with clear policies governing when funds move from cold storage. Your cold wallet holds the bulk of client assets offline, using multi-signature or Multi-Party Computation for key security, and ideally distributing key shards or signing devices across multiple physical locations.
Two rules apply regardless of your architecture. First, a strict 1:1 holdings requirement: client assets must match client balances at all times. No rehypothecation, no lending client assets without explicit consent. Second, Rulebook 2.0 requires monthly client statements showing accurate holdings. Each client’s assets must sit in segregated wallets under your VASP’s control, or your custodian must maintain clear segregation records that stand up to audit.
APIs and Third-Party Integrations
Institutional clients and market makers won’t use your web interface. They’ll connect via API, which means your API architecture becomes part of VARA’s technology review.
At minimum, plan for REST and WebSocket endpoints. FIX protocol support may be expected if you’re targeting institutional flow. Every endpoint needs to be documented, rate-limited, and secured with proper authentication and access controls.
Beyond your own APIs, your exchange will connect to a web of third-party services: market makers providing liquidity, KYT screening tools monitoring blockchain transactions, KYC providers verifying client identity. Each of these integrations needs a vendor SLA specifying uptime commitments, support response times, and liability terms. VARA also looks for SOC 2 Type II certification from critical vendors, and every third-party relationship must appear in your outsourcing register with documented oversight evidence.
The Technology Audit: What Happens Before Go-Live
Before you can onboard your first client, VARA conducts a technology review. Think of it as a final inspection before the building opens. They’re checking that everything works, not just that everything is documented.
The review typically covers external penetration test reports from a recognized provider (threat-led adversarial testing, not automated vulnerability scans), incident response runbooks showing how you’d handle security events and system failures, disaster recovery test results proving you can restore operations after an outage, access control documentation, and change management logs showing controlled release processes. The review ends with systems readiness confirmation, which often involves a live demonstration or formal attestation that the platform can handle real client trading.
For exchanges, this audit is the most common source of last-mile delays. Founders who have their penetration tests completed and their runbooks drafted before filing the IDQ move through this stage much faster than those scrambling to schedule testing after VARA asks for it.
Not sure if your technology stack meets VARA’s exchange requirements? We review your architecture and vendor documentation before you file.
2. The Custody Decision: Build Your Own or Partner
Getting your technology stack right leads directly to the biggest structural decision you’ll face as an exchange founder: who holds client assets?
This isn’t just an operational question. It shapes your entire corporate structure, your capital requirements, and how long it takes to reach go-live.
The Short Answer: You Need a Separate Company
If your exchange holds client virtual assets, you must set up a separate legal entity with its own standalone custody licence. VARA does not allow Exchange Services and Custody Services under the same company. Period.
In practice, this means your corporate structure looks something like this:
Your exchange company holds the Exchange Services licence. It runs the trading platform: matching engine, order book, and client interface.
Your custody company holds the Custody Services licence. It manages private keys, maintains segregated wallets, and holds client assets.
If you’re adding OTC or brokerage, that may sit under a Broker-Dealer authorization, either as a separate entity or combined with Exchange Services depending on your model.
And if you want to trade your own capital, that goes into yet another separate entity. Proprietary trading under your exchange licence is prohibited.
The Real Decision: Build or Buy?
Every exchange founder faces this fork in the road, and the right answer depends on your capital, timeline, and long-term strategy.
Building custody in-house means standing up a second regulated entity from scratch. You’ll need AED 4,000,000+ in capital for the Custody Services licence, your own wallet development team, a separate technology audit on your custody infrastructure, and direct regulatory accountability for client asset safety. More control over the client experience, but substantially more cost and a longer path to market.
Partnering with an existing VARA-licensed custodian flips that equation. Your exchange connects to their infrastructure via API. You skip the custody-specific technology build and audit. Your capital calculation drops too: using a VARA-licensed custodian reduces certain activity capital requirements from AED 1,500,000 to AED 800,000. The trade-off is dependency. Your exchange’s uptime, client asset safety, and regulatory standing are partly in someone else’s hands.
Custody providers commonly used in the market include Fireblocks (MPC wallet infrastructure, widely adopted, strong institutional reputation), BitGo (multi-signature architecture, institutional grade, insurance options), and Copper (MPC technology, UK and Dubai presence, growing Middle East footprint). Whichever vendor you choose, VARA looks for SOC 2 Type II certification and valid SLAs covering uptime, incident response, and liability.
How Regulators Evaluate Custody Arrangements
Whether you build or partner, VARA evaluates custody against the same criteria. They want to see per-client segregated wallets with clear ownership records, key management procedures covering the full lifecycle from generation through revocation, 1:1 proof of reserves demonstrating client assets match balances, monthly client statements, insurance covering hot wallet risk and commercial crime, and a wind-down plan specific to the custody entity showing how client assets would be returned if the custodian ceased operations.
Choosing between building custody in-house or partnering with a licensed custodian? We help exchange founders make this decision based on capital, timeline, and licensing implications.
3. Client Classification and What You Can Actually Offer
With your technology and custody decisions sorted, the next question is: what can your exchange actually sell? The answer depends on who’s buying.
VARA draws a hard line between retail clients and Qualified Investors, and the distinction shapes your entire product offering.
Retail Clients Get Spot Markets Only
If someone doesn’t meet Qualified Investor thresholds, they can trade spot markets: crypto-to-crypto and crypto-to-fiat pairs. That’s it. No margin trading, no derivatives, no perpetual contracts, no margin-based products of any kind. Every retail client goes through full CDD and KYC before their first trade, and VARA requires risk disclosures up front. Cooling-off periods may apply for certain product types.
Qualified Investors Can Access More, but the Bar Is High
Rulebook 2.0 sets specific thresholds for Qualified Investor status. Net assets of AED 3,500,000+ (excluding primary residence, and only 50% of virtual asset holdings count toward the total). Annual income of AED 700,000+. You must verify and classify every investor before granting access to restricted products. Self-certification doesn’t cut it.
Once verified, Qualified Investors can access derivatives including futures, options, and perpetual contracts, subject to VARA pre-approval for your exchange specifically. They can also access higher exposure limits and margin trading if your exchange offers it and has the necessary authorization.
Derivatives and Margin Require Separate VARA Pre-Approval
Offering derivatives or margin isn’t an automatic right that comes with your Exchange Services licence. You need explicit additional authorization from VARA. Only Qualified Investors can access these products. And your exchange must have documented margin and collateral management procedures, real-time margin monitoring, and automated liquidation protocols before VARA will approve.
Your Listing Policy Is Part of the Application
Every token on your exchange must pass due diligence before listing, and your listing process becomes part of your regulatory documentation. VARA looks for evidence that you’re evaluating token utility, issuer legitimacy, smart contract audit status, liquidity profiles, and regulatory status in other jurisdictions.
Two hard prohibitions to know: anonymity-enhanced tokens (Monero, Zcash, and similar privacy coins) cannot be listed on a VARA-licensed exchange, full stop. And stablecoins must meet VARA’s fiat-referenced token requirements before they’re eligible for listing.
Your listing committee structure, decision criteria, and delisting procedures all need to be documented. VARA may ask for records of past listing decisions during their review, so build the evidence trail from the start.
4. The Exchange-Specific Team You’ll Need
Client classification and product design decisions bring us to the people question. Standard VARA staffing requirements (Compliance Officer, MLRO, two Responsible Individuals) apply to every licensed VASP. Those are covered in our guides on compliance and regulatory documentation. Exchanges need additional operational roles on top of those.
Someone Who Owns the Technology
VARA needs a named individual accountable for your technology stack, typically a CTO or CISO. An outsourced arrangement or a “fractional CTO” is unlikely to satisfy this requirement.
This person responds to VARA’s queries on system architecture, security incidents, and technology governance. They own the technology audit process and any remediation. They maintain oversight of every vendor and integration your exchange relies on. Look for someone with a demonstrable background in exchange infrastructure, fintech systems, or comparable high-availability environments. “I built mobile apps” doesn’t translate to “I can run exchange infrastructure under regulatory scrutiny.”
A Market Operations Function
Staff who monitor market activity and manage listing decisions cannot be the same person as your Compliance Officer. VARA requires separation of duties here.
This function covers real-time monitoring of surveillance alerts, investigating potential manipulation, managing listing and delisting decisions under your documented policy, and coordinating with VARA on market integrity matters. When unusual trading patterns appear at 2 AM, someone needs to be awake and authorized to act.
Settlement and Reconciliation
VARA’s 24-hour settlement target means reconciliation cannot be a weekly task someone handles when they have time. This function handles daily reconciliation of client balances against wallet balances and order book activity, catches discrepancies before they compound, and maintains the audit trails that prove everything matched.
For ongoing compliance staffing costs and requirements, see our guide on crypto business licence activities, compliance, and banking.
5. What an Exchange Setup Actually Costs
People, technology, custody, and corporate structure all add up. And exchange setup is expensive by any measure. If the numbers below are out of reach, it’s better to know now than six months into an application that stalls at capital verification.
All figures are approximate. Service charges, consultation fees, legal advisory, document preparation, notary, attestation, PRO services, and government processing fees are additional and quoted separately.
Capital Requirements
Exchange Services: AED 5,000,000+ minimum.
Custody Services if building your own: AED 4,000,000+ minimum.
Broker-Dealer if adding this activity: AED 800,000+ with a VARA-licensed custodian, or AED 1,500,000+ without.
Expense-based buffer: 1.2x monthly operating expenses held as liquid assets, on top of activity-specific minimums.
Combined Exchange plus Custody: AED 9,000,000+ minimum capital before operational costs.
Technology Infrastructure Costs
Matching engine: Ranges widely depending on build versus buy. White-label exchange solutions run from AED 200,000+ to AED 2,000,000+ for licensing and setup. Custom builds cost considerably more.
Custody integration: If using third-party custody, expect setup fees plus monthly custody fees based on assets under management.
Market surveillance system: AED 100,000+ to AED 500,000+ annually depending on vendor and transaction volume.
KYT and blockchain analytics: Chainalysis, Elliptic, or comparable providers run AED 50,000+ to AED 300,000+ annually.
Penetration testing: AED 30,000+ to AED 100,000+ per engagement. Budget for at least one full-scope test before application and annual testing thereafter.
KYC and onboarding: Sumsub, Onfido, or similar providers cost AED 20,000+ to AED 100,000+ annually depending on volume.
Insurance Requirements
Professional indemnity: Required for all VARA-licensed entities.
Directors and Officers liability: Required.
Commercial crime and hot wallet coverage: Required for custodial exchanges. This coverage is essential if you’re holding client assets.
Cyber liability: Strongly recommended given the threat environment.
Insurance costs vary based on coverage limits, risk profile, and claims history. Budget for this as a meaningful line item, not an afterthought.
Total Pre-Launch Budget Indicators
Non-custodial exchange using third-party custody: AED 8,000,000+ to AED 15,000,000+ for capital, technology, team, and first-year operations.
Custodial exchange with your own custody entity: AED 15,000,000+ to AED 25,000,000+ including both entities, full technology stack, and operational runway.
These are directional ranges. Your actual costs depend on technology choices, team size, activity scope, and operational complexity.
6. Pre-Application Readiness Checklist
All the preparation above boils down to a practical question: are you ready to file? Before submitting your Initial Disclosure Questionnaire, run through this list. Each item represents a potential delay if it’s not addressed upfront.
1. Corporate structure decided
Exchange entity plus custody entity if custodial, plus any additional activity entities mapped out. Ownership chains, UBO structure, and shareholder agreements drafted. Custody segregation built into the structure from day one.
2. Technology stack selected and contracted
Matching engine chosen, whether white-label or custom build. Custody solution confirmed, whether in-house or third-party partner. Surveillance tools selected. KYT provider contracted. KYC provider contracted. Vendor SLAs signed. SOC 2 Type II certifications collected.
3. Key personnel identified
CTO or CISO confirmed and available for VARA queries. Compliance Officer with minimum five years relevant experience. MLRO with UAE residency and real authority. Two Responsible Individuals who are UAE-resident and full-time employees. Fit-and-proper packs being prepared in parallel with corporate setup.
4. AML/CFT framework drafted
Client-specific risk methodology tailored to exchange operations. Transaction monitoring rules covering both fiat and on-chain activity. Wallet screening procedures for deposits and withdrawals. SAR process documented. Training schedule for all staff.
5. Listing policy drafted
Token due diligence criteria documented. Listing committee structure defined. Delisting procedures ready. Evidence-based decision framework in place.
6. Client classification framework ready
Qualified Investor verification process defined. Retail restrictions implemented in platform access controls. Derivatives access controls ready if you’re seeking that authorization.
7. Financial projections built
Three-year P&L, cash flow, and balance sheet. Capital proof in entity corporate accounts, not personal accounts. Insurance quotations obtained. Revenue model documented with realistic assumptions.
8. Wind-down plan drafted
Mandatory under Rulebook 2.0. Shows how your exchange and custody entity would close orderly, how VARA could intervene, and how client assets would be protected and returned.
9. Office secured
Physical office in Dubai. Flexi-desk arrangements do not satisfy VARA requirements for Exchange Services.
10. Banking engagement started
Approach banks with your in-principle approval once received. Prepare source-of-funds documentation. Banking challenges for crypto companies are covered in our guide on activities, compliance, and banking.
Exchange applications succeed when the preparation is done upfront. Consultycs identifies gaps before VARA does.
How Consultycs Helps
- Exchange entity structuring. We set up your exchange, custody, and any additional activity entities with the licensing application in mind. Custody segregation, shareholder structure, governance setup, and activity mapping are built correctly from the start so VARA doesn’t send you back to restructure.
- Technology vendor coordination. We help you select and contract custody partners, surveillance tools, and KYT providers whose documentation meets VARA’s requirements. Vendor SLAs and SOC 2 certifications become part of your application package.
- Application documentation across all six categories. We prepare the full submission: business plan, AML/CFT framework with exchange-specific transaction monitoring, governance documents, technology policies including market surveillance and wallet architecture, financial projections, and fit-and-proper materials.
- Fit-and-proper coordination. We advise on Responsible Individual selection, prepare F&P declaration packs for your CTO, Compliance Officer, and key personnel, and manage the timeline for VARA approval.
- Regulator dialogue support. After submission, we help prepare evidence-based responses to VARA’s follow-up queries. For exchanges, technology queries are the most detailed. Fast, complete replies shorten the timeline.
Frequently Asked Questions
How much capital do I need to start a crypto exchange in Dubai?
AED 5,000,000+ minimum for Exchange Services alone. If you’re building your own custody entity, add AED 4,000,000+. With expense-based capital buffers and operational costs, total pre-launch capital for a custodial exchange typically runs AED 15,000,000+ to AED 25,000,000+. Service charges, consultation fees, legal advisory, and government processing fees are additional.
Do I need a separate company for custody if I run an exchange?
Yes, if your exchange holds client virtual assets. VARA requires custody services to operate through a separate legal entity with its own standalone licence. You cannot combine exchange and custody under one company.
What technology does VARA require for a crypto exchange?
Matching engine with demonstrated throughput capacity. Market surveillance systems detecting spoofing, layering, and wash trading. Kill switch and circuit breaker controls. Hot and cold wallet architecture documentation if custodial. KYT blockchain analytics integration. Threat-led penetration test reports. Incident response plans. Systems readiness confirmation before go-live.
Can I offer derivatives or margin trading on a crypto exchange in Dubai?
Only with VARA pre-approval and only to Qualified Investors. Qualified Investors must have AED 3,500,000+ net assets excluding primary residence, with only 50% of virtual asset value counting, and AED 700,000+ annual income. Retail clients cannot access derivatives or margin products.
What market surveillance does VARA require for exchanges?
Exchanges must detect and report market manipulation including spoofing, layering, wash trading, and pump-and-dump coordination. VARA’s 2025 Rulebook requires combining DLT transaction monitoring with AML typologies and behavioral analytics. Exchanges must share information with VARA to support market oversight.
How long does it take to get a VARA exchange licence?
7-12+ months total. For exchanges, timelines tend toward the longer end because technology documentation and audits are more extensive. The technology audit, including penetration testing and systems readiness confirmation, typically happens before go-live authorization. Better prepared applications move faster. Service charges, consultation fees, and government processing fees are additional.
Next Step
Building a crypto exchange in Dubai? The preparation starts months before the application. Book a call with Consultycs. We’ll review your technology stack, corporate structure, and documentation readiness for VARA’s exchange licensing process.
