Buy a licensed company 
VASPs live data and insights 
Learn about crypto safety 
Read the latest research 
Dubai VARA: The ” MVP” License Phase Explained for Startups
The era where firms could operate in grey zones, hide behind global branding, or rely on vague licensing language is over in Dubai. Today, there is an activity-based framework that forces every Virtual Asset Service Provider to prove operational maturity before touching client funds.
VARA was established under Law No. (4) of 2022. It was introduced as the world’s first standalone virtual asset regulator, but by 2026, that label means less than what it actually does. Through formal coordination with the federal Securities and Commodities Authority, VARA’s rulebooks now operate as a national benchmark, not just a Dubai-specific regime.
Legacy permissions are no longer recognised. Rulebook 2.0 became fully enforceable in June 2025, and VARA has shown zero hesitation in using it. Operating in Dubai today is not about whether the jurisdiction is “crypto-friendly.” It’s about whether a firm can survive an environment where the cost of entry is counted in millions of dirhams, and regulatory penalties reach AED 10,000,000. This framework exists to separate institutional operators from speculative projects. Nothing here is accidental.
Legal Architecture and the Regulatory Perimeter
At the top sits the Dubai Virtual Assets Law. Beneath it are binding regulations. At the bottom are activity-specific rulebooks that remove interpretation entirely. VARA regulates through instructions rather than principles.
Jurisdictionally, VARA covers the entire Emirate of Dubai, including free zones and special development zones. The only exclusion is DIFC, which remains a common-law jurisdiction regulated by the DFSA. There is no overlap, and VARA has been explicit about this boundary. One of the most common failure points in 2026 is the assumption that existing companies can be reused or “grandfathered.” They can’t.
VARA’s 2023 regulations and the subsequent 2025 updates codified a substance-first doctrine. Decision-making must happen in Dubai. Control must be local. Physical presence is mandatory. Shelf companies are not tolerated, and attempts to use them are treated as red flags.
The framework itself is split into four compulsory rulebooks: Company, Compliance and Risk Management, Technology and Information, and Market Conduct. These are not optional. Each regulated activity then has an additional manual layered on top.
By 2026, these rulebooks are fully aligned with FATF standards. Dubai did this to remain a white-listed jurisdiction for banking (not to attract startups). If a VASP cannot demonstrate real-time transaction monitoring and full asset segregation, banking access becomes fragile very quickly.
VARA Regulates Activities
VARA does not license “crypto businesses.” It licenses economic functions. Any entity providing services in or from Dubai must be licensed for the exact activity it performs. Each activity carries its own capital thresholds, fee structure, reporting burden, and supervision intensity. By 2026, VARA recognises eight regulated activities.
Virtual Asset Advisory Services cover personalised investment advice tailored to individual client circumstances. This category is often used by boutique firms as an entry point because application and supervision fees are lower.
In 2026, advisory firms must perform formal suitability assessments that go well beyond KYC. VARA expects documentation showing that clients understand volatility, drawdowns, and product mechanics. Risk tolerance is assessed, recorded, and reviewed.
Virtual Asset Management and Investment Services sit higher on the risk spectrum. Discretionary portfolio management, staking, and yield-generating strategies introduce fiduciary responsibility. Capital buffers increase accordingly. VARA treats control over client assets as a structural risk, not a commercial feature.
Broker-Dealer Vs. Exchange Operations
Broker-Dealer services involve arranging transactions, soliciting buy and sell orders, facilitating fiat-to-virtual-asset conversions, and sometimes market-making activity. Exchange services involve operating a platform that matches trades and maintains an order book.
The key variable in 2026 is custody. Exchanges that self-custody client assets face the highest capital requirements. Exchanges that outsource custody to a VARA-licensed custodian benefit from reduced paid-up capital obligations. VARA’s framework clearly discourages vertical concentration of risk. Separation of duties is rewarded. Shortcut structures are punished.
Custody, Transfer, and Settlement
Client assets must be fully segregated in separate wallets. Custody activities must be conducted through a standalone legal entity. Commingling is not tolerated. By 2026, custodians are required to perform daily reconciliations and submit proof-of-reserve reports to VARA on a quarterly basis.
Transfer and Settlement Services are no longer treated as secondary activities. Any entity facilitating asset movement between wallets or interfacing with traditional banking rails to settle off-chain balances is regulated under this category.
Virtual Asset Issuance
Category 1 issuance covers fiat-referenced and asset-referenced virtual assets. Stablecoins and Real-World Asset tokens fall here. These issuances trigger full regulatory obligations, including whitepaper approval, risk disclosures, and mandatory reserve asset rules.
Category 2 issuance covers utility tokens and lower-complexity assets. Approval is still required, but the disclosure burden is lighter.
Issuers do not self-classify. VARA determines categorisation, and misclassification is treated as a compliance failure.
Fees, Capital, and Prudential Rules
Licensing costs are split between one-time application fees and recurring supervision fees. Where multiple activities are licensed, a base fee applies with extension fees added for each additional activity.
Paid-up capital must be deposited with a UAE bank and held as unencumbered equity. Expense-based capital requirements ensure a firm can operate for at least six months in a zero-revenue scenario.
Every VASP must maintain Net Liquid Assets equal to or greater than 1.2 times monthly operating expenses. This is calculated daily and reported monthly.
For asset-referenced token issuers, capital requirements scale with reserve size. The minimum is the higher of a fixed baseline or 2 percent of the average market value of reserve assets over the preceding 24 months.
The Licensing Process: ATI to FMP
The first stage is Approval to Incorporate. ATI allows the firm to legally incorporate, lease office space, hire Responsible Individuals, and open local bank accounts. It does not permit any regulated activity or public marketing. Then comes the preparatory phase. This is where systems, controls, technology, and compliance frameworks are built.
The MVP license allows limited live operation with Qualified Investors and institutional clients. Retail access is prohibited. The MVP phase functions as a controlled stress test under real market conditions.
The final stage is Full Market Product status. External audits are required. Asset segregation must be fully demonstrated. Capital and insurance requirements must be met. Licences are renewed annually and remain subject to thematic reviews by VARA supervision teams.
VARA and SCA Harmonization
The VARA-SCA cooperation agreement resolved early-2020s jurisdictional fragmentation. VASPs operating from Dubai obtain their primary licence from VARA and are automatically registered with the SCA. This grants passporting rights across the UAE, excluding DIFC and ADGM.
VASPs operating primarily outside Dubai must licence directly with the SCA. Dubai functions as the specialist hub. The SCA maintains federal oversight. The structure is deliberate and stable.
AML, CFT, and the Travel Rule
For virtual asset transfers above AED 3,500, the FATF Travel Rule applies. Originator and beneficiary information must be transmitted immediately and securely. Counterparty VASPs must be verified before transfers are processed. Rejected transfers must be logged.
Privacy-enhancing cryptocurrencies and transaction-obfuscation tools are banned. Facilitation results in immediate licence revocation. Unhosted wallets are classified as high risk. Enhanced due diligence applies, including source-of-wealth verification.
Governance, Substance, and Responsible Individuals
VARA eliminated the shell-company model. Physical offices must be private, enclosed, and auditable. Coworking spaces do not meet the standard.
Two Responsible Individuals must be resident in the UAE. They must hold real authority and are personally accountable for regulatory breaches. An on-the-ground MLRO and Compliance Officer are mandatory. VARA expects direct access to decision-makers during inspections.
Investor Classification and Retail Restrictions
Qualified Investors must meet financial thresholds and knowledge requirements. Net assets must exceed AED 3.5 million, excluding primary residence. Only 50% of virtual asset holdings may be counted. Income-based qualification is available. Knowledge must be documented.
Institutional clients receive greater flexibility, especially around margin and risk limits. Retail protections are enforced.
M&A and Pre-Approved Entities
A secondary market exists for ATI and MVP entities, and VARA is aware of it. Any change of control requires prior approval. Applications must be filed at least 30 working days in advance. New controllers are assessed under the same fit-and-proper standards as new applicants.
Entities without staff or physical presence raise immediate concerns. VARA can withdraw approvals if shell characteristics are detected. Buyers must substantiate immediately or lose the asset.
Marketing and Promotion Rules
Marketing is regulated activity. All materials must be fair, clear, and not misleading. Risk disclaimers are mandatory. Guaranteed returns and low-risk claims are prohibited. Influencer promotions must be clearly disclosed.
Violations can result in fines up to AED 10,000,000 and suspension of licences. Jurisdictional arbitrage does not apply. Targeting UAE residents triggers compliance regardless of where the firm is based.
Continuous Supervision and Audits
Supervision is continuous. Monthly financial statements and wallet disclosures are required. Material changes must be reported immediately.
Quarterly risk reports include liquidity stress testing and cybersecurity incident logs. Annual financial audits are mandatory. Custodians and exchanges undergo semi-annual reserve audits. SOC 2 Type 2 reports are commonly required for technology-heavy firms. Inspections are ongoing and unannounced.
Dubai Going Into 2027
VARA achieved what it set out to do. High capital thresholds filtered out weak operators. Substance rules killed shell structures. Transparency rebuilt trust with banks.
Compliance is no longer administrative overhead. It is a core operating function. The next phase may include Real-World Asset tokenisation, stablecoins integrated into retail payments, and only firms that meet central bank-level standards will participate.
Anyone who understands and survives the 2026 VARA framework is no longer asking whether Dubai is serious. They’re already operating inside one of the tightest regulatory environments in the market.
Frequently Asked Questions (FAQ)
What is the VARA MVP license in Dubai?
The MVP (Minimum Viable Product) license allows limited live operation under VARA supervision, restricted to Qualified Investors and institutional clients. Retail access is not permitted at this stage.
Is the MVP license mandatory before getting a Full Market Product license?
In most cases, yes. VARA uses the MVP phase as a controlled testing period before granting Full Market Product status, especially for exchanges, brokers, and custodial platforms.
Can startups operate or market during the MVP phase?
Operations are limited and tightly supervised. Public retail marketing is prohibited. Engagement is restricted to approved client categories and approved activities only.
How long does the MVP phase usually last?
Typically 6-12 months, depending on audit outcomes, compliance performance, and operational maturity demonstrated during live supervision.
Can retail clients be onboarded under an MVP license?
No. Retail access is only permitted after Full Market Product approval. MVP is strictly institutional and Qualified Investor only.
What capital is required for the MVP license?
Capital requirements depend on the licensed activity. VARA applies expense-based capital rules and requires Net Liquid Assets equal to at least 1.2x monthly operating expenses.
Does VARA allow outsourced custody during the MVP phase?
Yes, but only to VARA-licensed custodians. Outsourcing custody can reduce capital requirements but does not reduce compliance or supervision obligations.
Can a company outside Dubai apply for a VARA MVP license?
No. The applicant must be incorporated in Dubai and maintain a physical office, resident Responsible Individuals, and local decision-making authority.
Is the MVP license transferable or sellable?
Changes of control are possible but require VARA pre-approval. Shell structures or inactive entities risk immediate withdrawal of approval.
What happens if a firm fails during the MVP phase?
VARA can restrict activity, extend the MVP phase, or revoke approval entirely. Failure at MVP usually blocks progression to Full Market Product status.
