Our Top Pick: Revolut — Best overall crypto bank for most users Open Account ↗ (affiliate)

VARA Dubai Explained

Dubai's Virtual Assets Regulatory Authority — what the framework looks like in 2026, who's licensed, and why no firm holds a Full Market Product licence yet.

SK
Reviewed by Stephan Kulik · Last updated: · How we rank

Short answer

VARA is the world's first standalone virtual-asset regulator (March 2022). It covers Dubai's emirate including DIFC, but excludes ADGM (Abu Dhabi). Licensing is graduated — Provisional → MVP → Full Market Product. No firm holds a Full Market Product (FMP) licence as of early 2026; every active authorisation is at MVP or earlier stage. This is intentional caution, not regulatory delay. Major platforms with VARA authorisations include Binance (MVP), OKX, Crypto.com, Bybit, Hex Trust, and Rain.

Origin and structure

VARA was established in March 2022 under Dubai Law No. 4 of 2022 as the world's first dedicated government regulator for virtual-asset activities. The legislation gave VARA jurisdiction over the issuance, exchange, custody, transfer, and management of virtual assets across Dubai — including DIFC and the broader emirate but excluding the Abu Dhabi Global Market, which operates under a separate framework (see our ADGM explainer).

VARA's mandate covers seven activities: advisory; broker-dealer; custody services; exchange services; lending and borrowing; payments and remittance services; and management and investment services. Each is licensed independently. A firm offering exchange + custody needs licences for both. The full Rulebook (published 2023, updated regularly) sets out activity-specific requirements for technology, capital, governance, AML, and consumer protection.

The graduated licence model

VARA operates a four-stage licensing model designed to slow firms through extensive pre-issuance scrutiny.

Provisional Approval

The first stage. Indicates VARA has accepted the firm's application for review. The firm cannot provide regulated services yet. This stage typically lasts months while VARA reviews technology, governance, capital, and personnel.

Initial Approval / Preparatory Licence

The firm has substantially met the application requirements and may begin operational preparations — but cannot serve customers. Includes pre-operational governance reviews, capital verification, and continued supervisory engagement.

Minimum Viable Product (MVP) Licence

The first stage at which the firm can serve customers, but under restrictions — typically capped customer numbers, capped transaction volumes, restricted product scope, and intensive ongoing supervision. Most currently-authorised VARA platforms hold MVP licences.

Full Market Product (FMP) Licence

Full commercial operation under standard supervision. As of early 2026, no firm holds an FMP licence. The graduation from MVP to FMP requires demonstrated track record, capital adequacy, and operational maturity. VARA is taking the position that this bar should be high.

Who's authorised (as of early 2026)

Major platforms with VARA authorisations include:

  • Binance — MVP licence (2022; extended to broader services since)
  • OKX — MVP licence holder
  • Crypto.com — Preparatory + MVP scope
  • Bybit — MVP licence
  • Hex Trust — VARA Temporary Permit (regional institutional custody)
  • Rain — VARA scope extended from primary CBB Bahrain licence

The full live register is at vara.ae. Always verify a platform's current VARA status before making a large deposit — licence status can change, and unauthorised firms operating in Dubai are subject to enforcement.

Why no FMP licences yet?

Some industry observers have read VARA's slow progression to FMP as bureaucratic delay. We think the alternative reading is more likely: VARA is operating extensive pre-issuance scrutiny in line with — or ahead of — global best practice.

The April 2025 enforcement against Hayvn by ADGM (not VARA) — $12.45M in penalties + a permanent ban for the CEO — demonstrated what happens when a crypto regulator issues full licences without sufficient ongoing supervisory infrastructure. ADGM had to pull a previously- licensed firm; VARA appears determined to avoid that pattern by being slower with initial issuance and more rigorous with the supervisory engagement that precedes FMP graduation. See our Hayvn ADGM enforcement post-mortem.

What VARA licensing means for users

Three practical implications.

Customer-asset segregation is required. VARA-licensed firms must hold customer crypto in segregated custody arrangements specified by the Rulebook (cold storage requirements, multi-signature controls, audited reserves). In a regulated wind-down, segregated customer assets should be returnable to customers ahead of unsecured creditors.

The Rulebook updates regularly. VARA publishes amendments to its activity- specific rules at intervals throughout the year. Platforms must adapt; users should expect platform behaviour to occasionally change in response to rule updates.

MVP-stage restrictions can affect customer experience. Some VARA-licensed platforms operate under product-scope restrictions — restricted leverage, capped withdrawal amounts, certain product types unavailable. Always check the per-platform terms in the UAE market specifically; offerings may differ from the same platform's offerings in other jurisdictions.

FATF Travel Rule and AML

UAE applies the FATF Travel Rule (Recommendation 16) via local CBUAE regulations. VARA- licensed firms must transmit originator and beneficiary information for transfers above the threshold. UAE is a FATF member and has implemented Recommendation 16 in full.

FAQ

What is VARA? +
VARA — the Virtual Assets Regulatory Authority — is Dubai's dedicated regulator for virtual-asset activities, established in March 2022 under Dubai Law No. 4 of 2022. It is the world's first standalone government regulator focused exclusively on virtual assets. VARA covers all of Dubai (including DIFC and the broader emirate), with the exception of the Abu Dhabi Global Market (ADGM) which has its own framework.
What VARA licences exist? +
VARA operates a graduated licensing model. Provisional approvals come first (initial discovery / market entry approval), followed by Minimum Viable Product (MVP) licences (limited operations under restrictions), then Full Market Product (FMP) licences (full commercial operation). As of early 2026, no firm holds an FMP licence — every authorised firm is at MVP or earlier stage. This is by design: VARA is operating extensive pre-issuance scrutiny in line with global best practice.
What activities are regulated under VARA? +
VARA covers seven licensable activities: virtual-asset advisory; broker-dealer; custody services; exchange services; lending and borrowing; payments and remittance services; and management and investment services. Each licence is activity-specific — a firm wanting to provide custody and exchange needs both. The full Rulebook governs each activity's technology, capital, governance, AML, and consumer-protection requirements.
Which platforms hold VARA authorisations? +
As of early 2026, platforms with VARA authorisations (Provisional or MVP stage) include: Binance (MVP), OKX, Crypto.com, Bybit, Hex Trust, Rain (extended from CBB Bahrain primary licence), and a handful of regional firms. The full live register is published at vara.ae. No firm holds a Full Market Product (FMP) licence; every authorisation is conditional on continued compliance and regular FSRA-style supervision.
Does VARA protect my crypto in bankruptcy? +
VARA-licensed firms are required to segregate customer assets from operational funds and to hold customer crypto in custody arrangements specified by the Rulebook (cold storage requirements, multi-signature controls, audited reserves). In a regulated wind-down, segregated customer assets should be returnable to customers ahead of unsecured creditors. The legal robustness of this depends on the licence category and the specific custody structure — verify the platform's published custody arrangements before making large deposits.
Why hasn't VARA issued any Full Market Product (FMP) licences yet? +
VARA is operating extensive pre-issuance scrutiny — review of operational systems, capital adequacy, governance, AML compliance, and ongoing supervisory examinations. As of early 2026, no firm has progressed from MVP to FMP. Some industry observers read this as VARA dragging its feet; an alternative reading is that VARA is being responsibly cautious. The April 2025 enforcement against Hayvn (ADGM, not VARA) demonstrated what happens when crypto regulators issue licences without sufficient ongoing supervision; VARA appears to be avoiding that pattern.
How does VARA differ from ADGM? +
VARA covers Dubai (Mainland, Free Zones, DIFC); ADGM is a separate financial free zone in Abu Dhabi with its own regulator (FSRA). Both regulate virtual-asset activities, but the legal frameworks, licence categories, and supervisory cultures differ. ADGM tends to attract institutional and B2B firms; VARA covers a broader spectrum including retail-facing exchanges. A firm operating across the UAE typically needs licences from both.
Are crypto gains taxed in Dubai? +
No personal income tax applies in the UAE for individuals on capital gains, including crypto. The 2023 UAE Corporate Tax (9% on profits above AED 375,000) applies to businesses including crypto firms operating as commercial activities. Free-zone entities have specific Qualifying-Free-Zone-Person rules. Always consult a UAE-licensed tax adviser for your specific situation.

Sources and further reading

Legal & editorial
esc
↑↓ navigate ↵ open esc close