National Supervisory Authority & Licensing Qualification Dossier • Middle East & GCC
VARA
United Arab EmiratesVirtual Assets Regulatory Authority
Source / Native Reference: 迪拜虚拟资产监管局
- Supervisory tier
- Tier-2
- License classes
- 3
- Licensed records
- 9
- Active / regulated
- 9
Statutory Supervisory Mandate & Scope
Dubai Virtual Assets Regulatory Authority (VARA) (VARA) serves as the statutory financial intelligence, anti-money laundering (AML/CFT), and Virtual Asset Service Provider (VASP) supervisory authority in United Arab Emirates (Dubai). Regulated entities must maintain registration in good standing, implement risk-based KYC/CDD screening, comply with FATF Recommendation 16 Travel Rule wire-transfer obligations, and submit suspicious transaction reports (STRs).
Authorises investment banks, multilateral trading facilities, prime brokers, asset managers, family offices, and global Virtual Asset Service Providers (VASPs) across the UAE.
Prudential Tier Assessment
Tier-2Premier Middle East common-law financial free-zone and specialised virtual asset regulators (DFSA in DIFC, FSRA in ADGM, VARA in mainland Dubai, and SCA/CBUAE federally).
National licensing qualifications & statutory authorisation classes (VARA)
Authorisation categories, permitted institutional and retail activities, minimum initial capital adequacy, and ongoing prudential solvency rules enforced by VARA in United Arab Emirates.
| License class / code | Official designation | Permitted institutional & retail activities | Minimum initial / base capital | Ongoing prudential & solvency rule |
|---|---|---|---|---|
| Category 2 / Category 3A (DFSA / ADGM FSRA) | Dealing in Investments as Principal (Cat 2) or Matched Principal / Agent (Cat 3A) | Principal market making, matched-principal FX/CFD/securities brokerage, or operating a Multilateral Trading Facility (MTF). | USD $2,000,000 Base Capital (Category 2 Principal) or USD $500,000 Base Capital (Category 3A Matched Principal / Agent), or Risk Capital + 18/52nds of annual expenditure. | PIB (Prudential — Investment, Insurance Intermediation and Banking) quarterly EPRS returns, mandatory local Senior Executive Officer (SEO), Finance Officer (FO), and Compliance Officer/MLRO. |
| Category 3C / Category 4 (DFSA / ADGM FSRA) | Managing Assets / Collective Investment Fund Manager (Cat 3C) & Arranging/Advising (Cat 4) | Discretionary asset management, hedge fund / venture capital fund management, and institutional investment advisory. | USD $70,000 to USD $500,000 Base Capital (Cat 3C) or USD $10,000 Base Capital + 6/52nds Expenditure-Based Capital Minimum (Cat 4). | Professional Indemnity Insurance (PII) mandatory, independent fund administrator/custodian, and annual external Client Money & Prudential Audit. |
| VARA VASP (Exchange / Broker-Dealer / Custody) | Dubai VARA Virtual Asset Service Provider Licence | Operating a centralized/order-book virtual asset exchange, OTC crypto broker-dealer desk, institutional VA custody, or VA management and investment services. | AED 500,000 to AED 1,500,000 paid-up capital (or 15%–25% of fixed annual overheads + 1.2x monthly operating expenses in net liquid assets). | 1:1 Reserve Assets backing all client virtual assets, monthly proof-of-reserve & balance sheet filings to VARA, and mandatory D&O + Cyber/Custody Insurance. |
Investor compensation, client money segregation & digital-asset regime
Statutory counterparty protections, custody reconciliation mandates, and virtual-asset licensing status under VARA.
Statutory Client Money & Safe Custody Trust Protection (DFSA COB 6.12 / ADGM COBS 14 / VARA Custody Rulebook)
- Maximum coverage per client
- 100% bankruptcy-remote statutory trust segregation of client money and virtual assets (no pooled retail cash compensation fund; protected via strict base/expenditure capital & PII insurance)
- Eligible counterparties & scope
- Retail Clients, Professional Clients, and Market Counterparties (subject to strict Client Classification net-worth tests of USD $1,000,000 liquid assets for Professional status).
DFSA COB Chapter 6.12 (Client Money) / ADGM COBS Chapter 14 / VARA Custody Services Rulebook
- Reconciliation & audit cadence
- Daily reconciliation of Client Money Accounts and Virtual Asset omnibus/segregated wallets; monthly Client Money Auditor’s Report.
- Approved custodian requirements
- Client money must be held with a licensed UAE bank or Tier-1 bank holding a written trust acknowledgment waiving all rights of set-off or counterclaim.
VARA Full-Market VASP Regime, ADGM FSRA Virtual Asset MTF/Custodian & DFSA Crypto Token Regime
- Travel Rule, custody & stablecoin rules
- UAE Central Bank & VARA/FSRA AML rules mandate FATF Travel Rule compliance for all VA transfers ≥ AED 3,500 (~USD $1,000); mandatory cold-wallet multi-sig governance.
Primary Governing Statutes & Rulebooks
- DIFC Regulatory Law 2004 & DFSA Rulebook (GEN, PIB, COB, CIR Modules)
- ADGM Financial Services and Markets Regulations 2015 (FSMR) & FSRA Virtual Asset Framework
- Dubai Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai (VARA Rulebooks)
- UAE Federal Decree-Law No. (20) of 2018 on Anti-Money Laundering and CFT
Regulatory Reporting & Audit Obligations
Quarterly Electronic Prudential Reporting System (EPRS) filings and annual IFRS audited financial statements within 4 months of year-endAnnual Client Money Auditor’s Report and Safe Custody Auditor’s Report filed with DFSA / FSRA / VARAUAE goAML Suspicious Transaction Reporting (STR) to the UAE Financial Intelligence Unit (UAE FIU)
Cross-Border Equivalence & Passporting
DIFC and ADGM operate under independent English common-law courts with UAE-wide fund passporting agreements between SCA, DFSA, and ADGM FSRA.
Supervised institutions & VARA licence records in our database
9 licence records referencing VARA (9 regulated/registered).
| Institution | Licence number | Status | Licensed legal entity | Effective date | Verification |
|---|---|---|---|---|---|
| OKX | VL/23/12/003 | Regulated | OKX Middle East Fintech FZE | 2024/09/17 | |
| BAM(Global network record) | VL/24/04/001 | Regulated | Binance FZE | 2024/04/17 | |
| Binance(Global network record) | Not supplied | Regulated | Binance FZE | 2023 | |
| bybit(Global network record) | Number pending check | Regulated | Bybit Limited | 2024-8-21 | |
| Komainu(Global network record) | VL/23/08/001 | Regulated | Komainu MEA FZE | 2023/08/18 | |
| Broker-4317(Global network record) | Number pending check | Regulated | Broker-4317 | 2023 | |
| SMS(Global network record) | VL/23/08/002 | Regulated | Hex Trust MENA FZE | — | |
| BitOasis(Global network record) | VL/2024/11/001 | Regulated | BitOasis Technologies FZE | 2024/11/29 | |
| CLTS(Global network record) | VL/24/01/001 | Regulated | Aquanow ME FZE | 2024-07-22 |
VARA (United Arab Emirates): institutional licensing & due diligence FAQ
Key statutory capital, compensation, custody segregation, and verification answers for compliance teams.
What are the primary licensing classes and minimum capital requirements under VARA (United Arab Emirates)?
VARA (Virtual Assets Regulatory Authority) supervises financial institutions in United Arab Emirates under DIFC Regulatory Law 2004 & DFSA Rulebook (GEN, PIB, COB, CIR Modules) and ADGM Financial Services and Markets Regulations 2015 (FSMR) & FSRA Virtual Asset Framework. Key statutory authorisation classes include: Category 2 / Category 3A (DFSA / ADGM FSRA) (Dealing in Investments as Principal (Cat 2) or Matched Principal / Agent (Cat 3A) — min. capital: USD $2,000,000 Base Capital (Category 2 Principal) or USD $500,000 Base Capital (Category 3A Matched Principal / Agent), or Risk Capital + 18/52nds of annual expenditure.); Category 3C / Category 4 (DFSA / ADGM FSRA) (Managing Assets / Collective Investment Fund Manager (Cat 3C) & Arranging/Advising (Cat 4) — min. capital: USD $70,000 to USD $500,000 Base Capital (Cat 3C) or USD $10,000 Base Capital + 6/52nds Expenditure-Based Capital Minimum (Cat 4).); VARA VASP (Exchange / Broker-Dealer / Custody) (Dubai VARA Virtual Asset Service Provider Licence — min. capital: AED 500,000 to AED 1,500,000 paid-up capital (or 15%–25% of fixed annual overheads + 1.2x monthly operating expenses in net liquid assets).). Ongoing prudential supervision requires strict adherence to capital adequacy and liquidity buffers.
Does VARA provide statutory investor compensation and mandatory client asset segregation?
Under VARA's framework, investor protection is governed by Statutory Client Money & Safe Custody Trust Protection (DFSA COB 6.12 / ADGM COBS 14 / VARA Custody Rulebook) with maximum coverage of 100% bankruptcy-remote statutory trust segregation of client money and virtual assets (no pooled retail cash compensation fund; protected via strict base/expenditure capital & PII insurance) (Retail Clients, Professional Clients, and Market Counterparties (subject to strict Client Classification net-worth tests of USD $1,000,000 liquid assets for Professional status).). For client money and custody assets, supervised firms must comply with DFSA COB Chapter 6.12 (Client Money) / ADGM COBS Chapter 14 / VARA Custody Services Rulebook, performing daily reconciliation of client money accounts and virtual asset omnibus/segregated wallets; monthly client money auditor’s report. with client money must be held with a licensed uae bank or tier-1 bank holding a written trust acknowledgment waiving all rights of set-off or counterclaim..
How does VARA regulate digital assets, crypto exchanges (VASPs/CASPs), and stablecoins?
VARA's digital-asset regime is structured around VARA Full-Market VASP Regime, ADGM FSRA Virtual Asset MTF/Custodian & DFSA Crypto Token Regime (World’s most granular activity-based virtual asset rulebooks covering Advisory, Broker-Dealer, Custody, Exchange, Lending/Borrowing, VA Management, and Transfer/Settlement.). Custody and AML/CFT compliance obligations require: UAE Central Bank & VARA/FSRA AML rules mandate FATF Travel Rule compliance for all VA transfers ≥ AED 3,500 (~USD $1,000); mandatory cold-wallet multi-sig governance.
How can I verify an institution's VARA licence number and check our 9 recorded licence entries?
Our database currently tracks 9 licence records referencing VARA (9 marked regulated or registered). To verify a counterparty at the primary source, open VARA's official public register (https://www.vara.ae/en/licenses-and-register/public-register/), search by the exact reference number and legal entity name, and confirm that the firm's domain and permitted activities match its statutory authorisation.
Related regulatory & market structure briefings
Research and compliance analysis from RegTech Codex relevant to VARA and United Arab Emirates.
RegTech & Prudential Compliance
European Financial Regulatory Architecture in 2026: DORA ICT Operational Resilience, MiCA CASP Prudential Supervision, and EU AMLA Direct Oversight
A comprehensive statutory compliance briefing analyzing Regulation (EU) 2022/2554 (DORA) ICT incident reporting and TLPT mandates, Regulation (EU) 2023/1114 (MiCA) Class 1-3 CASP and EMT/ART reserve rules, Regulation (EU) 2023/1113 Travel Rule, and Frankfurt AMLA direct supervision.
Regulatory Compliance & Licensing
FATF Travel Rule (Recommendation 16) Cross-Border VASP Compliance, EU AMLR/AMLA Supervision & FCA/MAS Client Asset Segregation Audits: 2026 Codex
Cross-border Virtual Asset Service Provider (VASP) compliance refers to the synchronized execution of cryptographic wire-transfer messaging under FATF Recommendation 16, direct supranational AML supervision under EU Regulation (EU) 2024/1624 (AMLR) and Regulation (EU) 2024/1113 (TFR), and statutory daily client asset segregation reconciliations mandated by the UK FCA CASS 7/CASS 15 and MAS PSN02/CMSA frameworks.
EU MiCA & DORA Compliance
EU DORA & MiCA Compliance Rules: ICT Incident Reporting, CTPP Oversight & CASP Licensing (2026)
The EU Digital Operational Resilience Act (DORA) mandates major ICT incident reporting within 4 hours (Source: Regulation EU 2022/2554, 2025-01-17) and full MiCA CASP authorization by July 1, 2026 (Source: ESMA, 2026-07-01).
EU MiCA & DORA Compliance
EU Digital Operational Resilience Act (DORA) ICT Risk & 4-Hour Incident SLA: Statutory Capital Floors, Prudential Ratios & Licensing Thresholds (4 Hours Major ICT Incident Alert Benchmark)
EU Digital Operational Resilience Act (DORA) ICT Risk & 4-Hour Incident SLA (EU-DORA-2022-2554) stands at 4 Hours (Major ICT Incident Alert) (Source: ESMA / EBA / EIOPA Joint RTS, 2026-10-20), governing initial permanent
Statutory licensing classes, base capital rules, and investor protection summaries for VARA (United Arab Emirates) are maintained for institutional benchmarking and do not constitute legal advice. Always verify current rulebooks and active firm authorisations directly on VARA’s official public register.