VARA Licence Dubai ATI to Full VASP Licence: Step-by-step Application Support

Quick Decision Panel: Is This Page for You?

If you are a founder, compliance officer or in-house counsel preparing to obtain a VARA licence Dubai or you already hold an Approval to Incorporate (ATI) and need to convert it into a full VASP licence this page provides the practical, step-by-step guidance you need. It covers every stage of the licensing journey: from the Initial Disclosure Questionnaire (IDQ) through to post-licence compliance obligations, with indicative costs, timelines and a downloadable application checklist mapped to each phase.

Whether you are launching an exchange, a custody platform, a broker-dealer or a lending protocol, the information below draws directly from VARA’s published rulebooks and official guidance to give you a realistic, commercially grounded roadmap. Download the VARA Application Checklist to track your documentation across IDQ, ATI and full submission milestones.

At a glance: indicative capital floors range from AED 200,000 (advisory/issuance) to AED 10,000,000+ (exchange services), and a typical ATI-to-full-licence timeline runs between three and eight months depending on activity type and application quality.

Introduction: What Is a VARA VASP Licence?

Dubai’s Virtual Assets Regulatory Authority (VARA) is the dedicated regulator established under Law No. (4) of 2022 Regulating Virtual Assets. VARA exercises jurisdiction over all virtual-asset activities conducted in or from the Emirate of Dubai, with the sole exception of the Dubai International Financial Centre (DIFC), which is supervised by its own regulator (DFSA). Any entity that wishes to provide virtual-asset services within this perimeter must first receive VARA’s approval operating without a licence is a regulatory offence.

VARA maintains a modular rulebook framework the Virtual Assets and Related Activities Regulations 2023 supplemented by activity-specific rulebooks for exchanges, custody, lending, issuance and more. Together, these set out the capital, governance, technology and AML requirements that every applicant must satisfy.

The business case for obtaining a VARA licence extends well beyond regulatory compliance. Licensed VASPs gain access to Dubai’s banking infrastructure, can establish formal custody and settlement relationships, and benefit from the supervisory credibility that institutional counterparties and sophisticated retail users now expect. VARA’s Public Register which lists entities with In-Principle Approvals (IPAs) and full VASP licences has become a de facto verification tool for the market.

The licensing pathway is structured in two stages: first, an IDQ submission leading to an In-Principle Approval or Approval to Incorporate (ATI); second, an operational build-out phase culminating in the conversion of that ATI into a full VASP licence. Understanding what each stage requires and how long it realistically takes is essential to planning capital, headcount and launch timelines.

At a Glance: VARA Licensed Activities

VARA’s regulatory framework covers a defined set of Virtual Asset Activities set out in Schedule 1 of the VA Regulations, each governed by its own activity-specific rulebook. Applicants may apply for one or more activity permissions, all held under a single VASP licence. The principal categories are:

• Exchange Services: Operation of order-book exchanges, matching engines and derivatives platforms that facilitate the buying, selling and trading of virtual assets. Exchange applicants face the most rigorous capital, technology and governance requirements under the Exchange Services Rulebook, including market-surveillance obligations and client-asset segregation.
• Broker-Dealer Services: Intermediation between clients and exchanges or liquidity providers, including execution, settlement and advisory-adjacent functions. Capital requirements are lower than for full exchange operators, but fit-and-proper and conduct-of-business standards remain stringent.
• Custody Services: Safeguarding virtual assets on behalf of clients, encompassing segregated-wallet infrastructure, key-management protocols and, where offered, custodial staking. The Custody Services Rulebook imposes detailed requirements around wallet architecture, disaster recovery and independent technology audits.
• Lending and Borrowing Services: Facilitating the lending or borrowing of virtual assets, whether through pooled models or bilateral arrangements. Applicants must demonstrate robust risk-management frameworks and transparent disclosure to users.
• Management and Investment Services: Portfolio management, fund-like structures and discretionary investment mandates involving virtual assets. Governance and investor-protection requirements mirror traditional asset-management standards.
• VA Issuance and Token Offering: The creation, promotion and distribution of new virtual assets or tokens, governed by the VA Issuance Rulebook. Issuers face disclosure, whitepaper and marketing-material obligations before launch.

Importantly, a single VASP may hold permissions across multiple activity categories for example, an exchange that also offers custody and staking provided it meets the requirements for each activity independently.

Process: Step-by-Step VARA Licence Application

The VARA licence application follows a clearly staged pathway. VARA’s official licensing page describes a structured sequence: pre-assessment, IDQ submission, In-Principle Approval (IPA) or Approval to Incorporate (ATI), operational build-out, and final conversion to a full VASP licence. Each stage has distinct deliverables and evidence requirements.

Step 0: Pre-Assessment and Business-Model Mapping

Before engaging with VARA, applicants should determine their preferred entity type (Dubai mainland LLC or qualifying free-zone company), map their proposed business model to one or more VA activity codes in Schedule 1, and conduct preliminary legal and tax checks including any implications arising from UAE corporate-tax obligations. This preparatory phase typically takes two to four weeks and reduces the risk of structural rework later in the process.

Step 1: IDQ Initial Disclosure Questionnaire

The IDQ is the applicant’s first substantive submission to VARA. It requires detailed, candid disclosures across several domains: corporate structure and ownership, proposed VA activities, technology architecture, AML/KYC controls, governance arrangements (including board composition and an organisational chart), and financial projections. Common pitfalls include vague descriptions of the business model, incomplete beneficial-ownership structures, and generic AML policies that do not reflect the applicant’s specific risk profile. The IDQ should be treated as a regulatory interview in documentary form examiners will follow up on inconsistencies. Preparing supporting evidence (tech-architecture diagrams, draft AML policies, CVs of key personnel) at this stage accelerates the review considerably. For applicants preparing their first IDQ submission, a practical IDQ answers guide can highlight common traps and examiner queries.

Step 2: In-Principle Approval / Approval to Incorporate (ATI)

If VARA is satisfied with the IDQ and any supplementary information requests, it issues an In-Principle Approval (IPA), also referred to as an Approval to Incorporate (ATI). The ATI is not a licence to operate it is conditional approval that authorises the applicant to incorporate a legal entity in Dubai, open bank accounts, lease office space, and begin hiring. The ATI letter will typically set out specific conditions that must be met before a full licence can be granted: these commonly include depositing the required regulatory capital, appointing a Money Laundering Reporting Officer (MLRO), completing independent technology audits, and finalising custodian or insurance arrangements. Applicants should plan for the ATI decision to take eight to sixteen weeks from IDQ submission, depending on the complexity of the application and the quality of the initial submission.

Step 3: Operational Set-Up to Satisfy ATI Conditions

With ATI in hand, the applicant enters the operational build-out phase. This involves establishing a physical office in Dubai, deploying and testing technology infrastructure, onboarding AML/KYC vendors and transaction-monitoring systems, securing bank custody or settlement accounts, and engaging an independent auditor for the technology and security assessment VARA requires. This phase is often the longest, typically spanning twelve to twenty-eight weeks, with bank onboarding and technology audits being the most common sources of delay.

Step 4: Final Submission Converting ATI to Full VASP Licence

Once all ATI conditions are satisfied, the applicant prepares a final evidence package for VARA. This includes proof of capital deposit and segregation, completed independent audit reports (technology and, where applicable, financial), executed custody and insurance agreements, and evidence that all governance and compliance functions are operational. VARA reviews the package, may conduct an on-site inspection or request supplementary evidence, and if satisfied issues the full VASP licence. The applicant’s details are then added to the Public Register.

Step 5: Post-Licence Obligations and Transitional Rules

Receiving a full VARA licence is the start of an ongoing supervisory relationship, not the end of the regulatory journey. VASPs must comply with periodic reporting obligations, submit to annual audits, maintain capital adequacy at all times, and promptly notify VARA of any material changes to their business model, governance or technology architecture.

Comparison Table: Requirements, Costs and Timelines by Activity

The table below provides indicative ranges for the principal cost and timeline variables across five common activity types. These figures are based on market experience and publicly available VARA fee communications; they should be used as planning estimates, not as definitive regulatory quotations. Actual figures depend on the applicant’s specific business model, activity scope and risk profile.

Important: these ranges cover VARA’s direct regulatory fees only. Applicants should budget separately for incorporation and local-licence costs, legal and compliance advisory fees, independent technology and security audits, office establishment, staffing (including the MLRO), custody and insurance arrangements, and travel-rule and KYC-vendor subscriptions. In aggregate, these ancillary costs often equal or exceed the regulatory fee component. Industry observers expect VARA to continue publishing periodic fee clarifications as the licensing regime matures.

Eligibility: Key VARA Regulatory Requirements

Legal and Corporate Form

Applicants must establish or maintain a legal entity registered in Dubai either a mainland LLC or an entity within a qualifying free zone. The ATI stage of the VARA application specifically authorises the applicant to incorporate, meaning that in many cases the entity is formed after (not before) ATI is granted. Law No. (4) of 2022 makes clear that VARA’s jurisdiction covers all Dubai territories except the DIFC. Free-zone entities applying for a VARA licence should verify that their zone’s regulations permit VA activities and that the entity can satisfy VARA’s substance requirements.

Fit and Proper Persons and Governance

VARA places significant weight on the quality of an applicant’s governance framework. The Company Rulebook requires that directors, senior management and key function holders pass fit-and-proper assessments covering competence, integrity, financial soundness and relevant experience. Boards must include members with demonstrable expertise in virtual assets, financial services or technology, and VARA expects a meaningful local management presence in Dubai not a purely nominal directorship. Governance documentation should include detailed CVs, declarations of interests, criminal-record clearances and a clear organisational chart mapping reporting lines from board level through to operational functions including the MLRO and Chief Technology Officer.

Capital and Prudential Requirements

Regulatory capital floors are set by the Company Rulebook and supplemented by activity-specific rulebooks. Capital must typically be deposited with a UAE-licensed bank and evidenced by a bank-confirmation letter. The required amount varies by activity type and risk profile as the comparison table above illustrates, exchange operators face substantially higher capital requirements than advisory or issuance applicants. Applicants should also prepare for ongoing capital-adequacy obligations, including maintaining minimum net-liquid-asset ratios throughout the licence term. Detailed capital-requirements modelling is available in our VARA capital requirements deep-dive.

Technology and Security

Technology infrastructure is scrutinised closely, particularly for custody and exchange applicants. The Custody Services Rulebook mandates segregated-wallet architectures, formal key-management procedures, disaster-recovery and business-continuity planning, and independent penetration testing. All applicants must demonstrate travel-rule readiness and may need to engage an accredited third-party auditor to certify their technology stack before a full licence is issued.

AML/KYC and Compliance

Robust AML/KYC controls are non-negotiable. VARA’s Regulations require applicants to implement customer due diligence, enhanced due diligence for high-risk clients, ongoing transaction monitoring, suspicious-activity reporting, and comprehensive record-keeping. The MLRO must be appointed before a full licence can be granted, and AML policies must be tailored to the specific VA activities being performed.

Required Documents: Practical Checklist

Preparing the right documentation at the right stage is one of the most important determinants of application speed. Below is a grouped checklist indicating which items are typically required at each milestone. Download the VARA Application Checklist for a printable version mapped to IDQ, ATI and full-submission phases.

• Corporate (IDQ / ATI): Proposed Memorandum of Association or LLC operating agreement, incorporation forms, shareholder register, beneficial-ownership structure chart, and proof of registered address.
• Governance (IDQ / ATI): Board and senior-management CVs, fit-and-proper declarations for all key function holders, organisational chart with reporting lines, and board resolutions authorising the VARA application.
• Compliance (IDQ / Full Submission): Tailored AML/CFT policy manual, transaction-monitoring plan, MLRO appointment letter and CV, sanctions-screening procedures, and record-keeping policy.
• Technology (ATI / Full Submission): System-architecture diagrams, wallet-management and key-custody procedures (for custody applicants), disaster-recovery and business-continuity plans, independent penetration-test reports, and travel-rule readiness evidence.
• Financial (ATI / Full Submission): Bank-confirmation letter evidencing capital deposit, audited financial statements (if the entity has operating history), professional-indemnity or insurance certificate, and projected financial statements for the first licence term.

Getting documents right at the IDQ stage significantly reduces the number of supplementary-information requests from VARA and can shorten the overall timeline by several weeks.

Common Rejections and How to Avoid Them

Based on market experience, the most frequent reasons for VARA delaying or refusing an ATI or full licence conversion are:

• Weak governance or board composition: Nominees without genuine VA or financial-services experience. Mitigate by appointing substantive directors with provable track records.
• Insufficient capital proof: Letters from non-qualifying banks or evidence that does not match the required capital floor. Mitigate by confirming deposit requirements with VARA and your bank before submission.
• Inadequate AML/CFT controls: Generic policies not tailored to the applicant’s specific VA activities and risk profile. Mitigate by commissioning a bespoke AML framework before IDQ submission.
• Unclear business model: Vague descriptions of product, revenue model or target market. Mitigate by mapping your model precisely to Schedule 1 VA activities with detailed product documentation.
• Technology and security gaps: Missing penetration tests, undocumented key-management procedures or no disaster-recovery plan. Mitigate by engaging a qualified security auditor early in the ATI phase.
• Inaccurate or inconsistent IDQ answers: Contradictions between the IDQ narrative and supporting documents. Mitigate by conducting an internal consistency review before submission and appointing a single point of responsibility for quality control.

Timeline and Realistic Milestones for a VARA Licence Application

A standard VARA licence application from initial pre-assessment through to receiving a full VASP licence typically spans six to ten months end to end. The following milestones represent a realistic month-by-month overview:

• Weeks 1–4: Pre-assessment, entity-structuring decisions, business-model mapping and IDQ preparation.
• Weeks 4–8: IDQ submission and initial VARA review, including any supplementary-information requests.
• Weeks 8–16: VARA assessment period culminating in ATI / IPA decision.
• Weeks 12–28: Operational build-out (overlapping with ATI review): entity incorporation, office set-up, technology deployment, bank onboarding, AML system implementation and independent audits.
• Weeks 16–32: Final evidence submission and VARA review, leading to full VASP licence issuance.

Factors that accelerate the process include a well-prepared IDQ with complete supporting evidence, prior regulatory engagement with VARA, and early appointment of an MLRO and independent auditor. Conversely, bank-onboarding delays, incomplete technology audits and unclear beneficial-ownership structures are the most common sources of timeline slippage.

Costs: Realistic Budgeting Guide for a VARA Licence

Understanding the full cost of obtaining a VARA licence Dubai requires looking beyond VARA’s direct regulatory fees. The principal cost categories are:

• VARA application and supervision fees: As outlined in the comparison table, these range from approximately AED 25,000 to AED 150,000 for the application and AED 40,000 to AED 400,000 annually for supervision, depending on activity type.
• Incorporation and local-licence costs: Mainland LLC or free-zone registration, trade-licence fees and visa costs typically AED 30,000 to AED 100,000.
• Technology and security audits: Independent penetration testing and technology assessments typically AED 80,000 to AED 250,000 depending on complexity.
• Legal and compliance advisory: IDQ drafting support, policy development, regulatory liaison typically AED 150,000 to AED 500,000 depending on scope.
• Operational set-up: Office lease, staffing (MLRO, compliance, operations), equipment highly variable by business model.
• Third-party custody, insurance and vendor costs: Travel-rule solution providers, KYC platforms, professional-indemnity insurance typically AED 50,000 to AED 200,000 annually.

Three illustrative first-year budget scenarios based on market experience:

• Boutique broker-dealer: Total first-year programme cost of approximately AED 800,000 to AED 1,500,000, including AED 500,000+ in regulatory capital.
• Regional exchange: Total first-year programme cost of approximately AED 4,000,000 to AED 8,000,000, including AED 3,000,000 to AED 10,000,000 in regulatory capital.
• Custody provider: Total first-year programme cost of approximately AED 2,000,000 to AED 4,500,000, including AED 1,000,000 to AED 5,000,000 in regulatory capital and higher technology-audit expenses.

These are indicative estimates based on market experience. All applicants should build a contingency buffer of 15–25 per cent above their base-case budget to accommodate VARA supplementary requests, audit re-work and bank-onboarding delays.

Client Case Studies (Anonymised)

Regional broker-dealer IDQ to full licence in five months: A MENA-headquartered brokerage submitted a well-prepared IDQ with complete governance documentation and a tailored AML framework. ATI was granted within ten weeks. The operational build-out, including bank onboarding and technology audit, took a further twelve weeks. Total advisory cost was approximately AED 350,000, with regulatory capital of AED 1,200,000 deposited during the ATI phase.

Digital-asset custodian technology audit as the critical path: A custody start-up with institutional backing received ATI within fourteen weeks but spent an additional sixteen weeks resolving technology-audit findings related to key-management procedures and disaster-recovery documentation. After engaging a specialist security auditor to remediate the findings, the full VASP licence was issued at week thirty. The experience underscores the value of commissioning the technology audit early in the ATI phase rather than waiting for the final-submission stage.

Multi-activity exchange parallel licensing and cost savings: An exchange applicant seeking permissions across exchange, custody and broker-dealer activities consolidated its applications into a single VASP licence. By preparing unified governance and compliance documentation and conducting a single comprehensive technology audit covering all three activities, the applicant reduced total advisory costs by approximately 20 per cent compared to sequential applications.

What Happens After Approval Ongoing Compliance and Reporting

Receiving a full VARA licence opens the next chapter: ongoing supervisory compliance. VARA’s activity and other rulebooks impose a series of continuing obligations that licensees must embed into their operations from day one:

• Periodic reporting: Licensees must submit regular reports to VARA covering financial position, transaction volumes, risk incidents and compliance metrics. Reporting frequency and format vary by activity type and are specified in the applicable rulebook.
• Annual audits: Independent financial and, in some cases, technology audits must be conducted annually and results submitted to VARA within stipulated deadlines.
• Material-change notifications: Any changes to governance, ownership, business model or technology architecture must be notified to VARA promptly, and in some cases require prior approval.
• Public Register updates: Licensee information on the Public Register must remain accurate and current. VARA may update or annotate register entries to reflect regulatory actions or changes in licensed activities.
• Annual supervision fees: Ongoing supervision fees must be paid to maintain the licence, with amounts dependent on the scope and scale of licensed activities.

A structured VARA compliance playbook covering KYC/AML operations, transaction monitoring and regulatory reporting is essential for managing these obligations efficiently. Industry observers expect VARA’s supervisory approach to intensify as the number of licensed entities grows.

Downloadable Asset: VARA Application Checklist

The VARA Application Checklist is a structured, printable document designed to accompany you through every stage of the licensing journey. It maps each required document and evidence item to the specific milestone at which VARA expects to receive it IDQ, ATI or full submission and includes practical notes on formatting, common examiner queries and quality-control checkpoints.

The checklist covers five document groups: corporate formation, governance and fit-and-proper evidence, compliance and AML materials, technology and security documentation, and financial proof. Each item is flagged with a priority level (critical, recommended, supporting) and cross-referenced to the relevant VARA rulebook provision. Download the VARA Application Checklist to begin organising your submission immediately.

How Global Law Experts Works with VARA Applicants

Global Law Experts connects businesses pursuing a VARA licence Dubai with specialist regulatory advisers who provide hands-on application support at every stage. Services available through the network include IDQ preparation and coaching, ATI-condition satisfaction planning, document drafting (AML policies, governance frameworks, compliance manuals), technology-audit coordination with accredited providers, capital-structuring advice, and direct regulator-liaison support throughout the VARA review process.

With a global network spanning more than 180 jurisdictions and over seventeen years of experience connecting clients with leading legal professionals, Global Law Experts brings both depth and breadth to the VARA application process. For multi-jurisdictional groups requiring parallel crypto licensing in Abu Dhabi (ADGM/FSRA), Singapore or the EU, the network can coordinate advisory teams across regulators to ensure consistency and efficiency.

Whether you are at the pre-assessment stage, managing an active ATI build-out, or converting an existing IPA into a full VASP licence, the right advisory support can materially reduce timeline risk, avoid common rejection triggers, and ensure your application reaches VARA in the strongest possible form.

Sources

• Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai Dubai Legislation Portal
• VARA Licence Applications (Official)
• VARA Public Register
• Virtual Assets and Related Activities Regulations 2023 VARA Rulebooks Portal
• Schedule 1 VA Activities VARA Rulebooks
• Company Rulebook VARA Rulebooks
• Exchange Services Rulebook VARA Rulebooks
• Custody Services Rulebook VARA Rulebooks
• VA Issuance Rulebook VARA Rulebooks
• VA Activity and Other Rulebooks VARA Rulebooks Portal
• VARA Clarification and Further Information on Fees