Dubai has placed itself at the centre of the global virtual-asset conversation by establishing a dedicated regulator: the Virtual Assets Regulatory Authority (VARA). Even for firms that already understand VARA’s licensing landscape, the Exchange Services permission is often the most operationally demanding; because it sits at the heart of trading infrastructure and attracts the deepest scrutiny on market integrity, surveillance, resilience, and fair execution.

If a business wants to operate a trading venue in Dubai (including its free zones and special development zones, excluding the DIFC); by maintaining an order book, matching and executing trades, setting venue rules, and running the surveillance, settlement and conduct controls that make a market function; that business will typically require a VARA Exchange Services licence. Ignoring the rule is not an option: operating an exchange “by way of business” without the proper authorisation exposes the firm to regulatory enforcement, commercial disruption, and serious reputational fallout.

In this article, we take a look at the Exchange Services licence offered by VARA, including what activities fall within scope, common exchange models captured, capital and insurance expectations, and the typical licensing pathway and ongoing compliance considerations.

What is VARA?

The Virtual Assets Regulatory Authority (VARA), established in early 2022, represents a pioneering initiative by the Dubai government to regulate the fast-growing sector of virtual assets.

VARA is the first regulatory body of its kind dedicated to ensuring the secure and effective functioning of Virtual Asset Service Providers (VASPs) in Dubai. This initiative positions Dubai and the UAE as a prominent centre for digital finance and innovation.

What are VARA’s objectives?

VARA’s primary objectives include promoting Dubai as a regional and international centre for virtual assets, enhancing the competitive edge of the Emirate in this domain, and fostering a robust digital economy.

The authority is tasked with developing regulations that protect investors while curbing illegal practices associated with virtual assets, including requirements around governance, disclosure, market conduct, and operational resilience.

The Virtual Assets Regulatory Authority is the single regulatory body in Dubai that offers licensing options in the virtual assets space. Here are the key benefits:

(i.)Regulatory Compliance and Legitimacy

1. Legal Authorisation: A VARA license provides legal authorization to operate within Dubai, ensuring that businesses comply with local laws and regulations governing virtual assets.
2. Investor Trust: Being licensed by VARA enhances credibility and trust among investors and clients, as it signifies adherence to established regulatory standards.

(ii.)Access to a Thriving Market

1. Strategic Location: Dubai's position as a global hub for blockchain and cryptocurrency innovation allows licensed firms to access a vibrant market with numerous opportunities for growth.
2. Supportive Ecosystem: VARA fosters a supportive regulatory environment that encourages innovation, providing firms with the necessary framework to develop and expand their services.

(iii.)Comprehensive Framework

1. Diverse Licensing Categories: VARA offers various licensing categories tailored to different types of virtual asset services, including advisory, exchange, custodial, and payment services. This flexibility allows businesses to choose a license that best fits their operational model.
2.  Ongoing Support: VARA provides continuous guidance and support throughout the licensing process and beyond, helping firms navigate compliance requirements effectively.

(iv.)Enhanced Operational Standards

1. High Compliance Standards:

License applicants are required to implement a robust compliance and anti-money laundering framework. They also have to put in place elaborate cybersecurity policies to address risks associated with virtual asset businesses.

This commitment not only protects consumers but also helps firms mitigate risks associated with virtual asset operations.

(v.)Training and Development: Licensed entities must engage in ongoing training for staff to stay updated on regulatory changes, ensuring that they maintain high operational standards at all times.

Firms that are licensed by VARA have to put in place detailed training and development plans for their employees and senior management, thus ensuring commitment to robust operational standards and keeping pace with the fast-developing field of virtual assets.

What activities fall under the VARA Exchange Services licence?

Covered exchange activities

An entity will generally require a VARA Exchange Services licence where, by way of business and for monetary or non-monetary benefit, it operates a venue or system that enables participants to exchange, trade, or convert virtual assets; either against fiat or against other virtual assets; and where the firm’s platform performs (or is responsible for) order intake, price formation, matching/execution, and/or maintaining an order book.

In practical terms, the perimeter is triggered when you are not merely “providing software”, but running the market infrastructure that determines how orders interact and trades are concluded.

Common scenarios include:

• Centralised spot exchange operations: operating a platform where users place bids/asks and trades are executed through a matching engine (VA↔fiat and/or VA↔VA).
  
  
• Order book + matching engine deployment: maintaining an order book and matching participant orders (including handling order types, prioritisation logic, cancellations, partial fills, and execution sequencing).
  
  
• Hosted trading venue for third parties: operating the venue layer for brokers, market makers, or institutional participants (including where the client relationship is B2B, but the platform is still providing exchange functionality).
  
  
• Conversion venues that are effectively an exchange: running an organised system that facilitates repeatable “convert” functionality between VA and fiat, or between VAs, where the firm controls execution and venue rules (even if the UX is framed as a simple conversion flow).
  
  
• Multi-participant crossing / internalisation at venue level: operating rules and systems that bring together multiple buyers and sellers (or multiple liquidity providers) and execute trades through venue logic, rather than a purely bilateral OTC arrangement.

What activities are exempt?

For Exchange Services, VARA’s perimeter is generally triggered when a firm is operating a trading venue; i.e., providing the infrastructure that brings together multiple buyers and sellers, forms prices, matches orders, executes trades, and/or maintains an order book. Activities that do not cross into that “venue layer” will typically sit outside the Exchange Services licensing requirement (though they may still fall under other permissions, depending on the facts).

1) Pure technology provision

This can include providing software, APIs, matching-engine technology, wallet infrastructure, cloud hosting, cybersecurity services, analytics tooling, or white-label components, where the provider does not:

• control or operate the marketplace rules,
  
  
• hold itself out as operating an exchange,
  
  
• handle order intake/matching/execution as a service provider to market participants, or
  
  
• maintain an order book or trading interface for participants under its responsibility.
  
  

A vendor supplying an order-matching engine as a licensed component to a separately authorised operator is not the same as operating the exchange.

2) Non-custodial / self-directed tooling that does not intermediate trading

Activities such as portfolio tracking dashboards, price charting, market data terminals, research screens, or token discovery tools are generally outside the Exchange perimeter where they are informational and do not provide a mechanism to execute trades through a venue operated by the firm.

3) Market data and general commentary 

Publishing market news, indices, price feeds, sector analysis, or educational content; including on social media, podcasts, or newsletters; does not, by itself, constitute operating an exchange, provided the content does not evolve into running a platform that executes trades or soliciting/arranging transactions through a venue.

4) Proprietary, internal trading 

Where a firm trades solely for its own account and does not operate a platform through which third parties place and match orders, it is typically not “Exchange Services” (though VARA may require an NOC / registration depending on volumes and facts, and other regimes may apply).

Important: exemptions are highly fact-sensitive. Once a “tech platform” starts to function like a multi-participant marketplace; for example, you host the trading UI, set trading rules, route orders to a matching engine, maintain an order book, determine execution logic, or market the service as a place to trade; the activity moves into Exchange Services risk, and VARA will treat it accordingly.

I want to operate a virtual asset business. Do I need a VARA license?

Yes. You will need to obtain a license from VARA, before you conduct any virtual asset business within the emirate of Dubai.

There are two stages in the licensing process. Step 1 is submission of an intial application, followed by a detailed review and in-principal approval.

VASPs are also required to be physically present in Dubai, in the form of leasing or purchasing an office.

The authority has also outlined specific requirements regarding capital adequacy, operational transparency, and compliance with anti-money laundering protocols.

What staffing and “fit and proper” expectations apply?

VARA expects advisory services firms to operate with an identifiable, accountable professional layer.

Advisory staff (including senior management and key advisory personnel) are typically expected to satisfy:

1. Integrity checks (fitness, propriety, conflicts, past conduct);
   
   
2. Competence checks (skills and capability to deliver advisory services responsibly);
   
   
3. Financial soundness checks; and For analysts, formal education and relevant experience in crypto and/or financial markets (especially where the firm produces research or recommendations relied upon by clients).

What is the process to set up a VARA license in Dubai?

1. Choose the zone of incorporation of the legal entity, this can be the DWTC or any other free zone in Dubai, or the Dubai Economic Department (mainland) license.
2. Finalise the physical office- this will be based on the number of visas required and actual space required to carry out your business operations.
3. Complete the reserving of the name and signing the corporate documents such as the Memorandum of Association.
4. Submit an Initial Disclosure Questionnaire (IDQ) to VARA.
5. VARA reviews the submission, revert with questions, if any, and then sends across an invoice for 50% of the application fees.
6. VARA issues an Initial Approval once the fees are paid.
7. Submit the Initial Approval to the contracted free zone to obtain the non-operational license.
8. Complete Part 2 of the VARA application within 12 months- this includes detailed document submissions, policies and procedures, appointment of responsible individuals, Compliance and AML officers, and company secretaries.
9. VARA then issues an invoice for the balance 50% of it’s application fees.
10. Once paid, VARA issues the permissions to formally carry out the activities applied for. This is now a fully functional and regulated license.

Fees and capital requirements

1) VARA regulatory fees (official schedule)

Under VARA’s Schedule 2- Supervision and Authorisation Fees, the Exchange Services activity attracts the following regulator fees:

• Licence application fee: AED 100,000 (one-time; payable on submission).
  
  
• Licence extension fee: 50% of the lower Licence Application Fee(s) (payable for each additional regulated VA activity added under the same application).
  
  
• Annual supervision fee: AED 200,000 (payable per year, per activity).

VARA notes that applications are not processed until the relevant application/extension fees are received, and it retains discretion to impose additional supervision fees or modify fees based on the VASP’s risk profile, market share, target market/client base, business-model complexity, and compliance track record.

2) Paid-up capital (minimum capitalisation)

VARA’s Company Rulebook prescribes paid-up capital for Exchange Services on a risk-sensitive basis:

• If using a VARA-licensed Custody provider (or otherwise approved during licensing): the higher of:
  
  
  • AED 800,000, or
    
    
  • 15% of fixed annual overheads.
    
    
• In all other instances: the higher of:
  
  
  • AED 1,500,000, or
    
    
  • 25% of fixed annual overheads.
    
    

If the entity is licensed for more than one VA activity, VARA requires the VASP to hold the paid-up capital amount specified for each VA activity for which it is licensed (with activity-by-activity overhead calculations), and to reconcile paid-up capital monthly.

Form / where capital is held: paid-up capital must be held and maintained in one of the permitted forms, including:

• a trust account with a UAE-licensed bank with VARA as beneficiary;
  
  
• a surety bond (no end date) with VARA as beneficiary; or
  
  
• another method specified by VARA as a licence condition.
  
  

3) Expense-based liquidity buffer 

In addition to paid-up capital, VARA requires VASPs to maintain Net Liquid Assets such that:

• Net Liquid Assets ≥ 1.2 × monthly operating expenses, maintained at all times.
  
  

Key practical points under the rulebook:

• NLA must be reconciled daily and reported to VARA monthly.
  
  
• NLA may only be maintained in permitted liquid assets, including cash/cash equivalents, and (where approved by VARA) USD/AED-referenced virtual assets.
  
  

In addition, firms are expected to maintain appropriate insurance coverage. The Company Rulebook requires professional indemnity, directors’ & officers’, and commercial crime (or similar) cover for virtual assets stored in hot wallets, plus any other insurance VARA stipulates as a licence condition. 

Ongoing compliance expectations

A well-run exchange is expected to implement controls around:

• Market integrity and surveillance (real-time and post-trade monitoring for manipulation, wash trading, spoofing/layering, abusive self-trading, and other disorderly trading behaviour; with clear escalation and enforcement playbooks).
• Fair and orderly markets / execution governance (transparent venue rules, matching-engine logic governance, order-type controls, priority rules, and consistent treatment of participants to avoid unfair execution outcomes).
• Conflicts of interest management (especially where the exchange, affiliates, or connected parties engage in proprietary trading, market making, listing sponsorship, issuer relationships, fee rebates, or other arrangements that can skew venue neutrality).
• Token admission / listing governance (a defensible listing framework, ongoing monitoring of traded assets, and clear suspension/delisting triggers to protect market quality and client outcomes).
• AML / sanctions and financial-crime controls (risk-based onboarding, screening and transaction monitoring, Travel Rule alignment where applicable, and oversight of outsourced compliance tooling and third-party dependencies).
• Technology, cyber, and operational resilience (change management, access controls, secure SDLC, penetration testing, incident response, and robust BCP/DR—because outages, latency, or control failures can directly impair market integrity).

FAQ

1) When does a “convert” feature become an Exchange Services activity under VARA? 

If the product is more than a simple bilateral sale and, in substance, you are operating a repeatable system that facilitates trading/conversion between participants (or routes orders into a venue you control), VARA will often analyse it as Exchange Services. The label “convert” does not avoid the venue perimeter if the mechanics look like a market.

2) Can a platform avoid an Exchange licence by using an RFQ model instead of an order book?

Not automatically. RFQ can reduce certain market-structure risks, but if the platform organises multiple liquidity providers and executes conversions/trades as a venue, VARA may still treat it as exchange activity. The question is the function (operating a trading venue), not the UI.

3) If we only serve institutions and market makers, is an Exchange licence still required?

Yes, if you operate the venue layer. Target client type affects conduct expectations, but it does not usually change the fact that operating a trading venue is a regulated activity.

4) What is the regulatory difference between a VARA Broker-Dealer and a VARA Exchange?

Broadly: a broker-dealer executes/arranges trades (often bilaterally or as an intermediary), while an exchange operates the market infrastructure where multiple buyers/sellers interact under venue rules (order intake, matching, order book, execution logic). Many business models need both analysis and careful perimeter mapping.

5) Do we need a separate VARA licence if the matching engine is outsourced or white-labelled?

Outsourcing the technology does not outsource the regulatory responsibility. If you operate the venue (even using third-party tech), you remain accountable for governance, surveillance, resilience, outsourcing controls, and fair-market operation.

6) Can a DEX aggregator or “smart routing” product trigger Exchange licensing?

It can, depending on whether you merely provide routing software or you are operating a venue-like layer (for example, setting execution rules, controlling order flow, or presenting the service as a trading venue). VARA will look at who controls execution, rules, and participant interaction.

7) How does VARA view market making, liquidity incentives, and fee rebates on an exchange?

These are not prohibited by default, but they are a classic source of conflicts and market integrity risk. Expect scrutiny on (i) disclosure, (ii) fair access, (iii) controls against abusive self-trading/wash trading, and (iv) governance around any affiliated market maker arrangements.

8) What ongoing controls do exchanges typically need for listings and delistings?

A defensible token admission framework, continuous monitoring (including market integrity and client risk), and clear triggers for suspension/delisting. VARA will expect listing decisions to be governed as a risk decision, not only a commercial one.

9) Can an Exchange licence holder custody client assets by default?

No, custody is generally treated as a separate high-risk activity. Many exchanges either (i) obtain separate custody permission, or (ii) integrate with a VARA-authorised custody provider, with clear accountability split and robust operational controls over deposits/withdrawals.

10) Can we offer the exchange to users outside Dubai/UAE if we are VARA-licensed?

VARA licensing addresses the Dubai regulatory perimeter, but cross-border access raises other jurisdictions’ rules (local VASP/market rules, marketing restrictions, geo-blocking, and onboarding controls). A compliant go-to-market usually requires a jurisdiction-by-jurisdiction distribution and licensing assessment.

How can 10 Leaves help you?

10 Leaves is a Corporate Service Provider at VARA.

We provide turnkey services for VARA Licenses, from initial consultations, to assistance in authorisations, to preparation of the legal documentation, helping you navigate VARA’s Rulebooks and submit an application that is comprehensive, complete and compliant.

Our services include assistance in:

1. Reviewing the business model and advising on the applicable regulatory framework and licensing perimeter;

2. Preparing the Regulatory Business Plan and submission narrative, including advisory operating model and governance approach;

3. Preparing the policy suite required for an advisory practice (conflicts, suitability, disclosures, recordkeeping, complaints, cyber and risk);

4. Supporting controlled functions and staffing readiness (including fit-and-proper support for key persons);

5. Finalising the legal structure, including holding company setup and customisation of Memorandums; and Supporting office setup and regulatory coordination through the IDQ stage and the detailed phase through to approvals.