Dubai has placed itself at the centre of the global virtual-asset conversation by establishing a dedicated regulator: the Virtual Assets Regulatory Authority (VARA). Lending and borrowing is treated as a distinctly high-risk activity under VARA’s framework because it introduces credit risk, liquidity risk, collateral-management risk, valuation risk, and (often) maturity mismatch risk; all of which can crystallise quickly during volatility. If a business wants to run “earn” products, offer crypto-backed loans, facilitate bilateral lending between clients, borrow virtual assets from clients or counterparties, or otherwise intermediate arrangements where virtual assets are lent out and must later be returned, that business will typically require a VARA Lending and Borrowing Services licence.

 

Operating without the proper authorisation is not a viable strategy: VARA’s Regulations prohibit any entity from carrying out a VA Activity “by way of business” in the Emirate unless it is licensed (subject to limited exemptions). In this article, we look at the Lending and Borrowing Services licence, including what the activity means under VARA, typical models captured, capital and insurance expectations, the licensing process and costs, and the ongoing compliance considerations that often decide whether a lending model is regulator-credible in practice.

What is a VARA Lending and Borrowing Services licence?

A VARA Lending and Borrowing Services licence authorises an entity to carry out contracts under which a virtual asset is transferred or lent from lender(s) to borrower(s), with the borrower committing to return the same asset at the lender’s request (at any time during, or at the end of, an agreed period). In other words, the perimeter is not defined by marketing labels (“yield”, “earn”, “credit”), it is defined by the legal and operational reality of a lend/transfer + return obligation arrangement.

Under VARA’s Lending and Borrowing Services Rulebook, the regulatory focus is on (i) liquidity sufficiency and collateral discipline, (ii) clear client consent and contractual risk allocation, (iii) independent valuation and recurring client reporting, (iv) robust counterparty due diligence, and (v) transparency to the public about how the platform holds, lends, borrows, and collateralises client positions.

What is VARA?

The Virtual Assets Regulatory Authority (VARA), established in early 2022, represents a pioneering initiative by the Dubai government to regulate the fast-growing sector of virtual assets.

VARA is the first regulatory body of its kind dedicated to ensuring the secure and effective functioning of Virtual Asset Service Providers (VASPs) in Dubai. This initiative positions Dubai and the UAE as a prominent centre for digital finance and innovation.

What are VARA’s objectives?

VARA’s primary objectives include promoting Dubai as a regional and international centre for virtual assets, enhancing the competitive edge of the Emirate in this domain, and fostering a robust digital economy.

The authority is tasked with developing regulations that protect investors while curbing illegal practices associated with virtual assets, including requirements around governance, disclosure, market conduct, and operational resilience.

What are the advantages of getting licensed by VARA?

The Virtual Assets Regulatory Authority (VARA) is Dubai’s dedicated regulator for virtual asset activities and the primary licensing gateway for firms that want to operate compliantly in this sector. A VARA licence can offer several practical advantages:

Regulatory compliance and legitimacy

1. Legal authorisation: A VARA licence gives a business formal legal authorisation to conduct permitted virtual asset activities in Dubai, and it provides a clear regulatory basis for how the firm may operate, market its services, and onboard clients in line with applicable requirements.

2. Investor trust: A licensed status typically strengthens credibility with investors, counterparties, and clients because it signals that the firm is operating under a recognised supervisory framework, with defined compliance, governance, and conduct expectations.

Access to a thriving market

1. Strategic location: Dubai has positioned itself as a regional and international hub for blockchain and digital asset innovation, and a VARA licence can help firms participate more effectively in this market by enabling them to build regulated offerings and engage institutional and retail segments (as applicable).

2. Supportive ecosystem: VARA’s regulatory infrastructure is designed to support the development of compliant business models, which can make it easier for licensed firms to scale operations, form partnerships, and expand service lines within a structured supervisory environment.

A comprehensive licensing framework

1. Diverse licensing categories: VARA offers multiple licensing categories that map to distinct virtual asset services, such as advisory, broker-dealer/exchange-related activities, custody, and payments, allowing firms to select the authorisation that aligns most closely with their business model and risk profile.

2. Ongoing regulatory engagement: Licensed firms benefit from clearer channels of regulatory engagement during the authorisation process and through ongoing supervision, which can help management teams interpret expectations, address regulatory queries, and implement compliance requirements in a more structured way.

Enhanced operational standards

1. High compliance standards: Applicants are expected to implement robust compliance controls, including anti-money laundering and counter-terrorist financing frameworks, alongside governance, risk management, and operational policies that are proportionate to their activities. In addition, firms are typically expected to maintain effective cybersecurity and technology risk controls to address threats that are common in virtual asset operations. These standards help protect clients and reduce the likelihood of operational, financial crime, and security incidents.

2. Training and development: Licensed entities are generally expected to adopt ongoing training and competence programmes for staff and senior management so that internal teams remain up to date with regulatory developments and evolving industry risks. In practice, this pushes firms to institutionalise professional development, maintain consistent operational standards, and ensure that key personnel can demonstrate continuing competence in a fast-changing sector.

What activities fall under the VARA Lending and Borrowing Services licence?

Covered lending and borrowing activities

A VARA Lending and Borrowing Services licence is generally triggered where a firm, for monetary or non-monetary benefit, carries out (or intermediates) arrangements in which virtual assets are lent/transferred with a contractual commitment that the borrower will return the same asset. In practice, the following common models fall into the perimeter-

Crypto-backed lending:

Where a platform extends loans (whether in virtual assets or fiat-linked form) against borrower-posted collateral, VARA’s core concern is not merely that collateral is present, but that it is adequate, continuously monitored, and capable of being enforced in practice, including in stressed market conditions. In that context, VARA’s rulebook expects collateral to be maintained at sufficient levels in line with the parties’ agreed parameters, supported by ongoing monitoring, regular auditing, and operational controls that ensure the collateral can be realised promptly if needed.

“Earn” / yield products:

Where clients place assets into an “earn” arrangement and the firm uses those assets for lending and borrowing activity (whether directly or via third parties), VARA is likely to view the product as lending/borrowing in substance, even if the user experience is presented as a passive “savings” feature. In these models, the compliance focus typically sits on informed client consent and tight contractual drafting: the documentation should make unambiguous whether the assets continue to be held on behalf of the client or are subject to a different legal treatment (for example, title transfer and/or re-use), and the risk disclosures must accurately reflect that client assets may be exposed to counterparty, liquidity, and loss risks.

Bilateral / marketplace lending:

Where a platform facilitates loans between users (or between users and institutional borrowers), VARA will still expect the operator to meet lending/borrowing standards, regardless of whether the platform presents itself as “just a marketplace.” In practice, this means robust counterparty due diligence, clear and client-facing terms covering key mechanics (including LTV parameters, pricing/interest, withdrawal and early-exit rights, default and enforcement processes), and ongoing reporting that enables clients to understand their exposures and performance on a recurring basis.

Borrowing virtual assets from clients or counterparties:

Where a firm borrows virtual assets; whether for liquidity management, market-making support, settlement, or treasury purposes; it remains within VARA’s lending/borrowing risk perimeter because the firm is taking on a binding obligation to return the relevant asset. Accordingly, VARA’s rulebook places particular weight on liquidity sufficiency: the firm must be able, at all times, to evidence that it holds (or can access) sufficient virtual assets to meet its obligations to clients, and it is expected to notify VARA immediately if those requirements are not met, or if there is a material risk that they may not be met.

Key lending and borrowing restrictions 

VARA’s lending and borrowing framework contains a set of practical design constraints that are best addressed at the start of product structuring, not bolted on later.

Liquidity sufficiency and regulatory notification: VARA expects lending/borrowing VASPs to

(i) maintain sufficient virtual assets to deliver the service and meet client obligations, and

(ii) ensure borrowers post sufficient collateral in line with agreed parameters, with both positions monitored and audited on a regular basis. Where those requirements are not met, or where there is a foreseeable risk that they may not be materially met, the VASP is expected to notify VARA immediately. In practice, this operates as a supervisory trigger: liquidity or collateral stress is treated as a matter for regulatory escalation, not simply a commercial issue.

Clear client consent and contractual treatment of asset use: VARA requires client agreements to obtain clear, transparent consent for any use of client virtual assets by the VASP (where applicable), consistent with applicable law. The rulebook also pushes the contract to address the underlying legal position directly; namely whether the relevant virtual assets are held “on behalf of” the client, or on another basis, and if not held on behalf, that must be stated expressly. This is often the pressure point for “earn” products: the commercial model assumes the firm can deploy client assets, while the documentation and front-end presentation can be less direct than VARA would expect.

What activities are not lending and borrowing ?

Boundary errors usually arise when firms lean on marketing labels (“earn”, “savings”, “wealth”) rather than VARA’s activity-based definition. As a rule of thumb, if the business is not entering into, arranging, or intermediating arrangements where virtual assets are transferred with an obligation (or expectation) of return, it may sit outside the lending/borrowing perimeter.

Pure technology delivery: Where a provider is offering technology services only; such as software development, analytics, security testing, infrastructure, or protocol integrations; and is not itself operating the product or entering into/arranging lending or borrowing arrangements as a business, this is generally outside the lending/borrowing category. The position can shift once the provider moves from “building tools” to “running the product” and becomes party to, or arranges, contracts involving a transfer of virtual assets with a return obligation.

Staking-only services: Staking can fall under other regulated activity permissions depending on structure (for example, where a firm is taking responsibility for staking as part of management or investment-type services). It becomes lending/borrowing only where the arrangement is, in substance, a loan or transfer of virtual assets coupled with an obligation to return the relevant asset (or an equivalent), rather than a staking mandate or delegation arrangement.

Custody-only services: Pure custody, holding client assets and safeguarding them without deploying them into loans, is a separate permission and does not, by itself, amount to lending/borrowing. The analysis changes where the custodian (or a custody product wrapped with an “earn” feature) uses, re-uses, pledges, or otherwise intermediates client assets into lending/borrowing activity.

I want to operate a virtual asset business. Do I need a VARA license?

Yes. You will need to obtain a license from VARA, before you conduct any virtual asset business within the emirate of Dubai.

There are two stages in the licensing process. Step 1 is submission of an intial application, followed by a detailed review and in-principal approval.

VASPs are also required to be physically present in Dubai, in the form of leasing or purchasing an office.

The authority has also outlined specific requirements regarding capital adequacy, operational transparency, and compliance with anti-money laundering protocols.

What staffing and “fit and proper” expectations apply?

VARA expects advisory services firms to operate with an identifiable, accountable professional layer.

Advisory staff (including senior management and key advisory personnel) are typically expected to satisfy:

1. Integrity checks (fitness, propriety, conflicts, past conduct);
   
   
2. Competence checks (skills and capability to deliver advisory services responsibly);
   
   
3. Financial soundness checks; and
   
   
4. For analysts, formal education and relevant experience in crypto and/or financial markets (especially where the firm produces research or recommendations relied upon by clients).

What is the process to set up a VARA license in Dubai?

1. Choose the zone of incorporation of the legal entity, this can be the DWTC or any other free zone in Dubai, or the Dubai Economic Department (mainland) license.
2. Finalise the physical office- this will be based on the number of visas required and actual space required to carry out your business operations.
3. Complete the reserving of the name and signing the corporate documents such as the Memorandum of Association.
4. Submit an Initial Disclosure Questionnaire (IDQ) to VARA.
5. VARA reviews the submission, revert with questions, if any, and then sends across an invoice for 50% of the application fees.
6. VARA issues an Initial Approval once the fees are paid.
7. Submit the Initial Approval to the contracted free zone to obtain the non-operational license.
8. Complete Part 2 of the VARA application within 12 months- this includes detailed document submissions, policies and procedures, appointment of responsible individuals, Compliance and AML officers, and company secretaries.
9. VARA then issues an invoice for the balance 50% of it’s application fees.
10. Once paid, VARA issues the permissions to formally carry out the activities applied for. This is now a fully functional and regulated license.

Fees and capital requirements 

1. VARA regulatory fees 

Under VARA’s Schedule 2- Supervision and Authorisation Fees, Lending and Borrowing Services attracts the following regulator fees: 

Licence application fee: AED 100,000 (one-time; payable on submission), 

Licence extension fee: 50% of the lower Licence Application Fee(s) (payable for each additional regulated VA activity included under the same application), 

Annual supervision fee: AED 200,000 (payable per year, per activity).

VARA also notes that an application is not processed until the relevant application/extension fees are received, and it retains discretion to impose additional supervision fees depending on the VASP’s risk profile.

2. Paid-up capital 

VARA’s Company Rulebook sets the minimum paid-up capital for Lending and Borrowing Services as the higher of (i) AED 500,000; or

(ii) 25% of fixed annual overheads, to be held and maintained at all times. Where the entity is licensed for more than one VA activity, VARA applies an activity-by-activity approach, requiring the VASP to hold the paid-up capital amount specified for each licensed VA activity. As to form, paid-up capital must be maintained either in a trust account with a UAE-licensed bank with VARA named as beneficiary, a surety bond (no end date) with VARA as beneficiary, or another method specified by VARA as a licence condition.

3. Expense-based liquidity buffer 

In addition to paid-up capital, VARA requires VASPs to maintain Net Liquid Assets such that Net Liquid Assets ≥ 1.2 × monthly operating expenses, at all times. Operationally, NLA must be reconciled daily and reported to VARA monthly, and it may be maintained only in permitted liquid assets, including cash/cash equivalents and (where approved by VARA) USD/AED-referenced virtual assets.

4. Insurance 

VARA also expects VASPs to maintain insurance appropriate to the size and complexity of the business and licensed activities, including professional indemnity insurance, directors’ and officers’ insurance, and commercial crime (or similar) cover for virtual assets held in hot wallets, plus any other types of insurance VARA stipulates as a licence condition. 

Governance and operating-model requirements 

Beyond the baseline governance, compliance, technology and market-conduct rulebooks that apply across all licensed VASPs, VARA tends to focus sharply on whether a lending/borrowing operating model can absorb volatility and liquidity stress without creating client detriment or disorderly market outcomes.

Client reporting and independent valuation discipline: VARA requires lending/borrowing VASPs to provide clients, at least monthly, a written statement covering (among other items) total account value, lending/borrowing transactions during the period, interest credited/debited, and collateral posted. VARA also expects client positions to be subject to independent valuation and client reporting, underpinned by robust valuation policies and procedures that are consistently applied and reviewable.

Public transparency obligations: VARA expects a VASP to publish, and keep up to date, a prominent explanation of its lending/borrowing services, the categories of clients eligible for each service, and any licensing or regulatory restrictions that apply by client type. In addition, the VASP must publish an asset and liability report, refreshed at least every three months, covering the values of virtual assets held, lent/borrowed, pledged/posted as collateral, and the basis on which those assets are held.

Collateral governance and withdrawal lock-up clarity: VARA expects collateral to be governed through appropriate frameworks, policies, systems and controls, and used only in accordance with the lending/borrowing terms that are clearly set out in the client agreement. Separately, where assets are subject to lock-ups or withdrawal constraints as part of the service, VARA’s expectation is that those limitations are made explicit and understood upfront, rather than buried in mechanics or implied through product design.

Counterparty due diligence and ongoing risk monitoring: VARA requires regular, comprehensive counterparty due diligence to manage counterparty risk to client assets, including collecting and verifying information such as loan purpose, the counterparty’s business profile, and financial position/liquidity, alongside other information a prudent lender would typically require. VARA also expects liquidity risk and market risk to be monitored and stress-tested on an ongoing basis, with timely mitigation where metrics move out of tolerance.

Recordkeeping (audit-ready, long retention): VARA requires lending/borrowing VASPs to retain transaction records, client agreements, counterparty agreements, client instructions, and counterparty due diligence materials for at least eight years, and to make those records available for VARA inspection on request.

What is the process to set up a VARA Lending and Borrowing Services licence in Dubai?

While VARA may update process mechanics over time, the licensing journey is typically built around (i) establishing a Dubai entity and operating footprint, (ii) submitting the application and regulator-facing business plan and control framework, (iii) responding to regulator queries and demonstrating readiness, and (iv) obtaining final permission before going live. The legal anchor remains that no entity may carry out lending/borrowing as a VA Activity “by way of business” unless licensed by VARA.

In practice, lending/borrowing applicants should expect the buildout to focus heavily on:

• Product and contract architecture (LTV logic, interest logic, withdrawal terms, defaults/close-out)
• Collateral model and enforceability (including how collateral is held, valued, and liquidated)
• Liquidity governance and stress readiness (including monitoring and escalation/notification pathways)
• Valuation independence, monthly client reporting, and quarterly public asset/liability reporting
• Counterparty due diligence and credit-risk governance
• Full policy suite aligned to VARA’s compulsory rulebooks (Company, Compliance & Risk, Technology & Information, Market Conduct) and to the Lending and Borrowing Services Rulebook itself.

Ongoing compliance expectations (what VARA will look for in practice)

VARA will generally expect a lending/borrowing VASP to evidence a live, functioning control environment, including:

• Liquidity sufficiency and collateral discipline that is continuously monitored, audited, and regulator-escalated when threatened.
• Transparent client terms, including LTV ratios, interest mechanics, withdrawal rights, default/termination consequences, and explicit statements about whether assets are held on behalf of the client.
• Monthly client reporting and independent valuation, supported by documented valuation methodologies.
• Quarterly public asset/liability reporting and clear public disclosures about which services are available to which client types (and any regulatory restrictions).
• Counterparty due diligence that looks like prudent credit practice, not checkbox KYC.
• Long-horizon, inspection-ready recordkeeping (minimum eight years for key lending/borrowing records).
• Capital, liquidity and insurance maintained and evidenced on an ongoing basis.

FAQ

1) What does VARA treat as “lending and borrowing” in practice?

If virtual assets are transferred under an arrangement where there is an obligation (or structured expectation) to return the same asset or an equivalent value; whether the platform is the lender, the borrower, or an arranger; VARA is likely to view it as lending/borrowing. Calling it “earn”, “yield”, or “savings” does not change the activity analysis if the economics are lending/borrowing in substance.

2) Are “earn” and yield products captured even if the User Interface looks like passive savings?

Often, yes. If client assets are deployed into lending/borrowing activity (directly or via third parties), the key VARA issues become (i) clear client consent, (ii) contractual clarity on whether assets are held on behalf of the client or treated differently (e.g., title transfer/re-use), and (iii) risk disclosures that reflect real exposure (counterparty, liquidity, rehypothecation, loss).

3) If the platform only matches lenders and borrowers (marketplace model), do we still need the licence?

Potentially. A marketplace model can still sit within VARA’s lending/borrowing perimeter if the platform is arranging or intermediating the loans as a business. VARA will still expect strong counterparty due diligence, transparent client terms (LTV, pricing, withdrawals, default mechanics), and recurring reporting.

4) What is VARA most sensitive to in collateralised lending?

Not simply “collateral exists”, but whether collateral is sufficient, continuously monitored, and operationally enforceable under stress. The expectation is that collateral frameworks are engineered for volatility- clear LTV triggers, margining, valuation, governance, and liquidation capability.

5) Can a VARA entity borrow assets from clients or counterparties for treasury/liquidity?

Yes, but it remains in a lending/borrowing risk frame because the firm assumes an obligation to return the asset. VARA’s focus is on liquidity sufficiency, client obligations, and escalation expectations where coverage is weak or at risk.

6) Do we have to publish anything publicly for a lending/borrowing product?

Yes, VARA imposes high prescriptive transparency expectations compared to typical crypto lending norms. Firms are expected to publish a clear description of services, eligible client types and restrictions, and maintain periodic (at least quarterly) asset/liability reporting covering assets held, lent/borrowed, and collateral positions, and the basis on which assets are held.

7) What reporting do clients receive?

At minimum, a monthly written statement is expected, covering items such as total account value, lending/borrowing activity during the period, interest credited/debited, and collateral posted, supported by independent valuation practices and robust valuation policies.

8) What are the main governance and risk controls VARA will test in the operating model?

Expect scrutiny on: counterparty due diligence (ongoing, not one-off), liquidity and market risk monitoring and stress testing, collateral governance and liquidation readiness, withdrawal lock-up clarity, conflict management, and operational resilience (including incident response and outsourcing oversight where third parties are involved).

9) What records do we need to keep, and for how long?

VARA expects the model to be audit-ready. Transaction records, client agreements, counterparty agreements, client instructions, and counterparty due diligence materials must typically be retained for at least eight years and made available promptly upon VARA request.

10) Is “custody-only” the same as lending/borrowing?

No. Custody is a separate permission and can sit outside lending/borrowing where assets are simply held and not deployed. The boundary shifts when a custody product is wrapped with “earn”, or where client assets are used, re-used, pledged, or intermediated into lending/borrowing arrangements.

11) Is staking the same as lending/borrowing?

Not automatically. Staking can fall under other permissions depending on structure. It starts to resemble lending/borrowing only where the arrangement is, in substance, a transfer plus return obligation contract (as opposed to a staking mandate/delegation model with clear treatment of assets and risks).

12) Can we phase licensing (start with one activity and add later)?

Structurally, VARA can accommodate expansions, but phasing is not just about process , it also involves credibility. If the business model you present requires lending/borrowing from day one, VARA will expect the permission set, controls, and capital/liquidity posture to align with the intended end-state. Adding categories later typically triggers additional fees, fresh evidence packs, and renewed supervisory scrutiny.

 

How can 10 Leaves help you?

10 Leaves is a Corporate Service Provider at VARA.

We provide turnkey services for VARA Licenses, from initial consultations, to assistance in authorisations, to preparation of the legal documentation, helping you navigate VARA’s Rulebooks and submit an application that is comprehensive, complete and compliant.

Our services include assistance in:

1. Reviewing the business model and advising on the applicable regulatory framework and licensing perimeter;

2. Preparing the Regulatory Business Plan and submission narrative, including advisory operating model and governance approach;

3. Preparing the policy suite required for an advisory practice (conflicts, suitability, disclosures, recordkeeping, complaints, cyber and risk);

4. Supporting controlled functions and staffing readiness (including fit-and-proper support for key persons);

5. Finalising the legal structure, including holding company setup and customisation of Memorandums; and

6. Supporting office setup and regulatory coordination through the IDQ stage and the detailed phase through to approvals.