• Portfolio management in crypto is a regulated activity in Dubai. If a firm manages virtual assets for clients, exercises discretion over portfolios, or implements token allocation strategies, it will typically require a VARA Management and Investment Services licence.
  
  
• Publishing research or market views is generally not regulated. But once a firm manages assets under a mandate, rebalances portfolios, or deploys client capital, it moves squarely into VARA’s regulated asset management perimeter.
  
  
• The licence captures a broad range of crypto investment activities. This includes discretionary portfolio management, staking and yield strategies, treasury management for corporates or DAOs, managed token baskets, and protocol or ecosystem treasury management.
  
  
• VARA’s ongoing compliance expectations are closely aligned with the standards ordinarily associated with traditional asset management. In practice, firms are expected to have robust controls around investment mandates, client suitability, conflicts of interest, valuation processes, market conduct, as well as technology and cybersecurity governance.

• VARA’s framework treats crypto portfolio management much like regulated fund or asset management; firms must operate with transparent governance, capital buffers, and professional oversight before managing client digital assets in Dubai.

If a firm intends to manage a virtual asset portfolio for a family office, deploy client capital into tokens or staking strategies on a discretionary basis, rebalance a treasury allocation across virtual assets, or otherwise make investment decisions for or on behalf of a client, that firm may require a VARA Management and Investment Services licence. This is not a light-touch permission. Once a business moves beyond general market commentary and into portfolio management, mandate-based execution, or discretionary investment activity, it enters a more heavily scrutinised regulatory perimeter. Carrying on such activity without the appropriate authorisation can expose the firm to administrative sanctions, serious reputational harm, and potential legal and commercial consequences under Dubai’s virtual asset regime.

In this article, we examine the Management and Investment Services licence under VARA, including the types of activity it captures, the distinction between discretionary management and non-regulated commentary, the applicable capital and insurance expectations, and the licensing process and ongoing compliance considerations.

What is a VARA Management and Investment Services license?

A VARA Management and Investment Services license authorises an entity to manage virtual assets, or arrangements relating to virtual assets, on behalf of clients. In practical terms, it covers mandate-based or discretionary activity where the firm is not merely commenting on the market, but is making, implementing, or executing investment decisions for a client; whether in relation to portfolio allocation, rebalancing, yield-generating strategies, treasury deployment, or other forms of managed exposure to virtual assets.

VARA treats this activity with particular stringency because the regulatory risk does not lie only in what is bought or sold, but in the fact that another person’s capital is being managed within a volatile and operationally complex asset class. Poorly governed management activity can expose clients to unsuitable risk, undisclosed conflicts, weak mandate controls, concentration issues, liquidity stress, and losses arising from inadequate oversight or execution. For that reason, the Management and Investment Services perimeter sits much closer to the logic of regulated asset management than to general market commentary or non-binding strategic input.

What is VARA?

The Virtual Assets Regulatory Authority (VARA), established in early 2022, represents a pioneering initiative by the Dubai government to regulate the fast-growing sector of virtual assets.

VARA is the first regulatory body of its kind dedicated to ensuring the secure and effective functioning of Virtual Asset Service Providers (VASPs) in Dubai. This initiative positions Dubai and the UAE as a prominent centre for digital finance and innovation.

What are VARA’s objectives?

VARA’s primary objectives include promoting Dubai as a regional and international centre for virtual assets, enhancing the competitive edge of the Emirate in this domain, and fostering a robust digital economy.

The authority is tasked with developing regulations that protect investors while curbing illegal practices associated with virtual assets, including requirements around governance, disclosure, market conduct, and operational resilience.

The Virtual Assets Regulatory Authority is the single regulatory body in Dubai that offers licensing options in the virtual assets space. Here are the key benefits:

(i.)Regulatory Compliance and Legitimacy

1. Legal Authorisation: A VARA license provides legal authorization to operate within Dubai, ensuring that businesses comply with local laws and regulations governing virtual assets.
2. Investor Trust: Being licensed by VARA enhances credibility and trust among investors and clients, as it signifies adherence to established regulatory standards.

(ii.)Access to a Thriving Market

1. Strategic Location: Dubai's position as a global hub for blockchain and cryptocurrency innovation allows licensed firms to access a vibrant market with numerous opportunities for growth.
2. Supportive Ecosystem: VARA fosters a supportive regulatory environment that encourages innovation, providing firms with the necessary framework to develop and expand their services.

(iii.)Comprehensive Framework

1. Diverse Licensing Categories: VARA offers various licensing categories tailored to different types of virtual asset services, including advisory, exchange, custodial, and payment services. This flexibility allows businesses to choose a license that best fits their operational model.
2. Ongoing Support: VARA provides continuous guidance and support throughout the licensing process and beyond, helping firms navigate compliance requirements effectively.

(iv.)Enhanced Operational Standards

1. High Compliance Standards:

License applicants are required to implement a robust compliance and anti-money laundering framework. They also have to put in place elaborate cybersecurity policies to address risks associated with virtual asset businesses.

This commitment not only protects consumers but also helps firms mitigate risks associated with virtual asset operations.

(v.)Training and Development: Licensed entities must engage in ongoing training for staff to stay updated on regulatory changes, ensuring that they maintain high operational standards at all times.

Firms that are licensed by VARA have to put in place detailed training and development plans for their employees and senior management, thus ensuring commitment to robust operational standards and keeping pace with the fast-developing field of virtual assets.

What activities fall within the VARA Management and Investment Services license?

Covered management and investment activities

An entity will generally require a Management and Investment Services licence where it manages virtual assets, or virtual asset exposure, for or on behalf of a client in return for a monetary or non-monetary benefit. The key regulatory feature is not merely that the firm expresses a view, but that it has authority to act on that view within a client mandate, exercise discretion over portfolio decisions, or implement an agreed investment strategy involving virtual assets.

Common scenarios include:

Discretionary portfolio management: This includes managing a client’s virtual asset portfolio under a mandate, selecting which assets to acquire, hold, reduce, or dispose of, and making allocation or rebalancing decisions without obtaining transaction-by-transaction approval.

Managed yield and staking strategies: This includes deploying client assets into staking, validator participation, restaking, liquidity arrangements, or other yield-generating strategies where the firm is responsible for deciding how the strategy is structured, when positions are entered or exited, and how risks are managed over time.

Treasury and balance-sheet management: This includes managing virtual asset allocations for corporates, funds, foundations, or family offices; for example, determining what proportion of treasury should be held in Bitcoin, stablecoins, or other tokens, and adjusting that exposure in accordance with an agreed mandate or investment objective.

Model portfolio implementation and rebalancing: Where a firm is not merely publishing a model allocation for general information, but is actually applying that model to a client account or mandate and carrying out rebalancing decisions, the activity is more likely to fall within the licensed perimeter.

Mandated management of issuer or ecosystem reserves: This may include managing treasury pools, reserve wallets, or protocol-linked token holdings on behalf of a token issuer, foundation, DAO-linked structure, or project treasury, where the firm is entrusted with ongoing investment decision-making rather than purely operational administration.

Managed exposure through structured virtual asset strategies: This includes running strategies involving baskets of tokens, yield overlays, hedging, liquidity deployment, or other actively managed virtual asset exposure where the firm exercises judgement over execution and risk within a client-facing investment mandate.

What activities are typically outside scope or exempt?

VARA will generally distinguish regulated management activity from work that does not involve discretionary authority, mandate-based implementation, or decision-making on behalf of a client.

1) General market commentary and non-personalised research

This includes newsletters, podcasts, market notes, public research, or educational content that discusses token markets in general terms without managing assets or implementing investment decisions for a specific client. A firm publishing a macro view on Bitcoin or Ethereum is not in the same position as a firm authorised to execute and rebalance a client portfolio.

2) Purely advisory or consulting input without management authority

A consultant may provide high-level strategic input, operational analysis, or non-binding views on virtual asset exposure without actually managing the assets or exercising discretion. That activity may raise separate advisory considerations, but it does not by itself amount to Management and Investment Services unless the firm moves into portfolio decision-making or mandate execution.

3) Purely technical, administrative, or infrastructure support

This includes wallet set-up, custody integration support, smart contract deployment, analytics tooling, reporting infrastructure, or execution support that remains operational in nature. So long as the firm is not deciding how client capital should be invested or managed, the activity is less likely to fall within this licensing category.

I want to operate a virtual asset business. Do I need a VARA license?

Yes. You will need to obtain a license from VARA, before you conduct any virtual asset business within the emirate of Dubai.

There are two stages in the licensing process. Step 1 is submission of an intial application, followed by a detailed review and in-principal approval.

VASPs are also required to be physically present in Dubai, in the form of leasing or purchasing an office.

The authority has also outlined specific requirements regarding capital adequacy, operational transparency, and compliance with anti-money laundering protocols.

What staffing and “fit and proper” expectations apply?

VARA expects advisory services firms to operate with an identifiable, accountable professional layer.

Advisory staff (including senior management and key advisory personnel) are typically expected to satisfy:

1. Integrity checks (fitness, propriety, conflicts, past conduct);
   
   
2. Competence checks (skills and capability to deliver advisory services responsibly);
   
   
3. Financial soundness checks; and
   
   
4. For analysts, formal education and relevant experience in crypto and/or financial markets (especially where the firm produces research or recommendations relied upon by clients).

What is the process to set up a VARA license in Dubai?

1. Choose the zone of incorporation of the legal entity, this can be the DWTC or any other free zone in Dubai, or the Dubai Economic Department (mainland) license.
2. Finalise the physical office- this will be based on the number of visas required and actual space required to carry out your business operations.
3. Complete the reserving of the name and signing the corporate documents such as the Memorandum of Association.
4. Submit an Initial Disclosure Questionnaire (IDQ) to VARA.
5. VARA reviews the submission, revert with questions, if any, and then sends across an invoice for 50% of the application fees.
6. VARA issues an Initial Approval once the fees are paid.
7. Submit the Initial Approval to the contracted free zone to obtain the non-operational license.
8. Complete Part 2 of the VARA application within 12 months- this includes detailed document submissions, policies and procedures, appointment of responsible individuals, Compliance and AML officers, and company secretaries.
9. VARA then issues an invoice for the balance 50% of it’s application fees.
10. Once paid, VARA issues the permissions to formally carry out the activities applied for. This is now a fully functional and regulated license.

Fees and capital requirements

1) VARA regulatory fees (official schedule)

Under Schedule 2 of the Virtual Assets and Related Activities Regulations 2023, the VA Management and Investment Services activity attracts the following regulatory fees:

• Licence application fee: AED 100,000 (one-time; payable on submission).
  
  
• Licence extension fee: 50% of the lower Licence Application Fee(s) for each additional regulated VA activity added under the same application.
  
  
• Annual supervision fee: AED 200,000 per year, per activity.
  
  

VARA also makes clear that an application will not be processed until the applicable application and extension fees have been paid, and it retains discretion to impose additional supervision fees where enhanced regulatory oversight is considered necessary.

2) Paid-up capital (minimum capitalisation)

Under Part VI of the VARA Company Rulebook, the paid-up capital requirement for VA Management and Investment Services depends on whether the firm is licensed to use a VARA-licensed custody provider, or is otherwise approved on that basis during licensing:

• Where the firm uses a VASP licensed by VARA to provide Custody Services (or is otherwise approved during the licensing process): the higher of
  
  
  • AED 280,000, or
    
    
  • 15% of fixed annual overheads
    
    
• In all other instances: the higher of
  
  
  • AED 500,000, or
    
    
  • 25% of fixed annual overheads
    
    

Where a VASP is licensed for more than one VA activity, VARA requires it to hold the paid-up capital applicable to each licensed activity, calculated by reference to the fixed annual overheads attributable to that activity. Paid-up capital must also be reconciled monthly.

Form / where capital is held: paid-up capital must be maintained at all times in one of the prescribed forms, namely:

• a trust account with a UAE-licensed bank, with VARA stated as beneficiary;
  
  
• a surety bond from a UAE-authorised surety company, with no end date and VARA as beneficiary; or
  
  
• another method specified by VARA as a condition of the licence.
  
  

3) Expense-based liquidity buffer (net liquid assets)

In addition to paid-up capital, VARA requires all VASPs to maintain sufficient Net Liquid Assets such that:

Net Liquid Assets >= 1.2 x monthly operating expenses

As a practical matter, this means:

• Net Liquid Assets must be reconciled daily and reported to VARA monthly; and
  
  
• they may only be maintained in permitted liquid assets, including:
  
  
  • cash and cash equivalents; and
    
    
  • USD-referenced (or AED-approved) fiat-referenced virtual assets, where the token is backed by cash or cash-equivalent reserves of at least the relevant market value.
    
    

4) Insurance expectations

Under the Company Rulebook, VASPs must maintain insurance that is adequate to the size and complexity of their business and VA activities, and in the manner specified by VARA in the licence conditions. This includes, at a minimum:

• professional indemnity insurance;
  
  
• directors’ and officers’ insurance;
  
  
• commercial crime insurance, or similar cover, for virtual assets stored in hot wallets; and
  
  
• any additional insurance VARA considers appropriate for the business model in question. All such insurance must be maintained with a regulated insurer.

Ongoing compliance expectations

A firm holding a VA Management and Investment Services licence is expected to operate to a standard comparable to that of a regulated investment manager. Because the business involves handling client capital and making discretionary decisions in a highly volatile asset class, VARA expects the control environment to extend well beyond basic compliance and to address governance, risk, client protection, and market integrity in a meaningful way.

In practice, a properly structured management business should maintain controls across the following areas:

Mandate governance and client suitability: The scope of each client mandate should be clearly documented, and investment activity should remain aligned with the client’s objectives, risk appetite, and classification. This usually requires properly recorded mandate terms, suitability analysis, and internal checks to ensure that allocation decisions and strategy execution stay within approved limits.

Conflicts of interest management: The virtual asset space can give rise to a wide range of conflicts, and firms are expected to identify, assess, and manage them appropriately. These may arise from proprietary token positions, affiliations with ecosystems or issuers, validator involvement, referral arrangements, fee structures, or incentive models that could affect decision-making. Where relevant, such conflicts should be disclosed and addressed through clear internal policies and governance procedures.

Portfolio management and risk controls: VARA expects firms to apply disciplined investment oversight across portfolio construction, exposure limits, liquidity risk, and valuation practices. This includes having internal processes for how positions are entered, monitored, adjusted, and exited, particularly in market conditions marked by sharp volatility, low liquidity, or sudden price movements.

Valuation and reporting discipline: Where client assets are being managed, valuation processes should be consistent, transparent, and properly documented. Clients should also receive reporting that clearly explains holdings, performance, fees, and risk profile, supported by reliable books, records, and internal reporting systems.

Market conduct and market abuse controls: Licensed managers are expected to ensure that their trading activity does not result in, support, or appear to support manipulative or disorderly market behaviour. This includes maintaining controls designed to prevent practices such as wash trades, coordinated trading activity, or misuse of confidential or non-public information in illiquid or thinly traded token markets.

Technology, operational resilience, and cyber governance: Because the business is heavily dependent on digital systems and infrastructure, firms must also maintain a strong technology and security framework. This should include controls over wallets, APIs, and other integrations, appropriate user-access management, monitoring of trading and analytics systems, protection of client information, and clear incident response and cyber resilience procedures.

FAQs

1. What is the difference between a VARA Management and Investment Services licence and a VARA Advisory Services licence?

The distinction turns largely on discretion and execution. A VARA Advisory Services licence generally covers firms that provide client-specific recommendations, views, or opinions on virtual assets. A VARA Management and Investment Services licence applies where the firm goes a step further and is authorised to manage portfolios, implement strategy, or make allocation decisions for a client under an agreed mandate. In broad terms, once the firm is exercising decision-making authority over client assets, the management licence is usually the relevant permission.

2. Can a hedge fund or crypto asset manager operate in Dubai without a VARA Management and Investment Services licence?

As a general rule, no; not where the business involves managing virtual assets for clients within the Emirate of Dubai, excluding the DIFC. If the firm is making portfolio decisions, carrying out investment strategies, or otherwise managing client exposure to virtual assets by way of business, it is likely to fall within VARA’s regulatory perimeter and should be properly licensed before commencing operations.

3. Does a family office managing its own crypto portfolio require a VARA licence?

Often, no, where the activity is limited to investing the family office’s own assets on a proprietary basis. VARA licensing is more commonly triggered where a firm is managing virtual assets for others or carrying on the activity as a business. That said, the position should be assessed carefully if the structure begins to involve third-party capital, multiple investors, or managed vehicles.

4. Can a licensed VARA investment manager also provide staking or yield strategies for clients?

Yes, provided those activities sit within the scope of the firm’s licensed business model, client mandate, and internal control framework. In practice, some managers may incorporate staking, validator participation, or other yield-generating arrangements into a managed strategy. However, those activities need to be supported by appropriate disclosure, risk management, and operational safeguards; particularly where issues such as lock-up periods, slashing exposure, or liquidity limitations may arise.

5. Does the Management and Investment Services licence allow a firm to hold client assets?

Not necessarily. Managing assets and holding assets are separate regulatory activities. If the firm intends to safeguard client virtual assets or control private keys, a VARA Custody Services licence may also be required. Many investment managers instead appoint a VARA-licensed custodian to hold client assets while the manager focuses on portfolio decisions.

6. What types of clients typically use a VARA-licensed virtual asset investment manager?

These services are commonly used by family offices, crypto-native funds, venture capital funds, corporates with digital asset treasury exposure, foundations, and high-net-worth individuals looking for professionally managed access to the virtual asset market. In many cases, more sophisticated or institutional clients prefer to work with regulated managers because that structure offers greater comfort around governance, reporting standards, and overall regulatory credibility.

7. Does VARA require local presence for a licensed investment manager?

Yes. VARA’s framework is built on the expectation that licensed firms will have a genuine operational footprint in Dubai. That ordinarily means more than just a paper presence; it includes appropriate senior management presence, governance infrastructure, and operational substance commensurate with the nature and scale of the business. Models that are effectively managed entirely from outside Dubai, without meaningful local oversight, are unlikely to meet regulatory expectations.

8. Why has VARA created a separate licence for virtual asset management?

VARA treats virtual asset management as a distinct regulated activity because managing client exposure to digital assets introduces a risk profile that is materially different from general advisory or operational support. The issues are not limited to market volatility; they also include fragmented liquidity, custody and wallet architecture, technology dependencies, execution risks, and governance complexities linked to decentralised systems. By ring-fencing this activity within its own licensing category, VARA is seeking to ensure that firms managing client crypto portfolios are subject to an appropriate level of governance, transparency, and risk control broadly comparable to that expected of regulated investment managers in traditional finance.

How can 10 Leaves help you?

10 Leaves is a Corporate Service Provider at VARA.

We provide turnkey services for VARA Licenses, from initial consultations, to assistance in authorisations, to preparation of the legal documentation, helping you navigate VARA’s Rulebooks and submit an application that is comprehensive, complete and compliant.

Our services include assistance in:

1. Reviewing the business model and advising on the applicable regulatory framework and licensing perimeter;

2. Preparing the Regulatory Business Plan and submission narrative, including advisory operating model and governance approach;

3. Preparing the policy suite required for an advisory practice (conflicts, suitability, disclosures, recordkeeping, complaints, cyber and risk);

4. Supporting controlled functions and staffing readiness (including fit-and-proper support for key persons);

5. Finalising the legal structure, including holding company setup and customisation of Memorandums; and

6. Supporting office setup and regulatory coordination through the IDQ stage and the detailed phase through to approvals.