VARA, ADGM or DIFC: which UAE perimeter fits your business

Start with the geography. Dubai Law No. 4 of 2022 makes VARA the sole virtual-asset regulator across Dubai's mainland, Special Development Zones and free zones - and then carves the DIFC out expressly (rulebooks.vara.ae). Inside that carve-out, the DFSA regulates financial services conducted in or from the DIFC under the Regulatory Law 2004 (dfsa.ae). Abu Dhabi's financial free zone runs its own regulator: the FSRA licenses Regulated Activities in or from ADGM under the Financial Services and Markets Regulations 2015 (adgm.com). None of the three reaches beyond its own boundary, and none substitutes for the others.

The federal architecture explains why the free zones can do this at all. Article 121 of the UAE Constitution enables Financial Free Zones, and Federal Law No. 8 of 2004 exempts them from federal civil and commercial financial regulation while keeping federal criminal and AML law in force. The same law, as published on dfsa.ae, prohibits DIFC authorised firms from taking deposits from the UAE market or dealing in the UAE Dirham, and limits insurance into the UAE to reinsurance. Outside the two financial free zones, banking and payments sit with the Central Bank of the UAE, and securities and commodities with the SCA.

For virtual assets, a federal layer sits on top of the emirate-level map. Cabinet Resolution No. 111 of 2022 regulates virtual assets UAE-wide and gives the SCA broad powers to supervise and license virtual asset service providers, with the financial free zones running their own regimes and the DIFC excluded from Law No. 4 of 2022's scope (u.ae).

One mechanic deserves precise wording, because it is routinely inflated into "one licence for the whole UAE". Under the SCA-VARA cooperation agreement of 5 September 2024, a VASP operating in or from Dubai obtains its licence from VARA and is registered with the SCA by default to service the wider UAE; VASPs operating in other Emirates require SCA licensing (uaecma.gov.ae). That is a default registration, not a country-wide licence: it does not reach inside the DIFC, does not create an ADGM permission, and does not replace Central Bank permissions where a product touches mainland banking or payments. No UAE perimeter passports into another - plan for one perimeter, chosen for the activity you actually run.

Three questions settle most files: who is the client - retail or professional; what is the product - tokens, securities, portfolios or payments; and where must it legally be sold. Run those against the map and the perimeter usually picks itself. One deliberate omission below: custody has its own capital arithmetic and token rules in each centre, and we keep those specifics in the custody comparison.

Deep tables belong on the landing pages; what a decision needs first is the order of magnitude, each figure from a named official schedule. At VARA, Exchange Services carry an AED 100,000 application fee and AED 200,000 annual supervision under "Schedule 2 - Supervision and Authorisation Fees", with paid-up capital of AED 800,000 to 1,500,000 under the Company Rulebook, Part VI.B. At the FSRA, the Category 3A dealing activities carry US$25,000 application and US$25,000 annual supervision under FEES 3.4.3 and 3.4.4, with a virtual-asset add-on under FEES 3.17 and base capital from PRU 3.3.2. At the DFSA, application fees range from US$15,000 to US$70,000 under FER 2.1.1, and for most categories the annual fee under FER 3.2.1, with its expenditure-based component, exceeds the application fee; base capital comes from PIB 3.6.2. The full tables, current as of July 2026, live on our VARA, ADGM and DIFC landing pages.

People substance is the constant across all three. VARA requires two UAE-resident, full-time Responsible Individuals under its Company Rulebook; the FSRA requires a UAE-resident Senior Executive Officer, Compliance Officer and MLRO under GEN 5.5.2; the DFSA requires the same three resident roles under GEN 7.5.2. And what none of the three publishes is a timeline: VARA and the FSRA publish no processing timetable at all, and the DFSA's own service page lists every stage duration as TBC. Treat any end-to-end estimate you are quoted as the consultancy's number, not the regulator's.

Each perimeter runs a staged authorisation with a hard gate in the middle, and each gate is routinely announced as if it were a licence. At VARA, the public register's own wording is that applicants holding an In-Principle Approval are "strictly prohibited from initiating operations, conducting any virtual asset activities, or servicing clients" until the full VASP licence is issued (vara.ae). At the FSRA, In-Principle Approval comes with preconditions - commercial licence, premises, bank account, capitalisation - and the Financial Services Permission is granted only after they are met. At the DFSA, the in-principle letter is a conditional step: authorisation follows only once its conditions are satisfied.

The same discipline applies to buying instead of building. A licence in any of the three perimeters is never transferred to a buyer: the regulator approves, conditions or objects to the new controller - GEN 8.8 and FSMR section 105 in ADGM, GEN 11.8 in the DIFC with its 90-day statutory window, and VARA through licence conditions, as it publishes no dedicated change-of-control regime. No adviser can guarantee that approval.