VARA licensing: two stages, and why Initial Approval is not a licence

The word does the damage. In most regimes, "approved" is the finish line: the regulator has assessed you, and you may trade. Under VARA, Initial Approval sits in the middle of the process. It means the regulator is content for you to establish and prepare - to build the firm that will later be assessed for an operational licence. It is permission to get ready, not permission to act.

The misreading has real consequences. A firm that onboards clients on the strength of Initial Approval is carrying on client-facing virtual-asset activity without the licence that covers it. That is not a technicality to tidy up later; it is the exact line the two-stage structure exists to draw. When we plan a Dubai application, the operating assumption is simple: no revenue-generating virtual-asset activity until the operational VASP licence for the relevant categories is in hand.

We see the confusion most often in announcements. "Approved by VARA" reads like a licence to the market, and sometimes to the firm itself. The honest formulation is narrower: approved to establish and prepare in Dubai.

The process opens with the Initial Disclosure Questionnaire - the IDQ - in which you tell VARA who you are, who stands behind the firm and what activity you intend to carry on. Initial Approval follows: permission to establish and prepare. The operational VASP licence comes last, and it is granted for the specific activity categories you applied for.

Each stage answers a different regulatory question. The IDQ asks whether VARA wants to engage with this applicant at all. Initial Approval asks whether the plan is credible enough for you to invest in building it locally. The operational licence asks whether what you actually built - people, premises, systems, controls - is fit to face clients.

There is no general VARA licence for virtual assets. Licences are activity-based - advisory, broker-dealer, custody, exchange, virtual-asset transfer and related categories - and the operational licence you eventually hold covers the categories you applied for and were granted, nothing more.

That has two practical consequences. First, the business model has to be settled before the application, because the categories you select define the perimeter of what you may lawfully do. Activity outside your categories is activity outside your licence, however adjacent it feels commercially. Second, every additional category widens the assessment: more activity means more to evidence on systems, controls and staffing.

Our advice at scoping is to apply for what you will genuinely do in the first phase of operations, and to treat expansion as a separate, later conversation with the regulator - not to stack categories just in case.

VARA expects the firm it licenses to exist in Dubai in a meaningful sense: a local presence, appointed Responsible Individuals and compliance staffing appropriate to the activity you carry on. None of this is decorative. It is the substance the regulator assesses when it decides whether the firm you prepared under Initial Approval deserves an operational licence.

The line item that surprises applicants is people. Advisory-market reporting consistently identifies the cost of compliance officers as the underestimated entry in Dubai budgets - not the office, not the application fees, but the salaried professionals the activity requires year after year. Substance is an operating cost, not a one-off setup cost, and it scales with the categories you hold.

VARA publishes a fee schedule per activity category. We do not reproduce the figures here, because a fee schedule is exactly the kind of detail that moves: as of July 2026, check the current schedule against the categories you intend to apply for rather than relying on any article, this one included.

The more useful budgeting exercise is structural. Fees track categories, so a broader licence costs more at the schedule level - but the dominant cost over time is the substance behind the licence: the office, the Responsible Individuals and the compliance staffing discussed above. A budget built on the fee schedule alone will be wrong in the way that matters.

VARA is not the only UAE route. ADGM's FSRA is the institutional-profile alternative, with its own controller-approval and capital framework. In broad strokes, the choice turns on profile: what activities you carry on, who stands behind the firm and who your clients are. We compare both routes at kick-off rather than defaulting to either.

Timelines are the other kick-off deliverable. We do not promise a standard duration for a UAE licence, because there is no honest standard to promise: the stages, the activity categories, the recruitment of Responsible Individuals and the build-out of substance all move at different speeds for different firms. What we can do is map the stages against your specific plan and name the deliverables at each one - that is what how we work looks like in practice.

And if an application timeline does not fit the business at all, buying can be the alternative: we maintain a catalogue of licensed companies currently available.