What VARA actually requires: substance, capital, custody and compliance

The rulebooks: compulsory rules plus activity-specific rulebooks

VARA's regulatory architecture is modular. Every licensed entity must comply with a set of compulsory rulebooks that apply regardless of what activity you perform. These cover four pillars:

• Company Rulebook: corporate governance, board composition, organisational structure
• Compliance and Risk Management Rulebook: internal controls, risk frameworks, compliance officer obligations
• Technology and Information Rulebook: cybersecurity standards, data protection, system resilience
• Market Conduct Rulebook: fair dealing, disclosure, conflicts of interest, advertising standards

On top of these, VARA publishes activity-specific rulebooks for each licensed activity: exchange services, broker-dealer services, lending and borrowing, advisory, management and investment, transfer and settlement, and custody. If you apply for multiple activities, you must satisfy the compulsory set plus each relevant activity rulebook. The custody rulebook, in particular, carries its own distinct and stricter obligations, which we address separately below.

This layered approach means your compliance programme cannot be generic. It must map to the precise combination of activities on your licence. Cosmos regularly helps operators build that mapping during the pre-application phase, ensuring the corporate structure and internal policies align with the specific rulebooks in play before the formal submission.

Capital and prudential requirements

VARA sets minimum capital thresholds that differ by activity type. An exchange operator faces a materially different capital requirement from an advisory-only VASP. The regulator also imposes ongoing prudential requirements, including maintaining adequate reserves and filing periodic financial returns.

Exact figures are published in the relevant activity rulebooks and have been adjusted since the framework first launched. Rather than quoting a single number, the honest guidance is this: budget conservatively, confirm the current minimums directly from VARA's published rules, and factor in the cost of maintaining those capital levels on an ongoing basis, not just at the point of licensing.

You should also expect VARA to scrutinise the source and quality of your capital. Demonstrating that funds are clean, traceable and genuinely available is part of the assessment. Operators who plan to run close to the minimum should reconsider; the regulator views thin capitalisation as a risk signal.

Substance in Dubai: real presence, qualified people, local senior management

VARA's substance expectations are among the most prescriptive of any virtual-asset regulator globally. A post-office box and a remote team will not pass. You need a physical office in Dubai, staff based in the emirate, and senior management who are genuinely resident and active in day-to-day operations.

The regulator expects your compliance officer, your chief executive, and other key function holders to be based locally. These are not roles you can fill with someone who flies in quarterly. VARA conducts interviews with proposed senior personnel and assesses whether the individual will be meaningfully present and engaged.

This requirement catches many international operators off guard. If your founding team is based in London, Singapore or elsewhere, you need to either relocate key people or hire qualified local leadership. Cosmos assists with structuring the corporate presence in Dubai, from trade licence setup through to visa processing and office arrangements, so that substance requirements are met before the licensing conversation begins.

Governance and fit-and-proper

Every person in a key role, including directors, senior managers, compliance officers and significant shareholders, must pass VARA's fit-and-proper assessment. This is not a rubber stamp. The regulator examines professional qualifications, industry experience, financial soundness and personal integrity.

Expect detailed background checks, disclosure of any regulatory actions or criminal proceedings in any jurisdiction, and a thorough review of each individual's track record in financial services or virtual assets. VARA may reject proposed personnel and require replacements before granting a licence.

Board composition matters too. The Company Rulebook sets expectations around independent directors, board committees and clear reporting lines. If your governance structure looks like a startup org chart with overlapping roles and no independent oversight, you will need to restructure before applying.

AML, sanctions and the Travel Rule

The UAE's anti-money laundering framework applies in full to VASPs, and VARA layers additional requirements on top. You must implement a risk-based AML programme that includes customer due diligence, ongoing transaction monitoring, suspicious transaction reporting to the UAE Financial Intelligence Unit, and sanctions screening against all relevant lists.

The FATF Travel Rule is enforced. This means that for qualifying transfers of virtual assets, you must collect, hold and transmit originator and beneficiary information to the counterparty VASP. The technical implementation of this requirement, whether through SWIFT-style messaging protocols or purpose-built Travel Rule solutions, must be documented and tested.

VARA expects your AML framework to be proportionate to your risk profile. A high-volume exchange with global retail users faces a different expectation from a B2B advisory firm. But the baseline is non-negotiable: know your customer, screen against sanctions, monitor transactions, and report suspicious activity. Failure here is the fastest route to enforcement action.

Custody: segregation, independence and why it stands apart

Crypto custody in Dubai carries the strictest requirements within VARA's framework, and for good reason. The collapse of several global platforms between 2022 and 2024 demonstrated what happens when client assets are commingled with operational funds or used to cover proprietary trading losses.

VARA's custody rulebook mandates:

• Full segregation of client assets from the custodian's own assets
• Independent custody arrangements where the custodian is operationally and financially separate from trading or exchange functions
• Detailed record-keeping that allows reconstruction of each client's holdings at any point
• Insurance or equivalent protections against loss from theft, hack or operational failure
• Regular independent audits of custodial holdings

If you operate an exchange and also want to custody client assets, the regulator will scrutinise whether genuine independence exists between those functions. Self-custody by an exchange, the model that failed spectacularly elsewhere, faces intense regulatory scepticism.

Operators planning to offer custody should treat this rulebook as a standalone compliance project. The infrastructure, personnel and audit requirements are substantial, and they represent a significant portion of the total cost of a multi-activity licence.

CARF and the reporting future

The UAE is aligning with the OECD's Crypto-Asset Reporting Framework (CARF), which will impose automatic exchange of information obligations on VASPs operating in the country. While the precise implementation timeline and local legislation are still being finalised, the direction is clear: VASPs will need to collect and report tax-relevant information about their clients to UAE authorities, who will then share it with other participating jurisdictions.

For operators, this means building data collection and reporting systems now rather than scrambling later. CARF requires you to identify the tax residency of each client, capture transaction-level data, and file structured reports. If your onboarding process does not already collect tax identification numbers and residency declarations, it will need to.

Cosmos advises operators to treat CARF readiness as part of the initial compliance build rather than a future add-on. Retrofitting reporting infrastructure into a live platform is far more expensive and disruptive than designing it in from the start.

Frequently asked questions

Can I get a VARA licence without a physical office in Dubai?

No. VARA requires genuine substance in Dubai, including a physical office and locally based senior management. Remote-only setups or nominee arrangements will not satisfy the regulator's requirements.

How much capital do I need for a VARA licence?

Capital requirements vary by activity type and are set out in the relevant activity-specific rulebooks. There is no single universal figure. Check the current published rulebooks and budget above the minimum to avoid appearing thinly capitalised.

Does VARA enforce the FATF Travel Rule?

Yes. VASPs must collect and transmit originator and beneficiary information for qualifying virtual asset transfers. You need both the technical infrastructure and the internal policies to comply.

What happens if my proposed compliance officer fails the fit-and-proper test?

VARA may reject the individual and require you to propose an alternative candidate before the licence application can proceed. Background checks are thorough and cover multiple jurisdictions.

Is custody treated differently from other VASP activities?

Yes. The custody rulebook imposes the strictest requirements in VARA's framework, including full asset segregation, independent custody arrangements and regular independent audits. It is effectively a standalone compliance workstream.

The VASP requirements in the UAE are detailed, costly and deliberately so. VARA has built a regime that filters out operators unwilling to commit real resources, real people and real governance to their Dubai operations. If you are serious about licensing, start with a proper gap analysis against the compulsory and activity-specific rulebooks, build your substance and governance before you file, and treat compliance as an ongoing operational cost rather than a one-off project.

Cosmos works with founders and compliance leads at the pre-application stage, helping structure the corporate entity, map rulebook obligations and coordinate with licensed legal partners who handle the regulated aspects of the licensing process. If you are scoping a VARA application, get in touch early: the structuring decisions you make now will determine whether the process takes months or years.

Disclaimer: this article is for general information only and does not constitute legal, regulatory or financial advice. VARA's rulebooks and fee schedules are updated periodically; always verify current requirements directly with the regulator or through qualified licensed advisers. Cosmos is not a law firm, not a regulator and not a licensed virtual-asset service provider.