Crypto Custody License UAE 2026: VARA Rules & Cost

Setting up a crypto custody business in Dubai starts with one hard number: the Virtual Assets Regulatory Authority (VARA) charges AED 100,000 as a non-refundable application fee for Custody Services and AED 200,000 every year in supervision fees. Those are the government line items. On top of them sit paid-up capital, insurance, senior compliance hires, audited systems and legal structuring, which together dwarf the licence fees. A crypto custody licence in the UAE is therefore not a cheap product to launch, but it is one of the most defensible and highest-trust businesses you can build in the region's digital-asset economy.

This guide explains exactly how the VARA custody licence works in 2026: what custody legally means, the fee schedule, the mandatory segregation rule that stops you bolting custody onto another licence, the capital and insurance expectations, the step-by-step authorisation journey, how Dubai compares with ADGM, DIFC and the wider UAE, the tax treatment, and the mistakes that quietly kill applications. It is written for founders who want the real picture before they commit capital, not a sales pitch. Nothing here is investment or trading advice — this is a licensing and compliance article only.

How much does a crypto custody licence cost in the UAE?

A VARA Custody Services licence costs AED 100,000 to apply and AED 200,000 in annual supervision fees, payable in advance every year. The application fee is due at submission and is non-refundable regardless of outcome. Because custody must be a segregated standalone entity, you cannot dilute these costs by sharing them across other activities. Add capital, insurance, audit, compliance staffing and legal, and a realistic first-year budget runs far higher than the AED 300,000 of pure VARA fees.

It is important to read these figures the way VARA does. The application fee is a one-time charge tied to processing your file. The AED 200,000 supervision fee recurs annually, in advance, for as long as you hold the licence, and it funds VARA's ongoing oversight of you as a regulated custodian. Neither figure includes the Dubai commercial licence for your operating company, office space (VARA-regulated firms are expected to have a genuine physical presence), immigration and visa costs, or the professional fees to assemble a compliant application. A founder who budgets only for the headline AED 100,000 will be unpleasantly surprised.

The table below sets the custody fees in the context of VARA's wider Schedule 2 so you can see where custody sits relative to other activities.

Custody sits in VARA's top fee tier alongside exchange, broker-dealer, lending and management. That reflects the risk profile: a custodian holds other people's assets, so the regulator prices its oversight accordingly.

What counts as "custody" under VARA?

Custody, in regulatory terms, is not simply storing files on a server. It is the activity of safeguarding virtual assets, or the cryptographic keys that control them, on behalf of clients — with the power to hold, control, transfer or administer those assets. If your business holds client keys, signs transactions for clients, or otherwise exercises control over assets that belong to someone else, you are almost certainly carrying on Custody Services and need the licence.

This matters because founders often assume that a slick wallet app or a key-management technology stack is "just software" and therefore unregulated. VARA looks at substance, not labels. The decisive question is whether you control client assets. A pure technology vendor that licenses non-custodial software to a regulated custodian, and never touches client keys or assets itself, may sit outside the perimeter. The moment you can move a client's assets, you are inside it. Because the line is fact-specific, this is exactly the kind of question to settle with legal advice before you build, not after a regulator comes knocking.

Custody also underpins nearly every other virtual-asset business. Exchanges need somewhere safe to hold client balances. Managers need assets safeguarded. Brokers settle trades against custodied positions. That is why a robust, independently regulated custodian is such a valuable node in the ecosystem — and why VARA treats it as a distinct, ring-fenced activity rather than a feature of some other licence.

The segregation rule: custody must stand alone

This is the single most important structural fact about VARA custody, and the one that most often reshapes a founder's plans. Custody Services must be conducted through a segregated, standalone entity and cannot be aggregated with other VARA activities in the same licence. You cannot run an exchange and custody the assets in the same legal vehicle. You cannot fold custody into a broker-dealer to save a fee. If you want to both operate an exchange and custody client assets, you generally need two separate licensed entities.

Why does VARA insist on this? Because segregation protects clients. If the trading business fails, client assets sitting in a separate, ring-fenced custodian are insulated from that failure. The collapses that scarred the global crypto industry — where customer funds were commingled with a trading arm and vanished together — are precisely what this rule is designed to prevent. Dubai's regulator learned that lesson from other jurisdictions' pain and hard-coded the protection into its framework.

The practical consequences are significant. Two entities means two incorporations, two governance structures, two sets of capital, potentially two compliance teams, and careful intercompany arrangements that VARA will scrutinise for conflicts of interest and genuine independence. It also means your fee budget cannot be shared: the custody entity pays its own AED 100,000 application and AED 200,000 annual supervision, full stop. The 50%-of-lower-application-fee extension discount applies to adding activities that are permitted to sit together — it does not let you smuggle custody in as an add-on.

Capital, insurance and safeguarding requirements

VARA does not publish a single flat capital figure that applies to every applicant. Instead, paid-up capital is set per activity and scales with risk, and custody sits at the higher end because you are safeguarding client assets. During the application, VARA assesses your business model, expected assets under custody, wallet architecture and client base, then confirms the capital you must hold and maintain. Treat any "one number" you see online with suspicion; the real figure comes from your engagement with the regulator.

Insurance is a defining feature of a credible custodian. VARA expects risk cover proportionate to the assets you safeguard, which in practice means specialist crime and cyber policies covering theft, key compromise and operational failure. The cost and availability of that cover depend heavily on your technical setup — the split between cold and hot storage, multi-signature and multi-party-computation controls, hardware security modules, and your incident-response maturity. A custodian that keeps the overwhelming majority of assets in properly governed cold storage will find cover cheaper and easier to obtain than one running large hot balances.

Beyond capital and insurance, safeguarding obligations run through everything: segregation of client assets from firm assets, robust key generation and storage, dual controls and separation of duties, disaster recovery and business continuity, independent reconciliation of client holdings, and clear books and records. VARA also imposes conduct expectations — how you onboard clients, handle their instructions, and report to them. These are not box-ticking exercises; they are the substance of what a regulated custodian is.

Step-by-step: getting a VARA custody licence

The path to a live custody licence is staged, and understanding the stages prevents nasty surprises about timing and cash flow.

1. Structure and pre-application. Decide the legal form, confirm custody will sit in a segregated entity, and prepare a business plan covering your custody model, technology, target clients and financials. Engaging with VARA early, informally, saves rework.
2. Incorporation. Establish the Dubai company that will hold the licence. VARA-regulated firms are expected to have genuine substance in Dubai — a real office, resident senior management and local presence, not a brass plate.
3. Application submission. File the formal application with VARA and pay the AED 100,000 application fee. This fee is non-refundable, so your file should be genuinely ready before you submit.
4. Initial approval and conditions. VARA reviews your governance, controls, technology, capital and key personnel. It typically grants an initial or in-principle approval subject to a list of operational conditions you must satisfy — final capital deposited, systems audited, senior compliance and money-laundering roles filled, policies finalised.
5. Operational readiness. You build and evidence everything VARA required: cold-storage architecture, insurance bound, reconciliation processes, AML/CFT framework, cyber controls. This is where most of the real work and cost lands.
6. Full authorisation and launch. Once VARA is satisfied, it grants the operating licence. The AED 200,000 annual supervision fee becomes payable, and you may begin providing custody to clients within your permitted scope.

Realistically, expect three to six months from serious engagement to full authorisation, and often longer for complex models. The bottleneck is rarely VARA's paperwork; it is the time it takes you to hire the right people, build compliant systems and bind adequate insurance.

Who else regulates crypto custody in the UAE?

Dubai is only one part of the UAE map, and knowing the boundaries matters if you are choosing where to base a custodian. VARA regulates virtual assets across the Emirate of Dubai, but explicitly excludes the Dubai International Financial Centre (DIFC). Inside the DIFC, the DFSA (Dubai Financial Services Authority) runs its own crypto-asset regime. In Abu Dhabi's financial free zone, ADGM, the FSRA (Financial Services Regulatory Authority) has one of the region's longest-established virtual-asset frameworks, including custody. At federal level, the SCA (Securities and Commodities Authority) oversees securities and commodity tokens, and the CBUAE (Central Bank of the UAE) governs payment tokens and stablecoins nationwide.

For a custody founder, the choice between VARA, FSRA and DFSA comes down to your target market, cost, timeline and where your clients and banking relationships sit. Each regulator has a distinct rulebook, fee structure and reputation. There is no universally "best" one — only the best fit for your specific model. A deeper side-by-side of VARA, ADGM and SCA is worth reading before you commit, because switching regulators after you have built one framework is expensive and slow.

Two authorities you will interact with regardless of which regulator licenses you are the Federal Tax Authority (FTA), for corporate tax and VAT, and the wider federal AML framework. Custody, by its nature, touches money-laundering risk directly, so expect intense focus on your AML/CFT controls no matter where you set up.

Tax treatment for a UAE custodian

The UAE's tax regime is a major reason custodians choose the country, but it is widely misunderstood. UAE corporate tax is 9% on taxable profit above AED 375,000, administered by the Federal Tax Authority. Profits up to AED 375,000 are taxed at 0%. There is no personal income tax on individuals, so founders and staff are not taxed on salaries or personal gains in the way they would be in most Western jurisdictions. Registration with the FTA is mandatory once you incorporate — see the official portal at https://tax.gov.ae/ for registration and guidance.

Custody businesses should not assume they are automatically exempt from corporate tax. Free-zone companies may access preferential treatment on qualifying income if they meet strict substance and activity conditions, but this is a nuanced area and must be assessed against your actual income streams. VAT is a separate question: certain financial services are exempt or zero-rated, but the treatment of virtual-asset services is technical and evolving, so you should confirm your position with a tax adviser and the FTA rather than assuming. The headline point stands, though: for a well-structured custodian, the UAE's tax burden is low and predictable, which is precisely why the ecosystem is growing.

Wallet architecture and technology: the heart of custody

No aspect of a custody business matters more than how you actually hold keys, because that single design choice ripples through your insurance premiums, your capital, your safeguarding claims and your credibility with VARA. Regulated custodians are expected to keep the overwhelming majority of client assets in properly governed cold storage — keys held offline, insulated from internet-borne attack — with only the minimum needed for operational liquidity in hot or warm wallets. The ratio you choose, and the controls around it, is one of the first things a serious assessor examines.

Modern custody rarely relies on a single private key sitting in one place, because that is a single point of catastrophic failure. Instead, custodians use multi-signature schemes, where several independent keys must authorise a transaction, or multi-party computation, where a signature is generated collaboratively without any one party ever holding the complete key. Layered on top are hardware security modules to protect key material, geographically distributed key shards, dual controls so no individual can move assets alone, and strict separation of duties between those who initiate, approve and reconcile transactions. Each of these controls exists to answer a regulator's core question: what happens if one person, one device, or one location is compromised?

Around the wallet architecture sits an operational fabric that VARA scrutinises just as closely. You need independent, frequent reconciliation of client holdings against on-chain reality; robust disaster-recovery and business-continuity plans that let you restore access to assets even if a facility, a vendor or key personnel are lost; tested incident-response procedures for a suspected compromise; and immutable audit trails of every action taken on client assets. Insurers underwrite this whole picture, not just the headline cold-storage percentage — a custodian with disciplined key ceremonies, tested recovery and clean logs is a far more insurable proposition than one relying on a clever wallet alone. In short, the technology is not a back-office detail; it is the product, and it is what a custody licence is really certifying.

Ongoing obligations after the licence goes live

Winning the licence is the start, not the finish. A VARA custodian carries continuing obligations for as long as it operates, and failure to meet them can lead to conditions, penalties or, ultimately, loss of authorisation. The AED 200,000 annual supervision fee funds exactly this ongoing relationship: VARA expects to supervise you continuously, not merely to have vetted you once.

Practically, that means maintaining the capital and insurance you were authorised on, and updating them as your assets under custody grow. It means periodic and event-driven reporting to VARA — on your financial position, on material changes to your business or controllers, on significant incidents such as a security breach or operational failure, and on your compliance with safeguarding and AML obligations. It means keeping your policies, technology and controls current as threats and standards evolve; a cold-storage model that was adequate at launch must keep pace with the state of the art. And it means an ongoing AML/CFT programme with live transaction monitoring, sanctions screening, suspicious-activity reporting and a properly resourced money-laundering reporting officer, because the risk a custodian manages never sleeps.

There are also governance expectations that persist. Fit-and-proper standards apply to your controllers and senior managers over time, not just at onboarding, so changes in ownership or key personnel must be notified and, where required, approved. Independent audit and assurance over your custody operations give VARA and your clients confidence that the reconciliations, controls and reserves are genuinely as described. Founders who treat the licence as a one-off trophy rather than an ongoing commitment are the ones most likely to run into trouble; the successful custodians build a compliance culture that assumes continuous supervision from day one.

A worked scenario: how the numbers stack up

It helps to see the pieces assembled. Imagine a founder who wants to run an institutional-grade custodian in Dubai serving funds and family offices. The VARA fees are the visible, fixed part: AED 100,000 to apply and AED 200,000 in annual supervision, and because custody must be a segregated standalone entity, none of that can be shared with any other activity. If the same founder also wanted to broker trades, that would require a second, separate licensed entity paying its own AED 100,000 and AED 200,000 — the licence-extension discount does not rescue custody from its standalone requirement.

Around those fees cluster the costs that actually dominate the budget. There is paid-up capital, set per activity and risk and confirmed by VARA, held and maintained rather than spent. There is insurance — specialist crime and cyber cover sized to assets under custody — whose premium depends heavily on the cold-storage architecture described above. There is a genuine Dubai office and the immigration and visa costs for resident senior management, because VARA does not authorise brass plates. There are the senior hires a credible custodian must have: a compliance head, a money-laundering reporting officer, technical and operational leadership. And there are the professional fees to incorporate the entity, build the submission and stand up audited systems. Layer on UAE corporate tax at 9% on taxable profit above AED 375,000 once the business is profitable, and the founder has a clear, if substantial, picture. The lesson is consistent: the AED 300,000 of VARA fees is real, but it is the smaller half of the story, and any plan built on the licence fee alone will fall short.

Common Mistakes When Applying for a VARA Custody Licence

• Trying to bolt custody onto another licence. Custody must be a segregated standalone entity. Founders repeatedly design a single-entity exchange-plus-custody model and have to re-architect the whole structure.
• Budgeting only for the AED 100,000 application fee. The real cost includes AED 200,000 annual supervision, capital, insurance, senior hires, audit and legal. Under-budgeting is the fastest route to a stalled application.
• Submitting before the file is genuinely ready. The application fee is non-refundable. A rushed submission that fails to satisfy VARA wastes AED 100,000 and months of time.
• Under-investing in cold-storage and key management. Weak wallet architecture makes insurance unaffordable and safeguarding claims unconvincing. Custody lives or dies on how you hold keys.
• Treating AML/CFT as an afterthought. Custodians sit at the heart of money-laundering risk. A thin compliance framework and an under-qualified money-laundering reporting officer will not pass.
• Assuming "it's just software." If you control client assets or keys, you are a custodian regardless of how you brand it. Mislabelling a regulated activity does not remove the obligation.
• Ignoring genuine substance requirements. A brass-plate company with no real office or resident management will not satisfy VARA. Plan for real premises and real people.
• Forgetting corporate tax registration. Every entity must register with the FTA. Overlooking it creates avoidable compliance exposure from day one.

Get your VARA custody licence with Noble Core

A crypto custody licence is one of the most demanding authorisations in the UAE, and the segregation rule means the structure has to be right from the very first decision. Noble Core Ventures guides founders through the entire journey — choosing between VARA, ADGM and DIFC, incorporating the segregated standalone entity, assembling a submission-ready application, sizing capital and insurance, hiring compliant senior staff, and introducing you to banks that understand virtual-asset businesses.

Start with our comprehensive UAE crypto licence guide covering VARA, ADGM and DMCC for the full regulatory landscape. Then dig into the exact numbers in our VARA licence cost breakdown, understand where custody fits among the activities in our VARA licence categories guide, and decide the right regulator with our VARA vs ADGM vs SCA comparison. When you are ready to move, book a free 20-minute consultation and we will map your custody structure, timeline and budget in plain numbers — so you commit capital with your eyes open, not on a guess.

Frequently Asked Questions