VARA License Categories 2026: All 8 Activities Explained

Choosing the right VARA license categories is the first real decision in setting up a crypto business in Dubai — and it drives everything that follows, from your application fee of AED 40,000 to AED 100,000 to your annual supervision cost of AED 80,000 to AED 200,000 per activity. The Virtual Assets Regulatory Authority (VARA) has carved the entire virtual asset industry into eight distinct licensed activities. Pick too few and you risk operating illegally; pick too many and you pay for activities you will never use. This guide explains all eight categories in plain language, what each one lets you do, what it costs, and how they combine.

VARA's category framework is deliberately built as a flexible foundation rather than a closed list — the regulator expects it to evolve as the sector matures. But as of 2026, these eight activities define the regulatory perimeter, and any business touching virtual assets in or from Dubai must map itself onto them before applying.

The 8 VARA License Categories at a Glance

VARA licenses eight virtual asset activities: Advisory Services (AED 40,000 application), Transfer & Settlement Services (AED 40,000), Broker-Dealer Services (AED 100,000), Custody Services (AED 100,000), Exchange Services (AED 100,000), Lending & Borrowing Services (AED 100,000), Management & Investment Services (AED 100,000), and Category 1 VA Issuance (AED 100,000). Each also carries an annual supervision fee — AED 80,000 for the two lower-band activities and AED 200,000 for the other six. A VASP can hold several activities under one licence, except Custody, which must be a separate entity.

Category 1 — Advisory Services

Advisory Services is the entry point to the VARA-regulated market and the lowest-cost category. It covers offering, providing or agreeing to provide a personal recommendation to a client — whether they ask for it or you offer it proactively — on one or more actions or transactions relating to any virtual asset. Wealth advisers, crypto research firms and consultancies that guide clients on virtual asset decisions fall here. Crucially, an advisory licensee does not hold client assets or execute trades; the moment you do either, you cross into custody or broker-dealer territory and need those categories too. This bright line between advising and acting is the most common category boundary that businesses accidentally step over as they grow.

Category 2 — Broker-Dealer Services

Broker-Dealer Services authorises arranging or executing virtual asset transactions on behalf of clients, or dealing as principal against them. If your platform matches buyers with sellers, routes orders, or takes the other side of a client trade, this is your category. It sits in the higher fee band at AED 100,000 application and AED 200,000 annual supervision, reflecting the client-facing execution risk it carries. A broker-dealer must demonstrate best-execution practices, transparent pricing, and controls that prevent it from trading against its own clients' interests. Many OTC desks, introducing brokers and firms that fill client orders from their own book need this category, and businesses that both broker and run a venue typically hold Broker-Dealer alongside Exchange.

Category 3 — Custody Services

Custody Services covers the safekeeping, holding or control of virtual assets — or the means of access to them, such as private keys — on behalf of clients. It is the single most tightly ring-fenced VARA category: custody must be segregated into a distinct legal entity with a standalone licence, and cannot be aggregated with any other activity. VARA also requires demonstrable independence of governance or an arms-length association from any affiliated business. For founders, this means an exchange that also holds client funds is legally two companies, not one — a fact that materially changes both structure and cost.

Category 4 — Exchange Services

Exchange Services authorises operating a platform that allows the exchange of virtual assets for fiat currency or for other virtual assets. This is the classic "crypto exchange" licence. Because exchanges concentrate market, operational and conduct risk, they attract the higher fee band and rigorous technology, market-surveillance and capital expectations. Most exchange operators also need a separate custody entity if they hold customer assets, effectively doubling their regulatory footprint.

Category 5 — Lending & Borrowing Services

Lending & Borrowing Services covers offering lending or borrowing arrangements involving virtual assets — crypto lending desks, yield products and margin-style borrowing structures. Given the prudential and consumer-protection sensitivities around crypto lending after global market events, VARA supervises this activity closely, and it sits in the AED 100,000 / AED 200,000 band. Expect detailed scrutiny of how you fund loans, manage collateral and liquidation, disclose risk to clients, and protect lenders — this is one of the categories where VARA's post-2022 caution is most visible.

Category 6 — Management & Investment Services

Management & Investment Services authorises managing virtual assets or virtual-asset portfolios on behalf of clients on a discretionary basis — the crypto equivalent of an asset or fund manager. Firms running managed crypto strategies, discretionary portfolios or virtual-asset funds map here. It carries the higher fee band and, like the other client-money activities, demands robust governance and capital. VARA will expect clear investment mandates, suitability and risk-profiling of clients, valuation and reporting discipline, and segregation of client assets — often meaning a management licensee also needs, or partners with, a licensed custodian.

Category 7 — Transfer & Settlement Services

Transfer & Settlement Services covers providing the infrastructure to transfer or settle virtual asset transactions — the plumbing beneath the market. It shares the lower fee band with Advisory (AED 40,000 application, AED 80,000 annual), reflecting its infrastructure rather than client-asset-holding nature, though the exact risk profile VARA assigns can adjust the supervision fee.

Category 8 — Category 1 VA Issuance

Category 1 VA Issuance authorises the issuance of asset-referenced or fiat-referenced virtual assets under VARA supervision — for example, tokens designed to track a real-world asset or currency. It is a full licensed activity at AED 100,000 / AED 200,000. Issuances that do not meet the Category 1 definition are treated as Category 2 issuance, handled through a VARA Issuance Approval Form (email issuance@vara.ae for the form) rather than a standalone activity licence. This split lets VARA supervise higher-impact issuances tightly while providing a lighter path for other token launches. Founders planning a token should establish early which category their issuance falls into, because a Category 1 issuance is a full licensed activity with capital and supervision obligations, whereas a Category 2 issuance follows the approval-form route — a materially different cost, timeline and compliance burden that must be settled before any token economics are finalised.

What Each Category Demands Beyond the Fee

The fee is only the visible tip of each category. VARA calibrates its full requirements — capital, governance, technology and reporting — to the risk each activity carries, which means two licences with the same headline fee can demand very different amounts of money and effort to actually obtain and keep.

The two lower-band activities, Advisory and Transfer & Settlement, are lighter across the board. Advisory firms do not hold or move client assets, so their capital, custody-technology and prudential expectations are modest; the core burden is fit-and-proper personnel, a compliant advisory process, and conflict-of-interest controls. This is why so many crypto ventures begin life as advisory licensees — the path to authorisation is the shortest and the ongoing cost the lowest.

The six higher-band activities are a different proposition. Exchange and Custody in particular demand serious capital held against operational and prudential risk, institutional-grade cybersecurity and key-management, market-surveillance systems, business-continuity and disaster-recovery plans, and a senior team VARA can individually assess as fit and proper — typically including a UAE-resident Compliance Officer and Money Laundering Reporting Officer. Lending & Borrowing and Management & Investment carry heavy consumer-protection and prudential obligations because they put client money at risk. Broker-Dealer sits between, with execution and best-interest duties. In practical terms, the AED 100,000 application fee for an exchange might be less than a tenth of what it actually costs to reach the operating stage once capital, systems and staffing are counted.

The lesson for category selection is that you are not choosing a price — you are choosing a workload and a capital commitment. A firm that could achieve its commercial goal with an Advisory licence but reflexively applies for Exchange has multiplied not just its fee but its entire launch project.

A Worked Multi-Activity Example

Consider a business that wants to run a crypto trading platform, hold client assets, and offer portfolio management — three functions that map to three categories. Here is how the categories and fees stack, remembering that custody must be a separate entity:

The trading company aggregates Exchange and Management under one licence — full fee for the first activity, a 50% extension fee for the second — but carries two annual supervision fees. Custody, by rule, is a standalone company with its own application and annual fee. The AED 250,000 Year 1 figure is VARA's charge alone; two incorporations, two offices, two compliance teams, capital for each entity, technology and legal all sit on top. Mapping this correctly before applying is what prevents a mid-process discovery that you needed two companies, not one.

How to Decide Which Categories You Need

Work through your business model function by function and match each to a category definition:

• Do you give clients recommendations on virtual assets? → Advisory Services.
• Do you execute or arrange trades for clients, or deal as principal? → Broker-Dealer Services.
• Do you hold client assets or their private keys? → Custody Services (separate entity).
• Do you run the venue where trading happens? → Exchange Services.
• Do you lend or borrow virtual assets, or offer yield? → Lending & Borrowing Services.
• Do you manage client portfolios on a discretionary basis? → Management & Investment Services.
• Do you provide transfer or settlement infrastructure? → Transfer & Settlement Services.
• Do you issue asset- or fiat-referenced tokens? → Category 1 VA Issuance.
• Do you trade only your own book? → Not a category, but you need a No Objection Certificate and a separate company.

Most real businesses tick more than one box, and that is fine — the categories are designed to aggregate. The discipline is to tick only the boxes you will genuinely operate at launch, and add categories later through the extension route once revenue supports the additional supervision fees. This staged approach keeps your Year 1 fee, capital and compliance burden proportionate to what you are actually doing on day one.

How the Categories Combine — and the Custody Exception

The rule that shapes most real applications is simple: you can aggregate multiple activities under one licence, except custody. A firm licensed for Broker-Dealer, Exchange and Management pays the first activity's full fee, then a 50% Licence Extension Fee for each additional activity, plus a full annual supervision fee for every activity it holds. But the moment client-asset custody enters the picture, VARA requires a segregated, standalone custody entity — a second company, second licence, second supervision fee.

Two boundary cases catch founders out. Proprietary trading — trading your own or your group's book — is not a licensed activity, but it needs a No Objection Certificate from VARA, must be registered above certain volumes, and must sit in a separate company. And any VASP seeking to offer these activities must be licensed before it begins operations in or from Dubai, whether it serves residents or only global customers where the activity is permissible. There is no "we only serve overseas users" carve-out.

How VARA Categories Map to ADGM and DIFC

VARA's eight categories are specific to the Emirate of Dubai outside the DIFC. If your business is based in Abu Dhabi Global Market (ADGM) or the Dubai International Financial Centre (DIFC), a different regulator and a different category framework apply — though the underlying activities are conceptually similar.

In ADGM, the Financial Services Regulatory Authority (FSRA) regulates virtual assets through its financial-services framework, treating certain crypto activities as regulated financial services with their own permissions for operating an exchange (a Multilateral Trading Facility), providing custody, dealing, arranging and managing. In DIFC, the DFSA runs a crypto-token regime that similarly maps crypto activities onto its existing financial-services permissions. The Securities and Commodities Authority (SCA) regulates virtual assets that qualify as securities at the federal level, and the Central Bank of the UAE (CBUAE) oversees payment tokens and stablecoins under its Payment Token Services Regulation.

The practical consequence is that "which category do I need" cannot be answered until you have chosen a jurisdiction. The same crypto exchange is an Exchange Services licensee under VARA, an MTF operator under ADGM's FSRA, and something different again under the DFSA — each with its own fees, capital rules and application process. Choosing the jurisdiction first, based on your customers, banking needs and team location, and only then selecting the category, is the correct order. Reverse it and you risk designing a business around a category framework that does not apply to where you actually want to operate.

Upgrading and Extending Your Categories Over Time

VARA categories are not a one-time, permanent choice. A licensee that starts with Advisory Services and later wants to execute trades can apply to add Broker-Dealer Services; an exchange that decides to hold client assets can incorporate and license a separate custody entity. This is the intended growth path, and it is why the fee schedule includes a Licence Extension Fee mechanism at 50% of the lower application fee.

The advantage of starting narrow and extending is real: you reach market faster, prove your model, generate revenue, and only then take on the heavier capital, compliance and supervision burden of additional categories. The trade-off is that each extension is a fresh regulatory process — VARA re-assesses your readiness for the new activity, and you must have the capital, systems and personnel that activity demands in place before it is granted. For most founders, the right strategy is to launch with the smallest category set that supports a viable business, then extend deliberately as the company matures. Trying to launch fully loaded across many categories is the single most common way early-stage crypto ventures exhaust their capital before they ever serve a customer.

Because the categories interact with capital, tax and corporate structure, the category decision should be made alongside — not before — decisions about your entity structure, your minimum capital plan, and your Federal Tax Authority registration obligations. Treating category selection as a standalone regulatory checkbox, divorced from the commercial and financial plan, is how businesses end up with a licence that does not match how they actually make money.

Common Mistakes When Choosing VARA Categories

• Under-licensing to save fees. Skipping the custody category while actually holding client keys is illegal operation, not a saving. Map every function you perform to a category honestly.
• Bundling custody with an exchange. VARA will not allow it — custody must be a separate entity. Plan for two companies from day one if you hold client assets.
• Over-licensing on day one. Applying for six activities "to be safe" multiplies extension and annual supervision fees. Launch with the minimum viable set and extend later.
• Confusing Broker-Dealer with Exchange. They are different activities with different obligations. If you both run a venue and deal as principal, you likely need both — not one used loosely.
• Treating proprietary trading as unregulated. It needs an NoC, possible registration, and a separate company.
• Ignoring capital and governance differences. Higher-band activities carry heavier capital, compliance and technology expectations than Advisory or Transfer & Settlement. The category you choose changes far more than the fee.

Get Your VARA Category Right the First Time

The category you choose determines your fee, your capital, your governance obligations and even how many companies you must incorporate. Getting it wrong is expensive in both directions — an under-scoped licence risks enforcement, an over-scoped one burns capital on activities you never launch. For the full fee mechanics see our VARA license cost breakdown, and for how VARA compares with Abu Dhabi and free-zone routes, our UAE crypto licence guide across VARA, ADGM and DMCC.

At Noble Core Ventures we start every crypto engagement with activity-mapping — pinning your exact business model to the correct VARA categories — before costing and building the application. Whether you are a lean advisory firm or a full exchange-and-custody structure, our crypto consultancy licensing service and Dubai business setup service make the path from category choice to full authorisation predictable. You can confirm the current federal tax obligations that apply to any licensed entity with the Federal Tax Authority.

Frequently Asked Questions