The legal starting point
Dubai's virtual-asset regime is built on three layers: Dubai Law No. 4 of 2022 (establishing VARA), the VARA Regulations 2023 (the seven activity Rulebooks plus Compliance, Market Conduct, Company and Risk Management Rulebooks), and the underlying federal anti-money-laundering and consumer-protection regime. If you carry on any of the seven regulated Virtual Asset Services "in or from" the Emirate of Dubai (excluding the DIFC), you need a VARA licence — full stop. Operating without one is an offence under Article 17 of Law No. 4.
The interesting question is therefore not "do I need VARA?" but "is what I am doing a Virtual Asset Service at all?"
The seven regulated activities — and what falls outside
VARA's Rulebooks regulate seven defined activities. Reduced to plain English:
- Advisory Services — giving advice to third parties on the merits of buying, selling or holding a virtual asset.
- Broker-Dealer Services — receiving, transmitting or executing client orders.
- Custody Services — holding or controlling client virtual assets or the private keys.
- Exchange Services — operating a multilateral facility matching buyers and sellers.
- Lending & Borrowing — providing or arranging credit denominated in or secured by virtual assets.
- VA Management & Investment — managing client portfolios or operating a collective investment vehicle.
- VA Transfer & Settlement — providing payment, transfer or settlement rails.
If none of those describes your activity, you are not carrying on a Virtual Asset Service. That opens up four practical lanes outside VARA.
Lane 1 — Pure proprietary trading
Trading your own money, with your own capital, from your own books, without holding client assets and without holding yourself out as offering a service to others, is not a regulated activity under any of the seven Rulebooks. We routinely structure proprietary trading vehicles in DMCC, IFZA or Meydan with a "Proprietary Trading" activity code — provided three conditions are met.
First, no client funds, ever. The moment you accept money from a friend, family member or "sophisticated investor", you are providing VA Management or Broker-Dealer Services. Second, no public marketing of your strategy, performance or fund-raising. Third, your AED treasury threshold must be honest — under the VARA Compliance & Risk Management Rulebook, scale becomes material once daily turnover crosses ~AED 250 million, and the SCA federal perimeter on "investment activity" must also be considered.
Lane 2 — Pure technology and infrastructure
You can build software, run validators for your own benefit, develop smart contracts on a paid-development basis, operate a marketing or analytics SaaS, run a wallet that the user controls (non-custodial), or operate as a Web3 development house without a VARA licence. The dividing line is custody and discretion: the moment you hold client keys, route client orders, or take discretionary investment decisions, you have crossed into a regulated lane.
Practical examples that sit outside VARA: a non-custodial wallet SDK; a blockchain analytics SaaS sold to exchanges; a NFT-mint smart-contract development shop; a validator node operator staking only its own treasury; a token-launch advisory firm whose advice is limited to legal, marketing and tokenomics (not investment merits).
Lane 3 — DIFC and ADGM
DIFC (regulated by the DFSA) and ADGM (regulated by FSRA) are common-law financial free zones inside the UAE federation but outside VARA's territorial scope. They have their own crypto regimes — DFSA's Crypto Token regime and FSRA's Virtual Assets Framework. These are not "no-licence" routes; they are different licences, often appropriate for institutional players who want a DFSA or FSRA stamp to passport into traditional finance counterparties.
DIFC's Innovation Testing Licence and ADGM's RegLab provide sandboxed pathways for genuinely novel models, with restricted scope and capped client numbers.
Lane 4 — Activity that is not "in or from" Dubai
VARA's jurisdictional reach is "in or from the Emirate of Dubai" (Article 4, Law No. 4 of 2022). A genuine offshore structure — say, a BVI company operated by directors and key management outside Dubai, with all decisioning, infrastructure and marketing offshore — is not "in or from Dubai", even if a UAE-resident shareholder happens to own it. This is the lane on which our most popular structure, the BVI + Cayman hybrid, depends.
The bear traps are well-known: directors physically in Dubai, key servers in Dubai, sales staff in Dubai, AED-denominated marketing — any of these will, in practice, pull the offshore vehicle back into "in or from Dubai" and into VARA's perimeter. We never advise clients that pure offshore is a licensing escape route for activity that is, in substance, run from Dubai.
The two activities people most often get wrong
Token issuance. Issuing a new token is, in itself, not one of the seven regulated activities — but the surrounding activity almost always is. If you market the token to the public, you are providing Advisory or Broker-Dealer Services. If you list it on a third-party exchange and remain involved in liquidity, you are arranging Exchange or Broker-Dealer Services. If you accept fiat for the token from public investors, you may be conducting a security offering under SCA federal rules. Token issuance is a regulated cluster, not a regulated activity — and almost always needs VARA's Category 1 VA Issuance approval.
Staking-as-a-service. Validators staking only their own assets fall outside VARA. The moment you pool client assets, take discretion, or promise yield, you are providing VA Management & Investment, Custody, or Lending & Borrowing, depending on the design.
Decision matrix
| Activity | Outside VARA? | Most appropriate vehicle |
|---|---|---|
| Personal/family-office prop trading | Yes (with caveats) | DMCC / IFZA Prop Trading SPV |
| Wallet SDK (non-custodial) | Yes | DMCC / Meydan tech licence |
| Validator on own treasury only | Yes | RAKEZ / IFZA |
| OTC desk for third parties | No — VARA Broker-Dealer | VARA Cat 3 |
| Custodial wallet | No — VARA Custody | VARA Cat 4 |
| Token issuance + public sale | No — VARA Issuance | VARA Cat 1 |
| Pure SaaS for exchanges | Yes | DMCC / DIFC Innovation Hub |
| Yield product for clients | No — VA Management / Lending | VARA Cat 7 / 5 |
What we do
Neo Legal runs the perimeter analysis before any structure is incorporated. We have advised over 1,000 clients across the seven VARA categories and the federal SCA, CBUAE and FATF perimeters since 2015. If you are unsure which side of the line you are on, the cheapest possible mistake is to spend an hour with us before — not after — you incorporate.
