Why the IDQ exists

VARA receives far more enquiries than it can process. The Initial Disclosure Questionnaire is the filter — it lets VARA understand who is asking, what they want to do, how much they intend to capitalise, and whether the application is viable before VARA invests case-officer time. A complete, professional IDQ buys you the right to enter VARA's application pipeline. An incomplete one is filed in the "thank you for your interest" pile.

The seven domains

1. Entity and ownership

Names of the proposed Dubai entity and all upstream shareholders to ultimate beneficial owners. KYC packs on every UBO with 5%+ holding. Group corporate chart. Sources of wealth for each UBO. Proof of capital availability for the regulatory capital injection.

Failure point: founders disclose a clean BVI parent but omit the offshore trust that owns the BVI. VARA finds this through external due diligence and the file is rejected.

2. Category and activity

Selection of one or more of the seven Rulebook categories. Description of which sub-activity within each Rulebook. Specific virtual assets to be handled — VARA distinguishes between "permitted VAs" (BTC, ETH and a defined list) and "non-permitted" or proprietary tokens which require separate approval.

Failure point: applying for Cat 3 (Broker-Dealer) when the actual model is Cat 5 (Exchange). VARA will reject and ask you to reapply against the correct Rulebook.

3. Business model

A two-to-five page narrative of how the business works: who the customers are (retail, professional, institutional), how they are onboarded, how revenue is generated (commission, spread, management fee, listing fee), how the technology stack is structured, and how the business interacts with VARA-regulated counterparties versus offshore. Customer-journey diagram is expected.

4. Financial projections

Three-year financial projections, by quarter for Year 1 and annually for Years 2-3. Revenue, cost, headcount, capital position, cash runway. VARA tests these against the regulatory capital requirements for the chosen category (paid-up capital plus floating-capital ratios under the Company Rulebook Part V).

5. Governance and key personnel

Proposed Authorised Senior Manager (CEO), MLRO, Compliance Officer, Finance Officer, and (for Cat 4/5) CISO. CVs, qualifications, regulatory references. Proposed board composition, including independent NEDs for Cat 4/5. Reporting lines.

Failure point: proposing a part-time MLRO based outside the UAE. VARA requires a UAE-resident, full-time MLRO at application stage.

6. AML/CFT and risk framework

Outline of the proposed AML programme: KYC tiers, sanctions screening, transaction monitoring, suspicious-activity reporting, country-risk policy, customer-risk-rating methodology. Proposed risk-management framework with risk-appetite statement.

7. Technology and security

Technology architecture: cloud vs on-prem, custody architecture (hot/warm/cold wallet split for Cat 4/5), MPC vs HSM, key-ceremony procedures, third-party vendors and their certifications, ISMS framework (ISO 27001 alignment expected for Cat 4/5).

How VARA reads an IDQ

From the inside, an IDQ is graded on four axes by the case officer: fit and proper of the principals; commercial coherence of the model; regulatory category match; operational and financial viability. Each axis can be scored low/medium/high. A "low" on any single axis triggers a request for further information; two "lows" trigger a soft rejection.

The "favourable initial disposition"

If VARA is content with the IDQ, it issues a "favourable initial disposition" letter — sometimes called a Pre-Application Approval. This is not a licence. It is permission to:

  • Incorporate the licensed entity in Dubai (mainland or eligible free zone).
  • Take an office lease in the entity name.
  • Hire and visa-sponsor the MLRO and other key personnel.
  • Submit the full formal application — which includes the policies, the audited capital injection, the BCP/DR documentation, and the technical security review.

From IDQ to formal application is typically 8-16 weeks. From formal application to In-Principle Approval is typically 4-10 weeks. From IPA to licence is 4-12 weeks depending on conditions.

How we prepare an IDQ

Neo Legal runs IDQs as a structured four-stage workflow: (1) two-hour scoping call with founders to pin down the category and model; (2) draft IDQ assembled in 2-3 weeks; (3) review with founders and finalise CVs, financial models and policies; (4) submission and case-officer liaison. We never submit an IDQ that we do not believe will receive a favourable initial disposition — the cost of a rejection is more than the cost of preparation.