The principle-based standard
VARA's framework — unlike, say, MAS Singapore — does not publish a fixed sqm-per-headcount matrix. The standard sits in Compliance & Risk Management Rulebook, Part III: a VASP must have "adequate physical infrastructure" proportionate to the scale, complexity and risk of its licensed activity. This means VARA expects you to justify your office choice in the light of what you do — not tick a box.
In practice, after working through dozens of VARA applications, the substance test resolves into seven concrete things: (i) genuine office, (ii) Dubai-resident key personnel, (iii) functional separation of duties, (iv) physical and information security controls, (v) board governance proportionate to category, (vi) BCP/DR site or arrangement, (vii) an audit trail proving the above.
Office, by category
| Category | Minimum office | Typical actual |
|---|---|---|
| Cat 1 — VA Issuance | Dedicated serviced office, 25-40 sqm | DIFC or DMCC serviced suite |
| Cat 2 — Advisory | Dedicated serviced office, 25-40 sqm | DIFC, DMCC, or Business Bay |
| Cat 3 — Broker-Dealer | Dedicated office, segregated trading area | 80-150 sqm, often DIFC / DMCC |
| Cat 4 — Custody | Dedicated office + secure document/HSM area | 120-200+ sqm, dedicated tenancy |
| Cat 5 — Exchange | Dedicated office + segregated operations, surveillance, ops floors | 200-500+ sqm, often DIFC Gate / ADGM-adjacent |
| Cat 6 — Lending & Borrowing | Dedicated office, segregated credit team | 80-150 sqm |
| Cat 7 — VA Management | Dedicated office, segregated PM & risk function | 80-150 sqm |
Cat 3-7 cannot be operated from a flexi-desk or coworking facility in 2026. VARA inspections include unannounced visits — a coworking lobby card does not pass.
Key personnel — and the residency requirement
VARA's Company Rulebook (Part II) requires four functions:
- Authorised Senior Manager — typically the CEO/MD. Must be UAE-resident (Emirates ID + employment visa under the VASP). VARA expects this person to actually run the business, not be a figurehead.
- MLRO (Money Laundering Reporting Officer) — UAE-resident, full-time, with direct reporting line to the board. Must hold an MLRO-style qualification (ICA, ACAMS or equivalent) and minimum 3-5 years AML experience in financial services.
- Compliance Officer — UAE-resident, full-time. May be the same person as the MLRO in Cat 1/2 if appropriately credentialed, but VARA strongly prefers separation in Cat 3-7.
- Finance Officer / CFO — UAE-resident or with regular UAE presence. Responsible for accurate books, audited financials and VARA prudential reporting.
Cat 4 (Custody) and Cat 5 (Exchange) additionally require a Chief Information Security Officer (CISO) and an independent non-executive director on the board.
What VARA looks for on inspection
From inspections we have witnessed and remediation work we have led:
- Signed lease in the name of the VASP entity (not the parent, not a director, not a free-zone shell).
- Floor plan submitted to VARA matches the physical premises.
- Reception, work area, secure document area and (where relevant) HSM/server area physically separated.
- CCTV log + access-control log available for the prior 12 months.
- BCP/DR site identified — either a second physical location or a documented cloud-DR arrangement with named provider, SLA and tested recovery point.
- Information-security policies (ISMS) operational — typically ISO 27001-aligned for Cat 4/5.
- Visitor logs, fire-safety certificate, civil-defence permit current.
- All key personnel resident in the UAE on a visa sponsored by the VASP (a board director on a separate Investor Visa is not enough for executive functions).
Free zone vs mainland
VARA-licensed entities can be incorporated either on Dubai mainland (with DET / DDA approvals where relevant) or in a participating Dubai free zone. The free zones in which VARA-licensed entities operate include DMCC, DWTC, DAFZA, JAFZA, Meydan, IFZA, DDA and the DIFC for federal-regulated affiliates. Each free zone offers different commercial terms — DMCC and Meydan are the most common for Cat 1/2/3; DIFC/ADGM-adjacent for Cat 4/5/7 because of banking access.
The three failure modes
1. "We will hire the MLRO when we get the licence." This is the single most common stall reason. VARA requires the MLRO to be in place — visa-sponsored and resident — before the licence is granted. We have seen In-Principle Approvals lapse because the founder waited.
2. "We will move into a real office after launch." The same problem in another form. The licensed entity must have the office in its own name, fitted out, and ready for inspection before the licence is granted.
3. "Our group BCP applies." No — VARA requires a BCP/DR specific to the Dubai entity, with documented and tested recovery procedures. Pointing at a parent-company BCP is rejected.
Cost ranges
Office costs vary widely. Cat 1/2 serviced offices in DMCC or Business Bay are accessible; Cat 4/5 dedicated premises in DIFC or DWTC are not. We are happy to walk through the actual ranges relevant to your category under engagement — we maintain a current real-estate panel.
