Building a Web3 product in Dubai: how VARA licensing maps onto your architecture

Engineers who end up running a crypto startup usually meet regulation late: the product already has a wallet, a swap screen and a staking page, and only then someone asks which licence covers all of it. In Dubai that question has a concrete shape, because the Virtual Assets Regulatory Authority (VARA) licenses activities one by one. The feature list of your product effectively becomes the licence application.

These notes are for technical founders and CTOs weighing Dubai as a base.

Features are activities

VARA licenses eight activities, and each is applied for explicitly: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and Category 1 virtual asset issuance. A typical "all-in-one" crypto app touches four or five of them at once.

That makes the activity map a useful design artefact. Put every user-facing flow next to the activity it falls under:

• order book or matching engine → exchange services;
• "buy with card" routed to a liquidity provider → broker-dealer services;
• keys or balances held on behalf of users → custody services;
• earn, lend or borrow products → lending and borrowing services;
• sending assets between users or to external addresses → transfer and settlement services.

Some features need their own legal entity

Two rules affect how you split services and databases. Custody is carried on by a distinct legal entity with its own standalone licence. Proprietary trading requires a separate company and a VARA No Objection Certificate.

For an engineering team this is an argument for clean service boundaries from the first sprint. If the custody component already lives in its own service, with its own key management and its own data store, moving it into a separate company is an organisational step. If custody logic is spread through the trading monolith, the separation becomes a rewrite.

The licence is a release gate

The route has two regulatory stages. First comes an Initial Disclosure Questionnaire, filed through Dubai Economy and Tourism for a mainland company or through a Dubai free zone (the DIFC has its own regime). VARA then issues an Approval to Incorporate. With the ATI the company is incorporated, rents an office and hires staff, while virtual asset activity is still closed. The licence application with the rulebook documents, interviews and fees comes after that, and only the VASP licence opens the activity.

Activity before the licence counts as unlicensed activity, and VARA's enforcement tools include cease and desist orders, fines and licence suspension. In practice that means production features stay behind flags until the licence is issued, and public testnets or demos are reviewed with the same care as a launch.

The Technology and Information Rulebook is your spec

Every VASP follows four compulsory rulebooks: Company; Compliance and Risk Management; Technology and Information; Market Conduct. The technology rulebook is the one your team will read most closely, because it turns security, data and system governance into obligations. Treat it as a requirements document: map each requirement to a control you already have, then list the gaps.

The application file also includes a wind-down plan, which is partly a technical document: how user assets are returned if the service stops.

People and place

VARA requires two Responsible Individuals who are full-time employees, approved as fit and proper, and UAE residents or UAE passport holders. All activities except advisory need a private office in Dubai. A remote-first team can still work this way, but the hiring plan has to include these two roles early, because they are tested at interview.

Tax touches the data model too

Corporate tax is 0% on taxable income up to AED 375,000 and 9% above it. A Qualifying Free Zone Person pays 0% on qualifying income, and whether crypto income qualifies depends on the activity lists of Ministerial Decision 229/2025. If you might rely on that regime, your ledger should tag revenue by activity and counterparty from day one.

For the full picture of stages, people, office, bank and tax, the team at Blocons keeps a detailed overview of crypto company registration and the VARA licence in the UAE, checked against VARA and Ministry of Finance sources.