Crypto.com Receives VARA MVP Preparatory License in Dubai
Dubai's Virtual Assets Regulatory Authority (VARA) has granted Crypto.com an MVP Preparatory License, the formal entry point into VARA's minimum viable product programme. The approval is not a full operational clearance. It authorises the exchange to satisfy a defined set of pre-conditions before it can conduct regulated virtual asset activities in and from the Emirate. For accounting firms, auditors, and CFOs managing UAE counterparty relationships, that distinction carries direct compliance weight.
What VARA's MVP Programme Actually Is
VARA was established in March 2022 under Dubai's Virtual Asset Regulation Law, the first jurisdiction-level law of its kind dedicated entirely to virtual assets. The authority's licensing architecture is deliberately phased. The MVP Programme sits between a preparatory approval and full operational status, and it exists to ensure that applicants have hardened their governance, controls, and operational infrastructure before they are permitted to serve live customers at scale.
Preparatory stage vs. operational licence
The preparatory stage allows an approved entity to complete all remaining pre-conditions: staffing key personnel roles, finalising governance documentation, and demonstrating that AML/CFT and KYC frameworks meet VARA's operational standards. Only once those conditions are satisfied does VARA issue the operational licence that unlocks live market activity. Crypto.com has cleared the first gate. The second gate is still ahead.
That sequencing is intentional. VARA's model forces regulated entities to prove their compliance infrastructure is operational, not just documented, before customers can transact. For firms assessing a VASP's regulatory standing, the difference between "preparatory" and "operational" is not a technicality. It is the difference between a licence that permits preparation and one that permits execution.
What VARA Reviewed to Grant This Licence
According to VARA's announcement, the preparatory licence followed a detailed review across several compliance dimensions. Understanding what was scrutinised helps accounting and legal teams calibrate their own counterparty assessments.
Personnel and governance
VARA examined key personnel appointments and governance procedures. This mirrors the fit-and-proper standards common across mature financial services regulators: the people holding material functions must be identifiable, qualified, and accountable. For a firm onboarding Crypto.com as a counterparty, confirming that governance structures have passed regulatory review is a meaningful data point in any VASP due diligence file.
AML/CFT, KYC, and UBO policies
The review explicitly covered anti-money laundering and counter-terrorist financing capabilities, KYC procedures, and ultimate beneficial owner identification policies. These are the three pillars that any regulated financial institution must satisfy under UAE Federal Decree-Law No. 20 of 2018 on AML/CFT and VARA's own rulebook. A preparatory licence signals that VARA is satisfied, at this stage, that the documented frameworks are adequate. The operational review will test whether those frameworks perform in practice.
Cross-border safety and security measures
VARA also assessed cross-border safety and security. This is significant given the scope of services Crypto.com intends to offer: spot and derivatives exchange, brokerage, margin and leverage trading, and OTC settlement targeted at institutional investors. Cross-border flows in those product lines create complex jurisdictional layering, and VARA's explicit review of this dimension reflects the authority's stated goal of enabling "secure cross-border interoperability."
Planned Service Scope and Its Accounting Implications
Once Crypto.com receives its operational licence, it intends to offer a full institutional suite under the VARA regime. The announced product lines span spot trading, derivatives, brokerage, margin and leverage trading, and OTC settlement services. Each of those categories carries distinct accounting and reporting considerations for institutional clients.
Derivatives and margin products
Derivatives written on virtual assets require careful classification under both IFRS 9 and IAS 32, depending on whether they meet the definition of a financial instrument and how settlement is structured. Margin and leverage products introduce collateral accounting: posted collateral may need to be derecognised from the client's balance sheet depending on the terms, and unrealised gains and losses on open positions require mark-to-market treatment. CFOs whose entities plan to trade on a VARA-licensed venue should confirm their chart of accounts and month-end processes can handle these instrument types cleanly.
OTC settlement for institutional investors
OTC transactions often settle bilaterally and off-exchange, which means the audit trail lives in trade confirmations and settlement records rather than on a public order book. Accounting teams need to capture the trade date, settlement date, counterparty identity, and agreed rate for each OTC transaction. Digital asset accounting software that can ingest OTC settlement data directly, rather than requiring manual journal entry, reduces both the error rate and the audit preparation burden. This is a practical area where robust crypto accounting software earns its keep in a UAE institutional context.
What This Means for VASP Due Diligence in the UAE
Accounting firms and compliance teams conducting counterparty due diligence on UAE-based or UAE-licensed VASPs need to track the distinction between licence types with precision. A preparatory licence is a positive signal: it means the regulator has reviewed and conditionally approved the entity. It is not, however, a green light for all regulated activities.
Recording licence status in due diligence files
When logging Crypto.com's regulatory status, files should note the licence type (MVP Preparatory), the issuing authority (VARA), and the activities that will become available only upon operational licence issuance. Any client agreements or counterparty risk assessments written now should include a condition that the relationship is subject to confirmation of operational licence status before live trading commences. VARA publishes its licensed entity register, and periodic re-checks against that register are good practice. For a structured approach to building these files, see our article on building a VASP due diligence and onboarding framework.
AML risk-rating implications
From an AML perspective, a VARA-licensed entity sits in a different risk tier than an unlicensed or offshore exchange. VARA's review of AML/CFT and KYC frameworks is a documented supervisory event, and that matters when a regulated financial institution applies its risk-based approach to customer or counterparty categorisation. The preparatory licence does not eliminate inherent risks, especially for derivatives and leverage products, but it does confirm that VARA has engaged with and accepted the entity's documented controls. Risk ratings should reflect this, and the underlying supervisory evidence should be referenced in the rationale. Teams working through similar exercises for entities in other jurisdictions can benchmark against the analysis in our piece covering EU VASP licensing outcomes and illicit-exposure risk after MiCA.
VARA's Broader Regulatory Trajectory
The Crypto.com approval fits into a consistent pattern of VARA building out a recognisable, standards-based licensing regime. VARA's CEO Henson Orser framed the move as part of the authority's mission to create a "resilient and securely future-proofed ecosystem" with global cross-border interoperability as an explicit design goal. That framing has practical implications for firms operating across the Gulf and beyond.
Mutual recognition and cross-border reporting
As VARA's regime matures, the question of how Dubai-licensed activities interact with other frameworks, including FATF's travel rule requirements, MiCA in the EU, and the regulatory regimes of other Gulf Cooperation Council states, will become increasingly relevant. Accounting and compliance teams building UAE exposure into their portfolios should monitor whether VARA develops mutual recognition arrangements with peer regulators, because those arrangements will shape how cross-border transaction reporting is structured and what information needs to flow with each transfer.
Institutional confidence signals
The involvement of a large global exchange with an existing multi-jurisdictional licence portfolio in VARA's MVP programme signals that institutional-grade participants view Dubai's framework as credible and commercially worthwhile. For accounting firms advising clients on where to domicile virtual asset operations or where to access institutional liquidity, the depth of the licensed participant base is a relevant factor alongside the legal framework itself. A broader, more credible licensee pool strengthens the case for treating VARA-regulated counterparties as lower inherent risk.
Practical Next Steps for Accounting Firms and CFOs
The immediate action items are straightforward but must be executed carefully to hold up under audit or regulatory review.
Update counterparty registers now
Any firm that has, or is considering, a relationship with Crypto.com for UAE-based activity should update its counterparty register to reflect the MVP Preparatory status. The register entry should include the licence number if published by VARA, the date of the announcement, the activities covered once operational, and a scheduled review date tied to the expected operational licence issuance. Do not record a preparatory licence as equivalent to full operational approval.
Review product-specific accounting policies
If client mandates include derivatives, leverage products, or OTC instruments on a VARA-licensed venue, review whether existing accounting policies cover those instruments adequately. Where gaps exist, document them and request guidance from a qualified practitioner before any trading commences. Using capable crypto bookkeeping software that can handle multi-product, multi-venue data from the outset will prevent a backlog of unreconciled positions accumulating before the first audit cycle.
Monitor the VARA register for operational licence issuance
Set a calendar alert to re-check VARA's public register at regular intervals. The operational licence issuance is the trigger point at which the full suite of services becomes available and at which counterparty risk assessments should be formally re-evaluated and signed off.
Frequently Asked Questions
What is the difference between VARA's MVP Preparatory License and an operational licence?
The MVP Preparatory License confirms that VARA has reviewed an applicant's governance, AML/CFT, KYC, and UBO frameworks and found them conditionally acceptable. It allows the entity to complete all remaining pre-conditions for live operations. An operational licence, issued after those pre-conditions are satisfied, is required before the entity can actually conduct regulated virtual asset activities with clients. Accounting teams should record these as distinct statuses in any counterparty register.
Which regulated activities will Crypto.com be permitted to offer once fully operational under VARA?
According to VARA's announcement, the approved scope covers spot and derivatives exchange services, brokerage, margin and leverage trading, and OTC settlement services targeting institutional investors. These activities will only become available after the operational licence is issued, not at the preparatory stage.
How should an accounting firm adjust its AML risk rating for a VARA MVP Preparatory licensee?
A VARA preparatory licence is a documented supervisory event: the regulator has reviewed and accepted the entity's AML/CFT and KYC frameworks. This is a positive factor in a risk-based assessment and generally supports a lower inherent risk rating than an unlicensed or offshore exchange. However, the rating should still reflect the product types involved, particularly derivatives and leverage, and should be updated once operational status is confirmed. Document the rationale and the supervisory evidence in the due diligence file.
Does a VARA licence affect how cross-border transactions with this entity must be reported?
VARA's framework references cross-border interoperability, and FATF's travel rule applies to virtual asset transfers above the relevant threshold regardless of where the VASP is licensed. For UAE-based transactions, UAE Federal AML requirements apply. Accounting and compliance teams should confirm that any data-sharing obligations under the travel rule are met for transfers to or from a VARA-licensed entity, and that counterparty information is captured at the point of settlement rather than retrospectively.
What does this development mean for firms using digital asset accounting software to manage UAE exposure?
The expansion of regulated, institutional-grade venues in Dubai increases the volume and complexity of transaction data that accounting teams need to process. Firms should confirm that their digital asset accounting software can ingest data from VARA-licensed exchanges, including OTC settlement records and derivatives positions, and map it correctly to the relevant accounting treatments. Manual reconciliation of multi-product institutional volumes is not scalable and creates material audit risk.