Dubai VARA Reaches 50 Licensed VASPs: What the Operational Gap Means for Firms
Dubai's Virtual Assets Regulatory Authority has granted its 50th VASP licence, with the latest approval going to tokenised assets platform Tribe Tokenisation FZE. The headline number signals continued momentum in the emirate's regulated crypto market, but accounting firms and CFOs advising clients in the UAE need to look past the count: at the end of 2025, VARA classified only 39 of those licensees as fully operational, and the regulator has not yet published an updated figure for 2026.
What the 50th Licence Actually Represents
VARA confirmed to Cointelegraph that holding an active licence does not mean a firm has completed its commercial launch. Newly approved entities pass through a controlled operationalisation period before they can offer services or onboard clients. That distinction matters for any counterparty due-diligence process.
The Licence-to-Operations Gap
The spread between 50 licensed firms and 39 operational ones at year-end 2025 is not a sign of regulatory failure. It reflects a deliberate sequencing: VARA grants approval, then monitors a firm's readiness before it goes live. For accounting firms conducting client onboarding or AML checks, verifying whether a VASP holds a licence is a necessary step, but it is not sufficient. You also need to confirm the entity's operational status directly with VARA's public register before treating it as an active counterparty.
What VARA Monitors Beyond Licence Counts
A VARA spokesperson indicated that the regulator assesses market activity using transaction volumes, assets under management, employment data, and audited financial statements, not just the number of licences issued. For firms preparing compliance reports or conducting substance assessments for UAE-based crypto clients, this is a useful indicator of the data VARA itself considers material.
Dubai's Activity-Based Regulatory Framework
VARA was established in March 2022 as a standalone crypto regulator, separate from Dubai's broader financial services architecture. Its framework is structured around specific virtual asset activities rather than entity type, meaning a single firm may hold approvals across multiple activity classes. That granularity has practical consequences for compliance work.
Implications for Client Onboarding and AML Programmes
When a VASP holds a VARA licence covering, say, broker-dealer and custody activities, its permitted scope differs from a firm licensed only for exchange services. Accounting firms running AML/KYC programmes for clients that transact with VARA-licensed counterparties should map the specific activity permissions, not just the top-level licence status. The same principle applies when assessing whether a client's own operations remain within their licensed perimeter, a common gap in fast-growing crypto businesses. This connects directly to broader questions about AML obligations when onboarding clients linked to high-risk platforms, where counterparty classification errors have serious downstream consequences.
How Dubai Compares to Hong Kong and Singapore
The 50-firm total places Dubai ahead of two closely watched rival hubs, though the comparison requires care because each jurisdiction licences different categories of business.
| Jurisdiction | Regulator | Regime Type | Licensed Firms (as reported) |
|---|---|---|---|
| Dubai (UAE) | VARA | Standalone VASP framework, activity-based | 50 licensed (39 operational at end-2025) |
| Singapore | Monetary Authority of Singapore (MAS) | Major Payment Institution licence within broader payments regime | 37 MPIs authorised for digital payment token services |
| Hong Kong | Securities and Futures Commission (SFC) | Platform-specific VATP licence | 13 licensed virtual asset trading platforms |
Singapore regulates digital payment token services inside its payments licensing structure rather than through a dedicated regulator. Hong Kong's SFC count is narrower still because its regime is limited specifically to trading platform operators. Neither comparison reflects the full universe of crypto-adjacent businesses operating in those markets under other authorisations.
Why the Comparison Matters for Firms Advising Across Jurisdictions
Clients operating across Dubai, Singapore, and Hong Kong face three distinct compliance architectures. A firm licensed as a VARA VASP in Dubai is not automatically treated as equivalent to an MAS-authorised MPI or an SFC-licensed VATP when it comes to correspondent relationships, audit scope, or AML risk ratings. Cross-border engagements require jurisdiction-specific licence verification rather than reliance on headline comparisons. Firms handling blockchain analytics as part of those reviews should also be asking the right due-diligence questions for blockchain analytics providers to ensure the data underpinning their AML work meets evidential standards.
Practical Steps for Accounting Firms and CFOs
Three actions are worth prioritising in light of this development.
Verify Operational Status, Not Just Licence Status
VARA's public register distinguishes between licensed and operational entities. Any client due-diligence process or counterparty risk assessment should confirm both. A firm in the operationalisation phase may have restrictions on the services it can offer, which affects the validity of any contractual or compliance reliance placed on its licensed status.
Map Activity Permissions Precisely
Because VARA's framework is activity-based, the specific permissions on a licence define what a firm can legally do. Auditors and compliance teams should obtain and retain a copy of the relevant activity schedule, not just evidence that a licence exists. This is particularly important for clients in custody, broker-dealer, or lending activities, where the permitted scope is narrowest.
Prepare for Updated 2026 Figures
VARA has indicated it is validating an updated operational count for 2026. When that figure is published, firms should reassess their counterparty and client registers against it. Any entities that were licensed but non-operational at end-2025 and have since launched will require a fresh onboarding review against their current permitted activities.
Source: Cointelegraph
FAQ
VARA classified 39 of its then-licensed VASPs as fully operational at end-2025. The regulator has said it is validating an updated figure for 2026. Holding an active licence does not automatically mean a firm is trading or onboarding clients.
VARA structures its licences around specific virtual asset activities, such as exchange, broker-dealer, custody, or advisory services, rather than granting a single blanket permission. A firm's permitted scope is defined by which activities appear on its licence. Compliance teams must review the activity schedule, not just confirm that a licence exists, to understand what a counterparty is legally authorised to do.
As reported, Dubai has 50 licensed VASPs, Singapore has 37 major payment institutions authorised for digital payment token services, and Hong Kong has 13 licensed virtual asset trading platforms. The figures are not directly comparable because each jurisdiction licences different categories of firm under different regulatory architectures. Cross-border due diligence requires jurisdiction-specific verification.
According to a VARA spokesperson, the regulator considers transaction volumes, assets under management, employment figures, and audited financial statements when evaluating the depth of market activity. This information is relevant for firms preparing substance assessments or compliance reports for UAE-based crypto clients.
VARA was established in March 2022 as Dubai's dedicated virtual asset regulator, operating as a standalone authority separate from the broader financial services regulatory structure. It is distinct from regulators in Singapore and Hong Kong, which licence crypto activities within existing financial services frameworks.