Dubai's VARA Opens the Gate for Legacy VASP Licensing
Every virtual asset business operating in Dubai, outside the DIFC, now has a hard regulatory clock running. Dubai's Virtual Assets Regulatory Authority (VARA), working in coordination with the Department of Economy and Tourism (DET) and the emirate's Free Zone Authorities (FZAs), has activated formal applications for legacy operators to migrate into the full VARA licensing regime. The first mandatory step, submitting an Initial Disclosure Questionnaire (IDQ), carries an end-of-April deadline. Miss it, and a business is effectively operating outside the law in one of the world's most watched crypto hubs.
The Regulatory Foundations Behind This Move
Cabinet Resolution No. 111 of 2022
The legal basis for this migration sits in Cabinet Resolution No. 111 of 2022 Concerning the Regulation of Virtual Assets and their Service Providers, which came into force on 15 January 2023. That resolution requires every company operating in, or seeking to operate in, the virtual assets sector in or from Dubai to hold a VARA licence. There are no carve-outs for businesses that were already trading before the regime existed. Legacy status does not grant immunity; it grants a structured off-ramp into compliance.
The Virtual Assets and Related Activities Regulations 2023
Sitting beneath the Cabinet Resolution, VARA's own Virtual Assets and Related Activities Regulations 2023 spell out what regulated activity looks like across seven distinct licence categories. The Full Market Product (FMP) Regulations, released on 7 February 2023, replaced the earlier Minimum Viable Product (MVP) programme, a time-limited arrangement that had allowed new entrants to set up operations while the full rulebook was being finalised. The FMP regime is now the only valid operating framework, and the IDQ process is the entry point into it for those who pre-date it.
How the Migration Process Works
Step 1: The Initial Disclosure Questionnaire
Legacy operators, meaning any VASP that was already carrying out virtual asset activities in Dubai before the VARA regime came fully into force, must submit an IDQ to their current licensing authority. That means DET if they are a mainland entity, or the relevant FZA if they are established in a free zone. The deadline for receipt of all IDQs across the sector is 30 April 2023. This is not an expression of interest or an informal notification; it is the formal first step in a regulated process, and VARA is coordinating directly with DET and the FZAs to track submissions.
Step 2: The Application Acknowledgement Notice
Once an IDQ is received and processed, the operator will be issued an Application Acknowledgement Notice (AAN). The AAN is the trigger for the next phase. From that point, the business must pursue the appropriate VARA authorisation, either a full licence or registration, depending on the nature of its activities. The deadline to complete that phase and be operating under a formal VARA authorisation is 31 August 2023.
The Seven Licence Categories
A business applying under the FMP regime must identify which of VARA's seven regulated activity types it intends to carry out. The categories are:
- Advisory Services
- Broker-Dealer Services
- Custody Services
- Exchange Services
- Lending and Borrowing Services
- Transfer and Settlement Services
- Management and Investment Services
Each category carries its own ruleset, capital requirements, and conduct obligations under the FMP Regulations. A business offering more than one of these services needs to consider whether it requires multiple licence endorsements or a single licence that covers its combined activity profile.
What This Means for Accounting Firms and CFOs
Client Portfolio Review
For accounting firms and CFOs serving the UAE market, the immediate action is a portfolio sweep. Any client that holds a Dubai commercial licence and is active in virtual assets needs to be identified and its legacy status confirmed. The question to ask is simple: did this business commence VA activities before VARA's FMP Regulations came into force on 7 February 2023? If yes, it is a legacy operator and the IDQ clock is ticking now.
This is not a background compliance matter. An IDQ submission requires accurate, current information about the nature of the business's virtual asset activities, the scope of its operations, and the category of regulated activity it falls under. Pulling that information together demands clean, categorised transaction records. This is exactly the scenario where robust crypto accounting software earns its keep: a firm that has been maintaining structured digital asset ledgers can respond to a regulatory questionnaire quickly; one that has been recording crypto transactions informally will scramble.
Preparing for the Full Licence Application
The IDQ is the entry gate, not the finish line. The AAN triggers a second, more demanding phase: the actual licence application. VARA's FMP Regulations are detailed. They address capital adequacy, governance, custody arrangements, AML and counter-terrorism financing (CTF) controls, and conduct of business rules. Accounting teams advising VASP clients should begin pre-positioning now, well before the AAN arrives, by building out the financial documentation package a full application will require.
That typically includes audited or auditable financial statements, proof of adequate capital for the licence category, evidence of proper custody and segregation of client assets, and documentation of the AML and KYC programme. For the AML dimension specifically, reviewing what the VASP due diligence onboarding framework demands at an institutional level is a useful starting point, since VARA's expectations align with the broader FATF standards that inform that framework.
Audit and Assurance Considerations
Auditors reviewing UAE VASP clients this cycle face a changed landscape. A legacy operator that has not submitted an IDQ by 30 April is technically non-compliant with a Cabinet Resolution. That is a going-concern consideration, not a footnote. Engagement teams should be flagging this in planning documents and ensuring that management representations cover the client's regulatory status explicitly. If a client cannot confirm it has submitted its IDQ, or cannot demonstrate it is on track for the August authorisation deadline, the auditor's response to that uncertainty needs to be proportionate.
The AML and KYC Dimension
VARA's regime is explicitly FATF-aligned, and the UAE itself is completing a significant period of regulatory reform following its grey-listing and subsequent removal from the FATF grey list. That context matters for how seriously VARA is likely to scrutinise AML programme quality during the licence application phase. Legacy operators that built their AML controls informally, before a mandatory regulatory framework applied to them, should treat the migration process as an opportunity to rebuild those controls to a defensible standard.
The practical checklist includes: a documented risk-based approach to customer due diligence, transaction monitoring with defined alert thresholds, sanctions screening against current lists, and a clear suspicious activity reporting chain. Understanding the AML capabilities that regulators actually look for when assessing a VASP's programme is foundational preparation, not optional housekeeping.
The Broader Strategic Context
This activation of the legacy migration process is part of Dubai's D33 Agenda, the emirate's strategic plan to position itself as a leading global hub for the future economy, with virtual assets, Web3, AI, and the metaverse named as central pillars. VARA's approach, building a regulated but explicitly innovation-friendly framework, reflects a deliberate policy choice to attract serious institutional participants while clearing out operators who cannot or will not meet compliance standards.
For businesses and the firms that serve them, that policy direction has a practical implication: Dubai's regulatory environment is not getting lighter. The MVP programme gave early movers operational latitude while the rules were being written. The FMP regime closes that latitude. The firms and clients that treat this migration as a box-ticking exercise will find VARA's subsequent oversight demanding. Those that use it as a genuine compliance reset will be far better positioned for the scrutiny that follows a licence grant.
It is also worth noting how Dubai's approach compares to other major jurisdictions working through similar transitions. The EU's MiCA regime imposed its own migration timelines on existing crypto-asset service providers, and the pattern is the same: a structured window, hard deadlines, and no grandfather provisions for non-compliant operators. Dubai is running the same playbook, with the added specificity of a coordinated three-body effort between VARA, DET, and the FZAs to ensure no operator can claim they did not know the process had opened.
Frequently Asked Questions
Who counts as a legacy operator under VARA's framework?
A legacy operator is any business that was carrying out virtual asset activities in Dubai, excluding the DIFC, before VARA's Full Market Product Regulations came into force on 7 February 2023. These businesses operated under either DET or a Free Zone Authority licence but without a specific VARA authorisation. They are now required to migrate into the VARA regime via the IDQ and subsequent licence application process.
Does this apply to businesses in the DIFC?
No. The DIFC operates under a separate regulatory framework administered by the DFSA. VARA's jurisdiction covers Dubai mainland and the non-DIFC free zones. Businesses in the DIFC should refer to DFSA requirements directly.
What happens if a legacy operator misses the April IDQ deadline?
Missing the deadline means the operator has not initiated the mandatory migration process required under Cabinet Resolution No. 111 of 2022. That resolution requires all virtual asset businesses operating in Dubai to hold a VARA licence. Continued operation without initiating the process would constitute non-compliance with the Cabinet Resolution. VARA has not publicly specified the exact enforcement consequences for non-submission, but the legal obligation is clear and the reputational and operational risk of being outside the regulated regime in a jurisdiction this closely watched is significant.
How should an accounting firm prepare a VASP client for the licence application phase?
The preparation falls into three areas. First, financial records: the client needs clean, auditable accounts that accurately reflect all virtual asset transactions, including the correct classification of assets held, revenue recognition, and any custody or client money positions. Second, governance documentation: board composition, ownership structure, and internal controls need to be formalised and documented. Third, the AML programme: the client's KYC, transaction monitoring, and suspicious activity reporting procedures need to meet the FATF-aligned standard that VARA's FMP Regulations require. Starting this work before the AAN arrives puts the client in a far stronger position.
What are the seven regulated activity licence types under VARA?
VARA's FMP Regulations cover Advisory Services, Broker-Dealer Services, Custody Services, Exchange Services, Lending and Borrowing Services, Transfer and Settlement Services, and Management and Investment Services. A business must identify all of the activities it carries out and ensure its licence application covers each of them. Carrying out an activity not covered by the licence held would be a regulatory breach.
Source: VARA