VARA and DET Open VA Licensing at Dubai Branches: What Firms Must Do Now
The Virtual Assets Regulatory Authority (VARA) has announced that regulated virtual asset activities, first gazetted on 7 February 2023, are now accessible directly through branches of Dubai's Department of Economy and Tourism (DET). For any firm conducting, or planning to conduct, virtual asset business on Dubai's mainland, this changes where and how licence applications are filed and brings a firm deadline for legacy operators who have not yet sought regulatory oversight.
What VARA and DET Have Actually Announced
The joint announcement is straightforward in its mechanics. VARA and DET have integrated their licensing process so that Virtual Asset Service Providers (VASPs) can now walk into a DET branch to either apply for a new virtual asset licence or modify an existing commercial licence to include regulated VA activities. Previously, navigating the Dubai mainland licensing process required separate engagement with both bodies. The physical branch channel is designed to streamline that journey.
Scope of the Integration
The integration applies to the full set of regulated virtual asset activities that VARA published on 7 February 2023. This covers the core VASP activity categories that VARA has defined under its regulatory framework, including exchange services, broker-dealer activities, custody, lending and borrowing, and related operations. Firms operating inside the Dubai International Financial Centre (DIFC) are explicitly excluded because the DIFC sits under a separate regulatory perimeter governed by its own authority.
Who Can Use DET Branches and for What
Two distinct groups of applicants are affected. First, new entrants wishing to conduct virtual asset business in Dubai mainland can now submit licence applications at DET branches, rather than navigating a more fragmented multi-agency process. Second, firms already holding a commercial licence that want to add VA activities, or to amend the scope of an existing licence, can present at the same branches to make those changes. VARA's announcement lists specific DET branch locations for this purpose.
The Legacy VASP Deadline and Enforcement Consequences
The most pressing aspect of the announcement is not the new application channel. It is the compliance deadline for legacy operators.
Who Counts as a Legacy VASP
VARA defines legacy VASPs as firms that were already carrying on virtual asset activities in Dubai mainland before 7 February 2023. These entities were operating before VARA's regulatory framework for those activities came into force, and they were given a transitional window to either seek regulatory oversight or obtain relevant guidance from VARA. That deadline has now passed.
Consequences of Non-Compliance
VARA's language is unambiguous. Firms that failed to comply with the framework before the deadline are required to act immediately. The authority has specified that non-compliant entities are exposed to:
- Material financial fines and penalties
- Potential firm closure
This is not a warning of possible future enforcement; it is a statement that punitive measures are available and will be applied. Any accounting firm or CFO with a Dubai mainland client in the virtual asset space needs to establish immediately whether that client's licence status is clean under the current VARA framework.
Regulatory Context: How VARA's Framework Is Structured
VARA operates under Law No. 4 of 2022, which established it as the dedicated virtual asset regulator for the Emirate of Dubai (outside the DIFC). Since its formation, VARA has released a suite of rulebooks covering market conduct, technology and information, company and token marketing, custody, exchange, lending and borrowing, broker-dealer, investment management, and advisory services. The 7 February 2023 date that VARA references in this announcement is the point at which those activity-specific rules became operative for mainland Dubai, creating the licensing obligation that legacy VASPs were required to meet.
The DET's Role
The Department of Economy and Tourism is Dubai's primary authority for issuing commercial licences to businesses operating in the emirate's mainland. Because a VASP needs both a commercial licence from DET and a regulatory licence from VARA to operate lawfully, the two bodies have historically required separate interactions. The current integration, where DET branches can now process VA activity applications and licence modifications, is a deliberate effort to reduce friction for compliant operators and, implicitly, to remove any administrative excuse for non-compliance.
Accounting and Bookkeeping Implications for Firms and CFOs
The announcement has direct workflow consequences for accounting professionals serving UAE-based clients.
Licence Status as a Client Onboarding and Retention Risk
An unlicensed or improperly licensed VASP is not just a legal problem for the entity itself; it creates professional risk for any accounting firm or CFO that continues to provide services without flagging the issue. Under standard professional due diligence obligations, advisers should confirm that clients holding or seeking to hold VA licences are correctly registered with VARA. If a client is a legacy VASP that has not yet regularised its position, the firm should be advising them to attend a DET branch and initiate the VARA oversight process without delay. Continuing to prepare financial statements, audits, or tax filings for an entity that VARA could shut down or fine heavily is a risk that the engagement team needs to document and address.
Licence Category Determines Accounting Treatment
The specific VARA activity licence a firm holds affects how its revenue, assets, and liabilities should be recognised and presented. A custodian holds client assets under a fiduciary arrangement that may require off-balance-sheet disclosure. An exchange records fee income differently from a lending platform recognising interest income. A broker-dealer operating on a principal basis carries inventory risk that a pure agency model does not. Accounting professionals using crypto accounting software to manage digital asset books need to map each client's VARA-licensed activities to the correct accounting treatment, because the licence category is the authoritative boundary of what the entity is permitted to do and therefore what it is economically doing.
AML and KYC Records Must Reflect Licensed Scope
VARA's rulebooks require licensed VASPs to implement AML and KYC programmes proportionate to the risk profile of their licensed activities. An entity that modifies its commercial licence to add new VA activities at a DET branch must ensure its AML policy, customer risk ratings, and transaction monitoring scope are updated to reflect the enlarged activity set. Accounting and compliance teams should coordinate with legal to ensure the AML framework is updated in parallel with any licence amendment, not after the fact. For a deeper look at AML due diligence obligations for VASPs in this context, the onboarding framework considerations remain directly relevant to the Dubai mainland setting.
Financial Statements and Going Concern for Non-Compliant Entities
For any legacy VASP that has not yet regularised its licence status, the going concern assessment is now materially affected. VARA has stated explicitly that firm closure is among the available sanctions. Auditors reviewing financial statements of a Dubai mainland VASP that cannot demonstrate current VARA oversight must consider whether that regulatory exposure requires disclosure or qualification. Under IFRS, IAS 1 requires management to assess going concern, and a credible regulatory closure threat is precisely the kind of event that demands disclosure at a minimum and potentially a modified audit opinion.
Practical Next Steps for Accounting Firms and CFOs
Immediate Licence Audit
The first step is a licence audit across your Dubai-based virtual asset client base or, for CFOs, your own entity. Confirm whether each firm holds a current VARA regulatory licence for its specific VA activities. Check that the commercial licence issued by DET correctly reflects the VA activity categories permitted by VARA. Any mismatch is a compliance gap.
Legacy VASP Remediation
If a client or your own firm qualifies as a legacy VASP and has not sought VARA oversight, remediation is urgent. The deadline has passed; the question is now how quickly the oversight process can be initiated to limit penalty exposure. Attending a DET branch to begin the process is the first physical step. Concurrently, engaging VARA directly for guidance on the remediation path is advisable, as voluntary engagement before enforcement action is typically viewed more favourably than engagement after a fine is issued.
Licence Modifications for Expanding Activities
Firms that are already VARA-licensed but want to expand their activity scope, adding custody to an existing exchange licence, for example, can now use DET branches to process those modifications. Before doing so, accounting teams should model the financial statement and AML impact of the new activity and ensure the firm's VASP due diligence and onboarding framework is updated to reflect the expanded scope.
Document Everything
Whatever stage a client or entity is at, documentation is critical. Accounting firms should record the date they advised on the licence status issue, what steps were recommended, and what the client confirmed in response. If VARA takes enforcement action, the professional adviser's file needs to show that the licensing obligation was identified and communicated promptly.
Frequently Asked Questions
Does this announcement apply to firms inside the DIFC?
No. VARA's jurisdiction covers Dubai mainland only. Firms operating within the Dubai International Financial Centre are regulated by the DFSA under a separate framework and are not affected by this announcement.
What VA activities does VARA regulate for mainland Dubai?
VARA's framework covers exchange services, broker-dealer services, lending and borrowing, custody services, investment management, and advisory services, among other defined activities. The full list of regulated activities was published by VARA on 7 February 2023 and is available on VARA's official website.
What happens if a legacy VASP still has not applied to VARA?
VARA has stated that firms that failed to meet the compliance deadline must act immediately and are exposed to material fines, penalties, and potential closure. There is no safe harbour for continued inaction. The recommended course is to contact VARA and attend a DET branch without delay.
How does a VARA licence modification affect a firm's financial statements?
A licence modification that adds new regulated activities changes the scope of what the entity is permitted to do and therefore changes the range of transactions it can enter into. This can affect revenue recognition policies, the classification of assets held, AML programme scope, and, depending on the activity added, whether client assets need to be disclosed on or off balance sheet. Accounting teams should review the financial statement impact of any licence change before it takes effect.
Is VARA's framework aligned with international AML standards?
VARA's rulebooks are designed to be consistent with FATF recommendations on virtual assets and VASPs, including requirements for customer due diligence, transaction monitoring, and suspicious activity reporting. Firms licensed by VARA are therefore expected to meet a standard broadly comparable to FATF-compliant jurisdictions, which matters for correspondent banking relationships and cross-border client onboarding.