Activity guide / Virtual Assets & FinTech
Virtual Asset & Crypto-Related Setup business setup in the UAE
Exchange, broker-dealer, custody, advisory or related virtual asset activity, with the exact permission depending on the model.
Plan this activityBy Two Pillars Advisory. Sources last checked 2026-09-12. Independent guidance, not authority advice.
Understanding virtual asset & crypto-related setup
Virtual asset businesses include exchanges, brokers, custodians and advisers. In Dubai outside DIFC, VARA licenses these activities; DIFC and ADGM regulate their own zones. Licensing involves AML programmes, technology audits and capital requirements. The services you actually offer, not the label you use, decide which regulator and which licence category applies.
At a glance
- What the activity covers: Exchange, broker-dealer, custody, advisory or related virtual asset activity, with the exact permission depending on the model.
- Activity type: Regulated financial activity
- Likely jurisdiction context: Regulated
- Possible external approvals: Virtual asset activities require authorisation from the competent virtual asset or financial services regulator, with substance, governance and AML conditions.
What you offer matters.
What this activity covers
Exchange, broker-dealer, custody, advisory or related virtual asset activity, with the exact permission depending on the model.
A plain-English label, not an official activity name or code.
Boundaries & approvals to check
Virtual asset activities require authorisation from the competent virtual asset or financial services regulator, with substance, governance and AML conditions.
Operating before authorisation.
Your independent consultant: Two Pillars Advisory
Two Pillars helps you define the business model, compare routes and prepare an application. We are an independent consultancy, not a licensing authority.
The licence issuer / regulator: the competent authority
The competent licensing authority decides the permitted activity scope and issues the licence. A sector regulator may separately assess and authorise regulated services. Neither decision is made by TPA.
Choose around your operations.
Full regulatory licensing, AML programmes, technology audits and capital requirements apply.
For virtual asset & crypto-related setup: Virtual asset activities require authorisation from the competent virtual asset or financial services regulator, with substance, governance and AML conditions.
Confirm the local operating route
Describe where customers, staff, premises and goods will be located. Ask the mainland issuer and any proposed free zone to confirm the exact scope and any permissions for operating outside the zone.
Map delivery across borders
Describe where the service is delivered or goods move. Confirm entity scope, destination requirements and any UAE local operations separately; international customers do not establish free zone eligibility.
Check the sector perimeter first
Describe the actual service, product and client type to the competent regulator. A commercial registration alone does not establish authorisation to deliver regulated services.
| Decision point | Mainland | Free Zone | Sectoral approvals |
|---|---|---|---|
| Who decides? | Competent emirate licensing authority | Proposed free zone licensing authority | Competent regulator, where applicable |
| Permitted operating scope | Requires case-by-case confirmation | Requires case-by-case confirmation | Virtual asset activities require authorisation from the competent virtual asset or financial services regulator, with substance, governance and AML conditions. |
| Premises, people & documents | Confirm for the selected activity | Confirm for the selected activity and zone | Confirm against the regulated service or product |
| Fees & timing | Obtain a current itemised quotation | Obtain a current itemised quotation | Confirm if a separate application applies |
From scope to application.
- Identify your VARA licensed activities.
- Choose VARA, DIFC or ADGM.
- Prepare compliance and technology documentation.
- Plan capital and key staff.
Illustrative planning sequence; the authority may require a different application order or additional steps.
Common mistakes worth avoiding.
- Operating before authorisation.
- Choosing a jurisdiction that does not cover your activity.
Authority information, independently explained.
Published by Two Pillars Advisory. References last checked 2026-09-12; each source’s check date and jurisdiction are shown below. Review is limited to the cited activity scope, not an approval or universal licensing assessment. Confirm current requirements directly before applying.
No affiliation, partnership or endorsement by the authorities listed.
- Virtual Assets Regulatory Authority (VARA): Licensed Activities. Official list of regulated virtual asset activities, including broker-dealer, custody, exchange, lending and borrowing, VA management and investment, transfer and settlement, and advisory services. A company is only VARA licensed once it holds an approval. (Dubai (excluding DIFC), checked 2026-09-12)
- Invest in Dubai: Search business activities. Official Dubai activity search. Final activity wording and code must be confirmed here or with the licensing authority before filing. (Dubai, checked 2026-09-12)
- Dubai Department of Economy and Tourism (DET): Business licensing. Official Dubai business licensing information, including licence types and permit requirements. (Dubai, checked 2026-09-12)
Before you take the next step.
Can a free zone licence cover crypto trading for clients?
No. Client-facing virtual asset activity needs regulatory authorisation.
How long does VARA licensing take?
Timelines vary by activity and application quality. We do not guarantee timelines.
Ask Two Pillars to confirm Virtual Asset & Crypto-Related Setup